L2TP: Implementation and Operation

Description

• Copyright 2000
• Dimensions: 5-3/8" x 8-1/4"
• Pages: 304
• Edition: 1st

• Book
• ISBN-10: 0-201-60448-5
• ISBN-13: 978-0-201-60448-1

Layer 2 Tunneling Protocol (L2TP) has emerged as a key technology in the construction of Virtual Private Networks. L2TP provides remote access capabilities to organizations using public networks for internal, private activities. It allows a corporation to retain the advantages of a private network--privacy of communication, access control, and company addressing--while reducing the need to invest heavily in networking infrastructure.

L2TP: Implementation and Operation is an essential resource for anyone who works with L2TP and Virtual Private Networks. Written for developers and network managers, the book provides an overview of the protocol, a detailed explanation of L2TP architecture, a step-by-step guide to its implementation, and information on L2TP security and management.

You will find useful background on the OSI model, the underlying PPP technology, how L2TP tunnels PPP, and the L2TP LAC and LNS Layer 2 roles. In addition, the book contains detailed information on such topics as:

• L2TP deployment models
• L2TP tunnel structure, terminology, and function
• Protocol state machines
• Tunnel authentication and initiation
• Header and control message format, including AVP
• Control channel dynamics
• Session setup
• Proxy authentication
• Data handling, including Multilink PPP
• L2TP security
• SNMP management of L2TP networks
• Comparisons with L2F, PPTP, and other VPN technologies

Throughout, the book highlights implementation tips, drawn from the author's extensive practical experience, that will help you avoid potential problems and maximize the benefits of L2TP.

0201604485B04062001



Sample Content

Table of Contents

Preface.


1. Background.

Remote Access.

Telecommuters—Small Office/Home Office.

Remote Office/Branch Office.

Partner.

Virtual Private Networks.

Open System Interconnect Model.

Point-to-Point Protocol.

Sublayers.

The Layer 2 Role of PPP.

The Layer 3 Role of PPP.

Physical Layer Assumptions.

Control Protocol Operation.

Chronological Operation of PPP.

Summary.

2. L2TP Basics.

Layer 2 Role of LAC.

Layer 2 Role of LNS.

Virtual Layer 1.

History.

L2TP Patent Issues.

3. L2TP Deployment Models.

VPN Deployment Models.

LAC Deployment, Distribution, and Support.

LNS Deployment, Distribution, and Support.

LNS “in the Cloud.”

Compulsory versus Voluntary Tunneling.

VPN Performance Considerations.

Multibox Multilink PPP.

Compulsory Tunneling Solution.

NAS Pool Solution.

Combined VPN Service and LNS Pool Solution.

Performance Implications.

Comparing L2TP to L2F and PPTP.

Asymmetric Digital Subscriber Line Forum Model.

Other VPN Technologies.

IP Security Protocol.

Generic Routing Encapsulation.

Mobile IP Protocol.

Multiprotocol Label Switching Protocol.

Secure Shell Protocol.

4. L2TP Protocol Overview.

Tunnel Structure and Terminology.

Protocol State Machines.

The Typical Life of a Tunnel.

Protocol Assumptions.

Non-IP Operation.

Separate LAC and Remote System.

Passive LAC Participation.

Protocol Difficulties.

Multilink PPP.

Link Awareness in LNS.

A Look Ahead.

5. Control Connection State Machine.

State Machine.

IDLE State.

Send SCCRQ Actions.

WAIT-CTL-REPLY State.

Send SCCN Actions.

Notify Sessions Actions.

ESTABLISHEDState.

Send SCCRP Actions.

WAIT-CTL-CONN State.

Send HELLO Actions.

Send StopCNN Actions.

CLEANUP-WAIT State.

Cleanup Actions.

Tunnel Authentication.

Initiating a Tunnel.

Tunnel Initiation Tie Breaker.

Comparing L2TP to L2F and PPTP.

Implementation Tips.

Handling Duplicate Received SCCRQ Messages.

Considering Timeout Conditions.

6. Data and Control Messages.

Headers.

T Bit.

L Bit.

F Bit.

S Bit.

Control Bit Handling and Reserved Bits.

Version.

Length.

Tunnel ID.

Call ID.

Ns.

Nr.

Offset Size.

Offset Pad.

Control Message Format.

Attribute Value Pairs.

M Bit.

H Bit.

Control Bit Handling and Reserved Bits.

Overall Length.

Vendor ID.

Attribute.

Value.

Hiding and Unhiding Algorithms.

AVP Hiding Algorithm.

AVP Unhiding Algorithm.

AVP Unhiding Algorithm with No Separate Storage Area.

