PPTP Passthrough with Cisco’s Zone Based Firewall
At my office and home I have setup Cisco routers, using SDM 2.5 which sets up Zone Based Firewalls. For those of you familiar with the old ACL style (IOS Classic they call it) of firewalls, Zone Based Firewalls look pretty foreign. Its the way ASDM works (in a way) and many other firewalls out there, although they all call it something else. Cisco’s implementation is easy enough to manage using SDM, but nearly impossible to manage using CLI (in my opinion). For more information on how to configure ZBF or what they do, check out Cisco’s page here.
What you’ll find out pretty quickly is that if you have any MS style PPTP VPN’s, they will cease to function. There is also very little information out on the web on how to configure the router to allow PPTP passthrough to function. Well after reading a bunch of posts, and even one that said to remove zone based firewalls and go back to an IOS Classic setup, I found a Cisco doc on how to setup the router itself as a PPTP server. You can find the documentation here. I was able to make it work taking a few of the commands out of that example and using it in my own router. There is not an example of how to do it through SDM which I’ll show you below. I’ll also show you how to do it through the CLI if you prefer that method.
First you want to set yourself up an ACL for the GRE (Generic Routing Encapsulation) protocol (protocol number 47). GRE is neither TCP nor UDP and it has to be specifically allowed through the firewall. There is also, to my knowledge, no way to ‘inspect’ this traffic as the Cisco mechanism only inspects TCP/UDP traffic.
SDM Method
In SDM, go to ‘Configure’, then ‘Additional Tasks’, and expand out the ‘ACL Editor’. Once you have the list, go into the ‘Access Rules’ and hit Add. Make sure you have the type set as ‘Extended Rule’ and put in a name such as PPTP-PASS-THROUGH.
Put a description if you like, then click ADD under ‘Rule Entry’. On the ‘Add an Extended Rule Entry’ box, leave everything default, except under the Protocol and Service area, type in 47 for protocol, or select it from the selection box.
Once you hit okay, you should see the following:
Now that the rule is created we can setup the class maps and apply the class map to the proper zone pairs. Back in the additional tasks page, expand out C3PL, and then expand out ‘Class Map’. Once you have that opened up, you’ll want to click on ‘Inspection’, and click ‘Add’ at the top of the page. That will open up the ‘Add Inspect Class Map’ dialogue box. In the box ‘Class Map’, give the map a name such as ‘PPTP-Pass-Through-Traffic’. Give a description if you’d like, and then we need to add the match traffic. Under the Match side of the box, you’ll expand out ‘Access Group’ section and find the PPTP-PASS-THROUGH rule we made earlier, and click OK.
Okay, now that we have the proper match group, and the proper class map, we need to apply it to the zone pairs. With the default SDM setup, you will have a zone pairs like sdm-zp-in-out, and sdm-zp-NATOutsideToInside. These are the two we’re interested in. The policy that the sdm-zp-in-out uses, is called ’sdm-inspect’, and the sdm-zp-NATOutsideToInside zone pair uses the sdm-pol-NATOutsideToInside-1 policy. Now that we know which policy we need to modify, we can go back to the C3PL area and expand out the Policy Map folder. Once you have that opened up, click on ‘Protocol Inspection’. On the right hand side, you’ll see all of the various policies that are in effect. All we’re concerned with is the two mentioned above. So highlight the sdm-pol-NATOutsideToInside-1 and click Edit at the top right.
Click add and under Class Name, type in the name of the class you created a few steps ago, make sure that under Action it says Pass and hit okay. You should be back to the Edit Protocol Inspection Policy Map, and if you scroll to the bottom, you should see the PPTP-Pass-Through-Traffic Class Map listed just above ‘class-default’. Click OK.
Perform the same steps with the sdm-inspect Policy Map. Thats it! You have enabled PPTP Passthrough using the SDM interface. Be sure to save your running config before you exit SDM.
CLI Method
Open up a session into your routers CLI. Once you are in, go into configure mode, and insert the following commands:
This will setup the Class Map:
class-map type inspect match-all PPTP-Pass-Through-Traffic match access-group name PPTP-PASS-THROUGH
These commands build the Access Group
ip access-list extended PPTP-PASS-THROUGH permit gre any any
Finally you need to add in the Class-Map to your inspection policies. So depending on what your policy maps are, the command might be different, but I’m sure you get the idea:
For your in-out zone pair policy:
policy-map type inspect In-Out-Policy class type inspect PPTP-Pass-Through-Traffic pass
Be sure to add it in the proper order (as in you may need to pull it out and re-insert it in the right order, like ACL’s. Be sure to do the same to your Out-In-Policy as well.
Conclusion
PPTP passthrough requires that there be 2 way TCP 1723 and Protocol 47 (GRE) enabled to work. You’ll also need to make sure that you have some rules in there to handle that TCP 1723 traffic. For a default SDM firewall installation, there is a default ‘inspect tcp’ rule so that all outbound tcp traffic has a return route. If you don’t have something like that, you’ll also need to setup something for TCP 1723 out and back in.
Good luck!