Subject: R: L2TP over NAPT question

From: "Leone, Guido" <[email-masked]>
Date: Wed, 8 Nov 2000 12:01:35 -0000

GRE is a "protocol" (number 47) in itself (not using TCP or UDP to
encapsulate) : why are you saying that it cannot be as "NAT-friendly" as
L2TP ?
Regards,
Guido.

> -----Messaggio originale-----
> Da:	Adriaan van den Brand [SMTP:[email-masked]]
> Inviato:	giovedì 2 novembre 2000 10.29
> A:	'Motonori Shindo'; Adriaan van den Brand
> Cc:	[email-masked]
> Oggetto:	RE: L2TP over NAPT question
> 
> Adriaan, 
> 
> L2TP encapsulates everything (ie. control & data msg) using UDP, so 
> it's much more NAT-friendly than other tunneling protocols based on 
> GRE ,IP-in-IP, IPsec, etc. However, there might be some cases where 
> NAT doesn't work with L2TP. 
> 
> L2TP (over IP/UDP) works in the following way in terms of a port 
> number usage (assuming a LAC initiates a tunnel creation): 
> 
> 
>    LAC                        LNS 
>      .xxx       SCCRQ        .1701 
>      --------------------------> 
> 
>      .xxx       SCCRP         .yyy 
>      <-------------------------- 
> 
>      .xxx       SCCCN         .yyy 
>      ---------------------------> 
> 
> 
> Here, .xxx and .yyy represent UDP port numbers. L2TP protocol allows 
> .xxx and .yyy to be arbitarily chosen. Once .xxx and .yyy are 
> determined, this pair will never change during the tunnel lifetime. A 
> port number usage like this is very similar to what is used in tftp. 
> 
> Most implementations use 1701 for .xxx (but some don't) and almost all 
> implementations also use 1701 for .yyy. However, there's a (very 
> small) possibility that .yyy happens to be something different from 
> 1701. In this case, if there is a NAT between the LAC and LNS, such a 
> NAT will be confused and very likely to be unable to do NAT properly, 
> unless it does some special treatment for L2TP packets (some clever 
> NAT box does this for tftp, BTW). 
> 
> Cosidering the fact that .yyy being something other than 1701 is quite 
> rare, L2TP *should* work with NAT, I would say. 
> 
> BTW, what are you using as a LAC and LNS? 
> 
> 
> 
> 
> LAC & LNS: 
>         Redback SMS500 
>         Enternet500 for client 
> 
> The NAT/PAT is located inside a cable modem. It doesn't have application
> support other than HTTP, so I guess that's the problem.
> 
> It is mainly designed for provisioning purposes. 
> 
> Regards, 
> Adriaan 
> 
> 
> 
> From: Adriaan van den Brand <[email-masked]> 
> Subject: L2TP over NAPT question 
> Date: Wed, 1 Nov 2000 13:14:15 +0100 
> 
> > Hi, 
> >  
> > Has anyone got experience in running L2TP tunnels over a NAPT (NAT/PAT) 
> > connection? We see some problems in the setup phase of the tunnels. For 
> > NAPT, we use a Linux 2.2 kernel (with IP masquerading). 
> >  
> > Best regards, 
> > Adriaan van den Brand 
> 
> =--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--= 
>  +----+----+     
>  |.. .|    |     Motonori Shindo 
>  |_~__|    |     
>  | .. |~~_~|     Sr. Systems Engineer 
>  | .  |    |     CoSine Communications Inc. 
>  +----+----+     
>  C o S i n e     e-mail:  [email-masked] 
> Communications 
> =--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--= 
>

---

From: "W. Mark Townsley" <[email-masked]>
Date: Thu, 09 Nov 2000 17:06:16 -0800

I suspect you will find more NATs on the planet that support UDP than
GRE, IPsec, or IP in IP. Since L2TP runs over UDP, it is therefore
fairly NAT friendly (though perhaps not friendly enough for your cable
modem if it only supports http).

I would expect your Linux 2.2 kernel (with IP masquerading) to be able
to handle NAPT of a UDP stream such as L2TP. The typical trip-up might
be the scenerio listed below where L2TP moves off ports, though *most*
implementations I see do not move off 1701.

- Mark