Hi out there,
Im trying to (re)build our VPN-gateway for Roadwarriors. First
everything seemed to be fine: win2k and WinXP clients from outside
could connect as usual.
But then the first windows mobile 5 device came knocking on gateways
door and doesnt come in.

conditions are as follows:
gentoo, kernel 2.6.16 with pptpd 1.2.3, pppd 2.4.2

/var/log/messages says:

Feb 3 13:30:02 vger pppd[15639]: pppd options in effect:
Feb 3 13:30:02 vger pppd[15639]: debug # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: nologfd # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: dump # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: require-mschap-v2 # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: refuse-pap # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: refuse-chap # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: refuse-mschap # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: refuse-eap # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: name vger # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: 115200 # (from command
line)
Feb 3 13:30:02 vger pppd[15639]: lock # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: local # (from command line)
Feb 3 13:30:02 vger pppd[15639]: mru 1500 # (from
/etc/ppp/options)
Feb 3 13:30:02 vger pppd[15639]: mtu 1500 # (from
/etc/ppp/options)
Feb 3 13:30:02 vger pppd[15639]: -vj # (from
/etc/ppp/options)
Feb 3 13:30:02 vger pppd[15639]: ipparam 80.226.250.97 # (from
command line)
Feb 3 13:30:02 vger pppd[15639]: ms-dns xxx # [don't know how to print
value] # (from /etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: ms-wins xxx # [don't know how to
print value] # (from /etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: 192.168.1.3:192.168.1.71
# (from command line)
Feb 3 13:30:02 vger pppd[15639]: nobsdcomp # (from
/etc/ppp/options)
Feb 3 13:30:02 vger pppd[15639]: nodeflate # (from
/etc/ppp/options)
Feb 3 13:30:02 vger pppd[15639]: require-mppe-128 # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: mppe-stateful # (from
/etc/ppp/options.pptpd)
Feb 3 13:30:02 vger pppd[15639]: pppd 2.4.2 started by root, uid 0

*(after this MS-Chap v2 authentication works fine - acces granted!)

*But NOW:

Feb 3 13:30:07 vger pppd[15639]: sent [CCP ConfReq id=0x1 +S -L -D -C>]

*The server tells the client +H (stateless) and +S (128bit mppe) -
thats right

Feb 3 13:30:07 vger pppd[15639]: rcvd [IPCP ConfReq id=0x0 0.0.0.0> 0.0.0.0>]

*Client "asks" for proper DNS & IP, OK

Feb 3 13:30:07 vger pppd[15639]: sent [IPCP TermAck id=0x0]
Feb 3 13:30:07 vger pppd[15639]: rcvd [IPV6CP ConfReq id=0x0 fe80::0209:2dff:fe7a:5463>]
Feb 3 13:30:07 vger pppd[15639]: Unsupported protocol 0x8057 received
Feb 3 13:30:07 vger pppd[15639]: sent [LCP ProtRej id=0x2 80 57 01 00
00 0e 01 0a 02 09 2d ff fe 7a 54 63]
************************************************** ************************************
*Feb 3 13:30:07 vger pppd[15639]: rcvd [CCP ConfReq id=0x0 -S -L -D -C>]*
************************************************** ************************************

*THAT is the problem: The Client tells his capabilities wrong an the
server rejects it now:

Feb 3 13:30:07 vger pppd[15639]: MPPE required but peer negotiation
failed
Feb 3 13:30:07 vger pppd[15639]: sent [LCP TermReq id=0x3 "MPPE
required but peer negotiation failed"]
Feb 3 13:30:07 vger pppd[15639]: sent [CCP ConfRej id=0x0 -S -L -D -C>]

*it does not negotiate with the client and so the nex LCP-answer: +S
128mppe-able is discarded:

Feb 3 13:30:07 vger pppd[15639]: rcvd [CCP ConfNak id=0x1 +S -L -D -C>]
Feb 3 13:30:07 vger pppd[15639]: Discarded non-LCP packet when LCP not
open

*thats it, connection closed.
*****

Coming from a WindowsXp-machine the things are working and differ:

Feb 3 15:37:18 vger pppd[15797]: sent [CHAP Success id=0xf8
"S=7F90195A610EE1044B0DECF838B2E90A9DAE6013 M=Access granted"]

* Authentication OK, and now the server tells the client first its
capabilities:

Feb 3 15:37:18 vger pppd[15797]: sent [CCP ConfReq id=0x1 +S -L -D -C>]
Feb 3 15:37:18 vger pppd[15797]: rcvd [CCP ConfReq id=0x4 +S +L -D +C>]
Feb 3 15:37:18 vger pppd[15797]: sent [CCP ConfNak id=0x4 +S -L -D -C>]
Feb 3 15:37:18 vger pppd[15797]: rcvd [IPCP ConfReq id=0x5 0.0.0.0> 0.0.0.0>]
Feb 3 15:37:18 vger pppd[15797]: sent [IPCP TermAck id=0x5]
Feb 3 15:37:18 vger pppd[15797]: rcvd [CCP ConfAck id=0x1 +S -L -D -C>]
Feb 3 15:37:18 vger pppd[15797]: rcvd [CCP ConfReq id=0x6 +S -L -D -C>]
Feb 3 15:37:18 vger pppd[15797]: sent [CCP ConfAck id=0x6 +S -L -D -C>]

*and they do negotiated as long as it becomes suiteable.

Feb 3 15:37:18 vger pppd[15797]: MPPE 128-bit stateless compression
enabled
Feb 3 15:37:18 vger pppd[15797]: sent [IPCP ConfReq id=0x1 192.168.1.2>]
Feb 3 15:37:18 vger pppd[15797]: rcvd [IPCP ConfAck id=0x1 192.168.1.2>]
Feb 3 15:37:19 vger pppd[15797]: rcvd [IPCP ConfReq id=0x7 0.0.0.0> 0.0.0.0>]
Feb 3 15:37:19 vger pppd[15797]: sent [IPCP ConfNak id=0x7 192.168.1.70> 192.168.0.33> ]
Feb 3 15:37:19 vger pppd[15797]: rcvd [IPCP ConfReq id=0x8 192.168.1.70> 192.168.0.33> ]
Feb 3 15:37:19 vger pppd[15797]: sent [IPCP ConfAck id=0x8 192.168.1.70> 192.168.0.33> ]
Feb 3 15:37:19 vger pppd[15797]: local IP address 192.168.1.2
Feb 3 15:37:19 vger pppd[15797]: remote IP address 192.168.1.70
Feb 3 15:37:19 vger pppd[15797]: Script /etc/ppp/ip-up started (pid
15802)
Feb 3 15:37:19 vger pppd[15797]: Script /etc/ppp/ip-up finished (pid
15802), status = 0x1

*and the connection is stable.

If I disable "require-mppe-128" the mobile device works fine but
unencrypted.

*before teaching me that there is something wrong in Windows Mobile
PPP-Client (of course it would be helpful to force that client to offer
mppe128 first) I have some remarks:

*- why doesnt the server negotiate?
*- as you can see, the client has the needed capabilities (mppe +H -M
+S -L -D -C), indeed.
*- why does it work with pppd 2.4.1 on gentoo 2.4.21 as shown below
here:

*optins.pptp:
lock
debug
name vyger
proxyarp
bsdcomp 0
+chapms-v2
mppe-128
mppe-stateless

*/var/log/messages on the old and working gateway during handshake with
windows mobile 5:

