Subject: Re: L2TP Redundency

From: Andy Valencia <[email-masked]>
Date: Fri, 02 Mar 2001 13:04:09 -0800

>After L2TP tunnels are established, the IP interface of the LAC
>goes down, is it still OK to maintain all these L2TP tunnels by
>using another IP interface of the LAC? Does the sender IP address
>matter?
>If anyone can provide me some information about this, I will greatly
>appreciate it.

Somebody already provided the short answer, which is yes, IP address
matters--no, it can't ever change.  I've written up a little background
in case you want to do more work on approaches to this problem.

Originally, L2TP permitted the source IP address to vary over the life of
the tunnel; I put this in on purpose.  I reasoned that multi-homing as well
as roaming would be accomodated nicely if this were permitted.  The peer
would only observe the new source IP address if the packet otherwise checked
out OK--session and tunnel ID, perhaps sequence numbers, and there was a
32-bit key field in that version of L2TP, also.

There was some thought that honoring this varying source IP address would
make hijackings easier.  I argued that to get a packet accepted in the first
place, you basically had to have snooped the packet stream anyway (to get
the key, even if you could guess everything else), and if you could do that,
you could inject packets and see the results--so there was no incremental
loss of security related to the IP address changing.  But the IESG forced it
to go away--IP address doesn't vary.  With hindsight, I should've made it an
AVP parameter, along the lines of the IP address management in SCTP.  So you
and your peer could, over time, move among a set of IP addresses.  This is a
little dodgey for roaming, since you're hosed if you find yourself in a new
cell (and thus, with a new IP address) without being to tell the peer by way
of your previous cell.  C'est la vie.

The IESG also mandated that the key field should go away.  The reasoning was
along the lines that having a 32-bit hard-to-guess field wasn't "real"
security, as it would only protect against blind attacks.  So it was pulled
out, making L2TP more vulnerable to blind attacks than it would have been.
Therefore, to protect against either blind *or* snooped attacks, you have to
go to IPsec.  In my experience blind attacks are much more common than
snooped ones, and a 32-bit integer compare is *way* cheaper than the most
streamlined IPsec authentication operation.  But the IESG wanted it gone, so
it's gone.

Regards,
Andy Valencia

---

From: Danny McPherson <[email-masked]>
Date: Fri, 02 Mar 2001 18:24:27 -0700

FWIW, one simple approach to this (that may not make 
sense in some configurations) is to employ a loopback 
or other similar 'virtual interface' as the source, 
then you're no longer link/interface dependent.

-danny