Cisco ASA 5512 Blocking PPTP connection (server Inside and client Outside)

[sagar88]

Could any one please help me out with the solution of following issue.

Cisco 5512-X ASA firewall is installed between ISP and Synology NAS drive :

Internet Provider => Firewall ASA 5512 => Synology NAS (VPN Server 5512).

Currently VPN Server (using PPTP) is configured at Synology NAS drive .

I cant access the the VPN server connection from outside world, seems like ASA 5512 is blocking it.

I have allowed all the required rules and ports as per given by below link, but still I did not get connections. Does any one experienced the same?

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/18806-pix-pptp.html

Regards

Sagar Patel

[Florin Barhala]

Please share the relevant config for this setup.
show asp-drop shows packet as being dropped?

[sagar88]

Thank you Florin for your replay., Please find following existing firewall configuration and asp drop result.

[Bogdan Nita]

I belive you need to have inspect pptp, also not sure the nat config is working as desired.
Can you post the output from:
packet-tracer input outside tcp 8.8.8.8 1025 <outside-ip> 1723 detailed

[sagar88]

Please find the following requested information.

[Bogdan Nita]

NAT and ACL work as supposed to. Did you enabled pptp inspection and tried to initiate the vpn ?

[sagar88]

Thank you for information Nita.

PPTP inspection is already enabled and tried too but still did not get any outcome.

[Bogdan Nita]

Hmm... You sure the synology is correctly configured ?

You could also try to set up some captures to further troubleshoot:

capture CAP-OUT interface outside match tcp any host 73.81.81.201 eq 1723
capture CAP-OUT interface outside match gre any host 73.81.81.201
capture CAP-IN interface outside match tcp any host 192.168.2.5 eq 1723
capture CAP-IN interface outside match gre any host 192.168.2.5
capture CAP-ASP-DROP type asp-drop match tcp any any eq 1723
capture CAP-ASP-DROP type asp-drop match gre any any

initiate the ptpp vpn

view caputred traffic:
show capture CAP-OUT
show capture CAP-IN
show capture CAP-ASP-DROP

remove captures:
no capture CAP-OUT
no capture CAP-IN
no capture CAP-ASP-DROP

[sagar88]

The Synology NAS VPN connection is working without firewall but with firewall its not working though.

The strange is Synology NAS has a internet Host name "XXXXXX.synology.me" (through it severs VPN connection) and it can be reachable from outside using web browser page but same is not accessible from inside network.

[Florin Barhala]

If you are out of ideas here's what I would try:

 - configure a Windows laptop as PPTP VPN server

 - place it behind ASA and assign Synology NAS IP temporary to that Windows "test machine"