Subject: L2TP Tunnel Authentication with RADIUS

From: [email-masked]
Date: Tue, 22 Aug 2000 06:50:46 -0500

Are there any L2TP implementations that use RADIUS for L2TP tunnel
authentication ?

Looking through the various RADIUS RFCs it looks like RADIUS can be used
for PPP authentication after the tunnel and call are established but I
can't see a way to get a RADIUS Server to send back a MD5 Hash value or a
password to use for a Challenge-Response for tunnel authentication. There
is a Tunnel-Password attribute but it is only sent back in an Access-Accept
packet. From an LNS standpoint it looks to me that I would need a tunnel
password stored locally in order to generate a Challenge-Response which
would defeat the purpose of using RADIUS to consolidate authentication
administration to a single system.

Am I missing something ?

Thanks,

Kurt Streifert
IBM AS/400 Endicott Programming Lab

---

From: "Glen Zorn" <[email-masked]>
Date: Tue, 22 Aug 2000 08:47:20 -0700

[email-masked] writes:

> password to use for a Challenge-Response for tunnel authentication.

There isn't any need.  L2TP tunnel authentication works just the same as
CHAP; you can use the same RADIUS attributes and the same method as you
would for PPP.

> There

---

From: Motonori Shindo <[email-masked]>
Date: Wed, 23 Aug 2000 01:38:13 +0900 (JST)

Hi,

AFAIK, Lucent TNT (as a LAC) can make use of RADIUS for tunnel
authentication using Tunnel-Password attribute. I haven't tested
myself the LNS side of Lucent products, but I assume it can. There
seems to be several other vendors that support Tunnel-Password, but be
aware that some of them don't support encrypted Tunnel-Password. Of
course, RADIUS server has to support Tunnel-Password encryption to
make the whole system works. Ascend Free RADIUS and Lucent NavisRADIUS
do support Tunnel-Password encyption.

Regards,

From: [email-masked]
Subject: L2TP Tunnel Authentication with RADIUS
Date: Tue, 22 Aug 2000 06:50:46 -0500

> IBM AS/400 Endicott Programming Lab

=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
 +----+----+     
 |.. .|    |     Motonori Shindo
 |_~__|    |     
 | .. |~~_~|     Sr. Systems Engineer
 | .  |    |     CoSine Communications Inc.
 +----+----+     
 C o S i n e     e-mail:  [email-masked] 
Communications
=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=

---

From: James Carlson <[email-masked]>
Date: Tue, 22 Aug 2000 13:44:16 -0400 (EDT)

[email-masked] writes:
> From an LNS standpoint it looks to me that I would need a tunnel

Nope.  This is the same problem as with RADIUS for regular CHAP --
RADIUS doesn't support the authenticatee (aka "client") role; only
authenticator.

Yes, you need either a locally-stored password, a RADIUS extension, or
a different authentication protocol.

-- 
James Carlson                                  <[email-masked]>
"PPP Design and Debugging" --- http://people.ne.mediaone.net/carlson/ppp