Subject: RE: Comments/questions to l2tp over ipsec draft

From: Barney Wolff <[email-masked]>
Date: Thu, 1 Jun 2000 15:56 EDT

This is the right answer, but the wrong reason.  If the two end nets
are secure, but connected by an insecure path, tunnel mode may be
all that's needed and perfectly appropriate.  But if it's not something
the LAC or LNS are themselves doing, IPsec becomes just like a link
encryptor that works transparently, with the two ends being unaware
of it.  Of course if the SG's don't operate transparently, such as
by not passing UDP at all or restricting it to port 1701, then things
may not work.  But this is the L2TP-thru-the-firewall scenario, not
something unique to IPsec.

Barney Wolff

> Date: Thu, 1 Jun 2000 14:21:03 -0400 (EDT)
> From: Skip Booth <[email-masked]>
> 
> I don't think this is scenario we should cover since this has security holes in
> it.  The L2TP tunnel(s) are unprotected between the LAC and the first Security
> Gateway and thus this scenario should not be considered in the L2TP Security
> draft.  To protect L2TP sufficiently (end to end), IPsec MUST run on the LAC and
> the LNS.