[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

PPP over IPSec (Re: Windows 2000 and Cicsco router interoperability)

"W. Mark Townsley" wrote:
> 
> Let's talk facts again. On a highly scaled, high bandwidth system,
> header size becomes increasingly less important. Over slow dialup lines,
> of course, it is worthwhile to try and get the header as small as
> possible. Negotiate PPP ACFC and PFC, and you get 1 byte of PPP header.
> L2TP's typical header for a voluntary tunnel would be either 6 bytes, or
> perhaps even 1 byte if you perform l2tphc.
> 
> 2 bytes (or even 7 bytes w/o l2tphc) of overhead for l2tp and ppp is
> small potatoes compared to ESP tunnel mode on each packet.
> 
> Also, you get all sorts of nifty things that PPP is working on to reduce
> overhead. For instance, draft-ietf-pppext-pppmux-00.txt allows you to
> frame small packets into a single PPP frame. Given IPsec's large header,
> multiplexing small packets into a single frame before encrypting and
> tunneling could result in a *significant* header overhead reduction.
> Care to add that to IPsec's repertoire of features too?
> 

I agree fully that having PPP for remote access provides with
tangible benefits. Something like IPX transport would even be useful
in a gateway to gateway case. It would be very inefficient for IETF
to respecify everything for IPSec without PPP. (This is not to say
that some non-PPP, non-L2TP remote access solution should not be created.)

What I disagree with is putting L2TP between PPP and IPSec. So far
the only reason I've been offered for doing so is that PPP breaks if
the packets are re-ordered during transit. L2TP has a lot of functionality,
but it's all irrelevant if you just want to have a link where the IPSec
and PPP endpoints coincide. (Anyone wanting to do compulsory tunneling
would of course be free to use PPP/L2TP/IPSec.)

I would be very happy to see a standards track RFC that describes
a lightweight method for running PPP over IPSec, usable in a voluntary
tunneling case. The PPP over IPSec combination should be negotiable
through IKE, IKE access controls should apply to whatever traffic comes
out of / goes into PPP, i.e. actual customer traffic.

-- 
Ari Huttunen                   phone: +358 9 859 900
Senior Software Engineer       fax  : +358 9 8599 0452

F-Secure Corporation       http://www.F-Secure.com 

F-Secure products: Integrated Solutions for Enterprise Security
Follow-Ups: References: