Subject: RE: Comments/questions to l2tp over ipsec draft

From: Ly Loi <[email-masked]>
Date: Thu, 1 Jun 2000 09:02:15 -0700

Glen, in my drawing, the LNS and the IPSEC tunnel terminator reside on the
same box. What is your point?
Mine is regarding covering this scenario in the draft. I believe we all
agree that L2TP over IPSEC is run with ipsec in transport mode if the l2tp
tunnel initiator resides on the same box as the ipsec initiator, but ipsec
is run in tunnel mode if they aren't on the box. So why not also cover the
latter in the draft? Sure, as you pointed out, the draft shouldn't cover all
the possible scenarios, but it could cover the most common ones. I believe
that the scenario I've described below is quite common.

- Ly

> -----Original Message-----
> From: Glen Zorn [mailto:[email-masked]]
> Sent: Wednesday, May 31, 2000 5:36 PM
> To: Ly Loi; 'Skip Booth'
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]
> Subject: RE: Comments/questions to l2tp over ipsec draft
> 
> 
> Ly Loi [mailto:[email-masked]] writes:
> 
> > Glen, the LNS is the tunnel terminator; e.g. the security gateway.
> 
> An LNS doesn't terminate IPSEC tunnels, though.  The LNS and "Security
> Gateway" may reside on the same box, but they are logically 
> distinct, right?
> 
> >
> > - Ly
> >
> > > -----Original Message-----
> > > From: Glen Zorn [mailto:[email-masked]]
> > > Sent: Saturday, May 27, 2000 11:16 AM
> > > To: Ly Loi; 'Skip Booth'
> > > Cc: [email-masked]; [email-masked]; [email-masked];
> > > [email-masked]; Glen Zorn
> > > Subject: RE: Comments/questions to l2tp over ipsec draft
> > >
> > >
> > > Ly Loi [mailto://[email-masked]] writes:
> > >
> > > > Skip, security between the client and the LAC isn't what I was
> > > > referring to.
> > > > In my scenario, the PPP and the LAC can reside on the box,
> > > or different
> > > > boxes. However, the LAC doesn't reside on the same box as
> > > the IPSEC tunnel
> > > > initiator.
> > > > To be more specific, what I have in mind is a group of LACs
> > > > sharing 1 IPSEC
> > > > SA. This IPSEC SA is between the gateway and the LNS.
> > > >
> > > > LAC1---------gateway------------ipsec_tunnel--------------LNS
> > > > LAC2-----------|
> > > > LAC3-----------|
> > >
> > > It appears that you are missing a "security gateway" at 
> the LNS end.
> > >
> > > >
> > > > Unlike the cases covered by the draft where each L2TP tunnel is
> > > > mapped to an
> > > > IPSEC SA, here, multiple L2TP tunnels map to one IPSEC SA.
> > > If the draft
> > > > could also cover this case, it'd be more complete.
> > >
> > > I don't think that the point of the draft is to present an
> > > exhaustive list
> > > of every method (no  matter how lame) that can be used to
> > > "secure" L2TP
> > > tunnels.
> > >
> > > >
> > > > A few more comments:
> > > >
> > > > 1. Could you not require that L2TP start the 
> retransmission timer
> > > > only after
> > > > the IPSEC SA has come up (section 9.2.2)? I stated the reason in
> > > > my original
> > > > email. In addition, in the above scenario, this requirement
> > > wouldn't be
> > > > applicable.
> > > >
> > > > 2. The draft lists the IPSEC filters as if they represent
> > > both the IPSEC
> > > > policies and the IPSEC SAs, which is rather confusing since
> > > IPSEC SAs are
> > > > derived from IPSEC policies. If you could decouple them in
> > > your examples,
> > > > it'd be great.
> > > >
> > > > 3. I don't know how others feel about having an external entity
> > > > (e.g. L2TP)
> > > > injecting some filters into the IPSEC policy database, but
> > > this appears to
> > > > me to be a local implementation issue. Also, this wouldn't
> > > be feasible for
> > > > the above scenario. I however appreciate the problems the draft
> > > > is trying to
> > > > solve.
> > > >
> > > > Thanks,
> > > >
> > > > - Ly
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > > -----Original Message-----
> > > > > From: Skip Booth [mailto:[email-masked]]
> > > > > Sent: Friday, May 26, 2000 12:36 PM
> > > > > To: Ly Loi
> > > > > Cc: [email-masked]'; [email-masked]; [email-masked];
> > > > > [email-masked]; [email-masked]
> > > > > Subject: RE: Comments/questions to l2tp over ipsec draft
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > On Fri, 26 May 2000, Ly Loi wrote:
> > > > >
> > > > > > Skip, I was referring to the case where the LAC and the
> > > ipsec tunnel
> > > > > > initiator didn't reside on the same device:
> > > > > > LAC---gateway(ipsec tunnel
> > > initiator)---------------LNS(ipsec tunnel
> > > > > > terminator)
> > > > > >
> > > > > > Is the draft supposed to cover this case too? This case
> > > > > would be considered
> > > > > > compulsory tunneling, ipsec tunneling :-)
> > > > >
> > > > > The draft discusses security concerns in the compulsory
> > > > > model.  Specifically, it
> > > > > talks about how the link between the client and the LAC is
> > > > > potentially not
> > > > > secure and that clients may require end to end security.  If
> > > > > the client is
> > > > > running end to end security than potentially no encryption is
> > > > > required for L2TP
> > > > > data packets between the LAC and LNS, but authentication may
> > > > > be.  As you noted
> > > > > however, currently there is no way standardized method
> > > for IPsec to
> > > > > differentiate between L2TP data and control packets.
> > > > >
> > > > > Does the draft need to go into more detail in this area?  If
> > > > > so what more would
> > > > > you like to be discussed?
> > > > >
> > > > > > If L2TP and IPSEC reside on the same device, then yes, we
> > > > > all agree IPSEC
> > > > > > would run in transport mode and I trust this will be stated
> > > > > in a future
> > > > > > version of the draft, thanks.
> > > > >
> > > > > Yes.
> > > > >
> > > > > -Skip
> > > > >
> > > > > >
> > > > > > - Ly
> > > > > >
> > > > >
> > > > > [rest of text snipped]
> > > > >
> > > >
> > > >
> > >
> >
> >
>

---

From: Skip Booth <[email-masked]>
Date: Thu, 1 Jun 2000 14:21:03 -0400 (EDT)

> that the scenario I've described below is quite common.

I don't think this is scenario we should cover since this has security holes in
it.  The L2TP tunnel(s) are unprotected between the LAC and the first Security
Gateway and thus this scenario should not be considered in the L2TP Security
draft.  To protect L2TP sufficiently (end to end), IPsec MUST run on the LAC and
the LNS.

-Skip