Policy timeout for PPTP over Virtual IP

[Erdal]

Hi all,

I have a problem in Firewall policy that says action is "timeout" in the Forward Traffic in log&Report. For this reason, VPN-Clients can not connec to VPN Server(RRAS) located in DMZ zone. VPN is using PPTP with the matching public ip address to DMZ VPN server's ip address. And also capturing the .pcap by wireshark on VPN server,  destination port 1723 of session from vpn-client is Spurious Retransmission.

What problem could be? 

If you need more info or log I can provide if current logs or config is not enough.

I provide some logs and current configuration I have on Fortigate(311B):

config system session-ttl

set default 3600

edit "port10" set vdom "root" set ip x.x.x.x 255.255.255.252 set allowaccess https set type physical set alias "WAN1-Connect to ISP" set device-identification enable set snmp-index 10 next

config system session-helper edit 1 set name pptp set protocol 6 set port 1723 next

edit "link_agg"----------------->Connects to dmz VPN Server set vdom "root" set ip 10.11.49.73 255.255.0.0 set allowaccess ping https ssh snmp fgfm capwap set type aggregate set member "port2" "port1" set description "Aggregate_Link_To_Bal_Chassis" set device-identification enable set listen-forticlient-connection enable set broadcast-forticlient-discovery enable set snmp-index 13 set lacp-ha-slave disable next

config firewall vip edit "VITVPN02" set comment "VITVPN02" set extip 58.100.212.71 set extintf "port10" set portforward enable set mappedip "10.11.49.21-10.11.49.21" set extport 1723 set mappedport 1723 next end

edit 11----------------------Firewall policy 11 set srcintf "port10" set dstintf "link_agg" set srcaddr "all" set dstaddr "VITVPN02" set action accept set schedule "always" set service "GRE" "PPTP" set logtraffic all set capture-packet enable set auto-asic-offload disable set devices "all" next

edit 5----------------------------->Firewall Policy 5 set srcintf "link_agg" set dstintf "port10" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set logtraffic all set capture-packet enable set auto-asic-offload disable set devices "all" next

[style="background-color: #ffff00;"]And some session flow:[/style]

BALLARAT_FTG # id=20085 trace_id=111 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=6, 210.9.112.109:45986 >21.200.232.71:1723) from port10. flag , seq 1099973472, ack 0, win 32120" id=20085 trace_id=111 func=init_ip_session_common line=4517 msg="allocate a new session-0197a813"

id=20085 trace_id=111 func=fw_pre_route_handler line=174 msg="VIP-10.11.49.21:1723, outdev-port10"

id=20085 trace_id=111 func=__ip_session_run_tuple line=2532 msg="DNAT 21.200.232.71:1723->10.11.49.21:1723"

id=20085 trace_id=111 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-10.11.49.21 via link_agg"

id=20085 trace_id=111 func=fw_forward_handler line=671 msg="Allowed by Policy-11:"

id=20085 trace_id=111 func=__ip_session_run_tuple line=2569 msg="run helper-pptp(dir=original)"

id=20085 trace_id=112 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=6, 210.9.112.109:45986->21.200.232.71:1723) from port10. flag , seq 1099973472, ack 0, win 32120"

id=20085 trace_id=112 func=resolve_ip_tuple_fast line=4427 msg="Find an existing session, id-0197a813, original direction"

id=20085 trace_id=112 func=__ip_session_run_tuple line=2532 msg="DNAT 21.200.232.71:1723->10.11.49.21:1723"

id=20085 trace_id=112 func=__ip_session_run_tuple line=2569 msg="run helper-pptp(dir=original)"

id=20085 trace_id=113 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=6, 210.9.112.109:45986->21.200.232.71:1723) from port10. flag , seq 1099973472, ack 0, win 32120"

id=20085 trace_id=113 func=resolve_ip_tuple_fast line=4427 msg="Find an existing session, id-0197a813, original direction"

id=20085 trace_id=113 func=__ip_session_run_tuple line=2532 msg="DNAT 21.200.232.71:1723->10.11.49.21:1723"

id=20085 trace_id=113 func=__ip_session_run_tuple line=2569 msg="run helper-pptp(dir=original)"

