L2TP/IPsec VPN clients unable to authenticate after 10.7.3 update

If you’re finding users are unable to dial-in via L2TP/IPsec VPN after upgrading Lion Server to 10.7.3 then check /var/log/ppp/vpnd.log
If you’re seeing DSAuth plugin: Failed to retrieve MPPE encryption keys from the password server: errno -14484, ctxt 4 logged on dial-in attempts then you’ll need to adjust your password policy.
There is an Apple support article HT4748 which covers how to make this change.
Thanks to the user bobgeo on the Apple discussion forums for the pointer.