Subject: RE: l2TP with dynamic routing.

From: Rajesh Kumar <[email-masked]>
Date: Tue, 21 Nov 2000 11:14:17 -0800

IMHO - to run routing protocols over a tunnel, an IpSec
(or an Ip-in-Ip tunnel if security is not a need) tunnel would
be a better choice than L2tp because of the lesser
overhead. Probably also less complex?

Rajesh

-----Original Message-----
From:	James Carlson [SMTP:[email-masked]]
Sent:	Tuesday, November 21, 2000 8:52 AM
To:	Ahmed, Hany
Cc:	[email-masked]
Subject:	RE: l2TP with dynamic routing. 

Ahmed, Hany writes:
> The reason I was asking about a new AVP is to determine
> the possibility of the LNS to use RIP/OSPF with the client
> once it finds out about this capability. 

My point is that if this is a real problem, then L2TP isn't the right
place to solve it.  It's a general problem with links.

> If the client doesn't support it, it can be disabled on 
> the link all together and save any bandwidth you may use
> for that purpose.  

Are you authenticating the peer at all?  If you are, then you can key
preferences -- such as desired routing protocol, filters, compression
protocols, and other options -- off of the authenticated peer name.
There's no reason to negotiate these.

If you're not authenticating, then you do have to use heuristics.  For
OSPF or IS-IS, it's easy.  Send a few Hellos, and if you don't hear
any back by RouterDeadInterval, then just stop.  For RIP, it's only a
little harder.  Send a few Response messages to make sure that silent
peers get the right data (two or three packets aren't going to hurt
anyone, and there's no compelling need to optimize that).  If you
don't get an ICMP Port Unreachable (telling you immediately that the
peer isn't running RIP), then send a Query to see if the peer is
running RIP.  (I'm not sure I would bother with this on bandwidth
grounds.  One small packet every 30 seconds has no real effect.  I
would do it, though, if it caused inactivity timer problems.)

> There was also the indication that with SPAP you can request
> routing as well, I guess SPAP is not that bad after all!

If that's true about SPAP (I have no documentation on the protocol),
then that's yet another design flaw.  Link layer authentication
protocols have no business negotiating network layer attributes.

-- 
James Carlson, Internet Engineering       <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677
Second Edition now available - http://people.ne.mediaone.net/carlson/ppp

---

From: James Carlson <[email-masked]>
Date: Tue, 21 Nov 2000 14:55:28 -0500 (EST)

> overhead. Probably also less complex?

How can whether you're running a routing protocol possibly affect
whether you use IPSec or IP/PPP/L2TP?

Routing sees these things as point-to-point links.  It doesn't care
how or why they're point-to-point.  In turn, IPSec and IP/PPP/L2TP see
routing packets as just IP packets.  They don't care what the packets
carry.

Sure, IP-IP tunneling has less overhead than L2TP on IP.  So what?
That's not necessarily the reason you choose one or the other.

---

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 23 Nov 2000 16:07:16 -0800

>overhead. Probably also less complex?

Unfortunately, most IPSEC tunnel mode implementations do
not support multicast, which is required by IGPs. So in
practice, with IPSEC tunnel mode, we see use of BGP or
static routing only. 

Since this is not an issue with L2TP/IPSEC (or
GRE with or without IPSEC, for that matter), these
protocols are preferred for use with IGPs.