Preface.
1. Background.
Remote Access.
Telecommuters-Small Office/Home Office.
Remote Office/Branch Office.
Partner.
Virtual Private Networks.
Open System Interconnect Model.
Point-to-Point Protocol.
Sublayers.
The Layer 2 Role of PPP.
The Layer 3 Role of PPP.
Physical Layer Assumptions.
Control Protocol Operation.
Chronological Operation of PPP.
Summary.
2. L2TP Basics.
Layer 2 Role of LAC.
Layer 2 Role of LNS.
Virtual Layer 1.
History.
L2TP Patent Issues.
3. L2TP Deployment Models.
VPN Deployment Models.
LAC Deployment, Distribution, and Support.
LNS Deployment, Distribution, and Support.
LNS "in the Cloud."
Compulsory versus Voluntary Tunneling.
VPN Performance Considerations.
Multibox Multilink PPP.
Compulsory Tunneling Solution.
NAS Pool Solution.
Combined VPN Service and LNS Pool Solution.
Performance Implications.
Comparing L2TP to L2F and PPTP.
Asymmetric Digital Subscriber Line Forum Model.
Other VPN Technologies.
IP Security Protocol.
Generic Routing Encapsulation.
Mobile IP Protocol.
Multiprotocol Label Switching Protocol.
Secure Shell Protocol.
4. L2TP Protocol Overview.
Tunnel Structure and Terminology.
Protocol State Machines.
The Typical Life of a Tunnel.
Protocol Assumptions.
Non-IP Operation.
Separate LAC and Remote System.
Passive LAC Participation.
Protocol Difficulties.
Multilink PPP.
Link Awareness in LNS.
A Look Ahead.
5. Control Connection State Machine.
State Machine.
IDLE State.
Send SCCRQ Actions.
WAIT-CTL-REPLY State.
Send SCCN Actions.
Notify Sessions Actions.
ESTABLISHEDState.
Send SCCRP Actions.
WAIT-CTL-CONN State.
Send HELLO Actions.
Send StopCNN Actions.
CLEANUP-WAIT State.
Cleanup Actions.
Tunnel Authentication.
Initiating a Tunnel.
Tunnel Initiation Tie Breaker.
Comparing L2TP to L2F and PPTP.
Implementation Tips.
Handling Duplicate Received SCCRQ Messages.
Considering Timeout Conditions.
6. Data and Control Messages.
Headers.
T Bit.
L Bit.
F Bit.
S Bit.
Control Bit Handling and Reserved Bits.
Version.
Length.
Tunnel ID.
Call ID.
Ns.
Nr.
Offset Size.
Offset Pad.
Control Message Format.
Attribute Value Pairs.
M Bit.
H Bit.
Control Bit Handling and Reserved Bits.
Overall Length.
Vendor ID.
Attribute.
Value.
Hiding and Unhiding Algorithms.
AVP Hiding Algorithm.
AVP Unhiding Algorithm.
AVP Unhiding Algorithm with No Separate Storage Area.
Restrictions on Hiding AVPs.
Comparing L2TP to L2F and PPTP.
Implementation Tips.
Meaning of AVP Mandatory Bit.
The Order of AVPs.
SCCRQ, SCCRP, and SCCCN AVPs Can Be Hidden.
Odd AVP Conditions.
7. Control Channel Dynamics.
An Overview of the Control Channel.
Sequence Number Handling.
The Reliable Delivery Sender.
The Sender Window.
Sender Actions.
The IDLE State.
Send Msg, Set Timer Actions.
The Operating State.
Send Msg Actions.
The MaxReTx? Predicate.
Retransmit, Set New Timeout Actions.
Notify State Machine Actions.
The Done State.
Stop Timer, Free Msg Actions.
The Window Empty? Predicate.
The New Lead Ack'd Predicate.
Free Msg Actions.
Restart Timer Actions.
The Reliable Delivery Receiver.
The RecvMsg Event.
The ZLB? Predicate.
The In Window? Predicate.
ACK Event for Sender Actions.
The Duplicate? Predicate.
The Ns == Sr? Predicate.
