Subject: L2TP and IPSec

From: Seshu <[email-masked]>
Date: Wed, 26 Jul 2000 09:39:04 -0400

I have a couple of questions which I could not find answers to searching
several documents.

1) There appears to be a conclusion that L2TP by itself will not
safegaurd against the spoofing, session hijacking and replay attacks.
Thus to provide protection against these, L2TP is deployed in
combination with IPSec. If this is true, Could some one explain in
detail how and why ?

2) L2TP supports other datagrams like IPX etc in addition to IP
datagrams and this, I believe,  is the reason for using L2TP rather than
IPSec alone where the datagrams are IPX. When the case is  IP datagrams
only, there is no compulsion to use L2TP. Is it true?  Are there any
scenarios that mandate the use of L2TP for IP datagrams case ?

Please excuse me if this is not the forum for these questions.

Seshu

---

From: James Carlson <[email-masked]>
Date: Wed, 26 Jul 2000 10:28:16 -0400 (EDT)

> safegaurd against the spoofing, session hijacking and replay attacks.

Yep.  L2TP does have a few simple security mechanisms, but it's not
complete.

> combination with IPSec. If this is true, Could some one explain in

You mean besides RFC 2661 section 9.4 and the L2TP/IPSec draft
(draft-ietf-l2tpext-security-00.txt)?

> IPSec alone where the datagrams are IPX.

L2TP neither knows nor cares about IPX datagrams.  PPP runs over L2TP,
and PPP can support IPX (among many other network layer protocols).

> When the case is  IP datagrams
> only, there is no compulsion to use L2TP. Is it true?

Not exactly.  Needing to tunnel IPX does not compel you to use L2TP,
and needing to tunnel only IP doesn't free you from having to use it.

There are many other tunneling protocols besides L2TP.  You could run
IPSec ESP to get secured tunnels.  You can use IP-IP and IP-GRE
tunneling as well.  MPLS can also be used for tunneling.  There are
also the proprietary forerunners to L2TP -- PPTP and L2F.

If you use IP-GRE, you can run IPX over GRE and skip L2TP completely.

>  Are there any

Not as such.  If the peers you're communicating use only LT2P, then
I'd suppose that L2TP is mandated.  Otherwise, it's not.

-- 
James Carlson, Internet Engineering       <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677
"PPP Design and Debugging" --- http://people.ne.mediaone.net/carlson/ppp