Cover image for L2TP : implementation and operation
L2TP : implementation and operation
Shea, Richard, 1972-
Personal Author:
Publication Information:
Reading, Mass : Addison-Wesley, [2000]

Physical Description:
xvi, 286 pages : illustrations ; 21 cm.
Format :


Call Number
Material Type
Home Location
Item Holds
TK5105.572 .S54 2000 Adult Non-Fiction Central Closed Stacks

On Order



Layer 2 Tunneling Protocol (L2TP) has emerged as a key technology in the construction of Virtual Private Networks. L2TP provides remote access capabilities to organizations using public networks for internal, private activities. It allows a corporation to retain the advantages of a private network--privacy of communication, access control, and company addressing--while reducing the need to invest heavily in networking infrastructure. L2TP: Implementation and Operation is an essential resource for anyone who works with L2TP and Virtual Private Networks. Written for developers and network managers, the book provides an overview of the protocol, a detailed explanation of L2TP architecture, a step-by-step guide to its implementation, and information on L2TP security and management. You will find useful background on the OSI model, the underlying PPP technology, how L2TP tunnels PPP, and the L2TP LAC and LNS Layer 2 roles. In addition, the book contains detailed information on such topics as: *L2TP deployment models *L2TP tunnel structure, terminology, and function *Protocol state machines *Tunnel authentication and initiation *Header and control message format, including AVP *Control c

Author Notes

Richard Shea was a member of the founding team of New Oak Communications (now merged into Nortel Networks), where he developed PPTP, L2F, and L2TP support. He continues to work with Nortel on VPN/Extranet access products. In addition, he has worked on such technologies as FDDI, Ethernet switching, PPP remote access, and IP routing.




Remote access has become more and more popular as organizations rely increasingly on their data networks. The increasing popularity of telecommuting and the numbers of individuals who are mobile are two strong factors in this trend. In order for organizations to provide traditional remote access, they must research and plan their use and make sizeable capital investments in infrastructure. To begin with, an organization needs to predetermine call capacity because the number of calls that can be simultaneously terminated is a factor in deciding what level of remote access device and how many T1 lines are purchased. The organization's call capacity must be increased to allow for the remote access connections to be made. Remote access connections are generally made via dedicated T1 lines (or T3 lines for very large organizations) connected to the remote access equipment. Next there is the purchase of the remote access equipment consisting of a device that terminates T1 or T3 lines on one side and has a connection to the organization's private network (typically Ethernet) on the other side. Traditional remote access is inflexible, inefficient, and inadequate for accommodating evolving broadband technologies. These technologies provide dedicated access to an Internet Service Provider (ISP), forcing the remote user to tie up his or her traditional phone line to access the private network of an organization. When the legacy phone network is used for remote access, the costs incurred per connection are based on the same rules that are used for voice communications. For mobile users, establishing a remote access connection may mean incurring long distance costs. In addition, evolving broadband communication technologies such as cable modem and Asymmetric Digital Subscriber Line (ADSL) cannot be supported by traditional remote access. By supporting traditional remote access, organizations also incur the ongoing costs involved in supporting the remote access devices, including the upgrade of these devices as technology changes. One good example of why this is a problem is the recent increase in analog connection speeds to 56K access. When the 56K connection speed was first introduced, there were two methods of signaling. Private organizations and Internet Service Providers (ISPs) could not be sure they were choosing the right signaling versions, and only later did equipment become available that could support both 56K signaling methods. The Layer 2 Tunneling Protocol, or L2TP, is aimed squarely at lifting the physical connection burden from the organization. The traditional remote access system is split into two halves. One half is responsible for terminating the physical connections, and the other half provides access to the private network. Conceptually, a line is drawn down the middle of a traditional remote access device; half of the device provides physical call connections, and the other half provides access to the private network communicating over L2TP. With L2TP, analog modem, Integrated Services Digital Network (ISDN), and ADSL connections can be physically terminated by an ISP, and the user data can be carried to a device at the edge of an organization's private network. L2TP client software can also be used to make virtual connections all the way from the remote user device (that is, a PC) to the organization's private network in such a way that the remote user's physical connection is completely independent. Although the outsourced remote access model is the starting point for deploying L2TP, other applications are possible. Essentially any time that running Point-to-Point Protocol (PPP) between two entities over a non-point-to-point connection would be advantageous, L2TP should be used to provide that functionality. This book provides details of L2TP for the individual who will be implementing L2TP in a data communications device. A history of L2TP is also provided, along with comparisons to the protocol's two predecessors, L2F and PPTP. Implementation tips are provided to cover those areas of use that are not readily understandable solely from reading the L2TP technical specification. Audience There are two audiences for this book. The primary audience is those who will be writing L2TP code. The book attempts to provide tips, give history, and logically explain and lay out the architecture for L2TP and the crucial and sometimes subtle interaction between L2TP and the PPP software running over it. The other audience for this book is those considering L2TP for their Virtual Private Network (VPN) deployment. The early chapters on the basics of L2TP and the discussion of security and management will be of particular interest to this reader. Organization The first three chapters are geared to a somewhat general audience. L2TP implementers may simply ignore these chapters if they wish to focus only on the details of L2TP implementation. Chapters 4-10 provide the details of L2TP implementation. These chapters may be skimmed by the reader with only a general interest in the details of the protocol itself. Special attention to Chapter 10 ("Security") should be paid even by the general reader. Chapter 11 ("SNMP Management") may also be of some interest to the general reader, and undoubtedly of interest to the L2TP implementer or the implementer of network management applications for L2TP. Chapter 12 provides resources for learning more about L2TP and gives information on what future work in L2TP is currently under consideration. 0201604485P04062001 Excerpted from L2TP: Implementation and Operation by Richard Shea All rights reserved by the original copyright owners. Excerpts are provided for display purposes only and may not be reproduced, reprinted or distributed without the written permission of the publisher.

