topic Microsoft VPN client and GRE in Network Security

Microsoft VPN client and GRE

bapatsubodh — Mon, 11 Mar 2019 23:13:25 GMT

Hello,

Trying to access Microsoft VPN (on the internet-outside zone) server from Microsoft VPN client (inside zone)

On ASA - allowed all outbound traffic from inside to outside-internet and all traffic is blocked from internet-outside to internet.

VPN client seems to be not working in this case. When firewall was bypased Microsoft VPN client got connected to Remote Microsoft VPN server.

Do we need to enable GRE from outside to inside for this work? ( along with corresponding static NAT entry for the remote Microsoft VPN server)

Microsoft tech support document did mention about permitting GRE through firewall but it's not stating any direction.

Please share the experience.

Thanks in advance

Subodh

Microsoft VPN client and GRE

Jennifer Halim — Wed, 30 May 2012 13:54:37 GMT

Please enable "inspect pptp" that would allow the GRE connection.

Here is the command for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/i2.html#wp1741718

Microsoft VPN client and GRE

bapatsubodh — Thu, 31 May 2012 15:02:07 GMT

Thanks for the link.

So when we enable the inspection for PPTP (similar to other protocols those are already configured for inspection) will the ASA permit the GRE traffic to cross from outside to inside?

As wireshark-packetcapture shows first GRE packet coming from the Microsoft VPN server to the client indicating that ------- "Server is initiating the GRE connection".

Please advice.

Thanks in advance.

Cheers!

Microsoft VPN client and GRE

Jennifer Halim — Thu, 31 May 2012 16:13:57 GMT

Yes, once the inspection is enabled for PPTP, ASA will automatically open hole for GRE as per stated in the documentation advised earlier.