Subject: RE: L2TP question on Tunnel Secret

From: "Vipin Jain" <[email-masked]>
Date: Tue, 29 May 2001 18:11:37 -0700

Kamlesh,

May be I don't have a very good idea of the context you are talking about:
Tunnel passwords are defined per tunnel and not per user; How does user2
gets a different password? Looks like configuration error, then.
Can you elaborate what you mean by "user2 comes in with"?

-- vipin

-----Original Message-----
From: Kamlesh Agrawal [mailto:[email-masked]]
Sent: Tuesday, May 29, 2001 5:20 PM
To: l2tp
Subject: L2TP question on Tunnel Secret

Hi,

I had a L2TP question, was wondering if anyone has any ideas/suggestions?

A tunnel is established between a LAC and a LNS and they have a shared
secret. The LAC and the LNS use the same shared secret to  encode(hide) and
decode the hidden AVPs.

Say user1 comes in with shared secret (Tunnel Password) = "secret" and
Tunnel endpoint = LNS1, Tunnel T1 gets established between LAC1 and LNS1 and
they both use "secret" to encode(hide) and decode the hidden AVPs.

Now, user2 comes into LAC1 with shared secret (Tunnel Password) = "secret1"
and Tunnel endpoint = LNS1, LAC1 sees that it has a tunnel T1 to LNS1, puts
the user in the same tunnel. However, when LNS1 tries to decode the hidden
AVPs from user2 which are now encoded using "secret1", it gets garbage.

Two workarounds to this:

1. LAC1 should reject user2 since the Tunnel Password for user2 is not the
same as Tunnel password of T1 (its tunnel to LNS1).
2. If LAC1 does not reject user2 and allows it to get to LNS1 through T1,
LNS1 should somehow magically figure out that the shared secret for user2 is
wrong and bump out user2.

Any ideas/suggestions as to how 2nd workaround can be implemented.

Any help in this matter will be appreciated.

Thanks in advance,

Regards
Kamlesh.

---

From: "Kamlesh Agrawal" <[email-masked]>
Date: Wed, 30 May 2001 08:23:49 -0700

User2 might get a different tunnel password from the AAA (Radius) server
that the LAC is trying to authenticate with. It gets the same tunnel
endpoint as T1 (Tunnel Endpoint = LNS1) but a different password. The LAC
first tries to find the tunnel based on the endpoint and if it finds a
tunnel, it will use the same tunnel even for this new user.

Hence, user2 ends up in tunnel T1 with a different password.

Kamlesh.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Vipin Jain
Sent: Tuesday, May 29, 2001 6:12 PM
To: 'kamlesh'; l2tp
Subject: RE: L2TP question on Tunnel Secret

Kamlesh,

-----Original Message-----
From: Kamlesh Agrawal [mailto:[email-masked]]
Sent: Tuesday, May 29, 2001 5:20 PM
To: l2tp
Subject: L2TP question on Tunnel Secret

Hi,