The company I work for has a client that has a Cisco PIX 506e firewall running v6.3. The PIX is currently set up to manage PPTP VPN connections using the local Windows domain controller as a RADIUS server. The PIX does not support MSCHAP v2 connections, so users cannot connect from Windows 7 workstations.
Our plan is to just disable the VPN connection on the PIX and pass VPN through and let the DC manage it. Problem is, I cannot find any information on disabling the existing VPN setup on the PIX.
I have only moderate experience with PIX's, but to the best of my knowledge, the following is all the commands that control the VPN setup.
vpdn group 1 accept dialin pptp vpdn group 1 ppp authentication pap vpdn group 1 ppp authentication chap vpdn group 1 ppp authentication mschap vpdn group 1 ppp encryption mppe 40 vpdn group 1 client configuration address local bigpool vpdn group 1 client configuration dns local_server_alias vpdn group 1 client configuration wins local_server_alias vpdn group 1 client authentication aaa RADIUS vpdn group 1 pptp echo 60 vpdn username some_users password ******** vpdn enable outside
I've looked at the PIX v6.3 command reference and I do not seen any information on disabling it. The
tftp-server commands reference using a
no command to disable the tftp-server, but the vpnd command reference has no information on it. To disable, is it as simple as using a
no vpdn enable outside command or doing a
no for all of the above commands, or is it something else?
Second, related question is then how to correctly pass VPN through the pix.
Reviewed Cisco Doc ID 18806 and it looks like all I need to do is add the following lines:
access-list acl-out permit gre any host external_ip_of_RRAS access-list acl-out permit tcp any host external_ip_of_RRAS eq 1723 static (inside,outside) external_ip_of_RRAS internal_ip_of_RRAS netmask 255.255.255.255 0 0 access-group acl-out in interface outside
There is also potentially a PPTP
fixup command that may be needed, but it sounds like that is only needed for inside to outside PPTP. Does this look correct or will I need anything more?