PPTP over NAT

[john-perrin]

I have a client wanting to allow inbound PPTP to theie internal network. They are running NAT on a 1751 with IOS 12.2 and have a single public IP. They are using static NAT entries to allow inbound SMTP and terminal services. Static NAT entries do not support protocol 47 (GRE) so we can't do it that way. What options do they have to do it another way? I think they will have to get another public IP and translate all inbound traffic to that Ip to the internal IP where PPTP terminates. Will that work and can they have multiple external VPN users connecting to the single internal network IP via NAT? Thanks in advance.

[gfullage · Accepted solution]

The only way to do this is to get a second IP address, then set up a one-to-one static translation for it, and have all your users connect to that static IP address. Yes, multiple users will be able to connect to that one IP address, no problem there.

The issue here is, as you've said, that you can't map GRE through with just the one IP addess, so they need the second one and map all protocols through to it with just a standard static NAT translation.

[john-perrin]

Thanks for confirming that. Is this something that will be supported in later IOS releases or is there some fundamental reason why it cannot work?

[gfullage]

I guess it could work, we actually support static PAT translations for ESP/IPSec now, so I presume we could support it for GRE. It's probably that no-one's really asked for it. Feel free to contact your Account Manager and get them to put in a feature request for it, the more people that ask for it the faster it gets included.