Layer 2 Tunneling Protocol (L2TP) is an IETF open standard that overcomes many of the problems
of PPTP. Its design is a combination of Layer 2 Forwarding (L2F) protocol and PPTP, making use of
the best features of both. Since the L2TP standard does not implement encryption, it is usually
implemented with an IETF standard known as L2TP/IPsec, in which L2TP packets are
encapsulated by IPsec.
The client communicates with a Local Access Concentrator (LAC) and the LAC communicates
across the Internet with a L2TP Network Server (LNS). The NetDefend Firewall acts as the LNS. The
LAC tunnels data, such as a PPP session, using IPsec to the LNS across the Internet. In most cases
the client will itself act as the LAC.
L2TP is certificate based and therefore is simpler to administer with a large number of clients and
arguably offers better security than PPTP. Unlike PPTP, it is possible to set up multiple virtual
networks across a single tunnel. Because it is IPsec based, L2TP requires NAT traversal (NAT-T) to
be implemented on the LNS side of the tunnel.
The Outer Interface Filter can be specified to be an IPsec tunnel object. If this is done then the
tunnel should not have the Dynamically add route to remote network option enabled since
this can cause problems.
Note: All DHCP special parameters are not sent to clients
When DHCP is configured on an L2TP/IPsec interface to hand out client IPs,
NetDefendOS does not return all the DHCP special parameters. This can be the source of
issues with Windows based L2TP clients running under Vista or Windows 7.
Example 9.13. Setting up an L2TP server
This example shows how to set up a L2TP Network Server. The example assumes that you have
created some IP address objects. You will have to specify the IP address of the L2TP server
interface, an outer IP address (that the L2TP server should listen to) and an IP pool that the L2TP
server will use to give out IP addresses to the clients from.
Command-Line Interface
gw-world:/> add Interface L2TPServer MyL2TPServer
ServerIP=wan_ip
Interface=any
IP=ip_l2tp
IPPool=L2TP_Pool
TunnelProtocol=L2TP
AllowedRoutes=all-nets
Web Interface
1. Go to: Network > Interfaces and VPN > PPTP/L2TP Servers > Add > PPTP/L2TP Server
2. Enter a suitable name for the L2TP Server, for example MyL2TPServer
3. Now enter:
• Inner IP Address: ip_l2tp
• Tunnel Protocol: L2TP
• Outer Interface Filter: any
Chapter 9: VPN
731
To Next Page
Loading...