Restrictions on Hiding AVPs.

Comparing L2TP to L2F and PPTP.

Implementation Tips.

Meaning of AVP Mandatory Bit.

The Order of AVPs.

SCCRQ, SCCRP, and SCCCN AVPs Can Be Hidden.

Odd AVP Conditions.

7. Control Channel Dynamics.

An Overview of the Control Channel.

Sequence Number Handling.

The Reliable Delivery Sender.

The Sender Window.

Sender Actions.

The IDLE State.

Send Msg, Set Timer Actions.

The Operating State.

Send Msg Actions.

The MaxReTx? Predicate.

Retransmit, Set New Timeout Actions.

Notify State Machine Actions.

The Done State.

Stop Timer, Free Msg Actions.

The Window Empty? Predicate.

The New Lead Ack’d Predicate.

Free Msg Actions.

Restart Timer Actions.

The Reliable Delivery Receiver.

The RecvMsg Event.

The ZLB? Predicate.

The In Window? Predicate.

ACK Event for Sender Actions.

The Duplicate? Predicate.

The Ns == Sr? Predicate.

Insert in RecvQueue Actions.

Send Msg up to SM, Sr++ Actions.

The Q Empty? Predicate.

The Q Head Ns == Sr? Predicate.

Dequeue Head Msg Actions.

The Before Window? Predicate.

Drop Msg Actions.

Note Ack Needed Actions.

The Message Delivery Process: An Example.

T = 0, LocalMsg for Peer A.

T = 1.0, Peer A Retransmits.

T = 1.1, Peer B Receives Message with Ns = 58, Nr = 37.

T = 1.5, LocalMsg for Peer B.

T = 1.6, Peer A Receives Message, Ns = 37, Nr = 59.

T = 2.1, Peer A Sends ZLB, Ns = 59, Nr = 38.

T = 2.2, Peer B Receives ZLB, Ns = 59, Nr = 38.

Packet Trace Summary.

Comparing L2TP to TCP.

Three-way Handshake Initiation.

Initial Sequence Numbers.

The Meaning of Sequence Numbers.

Sliding Window.

Comparing L2TP to L2F and PPTP.

Implementation Tip: Checking Sequence Number Ordering.

8. Session Setup.

Incoming Calls.

Incoming Call LAC State Machine.

Incoming Call LNS State Machine.

Outgoing Calls.

Outgoing Call LNS State Machine.

Outgoing Call LAC State Machine.

LCP Considerations.

LAC Frame Inspection and Negotiation/Translation.

Proxy LCP.

Proxy Authentication.

Comparing L2TP to L2F and PPTP.

ImplementationTips.

Including Last-Sent LCP CONFREQ AVPs.

Proxy CHAP Not Secure to LNS.

Tunnel Teardown.

LCP Issues.

9. Data Handling.

PPP Frame Handling.

Synchronous versus Asynchronous Framing.

LNS Frame Handling.

LAC Frame Handling for HDLC.

LAC Frame Handling for non-HDLC.

Tunnel Substrate Considerations.

Packet Delay.

Fragmentation.

Silent Packet Loss.

Reordering and Duplication.

Multilink PPP.

Coincidental MP Tunneling.

Multibox Multilink.

Performance.

Round-Trip Time.

Packet Loss and PPP Protocols with History.

Packet Loss and Packet Reordering Trade-off.

The Trade-Offs in Performance.

Comparing L2TP to L2F and PPTP.

Implementation Tips.

VJ Compression and Silent Packet Loss Is Bad.

Endpoint Discriminator with Coincidentally Tunneled MP.

Backward Compatibility with Draft 12 Data Flow Control.

10. Security.

Control Channel Security.

PPP Security.

Authentication.

Encryption.

L2TP Security Summary.

Weak Connection Authentication.

Limited Encryption Scope.

Poor Encryption Key Management.

No Message Authentication.

No Message Integrity.

No Replay Protection.

Transport Mode IPSEC.

Security Associations.

Connection Authentication.

Encryption.

Authentication/Integrity.

Replay Protection.

L2TP-Specific IPSEC Issues.

L2TP Components and Security Overview.

The LAC/LNS Trust Relationship.

Comparing L2TP to L2F and PPTP.

Implementation Tips.

Avoid or Adjust for PAP.

Trusting Proxy CHAP Challenges.

Randomness.

Keep “Backdoor” Holes in Mind.

Further Reading on IPSEC.

11. SNMP Management.

Interface Layering.

Management Information Base.

l2tpTunnelConfigTable.

l2tpDomainConfigTable.

l2tpDomainStatsTable.

l2tpTunnelStatsTable.

l2tpSessionStatsTable.

