PPTP VPN connection IOS FW (2620)

[srganote1]

I have a 2620 router using the IOS Firewall (12.3). I have a particular PC that connects to a customer's VPN. They are using PPTP and say all I need to allow is PPTP traffic (TCP port 1723). However, when I open 1723 for incoming traffic it does not work (all outgoing is allowed) - my attempt to connect times out as if either their server is not there or it cannot talk back to my PC. Any help would be appreciated - I know this is a vague description but I didn't want to be too lengthy.

[nkhawaja]

Hi,

May be there is some other port needed as well. You need to collect the syslog messages out from this router. They will shed more light on whats is happening. btw if say you open up all ports for incoming traffic, does it work?

Thanks

Nadeem

[srganote1]

How do I get the syslog messages (sorry untrained user)? I can't open all ports for incoming traffic (not an option) - all ports are open on outgoing traffic.

Thanks,

Suzanne

[srganote1]

I kept my TCP ports restricted but added an

access-list 101 permit ip any host nn.nn.nn.nn(ip addr of the pc that needs the vpn) - that works

Thanks

[jeff.bankston]

make sure you explicitly permit GRE outbound to the customer site. On my 2621 firewall, I have the inspection rules set for out on the inside interface, and in for the outside interface. I found that any other config broke PPTP thru the IOS firewall.

-Jeff

[scoclayton]

I think Jeff is on the right path here but I will add a slightly different angle on this. You need to make sure you allow GRE back into your network via the ACL applied inbound on your outside interface (I am making some assumptions here). CBAC does not inspect GRE traffic so it does not poke the dynamic hole in the ACL to allow the return traffic in. The TCP traffic should be handled by your inspect. Can you post a sanitized version of your config?

Scott

[shawn]

Add this to your ACL.

access-list 101 permit gre any any

Shawn

[aungureanu]

Allow 47 and 1723 for pptp