IP Addressing: NAT Configuration Guide, Cisco IOS XE Release 3S (ASR 1000)
PPTP Port Address Translation
Downloads: This chapterpdf (PDF - 1.29MB) The complete bookPDF (PDF - 5.17MB) | The complete bookePub (ePub - 1.74MB) | Feedback

PPTP Port Address Translation

PPTP Port Address Translation

The PPTP Port Address Translation feature supports the Point-to-Point Tunneling Protocol (PPTP) application layer gateway (ALG) for Port Address Translation (PAT) configuration. PAT configuration requires the PPTP ALG to parse PPTP packets. The PPTP ALG is enabled by default when Network Address Translation (NAT) is configured.

This module provides information about how to configure the PPTP ALG for PAT.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Restrictions for PPTP Port Address Translation

  • The Point-to-Point Tunneling Protocol (PPTP) application layer gateway (ALG) does not support virtual TCP (vTCP) and TCP segments.
  • The PPTP ALG will not work in Carrier Grade Network Address Translation (NAT) mode, when the NAT client and server use the same call ID.

Information About PPTP Port Address Translation

PPTP ALG Support Overview

The Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables the secure transfer of data from a remote client to an enterprise server by creating a VPN across TCP/IP-based data networks. PPTP encapsulates PPP packets into IP datagrams for transmission over the Internet or other public TCP/IP-based networks.

PPTP establishes a tunnel for each communicating PPTP network server (PNS)-PPTP Access Concentrator (PAC) pair. After the tunnel is set up, PPP packets are exchanged using enhanced generic routing encapsulation (GRE). A call ID present in the GRE header indicates the session to which a particular PPP packet belongs.

Network Address Translation (NAT) translates only the IP address and the port number of a PPTP message. Static and dynamic NAT configurations work with PPTP without the requirement of the PPTP application layer gateway (ALG). However, Port Address Translation (PAT) configuration requires the PPTP ALG to parse the PPTP header and facilitate the translation of call IDs in PPTP control packets. NAT then parses the GRE header and translates call IDs for PPTP data sessions. The PPTP ALG does not translate any embedded IP address in the PPTP payload. The PPTP ALG is enabled by default when NAT is configured.

NAT recognizes PPTP packets that arrive on the default TCP port, 1723, and invokes the PPTP ALG to parse control packets. NAT translates the call ID parsed by the PPTP ALG by assigning a global address or port number. Based on the client and server call IDs, NAT creates two doors based on the request of the PPTP ALG. ( A door is created when there is insufficient information to create a complete NAT-session entry. A door contains information about the source IP address and the destination IP address and port.) Two NAT sessions are created (one with the server call ID and the other with the client call ID) for two-way data communication between the client and server. NAT translates the GRE packet header for data packets that complies with RFC 2673.

PPTP is a TCP-based protocol. Therefore, when NAT recognizes a TCP packet as a PPTP packet, it invokes the PPTP ALG parse-callback function. The PPTP ALG fetches the embedded call ID from the PPTP header and creates a translation token for the header. The PPTP ALG also creates data channels for related GRE tunnels. After ALG parsing, NAT processes the tokens created by the ALG.

How to Configure PPTP Port Address Translation

Configuring PPTP ALG for Port Address Translation

The Point-to-Point Tunneling Protocol (PPTP) application layer gateway (ALG) is enabled by default when Network Address Translation (NAT) is configured. Use the no ip nat service pptp command to disable the PPTP ALG. Use the ip nat service pptp command to reenable PPTP ALG translation of applications.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    interface type number

    4.    ip nat inside

    5.    exit

    6.    interface type number

    7.    ip nat outside

    8.    exit

    9.    ip nat pool name start-ip end-ip {netmask netmask | prefix-length prefix-length}

    10.    ip nat inside source list {access-list-number | access-list-name} pool name overload

    11.    ip access-list standard access-list-name

    12.    permit host-ip

    13.    end


DETAILED STEPS
     Command or ActionPurpose
    Step 1enable


    Example:
    Device> enable
     
    Enables privileged EXEC mode.
    • Enter your password if prompted.
     
