Remote VPN using PPTP/VPDN

The Point to Point Tunneling Protocol (PPTP) is a network protocol used to create VPN tunnels between public networks. These VPN tunnels are encrypted from one end to the other and allow the secure transfer of data between them. PPTP is usually implemented between a server and a client, the server belonging to the enterprise network and the client being a remote workstation.

While PPTP's encryption algorithms do offer a certain level of security and privacy, they aren't the best encryption technologies available today. PPTP does have its weaknesses and therefore is not used for long term transactions. PPTP uses the Password Authentication Protocol and the Challenge Handshake Authentication Protocol encryption algorithms. It can offer encryption options of 40, 56 and 128 bit, depending on your needs.

Cisco routers can be set up to act as PPTP servers, alternatively known as Virtual Private Dialup Network (VPDN) servers. PPTP VPN is widely supported by all current windows platforms without the need to install a VPN client or any application.

For a router to be setup as a VPN Server/ VPDN server, the router must have a DES or 3DES IOS versions (IOS release 12.1(5)T and later versions). These are the versions that offer encryption, including the PPTP encryption we are using in these configurations. The DES or 3DES versions will have a k8 or k9 in the filename of the IOS (this can be verified on the IOS using show version command). These features must be licensed from Cisco and are not free, unless you already own that version of the IOS.

First you must make some changes on your router. First, you must enable VPDN (virtual private dial-up networking). This is used for VPN client connectivity, as opposed to site-to-site, always up, VPN connectivity. To do so use this command:

Router(config)# vpdn enable

Create a VPDN group configured to PPTP, just like the Microsoft VPN client will use, by default:

Router(config)# vpdn-group WORK-VPN

Router(config-vpdn)# accept-dialin

Router(config-vpdn)# protocol pptp

Router(config-vpdn)# virtual-template 1

Router(config-vpdn)# exit

Next, create your virtual-template that will apply to the inbound VPN connections. This template references the vlan 1 interface for its IP address. It also references a pool of IP addresses that will be handed out to VPN clients. Finally, it configures the PPP encryption and authentication mechanisms to match what the Microsoft VPN client defaults to:

Router(config)# interface Virtual-Template1

Router(config-if)# ip unnumbered vlan 1

Router(config-if)# peer default ip address pool defaultpool

Router(config-if)# ppp encrypt mppe auto required

Router(config-if)# ppp authentication ms-chap ms-chap-v2

The 'ppp encrypt' command specifies the encryption to be used. This can be set to 'auto' for maximum compatibility or can be define as using a specific value you want e.g 128 bit. The authentication is set to ms-chap and ms-chap v2 so that we can offer the best possible authentication method for this case.

Now, create the pool of IP addresses. This pool should not already be in use on the internal network you are connecting to:

Router(config)# ip local pool defaultpool 192.168.1.50 192.168.1.70

After that, create a test user:

Router(config)# username test password 0 test

Router(config)# username jane password jane123

Finally, configure authentication for PPP to use the local database. If you had a RADIUS server, this where you would point to the RADIUS server instead of the local database:

Router(config)# aaa new-model

Router(config)# aaa authentication ppp default local

CONFIGURE WINDOWS CLIENT MACHINE

Go to control Panel - Network and Internet - Network and Sharing Center,  while there, click on " Set up a new connection or network" as shown below;

On the new Window, select as indicated and then click on next

Select on " create a new connection" and click next.

Click on below as indicated;

Input the details as requested below, internet address being the internet IP  of VPDN server and destination name being the name of the connection configured on your VPDN server. for our case, this was WORK-VPN. Click on next.

Input the username and password as was configured on the VPDN Server local database. Click connect for the VPN connection process to begin.

                                    END