Subject: [L2tpext] Re: L2TP and IPSec

From: "Cheng-Yin Lee" <[email-masked]>
Date: 27 Nov 2002 14:49:16 -0500

Joe, Mark, Alok,
Some quick comments.

For  CE-based Virtual Private LAN (VPL):
- there is  no multiplexing of different customers VPL over a single IPSec
- VPL ID is not used regardless of whether IPsec or L2TP is the tunneling
protocol
- As Eric Rosen pointed out, "the path of least resistance  leads to
IPsec+L2TP", and I agree with him on this respect.
I am open to using IPSec (in fact, personally, I do like something like EtherIP,
but would IANA assign a new/recycled protocol ID for CE-based VPL?), but as I
understand from discussions, L2TP options signaling and keepalives are nice for
VPL applications, and L2TP+IPSec overhead is not significant compared to IPSec
only. Perhaps the L2TPEXT WG has some comments.

thanks
cheng-yin

Joe Touch wrote:

> Mark Duffy wrote:
> > I'm not familiar enough with the VPL work to be sure whether this is
> > relevant or not, but one possible reason to use L2TP+IPsec would be to get
> > the capability (based on L2TP sessions) to multiplex many separate VPN
> > contexts within one IPsec SA.  Thus saving on number of SAs to create.
>
> Muxing several VPNs over a single IPsec is contradictory:
>
>         - if the VPNs have sufficient security, they don't need IPsec
>         underneath
>
>         - if the VPNs lack security, they're not P anymore.
>
> > Also, L2TP is readily extensible to allow binding each L2TP session to a
> > given VPN context.  IPsec is not readily extensible to allow binding each
> > SA to a given VPN context.
>
> "extensible?" - this group isn't chartered to form new protocols to
> solve problems.
>
> Having a separate VPN ID space doesn't magically solve anything. VPN IDs
> must be unique, at least where multiple VPNs 'touchdown' (share routers
> or so-called 'edge' devices).
>
> I.e., there are two solutions:
>         a- IPsec with nonoverlapping (where touchdown occurs) addresses
>         b- L2TP et al extended with nonoverlapping VPN IDs
>
> (a) exists; (b) provides a larger IP address space, at the cost of
> requiring extension and deployment of a new protocol
>
> Joe

_______________________________________________
L2tpext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/l2tpext

---

From: "Cheng-Yin Lee" <[email-masked]>
Date: 27 Nov 2002 14:49:16 -0500

Joe, Mark, Alok,
Some quick comments.

thanks
cheng-yin

---

From: "Cheng-Yin Lee" <[email-masked]>
Date: 27 Nov 2002 18:07:57 -0500

Joe,

Joe Touch wrote:
> Cheng-Yin Lee wrote:
> IMO, these VPNs should be largely independent of tunnel used. There is
> no need for signalling or keep-alives per se in a tunnel - that is the
> task of a routing protocol within the VPN.
Perhaps I misunderstood your point, but I was commenting on Virtual
Private LAN above.

> The path of least resistance involves not creating new protocols.
May I know which new protocols are you referring to?

thanks
cheng-yin

---

From: "Cheng-Yin Lee" <[email-masked]>
Date: 27 Nov 2002 18:07:57 -0500

Joe,

thanks
cheng-yin