Table of Contents

1 Background
Remote Access
Telecommuters-Small Office/Home Office
Remote Office/Branch Office
Virtual Private Networks
Open System Interconnect Model
Point-to-Point Protocol
The Layer 2 Role of PPP
The Layer 3 Role of PPP
Physical Layer Assumptions
Control Protocol Operation
Chronological Operation of PPP
2 L2TP Basics
Layer 2 Role of LAC
Layer 2 Role of LNS
Virtual Layer 1
L2TP Patent Issues
3 L2TP Deployment Models
VPN Deployment Models
LAC Deployment, Distribution, and Support
LNS Deployment, Distribution, and Support
LNS "in the Cloud
"Compulsory versus Voluntary Tunneling
VPN Performance Considerations
Multibox Multilink PPP
Compulsory Tunneling Solution
NAS Pool Solution
Combined VPN Service and LNS Pool Solution
Performance Implications
Comparing L2TP to L2F and PPTP
Asymmetric Digital Subscriber Line Forum Model
Other VPN Technologies
IP Security Protocol
Generic Routing Encapsulation
Mobile IP Protocol
Multiprotocol Label Switching Protocol
Secure Shell Protocol
4 L2TP Protocol Overview
Tunnel Structure and Terminology
Protocol State Machines
The Typical Life of a Tunnel
Protocol Assumptions
Non-IP Operation
Separate LAC and Remote System
Passive LAC Participation
Protocol Difficulties
Multilink PPP
Link Awareness in LNS
A Look Ahead
5 Control Connection State Machine
State Machine
IDLE State
Send SCCRQ Actions
Send SCCN Actions
Notify Sessions Actions
Send SCCRP Actions
Send HELLO Actions
Send StopCNN Actions
Cleanup Actions
Tunnel Authentication
Initiating a Tunnel
Tunnel Initiation Tie Breaker
Comparing L2TP to L2F and PPTP
Implementation Tips
Handling Duplicate Received SCCRQ Messages
Considering Timeout Conditions
6 Data and Control Messages
T Bit
L Bit
F Bit
S Bit
Control Bit Handling and Reserved Bits
Tunnel ID
Call ID
Offset Size
Offset Pad
Control Message Format
Attribute Value Pairs
M Bit
H Bit
Control Bit Handling and Reserved Bits
Overall Length
Vendor ID
Hiding and Unhiding Algorithms
AVP Hiding Algorithm
AVP Unhiding Algorithm
AVP Unhiding Algorithm with No Separate Storage Area
Restrictions on Hiding AVPs
Comparing L2TP to L2F and PPTP
Implementation Tips
Meaning of AVP Mandatory Bit
The Order of AVPs
SCCRQ, SCCRP, and SCCCN AVPs Can Be Hidden
Odd AVP Conditions
7 Control Channel Dynamics
An Overview of the Control Channel
Sequence Number Handling
The Reliable Delivery Sender
The Sender Window
Sender Actions
The IDLE State
Send Msg, Set Timer Actions
The Operating State
Send Msg Actions
The MaxReTx? Predicate
Retransmit, Set New Timeout Actions
Notify State Machine Actions
The Done State
Stop Timer, Free Msg Actions
The Window Empty? Predicate
The New Lead Ack'd Predicate
Free Msg Actions
Restart Timer Actions
The Reliable Delivery Receiver
The RecvMsg Event
The ZLB? Predicate
The In Window? Predicate
ACK Event for Sender Actions
The Duplicate? Predicate
The Ns == Sr? Predicate
Insert in RecvQueue Actions
Send Msg up to SM, Sr++ Actions
The Q Empty? Predicate
The Q Head Ns == Sr? Predicate
Dequeue Head Msg Actions
The Before Window? Predicate
Drop Msg Actions
Note Ack Needed Actions
The Message Delivery Process: An Example
T = 0, LocalMsg for Peer A
T = 1.0
Peer A Retransmits.T = 1.1
Peer B Receives Message with Ns = 58
Nr = 37.T = 1.5
LocalMsg for Peer B.T = 1.6
Peer A Receives Message
Ns = 37
Nr = 59.T = 2.1
Peer A Sends ZLB
Ns = 59
Nr = 38.T = 2.2
Peer B Receives ZLB
Ns = 59
Nr = 38
Packet Trace Summary
Comparing L2TP to TCP
Three-way Handshake Initiation
Initial Sequence Numbers
The Meaning of Sequence Numbers
Sliding Window
Comparing L2TP to L2F and PPTP
Implementation Tip: Checking Sequence Number Ordering
8 Session Setup
Incoming Calls
Incoming Call LAC State Machine
Incoming Call LNS State Machine
Outgoing Calls
Outgoing Call LNS State Machine