I am using MS VPN/PPTP client. This client works fine from home but not at the office. At our office, we have a 192.168.2.0 /24 subnet. We have two DSL connections from the same provider. Both of these DSL connections are in the same Class C subnet. One DSL is used for the office users and one is used for a completely, separate/isolated test environment. I need to be able to PPTP into the test environment fw (71.x.x.50) from the local office lan. I am sitting behind a 2811 using CBAC for outbound traffic and an ACL for inbound traffic. I can't even telnet to port 23 and the log only shows this generic message:
002027: Mar 4 17:27:19.861 CST: %FW-6-SESS_AUDIT_TRAIL_START: Start pptp session: initiator (192.168.2.120:51094) -- responder (71.x.x.x:1723) 002028: Mar 4 17:27:42.226 CST: %FW-6-SESS_AUDIT_TRAIL: Stop pptp session: initiator (192.168.2.120:51094) sent 364 bytes -- responder (71.x.x.x:1723) sent 352 bytes Here is my config. What should I change, please? ip inspect name Outbound sip ip inspect name Outbound tftp ip inspect name Outbound tcp ip inspect name Outbound udp ip inspect name Outbound icmp router-traffic ip inspect name Outbound pptp audit-trail on timeout 3600 interface FastEthernet0/0 ip address 71.x.x.120 255.255.255.0 ip access-group 105 in no ip unreachables ip flow ingress ip flow egress ip nat outside ip inspect Outbound out ip virtual-reassembly duplex auto speed auto access-list 105 permit gre any any access-list 105 permit tcp any host 71.x.x.x. eq 22 access-list 105 permit udp any host 71.x.x.x eq 5060 access-list 105 permit tcp any any eq 1723 No-nat ACL for site-to-site VPN but these VPNS go out a separate private line T-1 interface. access-list 175 deny ip 192.168.2.0 0.0.0.255 192.168.60.0 0.0.0.255 access-list 175 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255 access-list 175 deny ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255 access-list 175 permit ip 192.168.2.0 0.0.0.255 any ip nat inside source route-map nonat interface FastEthernet0/0 overload Thank you, _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
