Cisco PIX behind NAT

Jan 04, 2006 4 Replies
P

Hi,



I have a Cisco PIX and a Aztech DSL router. Cisco PIX outside interface is currently receiving IP information through DHCP. I need PPTP clients(XP) to connect to the PIX VPN Server.



I tried to port forward 1723. The client can connects to the PIX VPN Server, but time out after verifying username and password. Tried connecting PPTP clients from inside interface, no problem though.



What do I need to NAT except for port 1723? Do I need to create any static routes?



I tried to use PPPoE on outside interface instead of DHCP, but got error "Cannot enable pppoe on the same interface as vpdn"



I am using web console to configure this PIX 501.



Please help.



Vote
Twitter Facebook LinkedIn
L

GRE is required, too. Your router must forward those packets.

Remove your router, drop vpdn and use the Cisco VPN client for direct IPSec.

Vote
Twitter Facebook LinkedIn
M

PPTP will fail when using NAT and hang at the point that you mention unless the Aztech router has an option to specifically support PPTP NAT Traversal.

I assume that your DSL is PPPoA and that is why you have the router in place?

Regards,

Martin

Vote
Twitter Facebook LinkedIn
M

Did you add udp or tcp port 1723 ? Additionally you must also forward PROTOCOL number 47, which is GRE Also look for any PPTP Pass-through option on your router

vh Martin Bilgrav

Vote
Twitter Facebook LinkedIn
P

Will try Cisco VPN Client. I do not think the Aztech DSL modem router support GRE/PPTP passthrough. The configuration of the modem router is very limited. I don't see anything regarding protocol number 47 as well. Nop, the connection is on PPPoE using Aztech modem. I tried to set Aztech as bridge and use PIX to run PPPoE but it failed, as I mention in the first thread. It seems PIX does not accept PPTP/L2TP endpoint to be at PPPoE connection.

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required