topic I have a same problems.How in Network Security

PPTP Traffic Not Passing

Muhammad.Eissa — Tue, 12 Mar 2019 07:13:18 GMT

Hello,

i have issue in my network , as part of the work we need to connect to outside PPTP server but its always fail , works only if we connect directly to the gateway router.

back behind the ASA the client cant connect , what is driving me crazy is when i do packet tracer with ASDM its show everything working fine ,

the below configuration is all i need to connect from client to outside server . also i have tried connect wireless and wired , but nothing

class-map inspection_default
 match default-inspection-traffic

policy-map global_policy
 class inspection_default
  inspect pptp

service-policy global_policy global

That should work. Is it

Philip D'Ath — Mon, 01 Feb 2016 10:44:16 GMT

That should work. Is it definitely using PPTP and not L2TP over IPSec (aka, is the client VPN configuration left on automatic and you have assumed it is PPTP)?

Using the ASDM log when trying to connect do you see anything being blocked or any warnings?

pptp-debug.jpg

Muhammad.Eissa — Mon, 01 Feb 2016 10:50:15 GMT

this is the debug from the asa for two connection try , its always fail after the unknown -message show up

What version of software are

Philip D'Ath — Mon, 01 Feb 2016 11:01:15 GMT

What version of software are you using on your ASA?

I meant just the normal ASDM logging, not debugging (although the above is interesting to see). Are any packets getting dropped?

The above makes it looks like the workstation is doing the disconnect.

we are working with Version 9

Muhammad.Eissa — Mon, 01 Feb 2016 11:10:43 GMT

we are working with Version 9.4(2) 5545 with firepower module what is driving me crazy that when i do packet tracer on the ASDM it show success for all steps and its working fine if i connect from anywhere and direct to the router , but not the ASA

I'm not really a fan of the 9

Philip D'Ath — Mon, 01 Feb 2016 11:23:45 GMT

I'm not really a fan of the 9.4(x) train, as I have had other issues with it.

I don't think it is likely to fix it, but I would be tempted to go to 9.5(2)200. That train has been working well for me.

i will keep looking and let

Muhammad.Eissa — Mon, 01 Feb 2016 11:29:40 GMT

i will keep looking and let you know the final result , thank you for the advice

I have a same problems.How

Murat TASKIN — Wed, 03 Feb 2016 09:49:19 GMT

I have a same problems.How did you solve it ?

i didn't solve it yet , i

Muhammad.Eissa — Wed, 03 Feb 2016 10:07:58 GMT

i didn't solve it yet , i also found a line to go with

: SFR requested to drop GRE packet from outside , this was message from the syslog server that the ASA send log to it , so now i know where is the issue

but it was totally hidden as no alarm on IPS or blocked by any rules

i will tell you in details when i get it to work

i am sorry for my late reply,

Muhammad.Eissa — Tue, 09 Feb 2016 18:56:03 GMT

i am sorry for my late reply, i found the solve.

i am using SSL Inspection , we has to remove the SSL Policy from the access policy after that its working, for now the TAC didn`t respond why that issue happen as its up-normal.

Hi

Bnnetwork — Fri, 19 Feb 2016 13:25:36 GMT

I have the same problem.

Can you be more specific when you says .. :

"...we has to remove the SSL Policy from the access policy after that its working".

Remove SSL Policy .. ?? Where ??

I have tried to do a Global Inspection specific that make the GRE pass.

After another inspection that redirect to SFR.

Same problem.....

Thanks for help...

Bnnetwork:

Muhammad.Eissa — Fri, 19 Feb 2016 13:38:52 GMT

Bnnetwork:

Please tell me what version of FireSIGHt do u have, and i will try to explain based on it.

Hi

Bnnetwork — Fri, 19 Feb 2016 13:40:31 GMT

Thanks for the answer

I have 6.0.0-1005

Thanks again

Hi

Bnnetwork — Fri, 19 Feb 2016 14:32:25 GMT

I've found and disable SSL Policy but nothing has changed.

Still see GRE dropped ...

Hi

Bnnetwork — Fri, 19 Feb 2016 14:41:59 GMT

I solved it simple creating a rule as you can see attached.

Hope to have helped you.

as per this photo . when you

Muhammad.Eissa — Fri, 19 Feb 2016 14:59:07 GMT

as per this photo . when you go to the access control, you will find your access control policy, then one of the options is adding

Identity Policy and SSL Policy, now in this if you have an ssl policy that mean your ssl inspection is active , and it's very important, by pressing on this policy and make it non that will remove the ssl inspection and the vpn will work.

maybe in your case the ssl inspection is mandatory so you only will test and check if it works then add it again and open case with TAC for this issue.

i am waiting for the TAC respond for this issue , i will gave a summary later for all what we done.

thank you for this advice ,

Muhammad.Eissa — Fri, 19 Feb 2016 15:46:07 GMT

thank you for this advice , but i have tried this before and didn't solve the case 😄

i think i have another issue.

problem is solved , and its

Muhammad.Eissa — Mon, 21 Mar 2016 21:07:57 GMT

problem is solved , and its issue and will be solved in the next release