Nfantis   55 pts.  |   Aug 17 2009  1:19PM GMT

Hi BlankReg,

Thanks for the prompt resonse! Yes, I do want to use PPTP. The VPN is terminated on the inside network to a Window server with a 192.168.1.100 IP address. The router is also used for Internet access from the inside and to access the PPTP server from the outside.

So essentially, yes to all of your questions

Nfantis   55 pts.  |   Aug 18 2009  3:30PM GMT

Would using access-lists rather than policy maps be an acceptable way to handle this?

BlankReg   11280 pts.  |   Aug 19 2009  7:36AM GMT

I think you are correct. I would configure the NAT and just use access-lists to allow the PPTP traffic to the server. So you are looking at sometihng like the following

no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
no ip domain-lookup
!
hostname Greco871
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
ip dhcp excluded-address 192.168.1.1 192.168.1.35
ip dhcp excluded-address 192.168.1.200 192.168.1.250
!
ip dhcp pool Internal
import all
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
domain-name greco.local
dns-server 68.9.16.30 68.9.16.245
!
ip domain name nlr.corp
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
ip address 68.109.233.18 255.255.255.224
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
zone-member security outside
ip route-cache flow
duplex auto
speed auto
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
zone-member security inside
!
ip route 0.0.0.0 0.0.0.0 68.109.233.1
!
no ip http server
no ip http secure-server
ip nat inside source static tcp 192.168.1.100 1723 interface FastEthernet4 1723
ip nat inside source list AllowNAT interface FastEthernet4 overload
!
ip access-list standard AllowNAT
permit 192.168.1.0 0.0.0.255
!
ip access-list extended Outside-In
permit tcp any host 68.109.233.18 eq 1723
{add any other things you need to permit}
!
!
line con 0
no modem enable
speed 115200
line aux 0
line vty 0 4
!
end

You also need to exclude the IP address of the PPTP server from the DHCP scope you have configured, so add the line

ip dhcp excluded-address 192.168.1.100

as well. Oterwise you will have some horrible problems if this address is given out to a PC as well !

I am not clear if you have the firewall version of the IOS software ? If you do then include all the ‘inspect’ commands, and don’t forget to include the ‘ip inspect name standard pptp’, if you don’t then you need to include lines in the access-list to allow the Internet access replies for the lan users. I would recommend that you use the firewall IOS, or get a small ASA5505 to protect your network.

Hope this helps.

BlankReg   11280 pts.  |   Aug 19 2009  7:39AM GMT

Ooops, forgot to apply the access list to the interface - silly me !

interface FastEthernet4
ip access-group Internet-In in

And if you do have the firewall IOS you also need to include the command

ip inspect standard in

on that same interface.

BlankReg   11280 pts.  |   Aug 19 2009  7:41AM GMT

The old Reg is having a bad one today !

The line should, of course, be

interface FastEthernet4
ip access-group Outside-In in

to match the access list we created.

I am now going to lie down in a darkened room and have a little rest

Nfantis   55 pts.  |   Aug 19 2009  12:26PM GMT

Thanks for the very detailed feedback BlankReg. I’m going to give this a shot this evening and I’ll let you know how it works.

Nfantis   55 pts.  |   Aug 25 2009  8:17PM GMT

Okay sorry for the delay but no luck yet.

However, it does seem that connection requests are being forwarded to the server. I tailed the PPTP log and it receives a request and sends an acknowledgement, but that just repeats 4 times or so then quits. Possibly an addressing issue on the outbound packet?

Is there a good debug command to try out to see what’s happening at the router?

I’ll post the config later this evening, I forgot to copy the updated over before I left last week.

Thanks

Nfantis   55 pts.  |   Aug 26 2009  2:35PM GMT

Just wanted to provide an update…

Interestingly enough, VPN is now working! I have no idea what changed since I last tested it, but I’ve verified from multiple PCs and outside Internet connections that I can get in.

Thanks for all your help BlankReg, I certainly appreciate it!

BlankReg   11280 pts.  |   Aug 26 2009  3:30PM GMT

Glad to help, and glad it is now working

You may need to add the keyword ‘extendable’ at the end of the nat for the pptp server, that should make it definately trigger in both directions (I think that’s what it does, the Cisco description is not too clear). So maybe what happened is that it workied in one direction, then when that was in the table it can work in the other, but not the other way round (if you can follow that ?).