id=20085 trace_id=114 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=6, 210.9.112.109:45986->21.200.232.71:1723) from port10. flag , seq 1099973472, ack 0, win 32120"

id=20085 trace_id=114 func=resolve_ip_tuple_fast line=4427 msg="Find an existing session, id-0197a813, original direction"

id=20085 trace_id=114 func=__ip_session_run_tuple line=2532 msg="DNAT 21.200.232.71:1723->10.11.49.21:1723"

id=20085 trace_id=114 func=__ip_session_run_tuple line=2569 msg="run helper-pptp(dir=original)"

id=20085 trace_id=115 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=6, 210.9.112.109:45986->21.200.232.71:1723) from port10. flag , seq 1099973472, ack 0, win 32120"

id=20085 trace_id=115 func=resolve_ip_tuple_fast line=4427 msg="Find an existing session, id-0197a813, original direction"

id=20085 trace_id=115 func=__ip_session_run_tuple line=2532 msg="DNAT 21.200.232.71:1723->10.11.49.21:1723"

id=20085 trace_id=115 func=__ip_session_run_tuple line=2569 msg="run helper-pptp(dir=original)"

id=20085 trace_id=116 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=6, 210.9.112.109:45986->21.200.232.71:1723) from port10. flag , seq 1099973472, ack 0, win 32120"

id=20085 trace_id=116 func=resolve_ip_tuple_fast line=4427 msg="Find an existing session, id-0197a813, original direction"

id=20085 trace_id=116 func=__ip_session_run_tuple line=2532 msg="DNAT 21.200.232.71:1723->10.11.49.21:1723"

id=20085 trace_id=116 func=__ip_session_run_tuple line=2569 msg="run helper-pptp(dir=original)"

id=20085 trace_id=117 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=6, 210.9.112.109:45986->21.200.232.71:1723) from port10. flag , seq 1099973472, ack 0, win 32120"

id=20085 trace_id=117 func=resolve_ip_tuple_fast line=4427 msg="Find an existing session, id-0197a813, original direction"

id=20085 trace_id=117 func=__ip_session_run_tuple line=2532 msg="DNAT 21.200.232.71:1723->10.11.49.21:1723"

id=20085 trace_id=117 func=__ip_session_run_tuple line=2569 msg="run helper-pptp(dir=original)"

id=20085 trace_id=118 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=6, 210.9.112.109:45986->21.200.232.71:1723) from port10. flag , seq 1099973472, ack 0, win 32120"

id=20085 trace_id=118 func=resolve_ip_tuple_fast line=4427 msg="Find an existing session, id-0197a813, original direction"

id=20085 trace_id=118 func=__ip_session_run_tuple line=2532 msg="DNAT 21.200.232.71:1723->10.11.49.21:1723"

id=20085 trace_id=118 func=__ip_session_run_tuple line=2569 msg="run helper-pptp(dir=original)"

id=20085 trace_id=119 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=6, 210.9.112.109:45986->21.200.232.71:1723) from port10. flag , seq 1099973472, ack 0, win 32120"

id=20085 trace_id=119 func=resolve_ip_tuple_fast line=4427 msg="Find an existing session, id-0197a813, original direction"

id=20085 trace_id=119 func=__ip_session_run_tuple line=2532 msg="DNAT 21.200.232.71:1723->10.11.49.21:1723"

id=20085 trace_id=119 func=__ip_session_run_tuple line=2569 msg="run helper-pptp(dir=original)"

id=20085 trace_id=120 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=6, 210.9.112.109:45986->21.200.232.71:1723) from port10. flag , seq 1099973472, ack 0, win 32120"

id=20085 trace_id=120 func=resolve_ip_tuple_fast line=4427 msg="Find an existing session, id-0197a813, original direction"

id=20085 trace_id=120 func=__ip_session_run_tuple line=2532 msg="DNAT 21.200.232.71:1723->10.11.49.21:1723"

id=20085 trace_id=120 func=__ip_session_run_tuple line=2569 msg="run helper-pptp(dir=original)"

[Erdal]

Any help please about my previous email?