Subject: Compulsory Tunnelling on Cisco/Windows

From: [email-masked]
Date: Mon, 31 Jul 2000 11:08:01 -0500

Greetings,

I would like to know how to set up a Cisco 2620 (IOS 11.3 ) and a Win 2K
box for "static compulsory" tunnelling.  I currently have the capability of
establishing a tunnel between our system (LAC) and each of the above
platforms (LNS), as well as the capability of starting sessions and moving
along the way through session establishment, etc.  However, upon
termination of the last session on the tunnel, the LNS (Win 2K and Cisco)
terminates the tunnel connection.  The next time we attempt to establish a
session, the tunnel does not exist and this leads to some problems within
our software (not that we cannot overcome them, it would just be a little
difficult).  Is it possible to configure either/both of the above boxes
such that the tunnel is not terminated by the LNS upon termination of the
last session and leave the tunnel in existence?  I cannot find these
configuration items.

Thanks,

Kevin

BTW, I am having trouble accessing the Archive List at [email-masked].  The
connection is timing out.

---

From: "Verma, Rohit (US - Chicago)" <[email-masked]>
Date: Mon, 31 Jul 2000 14:51:33 -0500

I just tried www.l2tp.net and it works fine.

Regards

Rohit Verma
Deloitte Consulting
180, N. Stetson Avenue
Chicago, Illinois 60601
Phone: 312-374-2475

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Monday, July 31, 2000 12:08 PM
To: [email-masked]
Subject: Compulsory Tunnelling on Cisco/Windows

Greetings,

Thanks,

Kevin

---

From: "William Dixon" <[email-masked]>
Date: Mon, 31 Jul 2000 13:41:43 -0700

Kevin, if you read the L2TP/IPSec security draft,
draft-ietf-l2tp-security-00.txt, it specifically says that IPSec main
mode state should be deleted when the last tunnel session is terminated.
This is exactly so the LAC and LNS will interoperate.  If your LAC
doesn't clean up MM state and the LNS does when the L2TP tunnel
terminates, then you/LAC will initiate quick modes for the next L2TP
session (?) which the LNS doesn't understand.  Still, you/LAC should be
getting IKE delete payloads for the MM delete from the LNS - though as
we all know, they are not reliable (not ack'ed and using UDP) and could
leave lingering state on the LAC, thus the way the draft reads to be
sure both do the same thing.  

For Win2k, it is possible to configure it so IPSec and L2TP are
independent, by not using the default integration between L2TP and
IPSec.  There is a KB article on support.microsoft.com to explain how to
use a pre-shared key in IKE for IPSec under L2TP - it describes the
registry key (rasman\"DisableIpsec=1" I think) to disable automatic
IPSec policy, so you can set any manual IPSec policy settings.  Thus
L2TP will not call to IPSec to delete the IKE state when the tunnel
terminates.  IKE MM & QM state will be independently maintained.
Microsoft does not support the use of manual IPSec policy (incl.
preshared key IKE auth) on the client, but will support it's use on the
server, primarily for gateway-to-gateway tunnel configurations (or yours
since the LAC is a form of gateway) and because the server admin is more
sophisticated and can handle manual IPSec policy config UI. Preshared
key hashes are more vulnerable to attack, so I hope you are using certs
anyway for IKE auth.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Monday, July 31, 2000 9:08 AM
To: [email-masked]
Subject: Compulsory Tunnelling on Cisco/Windows

Greetings,

I would like to know how to set up a Cisco 2620 (IOS 11.3 ) and a Win 2K
box for "static compulsory" tunnelling.  I currently have the capability
of
establishing a tunnel between our system (LAC) and each of the above
platforms (LNS), as well as the capability of starting sessions and
moving
along the way through session establishment, etc.  However, upon
termination of the last session on the tunnel, the LNS (Win 2K and
Cisco)
terminates the tunnel connection.  The next time we attempt to establish
a
session, the tunnel does not exist and this leads to some problems
within
our software (not that we cannot overcome them, it would just be a
little
difficult).  Is it possible to configure either/both of the above boxes
such that the tunnel is not terminated by the LNS upon termination of
the
last session and leave the tunnel in existence?  I cannot find these
configuration items.

Thanks,

Kevin

BTW, I am having trouble accessing the Archive List at [email-masked].
The
connection is timing out.