Subject: [L2tpext] Hidden AVPs and NAT

From: "Avinash Natarajan" <[email-masked]>
Date: Sat, 20 Sep 2003 16:05:05 +0530

Hi...
    i am trying to write a l2tp pass through for NAT. i need to get the assigned tid value
from the Assigned Tid AVP and create some mappings when necassary. is there any known
way of dealing with it/work around it in cases where this avp is hidden?
    Thanks.
-Avinash

"Because i live in a large tin can and i work in an egg carton Flirting is the only joy i have:)"

---

From: Vipin Jain <[email-masked]>
Date: Mon, 22 Sep 2003 09:32:38 -0700 (PDT)

In L2TPv2:

Instead of mapping tids across NAT, you may want to map
the udp port. For example, for a given incoming IP address
choose a source udp port and remap it back for the packets
coming back from the LNS. You may want to look into section
8.1, rfc2661 for more details.

That way you would avoid keeping the configuratin of tunnel
secrets for various LAC-LNS pairs.

-- vipin

> "Because i live in a large tin can and i work in an egg carton Flirting is

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

_______________________________________________
L2tpext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/l2tpext

---

From: Vipin Jain <[email-masked]>
Date: Mon, 22 Sep 2003 09:32:38 -0700 (PDT)

In L2TPv2:

-- vipin

---

From: "Avinash Natarajan" <[email-masked]>
Date: Tue, 23 Sep 2003 21:39:16 +0530

Hi
    One more clarification, suppose i can only be an initiator of a tunnel/session(pkts goin out of the NAT
would only be SSRQ/ICRQ), in that case a NAT capable of port mapping would suffice right. I need
not do anything extra to handle l2tp as a special case. (cos the recepient will always set the destination
port as the source port of the sender - so reverse translation will always succeed, the recepient can alter
source port to any free port of his but that will not affect my NAT's operation).
    Thanks.
-Avinash

  ----- Original Message ----- 
  From: Vipin Jain 
  To: Avinash Natarajan ; [email-masked] 
  Sent: Monday, September 22, 2003 10:02 PM
  Subject: Re: [L2tpext] Hidden AVPs and NAT

  In L2TPv2:

  -- vipin

---

From: "Avinash Natarajan" <[email-masked]>
Date: Tue, 23 Sep 2003 21:39:16 +0530

Hi

  ----- Original Message ----- 
  From: Vipin Jain 
  To: Avinash Natarajan ; [email-masked] 
  Sent: Monday, September 22, 2003 10:02 PM
  Subject: Re: [L2tpext] Hidden AVPs and NAT

  In L2TPv2:

  -- vipin

---

From: Vipin Jain <[email-masked]>
Date: Thu, 25 Sep 2003 10:29:22 -0700 (PDT)

> would only be SSRQ/ICRQ),
I assume you meant SCCRQ; I also assume that you
are talking about incoming calls;

> in that case a NAT capable of port mapping would
> suffice right. I need
> not do anything extra to handle l2tp as a special case.
> (cos the recepient will always set the destination
> port as the source port of the sender - so reverse
> translation will always succeed, the recepient can alter
IMO it would work.

On other hand if you are not the originator, then
implementing NAT for incoming calls from outside is
little confusing. NAT, typically makes sense, when
connections/sessions (whether TCP, UDP, L2TP, etc.)
are initiated from within.

Or did I not understand your point?

-- vipin

>   > from the Assigned Tid AVP and create some mappings when necassary. is
> there
>   > any known
>   > "Because i live in a large tin can and i work in an egg carton Flirting
> is
>   > the only joy i have:)"
>   > 
> 
> 
> **************************Disclaimer************************************
> 
> Information contained in this E-MAIL being proprietary to Wipro Limited is 
> 'privileged' and 'confidential' and intended for use only by the individual
>  or entity to which it is addressed. You are notified that any use, copying 
> or dissemination of the information contained in the E-MAIL in any manner 
> whatsoever is strictly prohibited.
> 
> ***************************************************************************
> 

__________________________________
Do you Yahoo!?
The New Yahoo! Shopping - with improved product search
http://shopping.yahoo.com

---

From: Vipin Jain <[email-masked]>
Date: Thu, 25 Sep 2003 10:29:22 -0700 (PDT)

IMO it would work.

-- vipin

---

From: "Avinash Natarajan" <[email-masked]>
Date: Mon, 29 Sep 2003 12:17:04 +0530

Hi..

  ----- Original Message ----- 
  From: Vipin Jain 
  To: Avinash Natarajan ; [email-masked] 
  Sent: Thursday, September 25, 2003 10:59 PM
  Subject: Re: [L2tpext] Hidden AVPs and NAT

  IMO it would work.

  ---Yes, i am always the originator, everything is initiated from inside the NAT.
  But the prob is, the NAT i am talking about does a comparison for the entire session information
  for any incoming packet. So comparison is made at nat for src ip,dstn ip,src port and 
  dstn port. Now the source port of the SCCRP could be different from the 1701(since recepient
  can use any free port as source port while responding to a SCCRQ). This wud cause
  a failure in the NAT lookup. i've deviced a workaround for the same with the port table 
  kindof thing i had sent earlier in the group as the basis...

  There's one more scenario where i foresee a problem(when more than one guy behind a nat tries to
  initiate a tunnel).

                               -----------------------
  Initiator1----------------|                      |
                              |         NAT      |---------------------Recepient 
  Initiator2----------------|                      |
                              -----------------------

  In above case, when originator 1 and 2 try to set up tunnels with the same assigned Tunnel id values
  one of them would fail. This calls for some kindof tunnel id mapping for the above scenario to work.
  This brings back the problem of hidden avps.
  Is this a real problem or am i inventing it.

  Thanks.
  -Avinash

  -- vipin

---

From: "Avinash Natarajan" <[email-masked]>
Date: Mon, 29 Sep 2003 12:17:04 +0530

Hi..

  ----- Original Message ----- 
  From: Vipin Jain 
  To: Avinash Natarajan ; [email-masked] 
  Sent: Thursday, September 25, 2003 10:59 PM
  Subject: Re: [L2tpext] Hidden AVPs and NAT

  IMO it would work.

                               -----------------------

  Thanks.
  -Avinash

  -- vipin