Windows Mobile 6.5 L2TP and PPTP VPN Settings

Windows Mobile 6.5 included native support for Virtual Private Network (VPN) connections, allowing enterprise users and mobile workers to connect securely to corporate networks using Point-to-Point Tunneling Protocol (PPTP) or Layer 2 Tunneling Protocol over IPsec (L2TP/IPsec). This guide details the specific native configuration options, authentication parameters, and network settings accessible within the operating system's connection manager.

Accessing Native VPN Settings

To set up a VPN connection in Windows Mobile 6.5, navigate to: Start > Settings > Connections tab > Connections icon > Tasks tab > Add a new VPN server connection.

General Connection Settings

Before selecting the protocol, the following initial settings are required for both PPTP and L2TP configurations:

  • Connection Name: A user-defined label to identify the VPN connection.
  • Host Name/IP: The fully qualified domain name (FQDN) or public IP address of the target VPN server.
  • VPN Type: A drop-down menu specifying the tunnel protocol:
    • PPTP
    • L2TP/IPsec

PPTP Configuration Settings

When PPTP is selected, Windows Mobile 6.5 provides the following native fields and security controls:

  • User Credentials:
    • User Name: The network or Active Directory account username.
    • Password: The account password.
    • Domain: The Windows NT or Active Directory domain (optional depending on network setup).
    • Save Password: Checkbox to cache authentication credentials for automatic connection attempts.
  • Security & Authentication (Advanced):
    • Data Encryption: Enforces 40-bit or 128-bit Microsoft Point-to-Point Encryption (MPPE).
    • Authentication Protocols: Natively supports MS-CHAP and MS-CHAPv2 (Microsoft Challenge Handshake Authentication Protocol).

L2TP/IPsec Configuration Settings

When L2TP/IPsec is selected, the device uses IPsec for tunnel encryption in addition to L2TP for data encapsulation. The native settings include:

  • User Authentication:
    • User Name, Password, and Domain: Standard identity parameters used for PPP-level authentication (MS-CHAPv2).
  • IPsec Authentication Method:
    • A Pre-Shared Key: Allows manual entry of a static, shared alphanumeric secret key used to establish the initial IPsec Security Association (SA).
    • A Certificate: Requires a valid machine/device certificate installed in the Windows Mobile Certificate Store (accessible via Settings > Security > Certificates). The client checks the Personal certificate store for a matching certificate issued by a trusted root Certificate Authority (CA).

Advanced Network & TCP/IP Settings

For both PPTP and L2TP/IPsec tunnels, tapping the Advanced button provides access to low-level network interface parameters:

  • TCP/IP Settings:
    • Server-assigned IP address: Automatically pulls an internal IP address via DHCP over the tunnel (default).
    • Specific IP address: Allows manual assignment of an IPv4 address, Subnet Mask, and Default Gateway.
  • Name Servers (DNS and WINS):
    • Server-assigned addresses: Automatically obtains internal DNS and WINS servers.
    • Specific addresses: Manually configure primary and secondary internal DNS servers, as well as primary and secondary WINS servers for NetBIOS resolution.
  • Software Compression: Option to enable or disable software-level data compression over the PPP link.