    Step 2configure terminal


    Example:
    Device# configure terminal
     

    Enters global configuration mode.

     
    Step 3interface type number


    Example:
    Device(config)# interface gigabitethernet 0/0/1
     

    Enables an interface and enters interface configuration mode.

     
    Step 4ip nat inside


    Example:
    Device(config-if)# ip nat inside
     

    Connects the interface to the inside network, which is subject to NAT.

     
    Step 5exit


    Example:
    Device(config-if)# exit
     

    Exits interface configuration mode and enters global configuration mode.

     
    Step 6interface type number


    Example:
    Device(config)# interface gigabitethernet 0/1/0
     

    Enables an interface and enters interface configuration mode.

     
    Step 7ip nat outside


    Example:
    Device(config-if)# ip nat outside
     

    Connects the interface to the outside network.

     
    Step 8exit


    Example:
    Device(config-if)# exit
     

    Exits interface configuration mode and enters global configuration mode.

     
    Step 9ip nat pool name start-ip end-ip {netmask netmask | prefix-length prefix-length}


    Example:
    Device(config)# ip nat pool pptp-pool 192.168.0.1 192.168.0.234 prefix-length 24
     

    Defines a pool of IP addresses for NAT translations.

     
    Step 10ip nat inside source list {access-list-number | access-list-name} pool name overload


    Example:
    Device(config)# ip nat inside source list pptp-acl pool pptp-pool overload
     
    Enables NAT of the inside source address.
    • When overloading is configured, the TCP or UDP port number of each inside host distinguishes between multiple conversations by using the same local IP address.
     
    Step 11ip access-list standard access-list-name


    Example:
    Device(config)# ip access-list standard pptp-acl
     

    Defines a standard IP access list by name to enable packet filtering and enters standard access-list configuration mode.

     
    Step 12permit host-ip


    Example:
    Device(config-std-nacl)# permit 10.1.1.1
     

    Sets conditions in named IP access lists that permit packets.

     
    Step 13end


    Example:
    Device(config-std-nacl)# end
     

    Exits standard access-list configuration mode and enters privileged EXEC mode.

     

    Configuration Examples for PPTP Port Address Translation

    Example: Configuring PPTP ALG for Port Address Translation

    Device# configure terminal
    Device(config)# interface gigabitethernet 0/0/1
    Device(config-if)# ip nat inside
    Device(config-if)# exit
    Device(config)# interface gigabitethernet 0/1/0
    Device(config-if)# ip nat outside
    Device(config-if)# exit
    Device(config)# ip nat pool pptp-pool 192.168.0.1 192.168.0.234 prefix-length 24
    Device(config)# ip nat inside source list pptp-acl pool pptp-pool overload
    Device(config)# ip access-list standard pptp-acl
    Device(config-std-nacl)# permit 10.1.1.1
    Device(config-std-nacl)# end

    Additional References for PPTP Port Address Translation

    Related Documents

    Related Topic Document Title

    Cisco IOS commands

    Cisco IOS Master Command List, All Releases

    NAT commands

    Cisco IOS IP Addressing Services Command Reference

    Standards and RFCs

    Standard/RFC Title

    RFC 2637

    Point-to-Point Tunneling Protocol (PPTP)

    Technical Assistance

    Description Link

    The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

    To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

    Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

    http:/​/​www.cisco.com/​support

    Feature Information for PPTP Port Address Translation

    The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

    Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

    Table 1 Feature Information for PPTP Port Address Translation

    Feature Name

    Releases

    Feature Information

    PPTP Port Address Translation Support

    Cisco IOS XE Release 3.9S

    The PPTP Port Address Translation Support feature introduces the Point-to-Point Tunneling Protocol (PPTP) application layer gateway (ALG) for Port Address Translation (PAT) configuration. PAT configuration requires the PPTP ALG to parse PPTP packets. The PPTP ALG is enabled by default when Network Address Translation (NAT) is configured.

    The following commands were introduced or modified: debug platform hardware qfp feature alg datapath pptp, ip nat service pptp, show platform hardware qfp feature alg statistics pptp.