PIX can't pass-through L2TP

[mcrichard]

Hi all,

We installed the win2003 L2TP server and the PIX is our firewall.But we can't connecte to L2TP server from internet(PPTP is OK)

here is our ACL.

access-list acl_outside permit icmp any any

access-list acl_outside permit udp any host 61.222.1.183 eq isakmp

access-list acl_outside permit udp any host 61.222.1.183 eq 4500

access-list acl_outside permit tcp any host 61.222.1.183 eq pptp

access-list acl_outside permit gre any host 61.222.1.183

access-list acl_outside permit udp any host 61.222.1.183 eq bootps

access-list acl_outside permit esp any host 61.222.1.183

access-list acl_outside permit udp any host 61.222.1.183 eq 1701

access-list acl_outside permit tcp any host 61.222.1.187 eq smtp

access-list acl_outside permit tcp any host 61.222.1.187 eq 8003

[sachinraja]

Hi richard,

Are you able to access the L2TP server from inside ? this is just to make sure that your server is up and running the l2tp service fine.

L2TP works on UDP 1701. I can see an access-list permitting that. so, no problems with your ACL configuration. did you try fixing up the l2tp protocol to this port number ?

fixup protocol l2tp 1701

even for pptp, we have to fixup for the vpn to work. try this and let us know..

Raj

[mcrichard]

Hi Raj,

Thaks your reply

The "fixup protocol l2tp 1701" is bad command

(LAB Test)

If we try static(inside,outside) 192.168.101.0 192.168.101.0 netmask 255.255.255.0 ===> is OK

But static(inside,outside) 192.168.100.0 192.168.101.0 netmask 255.255.255.0 ===> is fail

I think is the PIX and payload problems ???