Subject: RE: Comments/questions to l2tp over ipsec draft

From: Ly Loi <[email-masked]>
Date: Tue, 30 May 2000 08:33:03 -0700

Glen, the LNS is the tunnel terminator; e.g. the security gateway.

- Ly

> -----Original Message-----
> From: Glen Zorn [mailto:[email-masked]]
> Sent: Saturday, May 27, 2000 11:16 AM
> To: Ly Loi; 'Skip Booth'
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]; Glen Zorn
> Subject: RE: Comments/questions to l2tp over ipsec draft
> 
> 
> Ly Loi [mailto://[email-masked]] writes:
> 
> > Skip, security between the client and the LAC isn't what I was
> > referring to.
> > In my scenario, the PPP and the LAC can reside on the box, 
> or different
> > boxes. However, the LAC doesn't reside on the same box as 
> the IPSEC tunnel
> > initiator.
> > To be more specific, what I have in mind is a group of LACs
> > sharing 1 IPSEC
> > SA. This IPSEC SA is between the gateway and the LNS.
> >
> > LAC1---------gateway------------ipsec_tunnel--------------LNS
> > LAC2-----------|
> > LAC3-----------|
> 
> It appears that you are missing a "security gateway" at the LNS end.
> 
> >
> > Unlike the cases covered by the draft where each L2TP tunnel is
> > mapped to an
> > IPSEC SA, here, multiple L2TP tunnels map to one IPSEC SA. 
> If the draft
> > could also cover this case, it'd be more complete.
> 
> I don't think that the point of the draft is to present an 
> exhaustive list
> of every method (no  matter how lame) that can be used to 
> "secure" L2TP
> tunnels.
> 
> >
> > A few more comments:
> >
> > 1. Could you not require that L2TP start the retransmission timer
> > only after
> > the IPSEC SA has come up (section 9.2.2)? I stated the reason in
> > my original
> > email. In addition, in the above scenario, this requirement 
> wouldn't be
> > applicable.
> >
> > 2. The draft lists the IPSEC filters as if they represent 
> both the IPSEC
> > policies and the IPSEC SAs, which is rather confusing since 
> IPSEC SAs are
> > derived from IPSEC policies. If you could decouple them in 
> your examples,
> > it'd be great.
> >
> > 3. I don't know how others feel about having an external entity
> > (e.g. L2TP)
> > injecting some filters into the IPSEC policy database, but 
> this appears to
> > me to be a local implementation issue. Also, this wouldn't 
> be feasible for
> > the above scenario. I however appreciate the problems the draft
> > is trying to
> > solve.
> >
> > Thanks,
> >
> > - Ly
> >
> >
> >
> >
> >
> > > -----Original Message-----
> > > From: Skip Booth [mailto:[email-masked]]
> > > Sent: Friday, May 26, 2000 12:36 PM
> > > To: Ly Loi
> > > Cc: [email-masked]'; [email-masked]; [email-masked];
> > > [email-masked]; [email-masked]
> > > Subject: RE: Comments/questions to l2tp over ipsec draft
> > >
> > >
> > >
> > >
> > > On Fri, 26 May 2000, Ly Loi wrote:
> > >
> > > > Skip, I was referring to the case where the LAC and the 
> ipsec tunnel
> > > > initiator didn't reside on the same device:
> > > > LAC---gateway(ipsec tunnel 
> initiator)---------------LNS(ipsec tunnel
> > > > terminator)
> > > >
> > > > Is the draft supposed to cover this case too? This case
> > > would be considered
> > > > compulsory tunneling, ipsec tunneling :-)
> > >
> > > The draft discusses security concerns in the compulsory
> > > model.  Specifically, it
> > > talks about how the link between the client and the LAC is
> > > potentially not
> > > secure and that clients may require end to end security.  If
> > > the client is
> > > running end to end security than potentially no encryption is
> > > required for L2TP
> > > data packets between the LAC and LNS, but authentication may
> > > be.  As you noted
> > > however, currently there is no way standardized method 
> for IPsec to
> > > differentiate between L2TP data and control packets.
> > >
> > > Does the draft need to go into more detail in this area?  If
> > > so what more would
> > > you like to be discussed?
> > >
> > > > If L2TP and IPSEC reside on the same device, then yes, we
> > > all agree IPSEC
> > > > would run in transport mode and I trust this will be stated
> > > in a future
> > > > version of the draft, thanks.
> > >
> > > Yes.
> > >
> > > -Skip
> > >
> > > >
> > > > - Ly
> > > >
> > >
> > > [rest of text snipped]
> > >
> >
> >
>

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 31 May 2000 17:35:56 -0700

> Glen, the LNS is the tunnel terminator; e.g. the security gateway.

An LNS doesn't terminate IPSEC tunnels, though.  The LNS and "Security
Gateway" may reside on the same box, but they are logically distinct, right?