PDA

View Full Version : Cannot connect to PIX VPN with FC3


stefan_tech
25th August 2005, 06:12 AM
Sorry if this was beaten to death somewhere else. Tried searching and can't find anything definite.

I'm trying to connect a FC3 box at home to our PIX VPN at work. I've followed the instructions at http://pptpclient.sourceforge.net/howto-fedora-core-3.phtml verbatim. Everything seems to load alright, but whenever I try to connect I get this error in the status window:

LCP: timeout sending Config-Requests
Connection terminated.

At http://pptpclient.sourceforge.net/howto-diagnosis.phtml#lcp_timeout they listed possible reasons relating to GRE packets. I did a tcpdump/grep while trying to connect. There are numerous gre-ppp-payload packets going to and from the server; Followed by 10 gre-ppp-payload going to the server with no response. Don't have a clue on what to check from there.

Now I do have access to the PIX config (cannot change anything.) The relevant config lines would be:

vpdn group VPN_USER accept dialin pptp
vpdn group VPN_USER ppp authentication pap
vpdn group VPN_USER ppp authentication chap
vpdn group VPN_USER ppp authentication mschap
vpdn group VPN_USER ppp encryption mppe 40 (I guess there is a license problem for 128?)
...

My options.pptp looks like this:

lock
noauth
refuse-eap
refuse-pap
refuse-chap
refuse-mschap
nobsdcomp
nodeflate
require-mppe

I don't know what to try now... Any help would be greatly appreciated!

Update:
I allowed mschap auth in the config and I get this error while connecting:

CHAP authentication succeeded
Disabling 40-bit MPPE; MS-CHAP LM not supported
MPPE required but peer negotiation failed
Connection terminated.

So, I need to use mschap instead of v2; But what gives with the encryption? Do I not have 40bit capability? How do I check and fix?

(It's getting late btw, my brain is melting ;-)