Subject: Win2000 Netmon - L2TP protocol parser?

From: Ari Huttunen <[email-masked]>
Date: Thu, 20 Jan 2000 12:11:15 +0200

The Network Monitor documentation that comes with Windows 2000 Server
(released to manufacturing version) states that it understands
the L2TP protocol. Alas, l2tp.dll is nowhere to be found.

Would anyone have a clue if that functionality should be
available or not? I know this is not a Windows 2000 support
mailing list, but that monitor is actually pretty good otherwise!

-- 
Ari Huttunen                   phone: +358 9 859 900
Senior Software Engineer       fax  : +358 9 8599 0452

F-Secure Corporation       http://www.F-Secure.com 

F-Secure products: Integrated Solutions for Enterprise Security

---

From: John Thomes <[email-masked]>
Date: Thu, 20 Jan 2000 10:06:54 -0800

If you don't mind using Linux or Sun, there is a free network
protocol analyzer that supports L2TP @ http://ethereal.zing.org/.

	- John Thomes

> -----Original Message-----
> From:	Ari Huttunen [SMTP:[email-masked]]
> Sent:	Thursday, January 20, 2000 2:11 AM
> To:	l2tp
> Subject:	Win2000 Netmon - L2TP protocol parser?
>

---

From: William Dixon <[email-masked]>
Date: Thu, 20 Jan 2000 12:14:35 -0800

I'll check on what Netmon can parse in Windows 2000.  Normally L2TP is IPSec
encrypted, so...  However, in Win2k if you set the L2TP tunnel encryption
type to "no encryption", it gets interpreted as a multiple suite proposal
from the client for 
 
1. ESP null encryption, with integrity & authentication
2. AH
 
LNS server side can then choose what it wants.
 
Netmon does parse AH into upper layer protocols, but it doesn't parse ESP
past a few fields in the ESP header.
 
By default, Win2k's L2TP uses predefined IPSec policy to do certificate
auth.  If you have implemented a client of Cisco's CEP, the Microsoft's CA
will support Cisco's Simple Certificate Enrollment protocol, available as an
update pack to the Windows 2000 Server. More info available at:
http://sectestca3.rte.microsoft.com/certsrv/mscep/mscep.dll
<http://sectestca3.rte.microsoft.com/certsrv/mscep/mscep.dll>   We didn't
implement a client for that ourselves.  We will be working on client and
server sides of CMC for the future.
 
The Win2k Resource Kit has this text for testing non-IPSec L2TP, clear text
or custom IPSec policy for L2TP:
 
To prevent the Routing and Remote Access service from automatically creating
an IPSec policy for L2TP traffic, set the value of ProhibitIpSec to 1
(HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan \Parameters).
By default, ProhibitIpSec is set to 0. When ProhibitIpSec is set to 1, the
encryption settings on the demand-dial interface configured on the calling
router are ignored in favor of the encryption settings of the manually
configured IPSec policy. The computer must be restarted for the changes to
this registry setting to take effect
 
If you do a custom policy on the Win2k server side, for the server to
properly accept L2TP tunnels, the IKE proposal needs to be what we use:
From source port 1701, dest port Any.
 
Wm

-----Original Message-----
From: John Thomes [mailto:[email-masked]]
Sent: Thursday, January 20, 2000 10:07 AM
To: l2tp
Subject: RE: Win2000 Netmon - L2TP protocol parser?

	If you don't mind using Linux or Sun, there is a free network
protocol analyzer that supports L2TP @ http://ethereal.zing.org/
<http://ethereal.zing.org/> .

	- John Thomes 

	-----Original Message----- 
From:   Ari Huttunen [SMTP:[email-masked]] 
Sent:   Thursday, January 20, 2000 2:11 AM 
To:     l2tp 
Subject:        Win2000 Netmon - L2TP protocol parser? 

	The Network Monitor documentation that comes with Windows 2000
Server 
(released to manufacturing version) states that it understands 
the L2TP protocol. Alas, l2tp.dll is nowhere to be found. 

	F-Secure Corporation       http://www.F-Secure.com
<http://www.F-Secure.com>