A very interesting topic came up this week when I was attempting to connect to a client’s PPTP VPN from behind my Cisco ASA5505. I would attempt to make the connection and then it would drop, and I would not be able to complete the connection. At first, I thought it might have something to do with the client’s firewall being down, however, after I removed my ASA from the mix, and just used a DLINK wireless router, I was able to connect instantly.
First stop in my troubleshooting process was to look at the System Log within the ASDM for the ASA. I then tried to initialize the PPTP connection, I saw within the System Log the following error:
“regular translation creation failed for protocol 50 src inside:(Machine name) dst outside:(IP Address)”
After some research as to why this was happening, I was able to note that this is not something that is configured by default. You must put in a command within the CLI (Command Line Interface) that allows PPTP packets to be inspected. The firewall then creates dynamic GRE (generic routing encapsulation) connections and translations necessary to permit PPTP traffic. Here are a list of the commands that I had to execute within my firewall:
ASA5505> enable
Password: ********
ASA5505# conf t
ASA5505(config)# policy-map global_policy
ASA5505(config-pmap)# class inspection_default
ASA5505(config-pmap-c)# inspect pptp
After doing this, I then tested connectivity and it successfully worked. I found that this could be a big help in future firewall configurations where you must connect to various client PPTP VPN’s when you are behind a Cisco firewall.  Don’t forget to save your configuration after you have tested this successfully!
Digg This | Save to del.icio.us
Comments
You can follow this conversation by subscribing to the comment feed for this post.
Leave a Comment