Subject: RE: L2TP using IPSec for security

From: "William Dixon" <[email-masked]>
Date: Tue, 16 Jan 2001 17:06:33 -0800

The draft specifies IPSec behavior that is required to support how L2TP
is defined in it's RFC form.

Regarding Windows 2000:
Win2k does not support the draft, because the integration was designed
well before the draft had consensus. The win2k L2TP client always uses
UDP source 1701, dst 1701.  So the main difference, it proposes IKE
quick mode Proxy ID: src client IP, dst gw IP, UDP src 1701 dst Any
port.  This is because:
a. the L2TP gateway could float its UDP source port in reply to client
in accordance with the L2TP RFC
b. wanted only 1 pair of IPSec SAs for the tunnel, and
c. didn't want to depend on dynamic IPSec filter plumbing & another IKE
QM from the gateway to the client which nobody supported at the time

Since Win2k already shipped with the above way of negotiating, and
vendors have implemented interoperable support for it, we do not have
plans to change the L2TP/IPSec current behavior in our next release.
Beta 2 of the next release (due out soon) will include the option of
using a pre-shared key for main mode.  (A group name is not supported in
L2TP configuration UI or in IKE MM.)  Please try this out and let us
know of any issues.

However, the L2TP/IPSec draft is the best (in terms of securing RFC
compliant L2TP) way to go if you are implementing from scratch.  You can
implement the draft, and still be compatible with win2k client if you
look at our vendor id value and assume the proxy ID value is UDP src
1701, dst 1701.

Wm
IPSec program manager
Microsoft

cc'ing Rob Trace, [email-masked], VPN program manager

-----Original Message-----
From: Christian Franzen [mailto:[email-masked]]
Sent: Tuesday, January 16, 2001 3:16 PM
To: [email-masked]
Subject: L2TP using IPSec for security

Hi,

while doing my thesis about IPSec I got some questions, hoping you could
help me?

Is this the only standard for L2TP using IPSec?
http://www.ietf.org/internet-drafts/draft-ietf-l2tpext-security-01.txt

Which products do actually support this standard, Win2K?

Will there be any change in this draft?

What will happen if the responder has an unknown and changing IP
address? Is
there any solution about this?

Thank you for your patience
Regards
Christian