Subject: L2TP using IPSec for security

From: "Christian Franzen" <[email-masked]>
Date: Wed, 17 Jan 2001 00:15:44 +0100

Hi,

while doing my thesis about IPSec I got some questions, hoping you could
help me?

Is this the only standard for L2TP using IPSec?
http://www.ietf.org/internet-drafts/draft-ietf-l2tpext-security-01.txt

Which products do actually support this standard, Win2K?

Will there be any change in this draft?

What will happen if the responder has an unknown and changing IP address? Is
there any solution about this?

Thank you for your patience
Regards
Christian

---

From: Skip Booth <[email-masked]>
Date: Tue, 16 Jan 2001 22:40:50 -0500 (EST)

> http://www.ietf.org/internet-drafts/draft-ietf-l2tpext-security-01.txt

Yes

> Which products do actually support this standard, Win2K?

Cisco will claim full support of this draft in the 12.2(2)T or 12.2(3)T release
timeframe (soon).  We already support most of the MUSTs in the draft.

In general, there has been alot of interoperability support for this draft.
L2TP secured via IPsec has been through several bakeoffs.  There have been very
few non-conformancies noted at these bakeoffs.  Probably the area which has been
least tested is when the peer uses a dynamic UDP port number (i.e. moves the
negotiation off of 1701) or when the peer chooses a new port number.  Most
implementation don't do this and thus AFAIK almost no interoperability testing.

> Will there be any change in this draft?

A couple of clarifications are being made and my understanding is that it will
be posted for IETF last call shortly.

> there any solution about this?

In the draft it is assumed that the initiator knows the LNS (responder) IP
address through some means.  The draft does address how the responder can move
to a new IP address for load-balancing reasons, but that can only occur once the
L2TP negotiations have started.  Take a look at section 8.2.3 for more
information on how this occurs.

AFAIK, there are not any proposals in any working group which address how the
initiator can securely determine the responders IP address when this information
is not known.  The IPsec Policy WG may be addressing this so you could check
there.  It certainly seems to be outside the scope of the L2TP security draft.

-Skip