Subject: [L2tpext] l2tp ports

From: "Avinash Natarajan" <[email-masked]>
Date: Thu, 25 Sep 2003 14:25:38 +0530

Hi,
    i want to confirm if my understanding of how ports are set in lac/lns is right. i have a nat
which checks for the entire session info before letting a pkt pass thru that causes l2tp to
not operate over it.
    is the following port related data right for l2tp operation?

-----------------------------------------------------------------------------------------------
LAC(initial packet):
Src port = X
Dstn port = 1701

LNS (response to the above pkt):
Src port = Y (some free port,cud also be 1701)
Dstn port = X

LAC (rest of the tunnel's life after establishment)
Src port = X
Dstn port = Y

LNS (rest of the tunnel's life after establishment)
Src port = Y
Dstn port = X
-------------------------------------------------------------------------------------------------

  also, is there any scenario(any know implementation of lns) in which an LNS might decide to choose a 
source ip different from that on which it received the initial packet. there is no mention of such a thing in the
l2tp std but i saw such a scenario being discussed in linux netfilters forum with respect to l2tp operation 
over nat.

-Avinash

"Because i live in a large tin can and i work in an egg carton Flirting is the only joy i have:)"

---

From: Motonori Shindo <[email-masked]>
Date: Mon, 29 Sep 2003 15:08:40 +0900 (JST)

Avinash,

From: "Avinash Natarajan" <[email-masked]>
Subject: [L2tpext] l2tp ports
Date: Thu, 25 Sep 2003 14:25:38 +0530

> i want to confirm if my understanding of how ports are set in lac/lns is 
> right. i have a nat which checks for the entire session info before 
> letting a pkt pass thru that causes l2tp to not operate over it.

> -----------------------------------------------------------------------
> LAC(initial packet):
> Src port = X
> Dstn port = 1701
> 

I believe this is right. Couple of points you'd better be aware of:

  - LAC is not always the "initiator" in terms of tunnel
    establishment. LNS can also be an initiator (and this is because
    the standard is using the term "initiator" and "recipient", not
    LAC and LNS)

  - port number selected by initiator (port number X in above diagram)
    can be 1701

  - As mentioned in the standard, choosing port number "X" to be
    something other than 1701, there is some implication for such an
    L2TP implimentation to be NAT-friendly. Most implementations would
    choose 1701 to avoid such a complication if possible, but there
    are some systems that need to choose non-1701 port due to its
    system architecture (e.g. modular (line-card) architecture).

> also, is there any scenario(any know implementation of lns) in which 
> an LNS might decide to choose a  source ip different from that on which 
> it received the initial packet. there is no mention of such a thing in 
> the l2tp std but i saw such a scenario being discussed in linux 
> netfilters forum with respect to l2tp operation over nat.

In early days of l2tp draft, there was a paragraph:

   It is legal for a peer's IP address and/or UDP port used for a given
   tunnel to change over the life of a connection; this may correspond
   to a peer with multiple IP interfaces responding to a network
   topology change.  Responses should reflect the last source IP address
   and UDP port for that Tunnel ID.

but this paragraph was eliminated in draft-12 or later. I don't know
the rationale behind this decision, but it seems to me that it is to
avoid unnecessary complication for most implementations (particularly
that based on UNIX socket).

Regards,

_______________________________________________
L2tpext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/l2tpext

---

From: Motonori Shindo <[email-masked]>
Date: Mon, 29 Sep 2003 15:08:40 +0900 (JST)

Avinash,

Regards,