Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
500
Views
0
Helpful
5
Replies

Cisco Firepower 1010 ASA PPTP VPN Issue

Go to solution
philipvoceehs
Level 1
Level 1

‎02-12-2024 08:52 AM - edited ‎02-12-2024 08:55 AM

Hi Guys,

I've got a new Cisco FirePower 1010 device that I'm trying to get a PPTP VPN to passthrough. I've followed guides and tried various things but still coming up short. We want to move away from PPTP and switch to AnyConnect but management insist we get this new device in place working with our existing setup before we move over to AnyConnect as we have remote workers.

The Firepower has the ASA software loaded on it and managed primarily with ASDM.

Background:

Using dynamic PAT as the office has a single fixed IP address.

PPPOE configured on the outside interface, have tested and this does work. This is our running config, few bits redacted for obvious reasons:

Result of the command: "show running-config"

: Saved

:
: Serial Number: REDACTED
: Hardware: FPR-1010, 7204 MB RAM, CPU Atom C3000 series 2200 MHz, 1 CPU (4 cores)
:
ASA Version 9.16(2)3
!
hostname ciscoasa
enable password ***** pbkdf2
service-module 1 keepalive-timeout 4
service-module 1 keepalive-counter 6
!
license smart
feature tier standard
names
no mac-address auto

!
interface Vlan1
nameif inside
security-level 100
ip address 10.0.100.1 255.255.255.0
!
interface Ethernet1/1
no switchport
nameif outside
security-level 0
pppoe client vpdn group EHS
ip address pppoe setroute
!
interface Ethernet1/2
switchport
!
interface Ethernet1/3
switchport
!
interface Ethernet1/4
switchport
!
interface Ethernet1/5
switchport
!
interface Ethernet1/6
switchport
!
interface Ethernet1/7
switchport
power inline auto
!
interface Ethernet1/8
switchport
power inline auto
!
interface Management1/1
management-only
nameif management
security-level 100
ip address 192.168.45.1 255.255.255.0
!
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
name-server 208.67.222.222 outside
name-server 208.67.220.220 outside
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network EHSDEVHWN01
host 10.0.100.xx
object network EHS_BASELINE_VM
host 10.0.100.xx
object network EHS_DEV_AUTOBUILD_VM
host 10.0.100.xx
object network EHSDEVAPP01
host 10.0.100.xx
object network EHSDEVAPP02
host 10.0.100.xx
object network EHSDEVAPP03
host 10.0.100.xx
object network EHSDEVSQL01
host 10.0.100.xx
object network EHSDEVWEB01
host 10.0.100.xx
object network STU_BUILD_VM
host 10.0.100.xx
object network EHS_HYPERV_NODE
host 10.0.100.xx
object network EHS_BACKUP_SERVER
host 10.0.100.xx
object network EHS_PRIMARY_DC
host 10.0.100.xx
object network EHS_SECONDARY_DC
host 10.0.100.xx
object network EHS_VPN_SERVER
host 10.0.100.204
object network EHS_FILE_SERVER
host 10.0.100.xx
object network EHS_ESET_SERVER
host 10.0.100.xx
object network EHS_SQL_VM
host 10.0.100.xx
object network DEVAGENT_01
host 10.0.100.xx
object network DEVAGENT_02
host 10.0.100.xx
object network DEVAGENT_03
host 10.0.100.xx
object network DEVAGENT_04
host 10.0.100.xx
object network ROUTER
host 10.0.100.1
object network ALTERNATE_INTERNAL_NETWORK
subnet 10.0.1.0 255.255.255.0
object network EXTERNAL_IP
host REDACTED
object-group network Development_Servers
network-object object EHSDEVAPP01
network-object object EHSDEVAPP02
network-object object EHSDEVAPP03
network-object object EHSDEVHWN01
network-object object EHSDEVSQL01
network-object object EHSDEVWEB01
network-object object EHS_BASELINE_VM
network-object object EHS_DEV_AUTOBUILD_VM
network-object object EHS_HYPERV_NODE
network-object object STU_BUILD_VM
network-object object DEVAGENT_01
network-object object DEVAGENT_02
network-object object DEVAGENT_03
network-object object DEVAGENT_04
object-group network Operational_Servers
network-object object EHS_BACKUP_SERVER
network-object object EHS_ESET_SERVER
network-object object EHS_HYPERV_NODE
network-object object EHS_PRIMARY_DC
network-object object EHS_SECONDARY_DC
network-object object EHS_VPN_SERVER
network-object object EHS_SQL_VM
object-group network Development_Agent_Servers
network-object object DEVAGENT_01
network-object object DEVAGENT_02
network-object object DEVAGENT_03
network-object object DEVAGENT_04
network-object object EHSDEVAPP01
network-object object EHSDEVAPP02
network-object object EHSDEVAPP03
network-object object EHSDEVWEB01
network-object object EHS_DEV_AUTOBUILD_VM
object-group service DM_INLINE_TCP_1 tcp
port-object eq www
port-object eq https
object-group service ESET_Server tcp
port-object eq 2222
object-group service SVN_Connection tcp
port-object eq 8443
object-group service Dev_MPWeb_External tcp
port-object eq 8444
object-group service DM_INLINE_SERVICE_3
service-object gre
service-object tcp
service-object tcp destination eq pptp
object-group network All_Internal_Networks
network-object 10.0.100.0 255.255.255.0
network-object object ALTERNATE_INTERNAL_NETWORK
object-group service DM_INLINE_SERVICE_2
service-object gre
service-object tcp destination eq https
service-object tcp destination eq pptp
access-list outside_access_in remark EHS VPN Connection
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any object EHS_VPN_SERVER
access-list outside_access_in extended permit tcp any object-group Development_Agent_Servers object-group DM_INLINE_TCP_1
access-list outside_access_in extended permit tcp any object EHSDEVAPP01 object-group SVN_Connection
access-list outside_access_in remark ESET Management Server incoming connections
access-list outside_access_in extended permit tcp any object EHS_ESET_SERVER object-group ESET_Server
access-list outside_access_in extended permit tcp any object EHSDEVAPP01 object-group Dev_MPWeb_External
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit gre any any
access-list inside_access_in extended permit tcp any eq pptp any
access-list global_access extended permit object-group DM_INLINE_SERVICE_3 object EHS_VPN_SERVER interface outside
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (any,outside) source dynamic All_Internal_Networks interface
!
object network obj_any
nat (any,outside) dynamic interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
access-group global_access global
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http 192.168.45.0 255.255.255.0 management
http 10.0.100.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA
no validation-usage
crl configure
crypto ca trustpoint _SmartCallHome_ServerCA2
no validation-usage
crl configure
crypto ca trustpool policy
auto-import
crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 0a0142800000014523c844b500000002
    REDACTED
  quit
crypto ca certificate chain _SmartCallHome_ServerCA2
certificate ca 0509
    REDACTED
  quit
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group14-sha256
console timeout 0
vpdn group EHS request dialout pppoe
vpdn group EHS localname REDACTED@hg70.btclick.com
vpdn group EHS ppp authentication chap
vpdn username REDACTED@hg70.btclick.com password *****
dhcpd auto_config outside
!
dhcpd address 192.168.45.10-192.168.45.12 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
username admin password ***** pbkdf2 privilege 15
!
class-map inspection_default
match default-inspection-traffic
class-map class_snmp
match port udp eq 4161
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect pptp
class class_snmp
  inspect snmp
!
service-policy global_policy global
prompt hostname context
REDACTED CISCO BITS
: end

