After l2tp establishing a vpn tunnel, gre is used to transmit l2tp data frames through the tunnel.

L2TP Architecture

The L2TP protocol defines two message types: control messages and data messages that are transmitted between an LAC and an LNS. L2TP uses these two types of messages to expand PPP applications.

• Control message

  Control messages are used to establish, maintain, and tear down tunnels and sessions. L2TP uses retransmission and periodical tunnel connectivity check mechanisms to ensure reliable transmission of control messages. L2TP also supports flow control and congestion control on control messages.

• Data message

  Data messages are used to encapsulate PPP frames and are transmitted over tunnels. Data messages are transmitted over an unreliable channel without flow control, congestion control, and retransmission mechanisms.

Figure 1-3 illustrates the relationship between PPP packets, control messages, and data messages.

Figure 1-3  L2TP architecture

Control messages encapsulated with L2TP headers are transmitted over a reliable L2TP control channel on an IP network.

Data messages carrying PPP frames are transmitted over an unreliable data channel. PPP frames are encapsulated using L2TP and then transmitted over an IP network.

The well-known UDP port for L2TP is 1701, which is only used in initial stage of tunnel setup. The L2TP tunnel initiator randomly selects an idle port to forward packets to port 1701 of the receiver. After receiving the packets, the receiver randomly selects an idle port to forward packets to the port selected by the initiator. Both ends use the selected ports to communicate until the tunnel is disconnected.

L2TP Packet Structure

Figure 1-4 shows the format of an L2TP packet, which is generated by encapsulating a PPP frame initiated by a remote dial-up user.

Figure 1-4  Format of an L2TP packet

After L2TP encapsulation, an L2TP packet has 38 bytes more than the original packet. (If an L2TP packet carries sequence number information, it has 42 bytes more than the original packet.) If the length of the encapsulated packets exceeds the MTU of the outbound interface, the device must be able to fragment the IP packets because L2TP does not support packet fragmentation. The receiver end reassembles fragmented packets into L2TP packets.

L2TP Packet Encapsulation

As an expansion to PPP, L2TP allows PPP packets to be transmitted through tunnels over the public network.

If only PPP is deployed on the network, dial-up calls initiated by PPP terminals can only reach the edge node NAS of the dial-up network. The NAS is the termination point of PPP sessions. When L2TP is deployed, PPP packets can be transparently transmitted over the public network and reach the LNS in the enterprise headquarters. In this case, the LNS is the termination point of PPP sessions.

Figure 1-5  L2TP packet encapsulation

As shown in Figure 1-5, packets are sent from a branch to the headquarters following the process as follows:

1. PPP terminal: encapsulates IP packets with PPP at the link layer and sends the packets.
2. LAC: receives PPP packets and determines whether access users are VPDN users based on user names or domain names carried in the packets.
   • If they are VPDN users, the LAC adds L2TP headers to PPP packets and then adds UDP and IP headers to the packets based on the public network address of the LNS. The outer layer of the encapsulated packets is the IP address of the public network address. The packets are forwarded over the public network to the LNS.
   • If they are non-VPDN users, the LAC decapsulates PPP packets. In this case, the LAC is the termination point of PPP sessions.
3. LNS: receives L2TP packets and removes IP, L2TP, and PPP headers to obtain IP packets sent by PPP terminals. The LNS searches the routing table for the destination host in the headquarters based on the destination address contained in the packets.

When the destination host sends response packets to the branch device, the LNS searches the routing table for the outbound interface and encapsulated the packet with L2TP in a similar process.

L2TP Packet Transmission

L2TP tunnel connections and session connections must be set up before PPP packets can be transmitted. L2TP connections are initiated for the first time according to the following procedure:

1. Setting an L2TP tunnel connection

   After receiving a PPP negotiation request from a remote user, the LAC initiates an L2TP connection request to the LNS. The LAC and LNS exchange control messages to negotiate the tunnel ID and tunnel authentication information. After negotiation succeeds, an L2TP tunnel is set up and it is identified by a tunnel ID.

2. Setting an L2TP session connection

   After an L2TP tunnel is set up, the LAC and LNS exchange control messages to negotiate the session ID. The L2TP session carries LCP negotiation information and authentication information. After authenticating such information, the LNS informs the LAC that a session is set up. An L2TP session connection is identified by a session ID.

3. Transmitting PPP packets

   After an L2TP session connection is set up successfully, the PPP terminal sends data packets to the LAC. The LAC encapsulates the packets based on the tunnel ID and session ID and sends the packets to the LNS. The LNS decapsulates the packets and sends the packets to the destination host by searching for the host address in the routing table.

What two different types of encryption can be used by IPsec during data transfer?

Which file transfer protocol has no authentication or security for transferring files uses UDP and requires very little memory use?

At what layer of the OSI model does the IPsec encryption protocol operate?

What term is used to describe a space that is rented at a data center facility?