Subject: RE: L2TP over NAPT question

From: Adriaan van den Brand <[email-masked]>
Date: Thu, 2 Nov 2000 10:28:40 +0100

Adriaan,

L2TP encapsulates everything (ie. control & data msg) using UDP, so
it's much more NAT-friendly than other tunneling protocols based on
GRE ,IP-in-IP, IPsec, etc. However, there might be some cases where
NAT doesn't work with L2TP.

L2TP (over IP/UDP) works in the following way in terms of a port
number usage (assuming a LAC initiates a tunnel creation):

   LAC                        LNS
     .xxx       SCCRQ        .1701
     -------------------------->

     .xxx       SCCRP         .yyy
     <--------------------------

     .xxx       SCCCN         .yyy
     --------------------------->

Here, .xxx and .yyy represent UDP port numbers. L2TP protocol allows
.xxx and .yyy to be arbitarily chosen. Once .xxx and .yyy are
determined, this pair will never change during the tunnel lifetime. A
port number usage like this is very similar to what is used in tftp.

Most implementations use 1701 for .xxx (but some don't) and almost all
implementations also use 1701 for .yyy. However, there's a (very
small) possibility that .yyy happens to be something different from
1701. In this case, if there is a NAT between the LAC and LNS, such a
NAT will be confused and very likely to be unable to do NAT properly,
unless it does some special treatment for L2TP packets (some clever
NAT box does this for tftp, BTW).

Cosidering the fact that .yyy being something other than 1701 is quite
rare, L2TP *should* work with NAT, I would say. 

BTW, what are you using as a LAC and LNS?

LAC & LNS:
	Redback SMS500
	Enternet500 for client

The NAT/PAT is located inside a cable modem. It doesn't have application
support other than HTTP, so I guess that's the problem.
It is mainly designed for provisioning purposes.

Regards,
Adriaan

From: Adriaan van den Brand <[email-masked]>
Subject: L2TP over NAPT question
Date: Wed, 1 Nov 2000 13:14:15 +0100 

> Hi,
>  
> Has anyone got experience in running L2TP tunnels over a NAPT (NAT/PAT)
> connection? We see some problems in the setup phase of the tunnels. For
> NAPT, we use a Linux 2.2 kernel (with IP masquerading).
>  
> Best regards,
> Adriaan van den Brand

=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
 +----+----+     
 |.. .|    |     Motonori Shindo
 |_~__|    |     
 | .. |~~_~|     Sr. Systems Engineer
 | .  |    |     CoSine Communications Inc.
 +----+----+     
 C o S i n e     e-mail:  [email-masked] 
Communications
=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=