[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Bridging non-IP traffic over IPSec
Well, if L2TP will be in Windows 2000, that means that anyone who
wants to support mobile multiprotocol IPSec clients can do PPP, L2TP,
ESP, and the appropriate PPP NCP's. It's all standards-track.
I'm not sure if a different solution for inter-security-gateway
connections is called for? Can vendors of that solution ignore
Windows 2000, and not implement PPP/L2TP?
On the other hand, the larger header overhead of L2TP/UDP makes the
fragmentation mess worse, and with IPX you can't prevent fragmentation
in the intra-security-gateway configuration. GRE does address that.
That's a very real advantage to GRE. Well, it's also a lot simpler to
implement than PPP/L2TP.
Another approach to fixing the L2TP overhead issue would be to resume
the efforts to get a IP Protocol Number that can be used for the L2TP
data channel. It was an area that got attention before, but then was
abandoned due to arguing that L2TP wasn't a general-purpose enough
protocol to deserve an IP Protocol Number. If it becomes important
enough in the IPSec arena, that restriction may no longer hold.
Let's remember that PPP NCP option negotiation is a real operational
benefit.
References: