Cisco PIX behind NAT

- P
- ping
  
  Contact options for registered users
posted
18 years ago

Wed, Jan 4, 2006 3:59 PM

Hi,

I have a Cisco PIX and a Aztech DSL router. Cisco PIX outside interface is currently receiving IP information through DHCP. I need PPTP clients(XP) to connect to the PIX VPN Server.

I tried to port forward 1723. The client can connects to the PIX VPN Server, but time out after verifying username and password. Tried connecting PPTP clients from inside interface, no problem though.

What do I need to NAT except for port 1723? Do I need to create any static routes?

I tried to use PPPoE on outside interface instead of DHCP, but got error "Cannot enable pppoe on the same interface as vpdn"

I am using web console to configure this PIX 501.

Please help.

- L
- Lutz Donnerhacke
  
  Contact options for registered users
Vote on answer
posted
18 years ago

Wed, Jan 4, 2006 4:08 PM

GRE is required, too. Your router must forward those packets.

Remove your router, drop vpdn and use the Cisco VPN client for direct IPSec.

- M
- Martin Kayes
  
  Contact options for registered users
Vote on answer
posted
18 years ago

Wed, Jan 4, 2006 4:39 PM

PPTP will fail when using NAT and hang at the point that you mention unless the Aztech router has an option to specifically support PPTP NAT Traversal.

I assume that your DSL is PPPoA and that is why you have the router in place?

Regards,

Martin

- M
- Martin Bilgrav
  
  Contact options for registered users
Vote on answer
posted
18 years ago

Wed, Jan 4, 2006 5:56 PM

Did you add udp or tcp port 1723 ? Additionally you must also forward PROTOCOL number 47, which is GRE Also look for any PPTP Pass-through option on your router

vh Martin Bilgrav

- P
- ping
  
  Contact options for registered users
Vote on answer
posted
18 years ago

Thu, Jan 5, 2006 5:19 PM

Will try Cisco VPN Client. I do not think the Aztech DSL modem router support GRE/PPTP passthrough. The configuration of the modem router is very limited. I don't see anything regarding protocol number 47 as well. Nop, the connection is on PPPoE using Aztech modem. I tried to set Aztech as bridge and use PIX to run PPPoE but it failed, as I mention in the first thread. It seems PIX does not accept PPTP/L2TP endpoint to be at PPPoE connection.