Insert in RecvQueue Actions.
Send Msg up to SM, Sr++ Actions.
The Q Empty? Predicate.
The Q Head Ns == Sr? Predicate.
Dequeue Head Msg Actions.
The Before Window? Predicate.
Drop Msg Actions.
Note Ack Needed Actions.
The Message Delivery Process: An Example.
T = 0, LocalMsg for Peer A.
T = 1.0, Peer A Retransmits.
T = 1.1, Peer B Receives Message with Ns = 58, Nr = 37.
T = 1.5, LocalMsg for Peer B.
T = 1.6, Peer A Receives Message, Ns = 37, Nr = 59.
T = 2.1, Peer A Sends ZLB, Ns = 59, Nr = 38.
T = 2.2, Peer B Receives ZLB, Ns = 59, Nr = 38.
Packet Trace Summary.
Comparing L2TP to TCP.
Three-way Handshake Initiation.
Initial Sequence Numbers.
The Meaning of Sequence Numbers.
Sliding Window.
Comparing L2TP to L2F and PPTP.
Implementation Tip: Checking Sequence Number Ordering.
8. Session Setup.
Incoming Calls.
Incoming Call LAC State Machine.
Incoming Call LNS State Machine.
Outgoing Calls.
Outgoing Call LNS State Machine.
Outgoing Call LAC State Machine.
LCP Considerations.
LAC Frame Inspection and Negotiation/Translation.
Proxy LCP.
Proxy Authentication.
Comparing L2TP to L2F and PPTP.
ImplementationTips.
Including Last-Sent LCP CONFREQ AVPs.
Proxy CHAP Not Secure to LNS.
Tunnel Teardown.
LCP Issues.
9. Data Handling.
PPP Frame Handling.
Synchronous versus Asynchronous Framing.
LNS Frame Handling.
LAC Frame Handling for HDLC.
LAC Frame Handling for non-HDLC.
Tunnel Substrate Considerations.
Packet Delay.
Fragmentation.
Silent Packet Loss.
Reordering and Duplication.
Multilink PPP.
Coincidental MP Tunneling.
Multibox Multilink.
Performance.
Round-Trip Time.
Packet Loss and PPP Protocols with History.
Packet Loss and Packet Reordering Trade-off.
The Trade-Offs in Performance.
Comparing L2TP to L2F and PPTP.
Implementation Tips.
VJ Compression and Silent Packet Loss Is Bad.
Endpoint Discriminator with Coincidentally Tunneled MP.
Backward Compatibility with Draft 12 Data Flow Control.
10. Security.
Control Channel Security.
PPP Security.
Authentication.
Encryption.
L2TP Security Summary.
Weak Connection Authentication.
Limited Encryption Scope.
Poor Encryption Key Management.
No Message Authentication.
No Message Integrity.
No Replay Protection.
Transport Mode IPSEC.
Security Associations.
Connection Authentication.
Encryption.
Authentication/Integrity.
Replay Protection.
L2TP-Specific IPSEC Issues.
L2TP Components and Security Overview.
The LAC/LNS Trust Relationship.
Comparing L2TP to L2F and PPTP.
Implementation Tips.
Avoid or Adjust for PAP.
Trusting Proxy CHAP Challenges.
Randomness.
Keep "Backdoor" Holes in Mind.
Further Reading on IPSEC.
11. SNMP Management.
Interface Layering.
Management Information Base.
l2tpTunnelConfigTable.
l2tpDomainConfigTable.
l2tpDomainStatsTable.
l2tpTunnelStatsTable.
l2tpSessionStatsTable.
Mapping Tables.
12. Future Direction and Resources.
Protocol Summary.
Future Direction.
Resources.
Internet Engineering Task Force.
PPP.
IPSEC.
Bakeoffs.
Appendix: Draft 12 Data Flow Control.
Summary of Implementations.
Receive Window Size AVP in Call Establishment.
R Bit in Data Message Header.
Adaptive Timeouts and Piggybacking.
Draft 12 Specifications.
Glossary.
Bibliography.
Index. 0201604485T04062001
