VPN over NetScreen 5GT

Archived from groups: comp.security.firewalls (More info?)

Hi,

We recently updated our NetScreen 5GT firewalls from 5.0.0r6 to
5.2.0r2. Now we discovered that one of our customers can't connect
anymore to a VPN server inside our network (Windows 2003). According to
http://5xt.support.netscreen.safeh [...] s10552.htm
the behaviour in the way PPTP traffic gets passed has changed, but I
don't really understand that document. Here's our network layout:

Internet
|
|
Firewall 1
|
|
Firewall 2
|
|
W2003 Server


Both firewalls are NetScreen 5GTs with 5.2.0r2. The first is in bridge
(transparent) mode, and the 2nd does NAT using MIPs. Both have policies
configured to allow TCP port 1723 (PPTP) and IP 47 (GRE).

Anybody got a tip?


greetings and sorry for the horrible english,
markus