Subject: Re: [Fwd: R: L2TP over NAPT question]

From: Motonori Shindo <[email-masked]>
Date: Fri, 10 Nov 2000 14:17:21 +0900 (JST)

Leone,

Due to the confusion of this mailing list for the last couple of days,
I didn't receive your e-mail (my colleague forwarded this to me:-)).

I used the term "NAT" rather generically. To be more precise, I should
have said PAT (aka IP masquerading) in this case. Since GRE is neither
TCP nor UDP, it's impossible to do PAT. Suppose there are five users
behind a PAT which masquerades 5 internal IP addresses to one global
IP address, it's quite difficult for these users to use PPTP through
NAT simultaneously because TCP/UDP port number can't be utilized for
masquerading. From this perspective, L2TP, which uses UDP for
encapsulation, is more PAT-friendly over GRE-based tunneling
mechanisms like PPTP and ATMP.

Regards,

> > > > "Leone, Guido" wrote:
> > > > >
> > > > > GRE is a "protocol" (number 47) in itself (not using TCP or UDP to
> > > > > encapsulate) : why are you saying that it cannot be as "NAT-friendly" as
> > > > > L2TP ?
> > > > > Regards,
> > > > > Guido.
> > > > >
> > > > > > -----Messaggio originale-----
> > > > > > Da:   Adriaan van den Brand [SMTP:[email-masked]]
> > > > > > Inviato:      gioved？2 novembre 2000 10.29
> > > > > > A:    'Motonori Shindo'; Adriaan van den Brand
> > > > > > Cc:   [email-masked]
> > > > > > Oggetto:      RE: L2TP over NAPT question
> > > > > >
> > > > > > Adriaan,
> > > > > >
> > > > > > L2TP encapsulates everything (ie. control & data msg) using UDP, so
> > > > > > it's much more NAT-friendly than other tunneling protocols based on
> > > > > > GRE ,IP-in-IP, IPsec, etc. However, there might be some cases where
> > > > > > NAT doesn't work with L2TP.
> > > > > >
> > > > > > L2TP (over IP/UDP) works in the following way in terms of a port
> > > > > > number usage (assuming a LAC initiates a tunnel creation):
> > > > > >
> > > > > >
> > > > > >    LAC                        LNS
> > > > > >      .xxx       SCCRQ        .1701
> > > > > >      -------------------------->
> > > > > >
> > > > > >      .xxx       SCCRP         .yyy
> > > > > >      <--------------------------
> > > > > >
> > > > > >      .xxx       SCCCN         .yyy
> > > > > >      --------------------------->
> > > > > >
> > > > > >
> > > > > > Here, .xxx and .yyy represent UDP port numbers. L2TP protocol allows
> > > > > > .xxx and .yyy to be arbitarily chosen. Once .xxx and .yyy are
> > > > > > determined, this pair will never change during the tunnel lifetime. A
> > > > > > port number usage like this is very similar to what is used in tftp.
> > > > > >
> > > > > > Most implementations use 1701 for .xxx (but some don't) and almost all
> > > > > > implementations also use 1701 for .yyy. However, there's a (very
> > > > > > small) possibility that .yyy happens to be something different from
> > > > > > 1701. In this case, if there is a NAT between the LAC and LNS, such a
> > > > > > NAT will be confused and very likely to be unable to do NAT properly,
> > > > > > unless it does some special treatment for L2TP packets (some clever
> > > > > > NAT box does this for tftp, BTW).
> > > > > >
> > > > > > Cosidering the fact that .yyy being something other than 1701 is quite
> > > > > > rare, L2TP *should* work with NAT, I would say.
> > > > > >
> > > > > > BTW, what are you using as a LAC and LNS?
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > LAC & LNS:
> > > > > >         Redback SMS500
> > > > > >         Enternet500 for client
> > > > > >
> > > > > > The NAT/PAT is located inside a cable modem. It doesn't have application
> > > > > > support other than HTTP, so I guess that's the problem.
> > > > > >
> > > > > > It is mainly designed for provisioning purposes.
> > > > > >
> > > > > > Regards,
> > > > > > Adriaan
> > > > > >
> > > > > >
> > > > > >
> > > > > > From: Adriaan van den Brand <[email-masked]>
> > > > > > Subject: L2TP over NAPT question
> > > > > > Date: Wed, 1 Nov 2000 13:14:15 +0100
> > > > > >
> > > > > > > Hi,
> > > > > > >
> > > > > > > Has anyone got experience in running L2TP tunnels over a NAPT (NAT/PAT)
> > > > > > > connection? We see some problems in the setup phase of the tunnels. For
> > > > > > > NAPT, we use a Linux 2.2 kernel (with IP masquerading).
> > > > > > >
> > > > > > > Best regards,
> > > > > > > Adriaan van den Brand
> > > > > >
> > > > > > =--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
> > > > > >  +----+----+
> > > > > >  |.. .|    |     Motonori Shindo
> > > > > >  |_~__|    |
> > > > > >  | .. |~~_~|     Sr. Systems Engineer
> > > > > >  | .  |    |     CoSine Communications Inc.
> > > > > >  +----+----+
> > > > > >  C o S i n e     e-mail:  [email-masked]
> > > > > > Communications
> > > > > > =--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
> > > > > >
> > > >
> > > > --
> > > > /_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
> > > >
> > > >  +----+----+                  Tatsuya Yanagibashi
> > > >  |.. .|    |
> > > >  |_~__|    |                   Network Consultant
> > > >  | .. |~~_~|               CoSine Communications Inc.
> > > >  | .  |    |
> > > >  +----+----+            e-mail: [email-masked]
> > > >  C o S i n e                 Phone # +81-3-5219-1296
> > > > Communications               Fax   # +81-3-5219-1201
> > > >
> > > > /_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
> > >
> > > =--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
> > >  +----+----+
> > >  |.. .|    |     Motonori Shindo
> > >  |_~__|    |
> > >  | .. |~~_~|     Sr. Systems Engineer
> > >  | .  |    |     CoSine Communications Inc.
> > >  +----+----+
> > >  C o S i n e     e-mail:  [email-masked]
> > > Communications
> > > =--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
> > 
> > =--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
> >  +----+----+
> >  |.. .|    |     Motonori Shindo
> >  |_~__|    |
> >  | .. |~~_~|     Sr. Systems Engineer
> >  | .  |    |     CoSine Communications Inc.
> >  +----+----+
> >  C o S i n e     e-mail:  [email-masked]
> > Communications
> > =--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
> 
> -- 
> /_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
> 
>  +----+----+                  Tatsuya Yanagibashi     
>  |.. .|    |
>  |_~__|    |                   Network Consultant
>  | .. |~~_~|               CoSine Communications Inc.
>  | .  |    |
>  +----+----+            e-mail: [email-masked]
>  C o S i n e                 Phone # +81-3-5219-1296
> Communications               Fax   # +81-3-5219-1201
>    
> /_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
 +----+----+     
 |.. .|    |     Motonori Shindo
 |_~__|    |     
 | .. |~~_~|     Sr. Systems Engineer
 | .  |    |     CoSine Communications Inc.
 +----+----+     
 C o S i n e     e-mail:  [email-masked] 
Communications
=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=