PPTP through Cisco 1841

[aman.kapuria]

Hi All

Setup is as follows

c1841-advsecurityk9-mz.124-16.bin

Clients PC on Win 7 PPTP connection to a Public IP -----> Cisco 1841 onsite---->Internet

Client gets error 619. Now, client does have a site to site vpn configured on router to connect to a different customer and thats working fine.

When we dial pptp connection using windows 7, on cisco router I get

     %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.

    (ip) vrf/dest_addr= /<Router's Wan IP>, src_addr= <Public IP of destination>, prot= 47

Destination in question is not cisco and doesnt use ipsec. It works if i use my wifi 3g card so destination is not an issue

Win7 Firewall is disabled (FYI)

interface Dialer0
description SHDSL Primary Dialer
ip address negotiated
ip nat outside
ip nat enable
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer idle-timeout 2147483
dialer-group 1
no cdp enable
ppp authentication chap pap callin
ppp chap hostname ...
ppp chap password ...
crypto map VPN

ip nat source list 100 interface Dialer0 overload

access-list 100 deny   ip 192.168.0.0 0.0.0.255 host <Wan IP of different customer>
access-list 100 permit ip 192.168.0.0 0.0.0.255 any
access-list 100 permit gre any any

access-list 100 permit tcp any any eq 1723

access-list 120 permit ip 192.168.0.0 0.0.0.255 host <Wan IP of different customer>

crypto isakmp policy 1
encr aes
authentication pre-share
group 2
!
crypto isakmp policy 10
encr 3des
authentication pre-share
lifetime 86000
!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
lifetime 28800

crypto isakmp key  sharedkey address <Wan IP of different customer>

crypto ipsec transform-set Pactolus-cc esp-3des esp-sha-hmac

crypto map VPN 20 ipsec-isakmp
set peer <Wan IP of different customer>
set transform-set Pactolus-cc
set pfs group2
match address 120

Since acl 120 is precisely for a source destination, I should be able to receive non ipsec packets on device.

Any clue/suggestions appreciated.

[aman.kapuria]

anyone?

[Jitendriya Athavale]

i am not sure if i understand your requirement or setup correctly

please clarify to which interface of 1811 your r connecting win 7 clients

and what is its relevance to site to site

just too confused, please clarify

[aman.kapuria]

ok lets make it as easy as following.

client pc using windows 7 PPTP VPN ---->Through Clients onsite 1841------>Destination Public IP

FAILS. Message logged on router being

%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.

    (ip) vrf/dest_addr= /, src_addr= , prot= 47

Or in simple words, pptp doesnt work THROUGH cisco 1841.

I hope i have made it simple?

Thanks

Aman

[Jitendriya Athavale]

again this is what confuses me

FAILS. Message logged on router being

%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.

    (ip) vrf/dest_addr= /, src_addr= , prot= 47

tells me pptp is terminating on router

Or in simple words, pptp doesnt work THROUGH cisco 1841.

this gives me a feeling that you are configuring router as pass through

please clarify which is true

or is it that these win 7 boxes are behind a router 1811 and are trying to conenct to pptp server on the outside

sorry but i am still confused

[aman.kapuria]

yes mate you are right

win 7 boxes are behind a router 1811 and are trying to conenct to pptp server on the outside

and is pptp server

[Jitendriya Athavale]

do you have any firewall on the route, if so then use inspect pptp

also try doing static one to one nat to this client PC and then try pptp

[aman.kapuria]

There is no ip inspection present on the router. I will do static nat
and reply back

[patgeo1984]

hello Aman

I'm having this same problem. Could you fix it? If so

could you share the solution.

Thanks

Pat

[aman.kapuria]

Hi pat

Apparently the other end was not setup correctly in my case. They did setup the other end for ipsec. I ended up setting up a site to site vpn with them. Also, I was having an ACL  that was matching all gre packets and was passing it to another site to site vpn. i made it more precise. So make sure you have precise ACLs to isolate the issue. Make sure other end is configured correctly. Do you see any messages logged at other end? debugs?

[patgeo1984]

Thanks for answering Aman seems to me that my case is different from yours, I dont have deployed site to site

we establish VPNs to different customers from our office, the issue we have is when we try to connect to the network customers through PPTP, we have no problems against IPSEC clients, you had something similar?

Any recommendation,

I stay aware of your comments

PD: English is not my native language

[aman.kapuria]

In first instance I was trying to setup pptp through 1841. THen I ended up deploying a site to site vpn.

I am not sure but based upon your response it sounds like PPTP works for you. it looks more of a windows client settings issue. if you check the security tab there is an option to enter preshared key for an ipsec conenction. try that if that is the issue

[patgeo1984]

Indeed passtrhough PPTP is the problem we have. Let me give you a picture of ourporblem for clarification.

user lan> 1811 router> dsl> customer IPSEC vpn OK

user lan> 1811 router> dsl> customer PPTP vpn  Fail

I stay aware of your comments

Thanks

[aman.kapuria]

Has it ever worked? You might be encrypting entire traffic. Error messages, debug, config might help

[patgeo1984]

Thanks for responding Aman

PPTP has never worked, I see no logs listed in the CLI, sent the configuration that is operating on the router.