PPTP and L2TP Port Forwarding

Posted by on Sep 21, 2011 in Aerovision IT News | 0 comments

PPTP and L2TP Port Forwarding

PPTP and L2TP Port Forwarding | VPN

A recent VPN project for two customers required configuration of Port Address Translation through a NAT Device (one Cisco ASA and one Sonicwall) onto Remote Access Servers.

We decided to post some information regarding port forwarding of PPTP and L2TP Ports, specifically when the RAS is behind a NAT Device, so here goes:


PPTP tunnel maintenance – TCP 1723
GRE – Protocol ID 47

L2TP over IPSec

L2TP traffic – UDP 1701
Internet Key Exchange (IKE) – UDP 500
IPSec Network Address Translation (NAT-T) – UDP 4500

The port forwarding setup is quite straightforward, as long as you know how to configure your NAT Device.  However one thing to consider is a small detail whereby Windows Vista, Windows 7 and the Windows Server 2008 operating system do not support NAT-T security associations to servers that are located behind a NAT Device by default (it’s not recommended).  A small registry fix has to be applied, you can find further information about this, plus the necessary steps on the Microsoft Support Site:

How to configure L2TP/IPsec in Windows Vista, Windows 7 and Windows Server 2008