Cisco Pix PPTP VPN Setup

This is a somewhat bare-bones description of how to setup a cisco Pix 515 to serve as a PPTP VPN endpoint for windows XP clients, without using any sort of authentication (RADIUS, etc) server.

PIX Configuration:

These are the barebones commands that need to be entered into the Pix...

:
: This IP Pool, of course, will vary...
:
ip local pool mypool 192.168.200.100-192.168.200.110

:
: Alternatively to the sysopt commands, you can manually construct a list of all the allowed
: ports and protocols via access lists
:
sysopt connection permit-ipsec
sysopt connection permit-pptp

:
: This sets up the VPN itself and credentials for two users... user1 and user2
:
vpdn group mygroup accept dialin pptp
vpdn group mygroup ppp authentication mschap
vpdn group mygroup ppp encryption mppe 128 required
vpdn group mygroup client configuration address local mypool
vpdn group mygroup pptp echo 60
vpdn group mygroup client authentication local
vpdn username user1 password password-for-user-1
vpdn username user2 password password-for-user-2
vpdn enable outside

The rest of the config file - This isn't a drop-in-and-watch-it-work config, its just the one I was using at the time. You will have to adjust the non-vpn-related portions to suit your needs.

Windows Configuration:

Once the pix config is done, here are the steps to connect windows up to it...

Guide to connecting to this PPTP config under Windows XP - (via the wizard)
Guide to fixing the wizard's mess - if you don't want all traffic to route through the new tunnel

Details:

What the pix debugging reports during a successful connection...