topic Re: Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside) in Network Security

Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

sagar88 — Fri, 21 Feb 2020 15:45:37 GMT

Could any one please help me out with the solution of following issue.

Cisco 5512-X ASA firewall is installed between ISP and Synology NAS drive :

Internet Provider => Firewall ASA 5512 => Synology NAS (VPN Server 5512).

Currently VPN Server (using PPTP) is configured at Synology NAS drive .

I cant access the the VPN server connection from outside world, seems like ASA 5512 is blocking it.

I have allowed all the required rules and ports as per given by below link, but still I did not get connections. Does any one experienced the same?

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/18806-pix-pptp.html

Regards

Sagar Patel

Re: Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

Florin Barhala — Mon, 14 May 2018 08:24:46 GMT

Please share the relevant config for this setup.
show asp-drop shows packet as being dropped?

Re: Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

sagar88 — Mon, 25 Jun 2018 13:14:40 GMT

Thank you Florin for your replay., Please find following existing firewall configuration and asp drop result.

Re: Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

Bogdan Nita — Mon, 14 May 2018 14:49:25 GMT

I belive you need to have inspect pptp, also not sure the nat config is working as desired.
Can you post the output from:
packet-tracer input outside tcp 8.8.8.8 1025 <outside-ip> 1723 detailed

Re: Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

sagar88 — Mon, 25 Jun 2018 13:15:22 GMT

Please find the following requested information.

Re: Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

Bogdan Nita — Mon, 14 May 2018 15:03:51 GMT

NAT and ACL work as supposed to. Did you enabled pptp inspection and tried to initiate the vpn ?

Re: Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

sagar88 — Mon, 14 May 2018 15:12:14 GMT

Thank you for information Nita.

PPTP inspection is already enabled and tried too but still did not get any outcome.

Re: Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

Bogdan Nita — Mon, 14 May 2018 15:48:50 GMT

Hmm... You sure the synology is correctly configured ?

You could also try to set up some captures to further troubleshoot:

capture CAP-OUT interface outside match tcp any host 73.81.81.201 eq 1723
capture CAP-OUT interface outside match gre any host 73.81.81.201
capture CAP-IN interface outside match tcp any host 192.168.2.5 eq 1723
capture CAP-IN interface outside match gre any host 192.168.2.5
capture CAP-ASP-DROP type asp-drop match tcp any any eq 1723
capture CAP-ASP-DROP type asp-drop match gre any any

initiate the ptpp vpn

view caputred traffic:
show capture CAP-OUT
show capture CAP-IN
show capture CAP-ASP-DROP

remove captures:
no capture CAP-OUT
no capture CAP-IN
no capture CAP-ASP-DROP

Re: Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

sagar88 — Mon, 14 May 2018 16:44:30 GMT

The Synology NAS VPN connection is working without firewall but with firewall its not working though.

The strange is Synology NAS has a internet Host name "XXXXXX.synology.me" (through it severs VPN connection) and it can be reachable from outside using web browser page but same is not accessible from inside network.

Re: Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

sagar88 — Mon, 14 May 2018 19:26:54 GMT

Re: Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

Florin Barhala — Tue, 15 May 2018 13:49:57 GMT

If you are out of ideas here's what I would try:

- configure a Windows laptop as PPTP VPN server

- place it behind ASA and assign Synology NAS IP temporary to that Windows "test machine"