Mapping Tables.

12. Future Direction and Resources.

Protocol Summary.

Future Direction.

Resources.

Internet Engineering Task Force.

PPP.

IPSEC.

Bakeoffs.

Appendix: Draft 12 Data Flow Control.

Summary of Implementations.

Receive Window Size AVP in Call Establishment.

R Bit in Data Message Header.

Adaptive Timeouts and Piggybacking.

Draft 12 Specifications.

Glossary.


Bibliography.


Index. 0201604485T04062001

Preface

Remote access has become more and more popular as organizations rely increasingly on their data networks. The increasing popularity of telecommuting and the numbers of individuals who are mobile are two strong factors in this trend.

In order for organizations to provide traditional remote access, they must research and plan their use and make sizeable capital investments in infrastructure. To begin with, an organization needs to predetermine call capacity because the number of calls that can be simultaneously terminated is a factor in deciding what level of remote access device and how many T1 lines are purchased. The organization's call capacity must be increased to allow for the remote access connections to be made. Remote access connections are generally made via dedicated T1 lines (or T3 lines for very large organizations) connected to the remote access equipment. Next there is the purchase of the remote access equipment consisting of a device that terminates T1 or T3 lines on one side and has a connection to the organization's private network (typically Ethernet) on the other side.

Traditional remote access is inflexible, inefficient, and inadequate for accommodating evolving broadband technologies. These technologies provide dedicated access to an Internet Service Provider (ISP), forcing the remote user to tie up his or her traditional phone line to access the private network of an organization. When the legacy phone network is used for remote access, the costs incurred per connection are based on the same rules that are used for voice communications. For mobile users, establishing a remote access connection may mean incurring long distance costs. In addition, evolving broadband communication technologies such as cable modem and Asymmetric Digital Subscriber Line (ADSL) cannot be supported by traditional remote access. By supporting traditional remote access, organizations also incur the ongoing costs involved in supporting the remote access devices, including the upgrade of these devices as technology changes. One good example of why this is a problem is the recent increase in analog connection speeds to 56K access. When the 56K connection speed was first introduced, there were two methods of signaling. Private organizations and Internet Service Providers (ISPs) could not be sure they were choosing the right signaling versions, and only later did equipment become available that could support both 56K signaling methods.

The Layer 2 Tunneling Protocol, or L2TP, is aimed squarely at lifting the physical connection burden from the organization. The traditional remote access system is split into two halves. One half is responsible for terminating the physical connections, and the other half provides access to the private network. Conceptually, a line is drawn down the middle of a traditional remote access device; half of the device provides physical call connections, and the other half provides access to the private network communicating over L2TP. With L2TP, analog modem, Integrated Services Digital Network (ISDN), and ADSL connections can be physically terminated by an ISP, and the user data can be carried to a device at the edge of an organization's private network. L2TP client software can also be used to make virtual connections all the way from the remote user device (that is, a PC) to the organization's private network in such a way that the remote user's physical connection is completely independent.

Although the outsourced remote access model is the starting point for deploying L2TP, other applications are possible. Essentially any time that running Point-to-Point Protocol (PPP) between two entities over a non-point-to-point connection would be advantageous, L2TP should be used to provide that functionality.

This book provides details of L2TP for the individual who will be implementing L2TP in a data communications device. A history of L2TP is also provided, along with comparisons to the protocol's two predecessors, L2F and PPTP. Implementation tips are provided to cover those areas of use that are not readily understandable solely from reading the L2TP technical specification.

Audience

There are two audiences for this book. The primary audience is those who will be writing L2TP code. The book attempts to provide tips, give history, and logically explain and lay out the architecture for L2TP and the crucial and sometimes subtle interaction between L2TP and the PPP software running over it. The other audience for this book is those considering L2TP for their Virtual Private Network (VPN) deployment. The early chapters on the basics of L2TP and the discussion of security and management will be of particular interest to this reader.

Organization

The first three chapters are geared to a somewhat general audience. L2TP implementers may simply ignore these chapters if they wish to focus only on the details of L2TP implementation. Chapters 4-10 provide the details of L2TP implementation. These chapters may be skimmed by the reader with only a general interest in the details of the protocol itself. Special attention to Chapter 10 ("Security") should be paid even by the general reader. Chapter 11 ("SNMP Management") may also be of some interest to the general reader, and undoubtedly of interest to the L2TP implementer or the implementer of network management applications for L2TP. Chapter 12 provides resources for learning more about L2TP and gives information on what future work in L2TP is currently under consideration.

0201604485P04062001



Updates

Submit Errata

