Subject: Re: [L2tpext] Hidden AVPs and NAT

From: Vipin Jain <[email-masked]>
Date: Tue, 30 Sep 2003 23:45:25 -0700 (PDT)

Avinash,

my comments inline..

>   On other hand if you are not the originator, then
>   implementing NAT for incoming calls from outside is
>   little confusing. NAT, typically makes sense, when
>   connections/sessions (whether TCP, UDP, L2TP, etc.)
>   are initiated from within.
> 
>   Or did I not understand your point?
> 
>   ---Yes, i am always the originator, everything is initiated from inside the
> NAT.
>   But the prob is, the NAT i am talking about does a comparison for the
> entire session information
>   for any incoming packet. So comparison is made at nat for src ip,dstn
> ip,src port and 
>   dstn port. Now the source port of the SCCRP could be different from the
> 1701(since recepient
>   can use any free port as source port while responding to a SCCRQ). This wud
> cause
>   a failure in the NAT lookup. i've deviced a workaround for the same with
> the port table 
>   kindof thing i had sent earlier in the group as the basis...
True; The response to SCCRQ could have a different port (source port) not the
destination port, which would was indicated in SCCRQ. It invites keeping extra
information of mapped ports to be mapped to when doing NAT, i.e. it would have
to be stateful as opposed to stateless NAT. As indicated in section 8.1 the
solution is not very NAT friendly.

>   There's one more scenario where i foresee a problem(when more than one guy
> behind a nat tries to
>   initiate a tunnel).
> 
>                                -----------------------
>   Initiator1----------------|                      |
>                               |         NAT     
> |---------------------Recepient 
>   Initiator2----------------|                      |
>                               -----------------------
> 
>   In above case, when originator 1 and 2 try to set up tunnels with the same
> assigned Tunnel id values
>   one of them would fail. This calls for some kindof tunnel id mapping for
> the above scenario to work.
It depends on how LNS identifies a LAC. It could be one of the following:
- LAC IP address
- LAC IP Address, LAC UDP Port

If LNS chooses to identify LAC by just 'LAC IP address' then what you say would
be true. However, if UDP is the carrier protocol for L2TP, including UDP port
as LAC (or LNS) identifier would not be an incorrect assumption either.

>   This brings back the problem of hidden avps.
>   Is this a real problem or am i inventing it.
In which case you'd have to keep the database of tunnel-secrets
to unfold the parameters and replace the tunnel-ids yourself.

thanks,
-- vipin

> 
>   Thanks.
>   -Avinash
> 
>   -- vipin
> 
>   >     Thanks.
>   > -Avinash
>   > 
>   > 
>   > "Because i live in a large tin can and i work in an egg carton Flirting
> is
>   > the only joy i have:)"
>   >   ----- Original Message ----- 
>   >   From: Vipin Jain 
>   >   To: Avinash Natarajan ; [email-masked] 
>   >   Sent: Monday, September 22, 2003 10:02 PM
>   >   Subject: Re: [L2tpext] Hidden AVPs and NAT
>   > 
>   > 
>   > 
>   >   In L2TPv2:
>   > 
>   >   Instead of mapping tids across NAT, you may want to map
>   >   the udp port. For example, for a given incoming IP address
>   >   choose a source udp port and remap it back for the packets
>   >   coming back from the LNS. You may want to look into section
>   >   8.1, rfc2661 for more details.
>   > 
>   >   That way you would avoid keeping the configuratin of tunnel
>   >   secrets for various LAC-LNS pairs.
>   > 
>   >   -- vipin
>   > 
>   > 
>   >   --- Avinash Natarajan <[email-masked]> wrote:
>   >   > Hi...
>   >   >     i am trying to write a l2tp pass through for NAT. i need to get
> the
>   >   > assigned tid value
>   >   > from the Assigned Tid AVP and create some mappings when necassary. is
>   > there
>   >   > any known
>   >   > way of dealing with it/work around it in cases where this avp is
> hidden?
>   >   >     Thanks.
>   >   > -Avinash
>   >   > 
>   >   > 
>   >   > "Because i live in a large tin can and i work in an egg carton
> Flirting
>   > is
>   >   > the only joy i have:)"
>   >   > 
>   > 
>   > 
>   >   __________________________________
>   >   Do you Yahoo!?
>   >   Yahoo! SiteBuilder - Free, easy-to-use web site design software
>   >   http://sitebuilder.yahoo.com
>   > 
>   > **************************Disclaimer************************************
>   > 
>   > Information contained in this E-MAIL being proprietary to Wipro Limited
> is 
>   > 'privileged' and 'confidential' and intended for use only by the
> individual
>   >  or entity to which it is addressed. You are notified that any use,
> copying 
>   > or dissemination of the information contained in the E-MAIL in any manner
> 
>   > whatsoever is strictly prohibited.
>   > 
>   >
> ***************************************************************************
>   > 
> 
> 
>   __________________________________
>   Do you Yahoo!?
>   The New Yahoo! Shopping - with improved product search
>   http://shopping.yahoo.com
> 
> **************************Disclaimer************************************
> 
> Information contained in this E-MAIL being proprietary to Wipro Limited is 
> 'privileged' and 'confidential' and intended for use only by the individual
>  or entity to which it is addressed. You are notified that any use, copying 
> or dissemination of the information contained in the E-MAIL in any manner 
> whatsoever is strictly prohibited.
> 
> ***************************************************************************
> 

__________________________________
Do you Yahoo!?
The New Yahoo! Shopping - with improved product search
http://shopping.yahoo.com

_______________________________________________
L2tpext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/l2tpext

---

From: Vipin Jain <[email-masked]>
Date: Tue, 30 Sep 2003 23:45:25 -0700 (PDT)

Avinash,

my comments inline..

thanks,
-- vipin