Any advice would be appreciated!

Thanks in advance!

Labels:
0 Helpful
1 Accepted Solution

Accepted Solutions

Go to solution
tvotna
Spotlight
Spotlight
In response to philipvoceehs

‎02-12-2024 11:32 AM

I doubt that PPTP will be able to establish connection in the outside->inside direction if you have only one public IP and this IP is assigned to the outside interface, but you can try:

no access-group global_access global
no access-list global_access extended permit object-group DM_INLINE_SERVICE_3 object EHS_VPN_SERVER interface outside
no nat (any,outside) source dynamic All_Internal_Networks interface
object service PPTP-srv
 service tcp source eq 1723
nat (inside,outside) source static EHS_VPN_SERVER interface service PPTP-srv PPTP-srv

Inside->outside PPTP should work if you remove global ACL as shown above.

 

View solution in original post

0 Helpful
5 Replies 5

Go to solution
tvotna
Spotlight
Spotlight

‎02-12-2024 09:11 AM

You probably need static PAT in order to connect to EHS_VPN_SERVER from the outside, right?

 

0 Helpful

Go to solution
philipvoceehs
Level 1
Level 1
In response to tvotna

‎02-12-2024 09:41 AM

I don't think we can as we only have one external fixed address and that address is assigned to the outside interface. We are using dynamic as it's an office environment rather than a datacenter where each server would have it's own IP.

0 Helpful

Go to solution
tvotna
Spotlight
Spotlight
In response to philipvoceehs

‎02-12-2024 11:32 AM

I doubt that PPTP will be able to establish connection in the outside->inside direction if you have only one public IP and this IP is assigned to the outside interface, but you can try:

no access-group global_access global
no access-list global_access extended permit object-group DM_INLINE_SERVICE_3 object EHS_VPN_SERVER interface outside
no nat (any,outside) source dynamic All_Internal_Networks interface
object service PPTP-srv
 service tcp source eq 1723
nat (inside,outside) source static EHS_VPN_SERVER interface service PPTP-srv PPTP-srv

Inside->outside PPTP should work if you remove global ACL as shown above.

 

0 Helpful

Go to solution
philipvoceehs
Level 1
Level 1
In response to tvotna

‎02-14-2024 11:49 PM

Perfect this worked! Thanks @tvotna much appreciated!

0 Helpful

Go to solution
MHM Cisco World
VIP
VIP

‎02-12-2024 10:16 AM

this assume that the PTPP server inside and client outside try to access 

object network obj-priv
host <private server IP>
nat (inside,outside) static <public server IP>

ciscoasa(config)# access-list acl-out permit gre any host <private server IP>
ciscoasa(config)# access-list acl-out permit tcp any host <private server IP> eq 1723
ciscoasa(config)# access-group acl-out in interface outside

 

lastly as I see you config the inspect ptpp 

so try above and check 

MHM

0 Helpful
Customers Also Viewed These Support Documents