Description

A PPTP tunnel is instantiated by communication to the peer on TCP port 1723. This TCP connection is then used to initiate and manage a GRE tunnel to the same peer. The PPTP GRE packet format is non standard, including a new acknowledgement number field replacing the typical routing field in the GRE header. However, as in a normal GRE connection, those modified GRE packets are directly encapsulated into IP packets, and seen as IP protocol number 47. The GRE tunnel is used to carry encapsulated PPP packets, allowing the tunnelling of any protocols that can be carried within PPP, including IP, NetBEUI and IPX. 

 

 

Symptoms

For the PPTP tunnel over CGNAT NAPT scenario, the system will allocate a NAT IP and NAT port (or port block) for the TCP control session and log the information, for this PPTP tunnel's child (GRE) sessions, same NAT IP is used but with the dummy (not allocated) ports will be used, it is expected behavior.

 

user@router> show services sessions service-set IPV4_NAT source-prefix 10.61.4.209 application-protocol pptp

mams-5/1/0 (ams0)

Service Set: IPV4_NAT, Session: 1778388293, ALG: pptp, Flags: 0x10080380, IP Action: no, Offload: no, Asymmetric: no

GRE 10.61.4.209:0 -> 4.3.2.1:18048 Forward I 15

GRE 4.3.2.1:18048 -> 1.2.3.4:65001 Forward O 0         <<<<< the GRE session with dummy ports (source 65001 and destination 18048)

 

Service Set: IPV4_NAT, Session: 1543533051, ALG: pptp, Flags: 0x10180180, IP Action: no, Offload: no, Asymmetric: no

TCP 10.61.4.209:58482 -> 4.3.2.1:1723 Forward I 6

TCP 4.3.2.1:1723 -> 1.2.3.4:8792 Forward O 4           <<<<< original PPTP TCP session

 

The dummy ports (65001 and 18048) are just internal numbers, no real ports will be assigned. The original GRE packet with private source IP (i.e. 10.61.4.209), format as IP/GRE/payload, will be translated to public source IP (1.2.3.4) and sent to destination peer 4.3.2.1.

 

Solution

Since the GRE standard does not have the concept of ports, it causes the technical limitation in CGNAT - NAPT scenario:

For an unique public IP peer addresses, in this case, between 1.2.3.4 and 4.3.2.1, only one GRE session will be created at one time.

Modification History

2023-11-30 : Article Created

Related Information

https://en.wikipedia.org/wiki/Point-to-Point_Tunneling_Protocol