Re: Trouble configuring a VPN interface to access a Windows network

[Kevin Gilbert <kmg952 bigpond com>]

On Tue, 17 Mar 2009, Dan Williams opined:
> I assume MPPE was in-use on the PPTP server?  Unless there's some
> mechanism to figure this stuff out during the negotiation process, these
> sorts of things are just something the network admin has to tell the
> users to set, or preload on the users machine :(

Given that the connection can only be established when MPPE is specified, I 
suppose you are correct. I've had a look at the "Properties" dialog for the 
connection of my Windows machine, and under the "Security" tab, selecting the 
"Advanced (custom settings)" option, the following options have been set by 
the wizard:

Data encryption
    Require encryption (disconnect if server declines)
Logon security
    Allow these protocols
        Microsoft CHAP (MS-CHAP)
        Microsoft CHAP Version 2 (MS-CHAP v2)

So I guess that it's all in the "Data encryption" option which defaults to 
"required". More evidence that encryption is not a negotiable option. If it 
was, the encryption level would be set at the server end and we would not have 
this option.

> Thanks for the log, I haven't set up an MPPE system yet.  If you have,
> are there any gotchas I should look out for when I do?

The remote MPPE system is not under my control, it belongs to a client, so I 
cannot help you there. And, given the level of sophistication of that client, 
I doubt that it was a conscience decision to configure encryption. It's 
probably one of those rare Microsoft decisions to have security enabled "out 
of the box". ;)

Cheers,
Kevin