I am new to the 5505 and configuring them. I have several books and the web as research tools however I haven't wrapped my head around the whole thing. I am better at reverse engineering then initial config. I am trying to terminate remote access PPTP VPN connection on my internal Win 2012 RRAS server. I know I need to allow GRE and PPTP 1723 thru as well as port forward 1723 to the Win 2012 internal IP. Precisely how this is done in config is where I lose it, sadly. Below is my config and if there's someone that can really spell it out for me I'd be ever appreciative. Thanks in advance. Please note that I'd gone thru the IPSec and AnyConnect wizards on the ASDM and there's config in there for that, however it didn't function, and I'd prefer to use the Win 2012 RRAS server for PPTP as client workstation are already configure for it. Additionally I am limited to one public IP by ISP.

ASA Version 8.2(5)

hostname ciscoasa

enable password uXZJvr7TNDFcspD4 encrypted

passwd uXZJvr7TNDFcspD4 encrypted


interface Ethernet0/0

 switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/7

 switchport access vlan 5

interface Vlan1

 nameif inside

 security-level 100

 ip address

interface Vlan2

 nameif outside

 security-level 0

 ip address 1.outside.ip.1

interface Vlan5

 nameif dmz

 security-level 50

 ip address

ftp mode passive

clock timezone EST -5

clock summer-time EDT recurring

access-list domainVPN_splitTunnelAcl standard permit

access-list inside_nat0_outbound extended permit ip

pager lines 24

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu dmz 1500

ip local pool VPN_IP_Pool mask

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1

route outside 1.outside.gateway.ip.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint _SmartCallHome_ServerCA

 crl configure

crypto ca certificate chain _SmartCallHome_ServerCA

 certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

    308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130

crypto isakmp enable outside

crypto isakmp policy 10

 authentication pre-share

 encryption 3des

 hash sha

 group 2

 lifetime 86400

telnet inside

telnet timeout 10

ssh inside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

dhcpd address inside

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept


 enable outside

 svc enable

group-policy domainVPN internal

group-policy domainVPN attributes

 wins-server value 1.inside.dc.ip.1 1.inside.dc2.1

 dns-server value 1.inside.dc.ip.1 1.inside.dc2.1

 vpn-tunnel-protocol IPSec

 split-tunnel-policy tunnelspecified

 split-tunnel-network-list value domainVPN_splitTunnelAcl

 default-domain value domain.local

group-policy DfltGrpPolicy attributes

 vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn

username username password 6phXKPxOcSDjp7J7 encrypted privilege 0

username username attributes

 vpn-group-policy domainVPN

tunnel-group domainVPN type remote-access

tunnel-group domainVPN general-attributes

 address-pool VPN_IP_Pool

 default-group-policy domainVPN

tunnel-group domainVPN ipsec-attributes

 pre-shared-key *****

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

 address-pool VPN_IP_Pool

class-map inspection_default

 match default-inspection-traffic

policy-map type inspect dns preset_dns_map


  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
service-policy global_policy global
prompt hostname context
  • 1
    You can't port-forward GRE, since its L3 and doesn't use ports. So you need to have a static public address that you map to your RRAS server. Once you have that, the rest is easy (well, easier).
    – Ron Trunk
    Apr 23, 2014 at 21:10
  • I hear what you're saying...but wanted to point out that with a cheapo Netgear wireless router I was able to do this with only 1 public IP. Now that I've "upgradeded" to the Cisco ASA it can't do the same thing the Netgear could?
    – SRH
    Apr 24, 2014 at 14:45
  • I believe this Cisco document explains what you need to do. If you get it running before I have time to answer myself, please answer your own question with the config diffs that made it work. Apr 25, 2014 at 10:27
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Nov 19, 2022 at 21:48

1 Answer 1


For anyone else looking to do this, I'm pretty sure the solution is just to enable PPTP inspection like this:

policy-map global_policy
 class inspection_default
  inspect pptp

If your policy-map or class name is different from the OP, you would need to modify the solution before pasting it in to your firewall.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.