MikroTik

Forum. We have a subscribers who is having a problem with the current version of Router OS and compatibility with ISA. In a nutshell, the Mikrotik is changing the CALL-ID in the PPTP packets. This is not RFC compliant and ISA2004 is the first filter I’ve seen actually enforce it, but it should.

Here's what we found:

External Trace: Frame 1273 Call Request.

PPTP: Call ID = 512 (0x200)

Frame 1281 Call Response

PPTP: Call ID = 10771 (0x2A13)

The call ID’s should remain the same for the rest of this session.

Frame 1295 (Call ID response from the remote VPN Server) Set Link Info

PPTP: Call ID = 1252 (0x4E4)

An immediate ACK_RESET send from ISA to remote VPN Server and Client. And Should be.

Any advise is greatly appreciated.

Get a real PPTP client?

I've tried to mention it to support@ more than once. Maybe my e-mails didn't get there (could happen) or otherwise.

This is the reason why you can't have several PPTP sessions running through a PPTP aware NAT gateway too :/

"/ip firewall service-port disable pptp" and
"/ip firewall service-port disable gre" on all routers that all on the path.

PPTP connection tracking helper probably fails to update callID in
SET_LINK_INFO. It should be fixed since v2.9.2.