12:49:56 vyger pppd[9165]: pppd 2.4.1 started by root, uid 0
Feb 3 12:49:56 vyger pppd[9165]: using channel 246
Feb 3 12:49:56 vyger pppd[9165]: Using interface ppp1
Feb 3 12:49:56 vyger pppd[9165]: Connect: ppp1 <--> /dev/pts/1
Feb 3 12:49:56 vyger pppd[9165]: sent [LCP ConfReq id=0x1 0x0> ]
Feb 3 12:49:57 vyger pptpd[9164]: GRE: Discarding duplicate packet
Feb 3 12:49:57 vyger pppd[9165]: rcvd [LCP ConfAck id=0x1 0x0> ]
Feb 3 12:49:59 vyger pppd[9165]: sent [LCP ConfReq id=0x1 0x0> ]
Feb 3 12:50:00 vyger pppd[9165]: rcvd [LCP ConfReq id=0x0
]
Feb 3 12:50:00 vyger pppd[9165]: sent [LCP ConfAck id=0x0
]
Feb 3 12:50:00 vyger pppd[9165]: rcvd [LCP ConfAck id=0x1 0x0> ]
Feb 3 12:50:00 vyger pppd[9165]: cbcp_lowerup
Feb 3 12:50:00 vyger pppd[9165]: want: 2
Feb 3 12:50:00 vyger pppd[9165]: sent [CHAP Challenge id=0x1
<152208217a3b3eb242daa21d249e5394>, name = "vyger"]
Feb 3 12:50:00 vyger pptpd[9164]: CTRL: Received PPTP Control Message
(type: 15)
Feb 3 12:50:00 vyger pptpd[9164]: CTRL: Ignored a SET LINK INFO packet
with real ACCMs!
Feb 3 12:50:01 vyger pppd[9165]: rcvd [CHAP Response id=0x1 ,
name = "name"]
Feb 3 12:50:01 vyger pppd[9165]: sent [CHAP Success id=0x1
"S=ACC359085FFFF1CB03216EECD2993024256185B4"]
Feb 3 12:50:01 vyger pppd[9165]: sent [IPCP ConfReq id=0x1 192.168.1.1> ]
Feb 3 12:50:01 vyger pppd[9165]: sent [CCP ConfReq id=0x1
]
Feb 3 12:50:01 vyger pppd[9165]: MSCHAP-v2 peer authentication
succeeded for name
Feb 3 12:50:02 vyger pppd[9165]: rcvd [IPCP ConfReq id=0x0 0.0.0.0> 0.0.0.0>]
Feb 3 12:50:02 vyger pppd[9165]: sent [IPCP ConfNak id=0x0 192.168.1.129> 192.168.0.33> ]
Feb 3 12:50:02 vyger pppd[9165]: rcvd [proto=0x8057] 01 00 00 0e 01 0a
02 09 2d ff fe 7a 54 63
Feb 3 12:50:02 vyger pppd[9165]: Unsupported protocol 0x8057 received
Feb 3 12:50:02 vyger pppd[9165]: sent [LCP ProtRej id=0x2 80 57 01 00
00 0e 01 0a 02 09 2d ff fe 7a 54 63]
Feb 3 12:50:02 vyger pppd[9165]: rcvd [IPCP ConfRej id=0x1 VJ 0f 01>]
Feb 3 12:50:02 vyger pppd[9165]: sent [IPCP ConfReq id=0x2 192.168.1.1>]
Feb 3 12:50:02 vyger pppd[9165]: rcvd [CCP ConfReq id=0x0 0>]
Feb 3 12:50:02 vyger pppd[9165]: sent [CCP ConfRej id=0x0 0>]
Feb 3 12:50:02 vyger pppd[9165]: rcvd [CCP ConfRej id=0x1
]
Feb 3 12:50:02 vyger pppd[9165]: sent [CCP ConfReq id=0x2 40>]
Feb 3 12:50:02 vyger pppd[9165]: rcvd [IPCP ConfReq id=0x1 192.168.1.129> 192.168.0.33> ]
Feb 3 12:50:02 vyger pppd[9165]: sent [IPCP ConfAck id=0x1 192.168.1.129> 192.168.0.33> ]
Feb 3 12:50:02 vyger pppd[9165]: rcvd [IPCP ConfAck id=0x2 192.168.1.1>]
Feb 3 12:50:02 vyger pppd[9165]: Cannot determine ethernet address for
proxy ARP
Feb 3 12:50:02 vyger pppd[9165]: local IP address 192.168.1.1
Feb 3 12:50:02 vyger pppd[9165]: remote IP address 192.168.1.129
Feb 3 12:50:02 vyger pppd[9165]: Script /etc/ppp/ip-up started (pid
9169)
Feb 3 12:50:02 vyger pppd[9165]: rcvd [CCP ConfReq id=0x1]
Feb 3 12:50:02 vyger pppd[9165]: sent [CCP ConfAck id=0x1]
Feb 3 12:50:02 vyger pppd[9165]: Script /etc/ppp/ip-up finished (pid
9169), status = 0x0
Feb 3 12:50:02 vyger pppd[9165]: rcvd [CCP ConfNak id=0x2 40>]
Feb 3 12:50:02 vyger pppd[9165]: sent [CCP ConfReq id=0x3 40>]
Feb 3 12:50:03 vyger pppd[9165]: rcvd [CCP ConfAck id=0x3 40>]
Feb 3 12:50:03 vyger pppd[9165]: MPPE 128 bit, non-stateless receive
compression enabled

*btw: I did not compile pppd with "USE mppe-mppc"

Any idea?

Thanx a lot -
Christian Reichhoff