PPTP on PIX

lganetwork · ‎11-25-2002

Hi All,

I will appreciate if anyone can help me...

I have a question regarding to PPTP on PIX. Is it possible If I want to use the same subnet with the internal network for the pptp pool ???

Lets say the IP for internal network is 10.0.0.0/24...and the pool is 10.0.0.100-10.0.0.200

Thanks for your help

regards

afakhan · ‎11-25-2002

Hi,

You can use the portion of the same subnet, PIX would just proxy ARP for the return traffic for the pool of IPs.

Thanks,

Afaq

lganetwork · ‎11-25-2002

Hi,

I have configured the pix,... when I tried to connect using the windows pptp dialer I could get connected. but I can't ping all the ip in the internal LAN.

I saw this on pix,

No translation group found for icmp src outside (remote IP) dst inside internal_ip

here is the config

pixfirewall# wr t

Building configuration...

: Saved

:

PIX Version 6.2(1)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 intf2 security10

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

hostname pixfirewall

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000

names

pager lines 24

logging on

logging console informational

logging monitor errors

interface ethernet0 10baset

interface ethernet1 10baset

interface ethernet2 auto shutdown

mtu outside 1500

mtu inside 1500

mtu intf2 1500

ip address outside 192.168.101.2 255.255.255.0

ip address inside 10.0.0.2 255.255.255.0

ip address intf2 127.0.0.1 255.255.255.255

ip audit info action alarm

ip audit attack action alarm

ip local pool pptp-pool 10.0.0.100-10.0.0.200

no failover

failover timeout 0:00:00

failover poll 15

failover ip address outside 0.0.0.0

failover ip address inside 0.0.0.0

failover ip address intf2 0.0.0.0

pdm history enable

arp timeout 14400

conduit permit icmp any any

route outside 0.0.0.0 0.0.0.0 192.168.101.4 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si

p 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-pptp

no sysopt route dnat

telnet timeout 5

ssh timeout 5

vpdn group 1 accept dialin pptp

vpdn group 1 ppp authentication pap

vpdn group 1 client configuration address local pptp-pool

vpdn group 1 pptp echo 60

vpdn group 1 client authentication local

vpdn username cisco password *********

vpdn enable outside

terminal width 80

Cryptochecksum:954733fadf61b81bbeae48e792c4b362

: end

Did I miss something ???

regards

kdurrett · ‎11-25-2002

Your pool should be on a different network than your inside lan range. Change this "ip local pool pptp-pool 10.0.0.100-10.0.0.200" to something like 10.0.1.1-10.0.1.254. Main reason you are failing though is you need to deny NAT/PAT from you inside network to your pool address. Otherwise you see that error as the return traffic will try to get NAT'd on the way back. Even though you dont have NAT/PAT setup, the pix will not allow traffic to pass through with out doing somekind of NAT. So after changing the pool, add this:

access-list nonat permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0

nat (inside) 0 access-list nonat

Kurtis Durrett