CBAC PPTP outbound issue to server on same isp subnet - 2811

jacob6000 — Tue, 12 Mar 2019 01:10:17 GMT

Hello,

I am using MS VPN/PPTP client. This client works fine from home but not at the office. At our office, we have a 192.168.2.0 /24 subnet. We have two DSL connections from the same provider. Both of these DSL connections are in the same Class C subnet. One DSL is used for the office users and one is used for a completely, separate/isolated test environment. I need to be able to PPTP into the test environment fw (71.x.x.50) from the local office lan. I am sitting behind a 2811 using CBAC for outbound traffic and an ACL for inbound traffic. I can't even telnet to port 23 and the log only shows this generic message:

002027: Mar 4 17:27:19.861 CST: %FW-6-SESS_AUDIT_TRAIL_START: Start pptp session: initiator (192.168.2.120:51094) -- responder (71.x.x.x:1723)
002028: Mar 4 17:27:42.226 CST: %FW-6-SESS_AUDIT_TRAIL: Stop pptp session: initiator (192.168.2.120:51094) sent 364 bytes -- responder (71.x.x.x:1723) sent 352 bytes

Here is my config. Wha should I change, please?

ip inspect name Outbound sip
ip inspect name Outbound tftp
ip inspect name Outbound tcp
ip inspect name Outbound udp
ip inspect name Outbound icmp router-traffic
ip inspect name Outbound pptp audit-trail on timeout 3600

interface FastEthernet0/0
ip address 71.x.x.120 255.255.255.0
ip access-group 105 in
no ip unreachables
ip flow ingress
ip flow egress
ip nat outside
ip inspect Outbound out
ip virtual-reassembly
duplex auto
speed auto

access-list 105 permit tcp any host 71.x.x.x eq 22
access-list 105 permit udp any host 71.x.x.x eq 5060
access-list 105 permit tcp any any eq 1723
access-list 105 permit gre host 71.x.x.50 any
access-list 105 deny ip any any log

access-list 175 deny   ip 192.168.2.0 0.0.0.255 192.168.60.0 0.0.0.255
access-list 175 deny   ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 175 deny   ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 175 permit ip 192.168.2.0 0.0.0.255 any

ip nat inside source route-map nonat interface FastEthernet0/0 overload

CBAC PPTP outbound issue to server on same isp subnet - 2811

johnlloyd_13 — Tue, 26 Mar 2013 06:06:24 GMT

hi,

could you re-write ACL:

access-list 105 permit tcp any host 71.x.x.x eq 22

access-list 105 permit udp any host 71.x.x.x eq 5060

access-list 105 permit tcp any any eq 1723

access-list 105 permit udp any any eq 1723

access-list 105 permit gre host 71.x.x.50 any

access-list 105 deny ip any any log

topic CBAC PPTP outbound issue to server on same isp subnet - 2811 in Network Security

CBAC PPTP outbound issue to server on same isp subnet - 2811

CBAC PPTP outbound issue to server on same isp subnet - 2811