Native VPN Protocols in Windows Mobile 6.5

Windows Mobile 6.5, Microsoft's legacy operating system for smartphones and PDAs, included built-in networking tools that allowed mobile workers to connect directly to corporate networks. Out of the box, the platform natively supported two primary Virtual Private Network (VPN) tunneling protocols: Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol over Internet Protocol Security (L2TP/IPsec). This article details these native protocols, their configuration options, and the security standards available on the platform without third-party software.

Point-to-Point Tunneling Protocol (PPTP)

PPTP was the default and most commonly used protocol in Windows Mobile 6.5 due to its simplicity and low overhead. It operated using standard Point-to-Point Protocol (PPP) mechanisms encapsulated within Generic Routing Encapsulation (GRE) packets.

  • Encryption: Data encryption was handled via Microsoft Point-to-Point Encryption (MPPE), supporting 40-bit, 56-bit, or 128-bit encryption keys.
  • Authentication: PPTP connections natively supported Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), Microsoft CHAP (MS-CHAP), and MS-CHAP v2. It also supported Extensible Authentication Protocol (EAP), including EAP-TLS and PEAP.

Layer 2 Tunneling Protocol over IPsec (L2TP/IPsec)

For environments requiring stronger security than PPTP could provide, Windows Mobile 6.5 included native support for L2TP encapsulated inside an IPsec tunnel. This configuration provided data confidentiality, data integrity, and replay protection.

  • Authentication Types: The native L2TP/IPsec client supported two mutual authentication mechanisms:
    • Pre-Shared Keys (PSK): Administrators or users could enter a static secret passphrase directly into the VPN configuration screen.
    • Digital Certificates: Devices could authenticate using X.509 user and machine certificates installed in the Windows Mobile local certificate store.
  • Encryption: The underlying IPsec layer typically negotiated Data Encryption Standard (DES) or Triple DES (3DES) encryption, along with SHA-1 or MD5 hashing algorithms for packet integrity.

Unsupported Protocols Out of the Box

Windows Mobile 6.5 did not feature native support for newer or open-source protocols:

  • SSTP (Secure Socket Tunneling Protocol): Although Microsoft introduced SSTP in Windows Vista and Windows Server 2008 to bypass firewalls over TCP port 443, it was not ported to the native client in Windows Mobile 6.5.
  • OpenVPN: OpenVPN was not built into the system; running it required third-party software installations.
  • IKEv2: The native IPsec implementation did not include support for Internet Key Exchange version 2 (IKEv2) mobility standards, which became standard in later operating systems.