Subject: RE: Need for TSP? RE: Tunneling scenarios and mechanisms evaluation

From: "Soliman Hesham" <[email-masked]>
Date: Fri, 12 Mar 2004 23:07:31 -0500

> Hesham,
 > As you are saying, if its already there (L2TP 
 > infrastructure), then this 
 > route can certainly make sense. But if an ISP doesn't have an L2TP 
 > infrastructure, deploying a tunnel broker solution is simpler.

=> Respectfully disagree. Many hosts already have L2TP, 
you're asking them to implement another protocol. 
If the operator doesn't have then he can have it, it's 
already available in products. An existing protocol that 
is already implemented is better than standardising 
a new protocol because it might be simpler to implement.

 > 
 > To me, this is analogous to the BGP tunneling (6PE) stuff: 
 > if you already 
 > have MPLS-IPv4 backbone, BGP tunneling is attractive for 
 > IPv6 deployment to 
 > CE. Otherwise, doesn't make sense to deploy MPLS to get IPv6 to your 
 > customers.

=> I'd like BGP tunnelling mechanisms to be independent 
of MPLS as much as possible. We can also do the same thing
for OSPF, IS-IS ...etc. IMHO these are the best auto tunnelling
mechanisms for the core.

Hesham

 > Florent

---

From: Pekka Savola <[email-masked]>
Date: Tue, 16 Mar 2004 10:10:50 +0200 (EET)

> a new protocol because it might be simpler to implement.

I looked at different L2TP approaches a bit.

An important thing to note is that L2TP only offers control plane 
security, no data plane security.  For the latter, you need IPsec as 
well.

L2TP appears very heavyweight (even the spec is over 100 pages) for
this specific purpose, especially for some scenarios -- e.g., 3GPP
network for UE tunneling.

So, my personal gut feeling at this point is that L2TP is probably
applicable in the environments which already have the machinery in
place, but is a pain to set-up, and has significant complexity and
overhead which are probably drawbacks in a few scenarios at least.

We could actually achieve more than L2TP with simply IPsec with NAT
traversal (as outlined in a separate thread previously) -- but there
are some issues here to be investigated -- the biggest problem AFAICS
is the implementation status.  But I'm not certain this is a feasible
approach in all the scenarios either...

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings