Subject: GRE and L2TP

From: Rohit Gupta <[email-masked]>
Date: Wed, 17 Mar 2004 21:03:05 -0800 (PST)

Hi,

What is it in L2TP that i cant do with a simple GRE tunneling when implementing a remote access
VPN for a mobile client to connect to the corporate network. In L2TP, since it uses PPP
end-to-end, the LNS is able to supply dynamic IP address using IPCP to the remote client. LNS
takes this IP address from a pool of IP addresses it has. If one were to use GRE, then the same
can be done by using some out-of-band mechanism (or even have a fixed IP address which the mobile
client is instructed to use). GRE will tunnel the data packet originated from the mobile client,
the inner IP header will have the ip addresses as assigned by the corporate network. The outer IP
header will contain the IP address of teh ISP and the gateway to reach the corporate network.

My whole point is that i want to know as to what is the burning need to have L2TP!

Regards,
Rohit

P.S.

Am not sure if this is indeed the right place to ask this question. But since there will be a lot
of experienced people on this list who would have worked on both these protocols, replying to this
one should be very easy.

__________________________________
Do you Yahoo!?
Yahoo! Mail - More reliable, more storage, less spam
http://mail.yahoo.com

---

From: "W. Mark Townsley" <[email-masked]>
Date: Thu, 18 Mar 2004 21:29:59 +0100

> header will contain the IP address of teh ISP and the gateway to reach the corporate network.

GRE is an encapsulation. If you can manually provision or have some other "out 
of band" mechanism that does everything L2TP and PPP would otherwise do for you, 
then by all means use GRE - or IP in IP for that matter as your scenario with 
fixed IP addresses for all mobile clients (which I would think is a showstopper 
from the start) does not obviate the need for a GRE shim either.

L2TP is an encapsulation that allows multiplexing of multiple PPP sessions 
between two IP-connected endpoints, and a control protocol for dynamically 
establishing and maintaining the emulation of these PPP sessions. This is very 
different than GRE (though there are some ways to deploy L2TP between two 
routers to make it look like it is doing what GRE typically does in a bit more 
of a dynamic manner, though this is really a subset of L2TP's overall 
functionality).

Since you indicate that this is for a mobile environment, you might want to look 
at using Mobile IP.

> My whole point is that i want to know as to what is the burning need to have L2TP!

This question probably has more to do with whether you need PPP. If you do, L2TP 
could work for you to transport that PPP session (or many PPP sessions) over an 
IP network. If not, I see no reason for you to be burning with need for L2TP!

- Mark

---

From: Rohit Gupta <[email-masked]>
Date: Thu, 18 Mar 2004 20:38:25 -0800 (PST)

Hi,
 
> between two IP-connected endpoints, and a control protocol for dynamically 

Since L2TP is so strongly tied with PPP, can i assume that it will be *mostly* used when a user
dials (ISDN/modem) into the ISP network (LAC) to contact the corporate network.

Can I then connect a small branch office to the corporate network using L2TP? Does it make any
sense doing that. I am now talking of a deployment scenario. Do you ever have two branches
connected via L2TP? I searched the internet and found only scenarios wherein a remote access user
dials into the ISP to access the corporate network using L2TP. Is the former possible?

In theory, one could have a small office with some < 10 users connected to switch which in turn
dials into the ISPs network. Is this possible?

With regards,
Rohit

P.S.
And thanks to everybody for responding both on the list and offline!

---

From: "W. Mark Townsley" <[email-masked]>
Date: Fri, 19 Mar 2004 08:58:02 +0100

> dials (ISDN/modem) into the ISP network (LAC) to contact the corporate network.

It tends to be used rather often for PPPoA and PPPoE in DSL environments these 
days as well.

> sense doing that. 

Sure, in some cases.

 > I am now talking of a deployment scenario. Do you ever have two branches
> connected via L2TP? 

A number of small routers on the market today have the ability to initiate an 
L2TP session from the router to an LNS.

 > I searched the internet and found only scenarios wherein a remote access user

Look for "L2TP voluntary tunneling" or "client-initiated L2TP"

Also, if you are going to be running L2TP over the Internet and you are worried 
about folks hacking the connection, you would want to secure the L2TP tunnel 
with IPsec transport mode as defined in RFC3193.

> dials into the ISPs network. Is this possible?

If you are using L2TP over IP to connect to an ISP to get IP access you likely 
have a bit of a chicken and egg problem.

But, yes, if you already have IP connectivity from one ISP, but want to use L2TP 
to connect to another ISP (perhaps with some other value add on their network) 
it is *possible* if the ISP allows L2TP connections from your router. Typically, 
an ISP would accept L2TP connections only from a wholesale access provider (or 
in some cases from their own PC client). In any case, you'd probably have to 
find a very knowledgable person at your ISP to talk to this about as it likely 
isn't standard practice.

- Mark

---

From: Stewart Bryant <[email-masked]>
Date: Fri, 19 Mar 2004 18:53:22 +0000

W. Mark Townsley wrote:

> GRE is an encapsulation. If you can manually provision or have some 
> other "out of band" mechanism that does everything L2TP and PPP would 
> otherwise do for you, then by all means use GRE - or IP in IP for that 
> matter as your scenario with fixed IP addresses for all mobile clients 
> (which I would think is a showstopper from the start) does not obviate 
> the need for a GRE shim either.
> 
> L2TP is an encapsulation that allows multiplexing of multiple PPP 
> sessions between two IP-connected endpoints, and a control protocol for 
> dynamically establishing and maintaining the emulation of these PPP 
> sessions. This is very different than GRE (though there are some ways to 
> deploy L2TP between two routers to make it look like it is doing what 
> GRE typically does in a bit more of a dynamic manner, though this is 
> really a subset of L2TP's overall functionality).
> 
> Since you indicate that this is for a mobile environment, you might want 
> to look at using Mobile IP.
> 
>>
> This question probably has more to do with whether you need PPP. If you 
> do, L2TP could work for you to transport that PPP session (or many PPP 
> sessions) over an IP network. If not, I see no reason for you to be 
> burning with need for L2TP!
> 
> - Mark
> 

Mark

I think that the correct comparison in Rohit's case is not
between L2TP and GRE, but between L2TPv3 and GRE. As we both
know L2TPv3 is better suited to VPN apps than GRE because of
its highly functional control plane, and mild security
enhancements.

- Stewart

---

From: "W. Mark Townsley" <[email-masked]>
Date: Fri, 19 Mar 2004 22:08:09 +0100

Stewart Bryant wrote:

>> sessions between two IP-connected endpoints, and a control protocol 
>> for dynamically establishing and maintaining the emulation of these 
>> PPP sessions. This is very different than GRE (though there are some 
>> ways to deploy L2TP between two routers to make it look like it is 
>> doing what GRE typically does in a bit more of a dynamic manner, 
>> though this is really a subset of L2TP's overall functionality).
>>
>> Since you indicate that this is for a mobile environment, you might 
>> want to look at using Mobile IP.
>>
>>>
>> This question probably has more to do with whether you need PPP. If 
>> you do, L2TP could work for you to transport that PPP session (or many 
>> PPP sessions) over an IP network. If not, I see no reason for you to 
>> be burning with need for L2TP!
>>
>> - Mark
>>
> 
> Mark
> 

I was under the impression during this thread that Rohit was referring to L2TP 
as defined in RFC2661, not L2TPv3 (currently 
draft-ietf-l2tpext-l2tp-base-11.txt) which is certainly not so closely tied to PPP.

Thanks,

- Mark