Topic: LCP: timeout sending Config-Requests

[guest22]

Hi,

I'm trying to connect to a fresh SME server 7.4. It's behind a firewall that I do not control. Is there a specific port or ports that must be opened on that firewall to establish a correct VPN connection please? See below the 7.4 that I am trying to connect to from a windows xp machine.

Thanks
guest

----------- (removed private details)
pptpd[2320]: CTRL: Client xx.xx.xx.xx control connection started
Mar 21 22:21:58 pptpd[2320]: CTRL: Starting call (launching pppd, opening GRE)
Mar 21 22:21:58 pppd[2321]: Plugin radius.so loaded.
Mar 21 22:21:58 pppd[2321]: RADIUS plugin initialized.
Mar 21 22:21:58 pppd[2321]: pppd 2.4.4 started by root, uid 0
Mar 21 22:21:58 kernel: divert: not allocating divert_blk for non-ethernet device ppp0
Mar 21 22:21:58 pppd[2321]: Using interface ppp0
Mar 21 22:21:58 pppd[2321]: Connect: ppp0 <--> /dev/pts/0
Mar 21 22:22:28 pppd[2321]: LCP: timeout sending Config-Requests
Mar 21 22:22:35 pptpd[2320]: CTRL: Reaping child PPP[2321]
Mar 21 22:22:35 pppd[2321]: Modem hangup
Mar 21 22:22:35 pppd[2321]: Connection terminated.
Mar 21 22:22:35 kernel: divert: no divert_blk to free, ppp0 not ethernet
Mar 21 22:22:35 pppd[2321]: Exit.
Mar 21 22:22:35 pptpd[2320]: CTRL: Client xx.xx.xx.xx control connection finished
------------

[p-jones]

The firewall needs to be able to pass PPTP/GRE Traffic. Is it an appliance firewall (SONIC) or something like IPCop or Smoothwall ?

I have beaten this one also by disabling LCP on the XP machine.

Also found that when a connection fails, it can take several minutes for SME to clear the connection and permit a new connection. Without that wait, any tweaks / changes are futile. Always a bad outcome.

[CharlieBrady]

I have beaten this one also by disabling LCP on the XP machine.

AIUI, LCP is required for PPTP to work. Are you quite sure you disabled LCP? If so how, and what was the result.

[David Harper]

The firewall needs to be able to pass PPTP/GRE Traffic.

If the fireweall doesn't support forwarding GRE traffic specifically, then you can put the server in the DMZ, so that all traffic is forwarded to SME. That will almost certainly work.

[p-jones]

I disabled LCP it in the properties of the XP network connection for the vpn

[guest22]

Firewall mentioned above is a Cisco PIX
Tried the 'disable LCP in VPN connection', did not work, same result.

Thanks,
guest

[p-jones]

HF - Sorry. At the end of my road. No more suggestions even though that block from the logs is too familiar to me !

[CharlieBrady]

HF - Sorry. At the end of my road. No more suggestions even though that block from the logs is too familiar to me !

That line in the logs just indicates that GRE traffic is not arriving at the server from the client.

[guest22]

Thanks,

here are the current PIX rules for the SME Server 7.4 behind it:

----------------
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx object-group DMZ-firewall-tcp
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq 1022 (hitcnt=123)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq 465 (hitcnt=0)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq 995 (hitcnt=0)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq smtp (hitcnt=173)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq 993 (hitcnt=0)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq ident (hitcnt=0)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq www (hitcnt=10930)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq ssh (hitcnt=126)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq pptp (hitcnt=17)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq 5061 (hitcnt=0)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq sip (hitcnt=0)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq https (hitcnt=79)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq ftp-data (hitcnt=1)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq ftp (hitcnt=2375)
access-list acl_outside line 21 extended permit tcp any host xx.xx.xx.xx eq ctiqbe (hitcnt=0)
access-list acl_outside line 22 extended permit udp any host xx.xx.xx.xx object-group DMZ-firewall-UDP
access-list acl_outside line 24 extended permit gre any host xx.xx.xx.xx (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any object-group DMZ-firewall-tcp
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq 1022 (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq 465 (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq 995 (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq smtp (hitcnt=10)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq 993 (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq ident (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq www (hitcnt=1816)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq ssh (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq pptp (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq 5061 (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq sip (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq https (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq ftp-data (hitcnt=0)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq ftp (hitcnt=138)
access-list DMZlan_access_in line 3 extended permit tcp host xx.xx.xx.xx any eq ctiqbe (hitcnt=0)
access-list DMZlan_access_in line 5 extended permit udp host xx.xx.xx.xx any object-group DMZ-firewall-UDP
access-list DMZlan_access_in line 6 extended permit tcp host xx.xx.xx.xx any eq domain (hitcnt=0)
access-list DMZlan_access_in line 7 extended permit udp host xx.xx.xx.xx any eq domain (hitcnt=28767)
access-list DMZlan_access_in line 8 extended permit gre host xx.xx.xx.xx any (hitcnt=7)

--------------------

[electroman00]

I don't see 1194 udp forwarded to the server?

BTW why are you deploying a SME VPN Server within a perimeter firewall??

Some special reason for negating quality network security practices and deployment?

Certainly hope it's not a business network.

[guest22]

The 7.4 box has been given a spot beyond my control. Reason to VPN to it is to access the server-manager.

UDP 1194 is used by OpenVPN isn't it? The 7.4 box is not a OpenVPN box. VPN access required is the default SME 7.4 VPN access method.

Thanks,
guest

[Stefano]

access-list acl_outside line 24 extended permit gre any host xx.xx.xx.xx (hitcnt=0)

maybe there's something in front of your pix (wan side) that block GRE.. how is that network connected?

Ciao
Stefano

[guest22]

Home networks -> ISP1 -> Public internet -> ISP2 -> SME 7.4

Both ISP2 and SME 7.4 are on the same premisses. (ISP2 hosts the 7.4 box)

Thanks,
guest

ps. I can contact ISP2 and trace whatever is traceable on the non-public networks. Any pointers please?

[Stefano]

ok..

I'm not a cisco fan/user, so.. is the pix that keep you connected? I mean, is it a router? is there something in front of it?
did you try to connect to the same SME from another wan connection (different isp)?

Ciao
Stefano

[guest22]

The PIX firewall apparently provides controlled/secure access to a DMZ at ISP2, from that DMZ traffic is being forwarded to the internal 7.4 box. There is nothing else in front of it.

I will try connecting through UMTS (Cell phone) later this (yours and mine ) evening.

Thanks,
guest