Subject: L2TP question on Tunnel Secret

From: "Kamlesh Agrawal" <[email-masked]>
Date: Tue, 29 May 2001 17:19:58 -0700

Hi,

I had a L2TP question, was wondering if anyone has any ideas/suggestions?

A tunnel is established between a LAC and a LNS and they have a shared
secret. The LAC and the LNS use the same shared secret to  encode(hide) and
decode the hidden AVPs.

Say user1 comes in with shared secret (Tunnel Password) = "secret" and
Tunnel endpoint = LNS1, Tunnel T1 gets established between LAC1 and LNS1 and
they both use "secret" to encode(hide) and decode the hidden AVPs.

Now, user2 comes into LAC1 with shared secret (Tunnel Password) = "secret1"
and Tunnel endpoint = LNS1, LAC1 sees that it has a tunnel T1 to LNS1, puts
the user in the same tunnel. However, when LNS1 tries to decode the hidden
AVPs from user2 which are now encoded using "secret1", it gets garbage.

Two workarounds to this:

1. LAC1 should reject user2 since the Tunnel Password for user2 is not the
same as Tunnel password of T1 (its tunnel to LNS1).
2. If LAC1 does not reject user2 and allows it to get to LNS1 through T1,
LNS1 should somehow magically figure out that the shared secret for user2 is
wrong and bump out user2.

Any ideas/suggestions as to how 2nd workaround can be implemented.

Any help in this matter will be appreciated.

Thanks in advance,

Regards
Kamlesh.

---

From: "Glen Zorn" <[email-masked]>
Date: Thu, 31 May 2001 14:08:40 -0700

> AVPs from user2 which are now encoded using "secret1", it gets garbage.

This is not a problem.  From RFC 2661, section 5.1.1: "To participate in
tunnel authentication, a single shared secret MUST exist between the LAC and
LNS. This is the same shared secret used for AVP hiding..."
^^^^^^^^^^^^^^^^^^^^^^^

"Users" (what ever they might be in the context of L2TP) don't share secrets
with either the LAC or LNS.

---

From: Bill Baumann <[email-masked]>
Date: Thu, 31 May 2001 15:37:15 -0700 (PDT)

RADIUS supports multiple tunnels per LAC/LNS pair.  So it is possible to
have multiple passwords, they just belong to multiple tunnels.

A unique RADIUS-specified id comes with the password.  This specifies
which tunnel to use.  If it passes a different password, the id had better
be different too, or the RADIUS server is broken.  As Glen says, there's
only one password per tunnel.

Regards,
Bill Baumann