topic Re: Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound in Network Security

Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound)

Scott Gardner — Tue, 12 Mar 2019 01:52:24 GMT

Hi All

Hoping someone can help me with an issue I am having with zbf on a router config I have just inherited.

I have configured it to passthrough GRE but the users still cannot connect outbound to a PPTP server on the internet.

I have configured the following:

policy-map type inspect OUT-TO-WORLD

class type inspect URL-FILTER

inspect

service-policy urlfilter cppolicymap-1

class type inspect OUT-TO-WORLD

inspect

class type inspect PASS-ZBF-GRE

pass

class class-default

drop

class-map type inspect match-any PASS-ZBF-GRE

match access-group name pass-zbf-gre

Extended IP access list pass-zbf-gre

10 permit gre any any

And added the same PASS-ZBF-GRE class-map to the IN-FROM-WORLD policy-map too but this has made no change.

Any thoughts?

Scott

Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound)

Julio Carvajal — Mon, 03 Jun 2013 19:57:02 GMT

Hello Scott,

With PPTP the first connection that will be stablish will be the TCP 1723 so then the traffic gets encapsulated into GRE packets for the data exchange (after both ends authenticate with each other)

Where is the PPTP traffic being inspected?

Is it on the OUT-TO-WORLD class-map

Regards

Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound)

Scott Gardner — Mon, 03 Jun 2013 22:22:48 GMT

Thanks for your quick reply.

pptp traffic is being inspected in the OUT-TO-WORLD class-map.

Scott

Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound)

Julio Carvajal — Mon, 03 Jun 2013 22:24:25 GMT

If possible I would like to check entire Config

Re: Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound

Scott Gardner — Mon, 03 Jun 2013 23:41:26 GMT

See attached

Re: Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound

Julio Carvajal — Tue, 04 Jun 2013 00:07:16 GMT

Hello Scott,

It looks good.

Can you add

ip inspect log drop-pkt

And then try to connect and share

show logging | include x.x.x.x (PPTP server)

Re: Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound

Scott Gardner — Tue, 04 Jun 2013 03:25:37 GMT

I did as requested but there is nothing in the output at all.

Re: Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound

Scott Gardner — Tue, 04 Jun 2013 03:40:01 GMT

When trying to telnet to the remote PPTP server on 1723 I get the following also:

telnet x.x.x.x 1723

Trying x.x.x.x, 1723 ...

% Connection timed out; remote host not responding

I have checked on the other end and there is nothing blocking traffic from this location and I can VPN to it from anywhere on the internet, just not this router.

On the windows client I get VPN error 800 (which is generally GRE)

Re: Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound

Julio Carvajal — Tue, 04 Jun 2013 05:57:30 GMT

Hello Scott,

Does not make any sense as the router is not showing any issues,

Let's do a quick ACL check on the router so we can determine if traffic is even reaching the router

ip access-list extended inside_in

permit tcp host client_ip host PPTP_server eq 1723

permit ip any any

ip access-list extended inside_out

permit tcp host PPTP_server eq 1723 host client_ip

permit ip any any

ip access-list extended outside_out

permit tcp host client_ip host PPTP_server eq 1723

permit ip any any

ip access-list extended outside_in

permit tcp host PPTP_server eq 1723 client_ip address_public

permit ip any any

interface inside

ip access-group inside_in in

ip access-group inside_out out

interface gig 0/x outside

ip access-group outside_out

ip access-group outside_in in

Then try to connect and share all of the

show ip access-list for each of the ones,

If we see matches in only one direction then we no this is an uniderectional-problem and if we see traffic stuck in the router then a problem in our site,

Let me know how it goes,

Hey remember to rate all of the helpful posts, that for a free community as this is as important as a thanks

Julio

Re: Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound

Scott Gardner — Wed, 05 Jun 2013 00:58:11 GMT

Hi Julio

Turns out coincidentally the other end was having issues with the PPTP server after I made the GRE changes so all is working now.

Many thanks for your help!

Scott

Re: Zone-Based Firewall - GRE Passthrough for PPTP VPN (outbound

Julio Carvajal — Wed, 05 Jun 2013 01:01:16 GMT

Hello,

Yeah, as we saw before the ZBFW was not complaining about any problems,

Glad to see that I could help but remember to rate all of the helpful posts, that for a free community as this is as important as a thanks

Cheers

Julio