1. Home
  2. Cisco Systems
  3. 837 vs 857 PPTP Pass through Problems

837 vs 857 PPTP Pass through Problems

Hi,

I have come across a strange issue and was wondering if anyone here had seen this before, and if so had any ideas on what to do next/where to look.

We are having problems with PPTP pass through on 857's using XP clients.

We have a mix of 837's and 857's. Both essentially run the same access rules with only minor differences due to the IOS differences of these devices.

The routers are configured with NAT and hosts on the inside (ethternet) establish a PPTP VPN session with a Windows 2000 SP4 RRAS server located on the WAN (ADSL) side.

Windows 2000 and XP clients behind the 837's have no problems establishing the PPTP session.

Windows 2000 clients behind the 857's have no problems establishing the PPTP session.

Windows XP clients behind the 857's are unable to establish the PPTP session 99% of the time, but very occasionally can. In fact you can have an XP client and a 2000 client connected to the same 857, the 2000 client can consistently connect whilst the XP client has serious issues.

Initially we thought this to be an XP configuration issue (it still could be), but we have tried SP1 and SP2 XP machines, and if you make no changes to the XP client, other than replacing the 857 with an 837, the XP client can then consistently connect - so we are now suspecting something odd with the 857, but given 2000 clients work it is very odd.

Cheers,

Reply to
gpnz
Loading thread data ...

Post the output of show version and santized configs for both 837 and the 857

Reply to
Merv

Hi,

Below are the versions/configs.

Cheers,

857:
Reply to
gpnz

Access list 101 is not identical on both routers - should they be ?

Reply to
Merv

Whoops, they started out the same, but on the 857 we started playing around a little to see if it were something in the access list on the

857 that operated differently than on the 837. With these two configs however, operation is as described as in my first message. A 2000 box behind the 857 has no trouble, any XP machine has trouble. Do nothing, but replace the 857 with the 837 with the above config and the both the 2000 and XP boxes are happy.

Cheers,

Reply to
gpnz

So things that you could try:

  1. upgrade the 857 to the latest 12.4T image

  1. downgrade 857 to latest 12.3T image

  2. load Etherreal on both an XP and 2000 PC and see if any useful infomation can be glened about what is different between XP and 2000.
Reply to
Merv

Thanks,

I'll try that. I am going to log a TAC case as well once the contracts are sorted out. We did do a basic trace early on, and all we saw was that there was no GRE traffic coming back to the XP client from the RRAS server during the setup - at the same time, we didnt see the router dropping anything from the RRAS server. I guess we might need to look closer into the data in the packets to see if there is a difference between the 2000 and xp... sigh, hopefully I've made a simple mistake that Cisco can point out to me :)

Cheers,

Reply to
gpnz

Just a stab in the dark...

Even though the config looks the same, be careful because the hidden commands (defaults of everything)t may have changed. ie. 'no cdp enable' shows in one config/IOS by default.. whilst the other config/IOS shows nothing - but they are both off if you get my drift. until you explicitly 'cdp anable' - in which the 'cdp enable' apeears in config - whilst the other disapears again.

But the above does not make much sense in relation to your issue, since I dont think there are many commands/features that effect 'pass through' traffic.

The 12.4T could have extra features not on the 837 - such as NAT traversal and things related to NAT, and the passing of L2TP/VPN tunnels. One thing I found with NAT in IOS is that DNS resolutions gets modified by NAT in certain situations (like dns fix-up on the PIX), which took me days to understand troubleshoot.

I think you should be looking at new 12.4 NAT features and disabling them, and look at possibly WinXPs L2TP features with NAT and see why that OS does it over win2K??

Good Luck.

Reply to
jay

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.