computer network A computer network is a set of computers sharing resources located on or provided by network nodes. The computers use common communication protocols over digital interconnections to communicate with each other. These interconnections ar ...

ing, Layer 2 Tunneling Protocol (L2TP) is a

tunneling protocol In computer networks, a tunneling protocol is a communication protocol which allows for the movement of data from one network to another. It involves allowing private network communications to be sent across a public network (such as the Internet ...

used to support virtual private networks (VPNs) or as part of the delivery of services by ISPs. It uses encryption ('hiding') only for its own control messages (using an optional pre-shared secret), and does not provide any

encryption In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can dec ...

confidentiality Confidentiality involves a set of rules or a promise usually executed through confidentiality agreements that limits the access or places restrictions on certain types of information. Legal confidentiality By law, lawyers are often required ...

of content by itself. Rather, it provides a tunnel for Layer 2 (which may be encrypted), and the tunnel itself may be passed over a Layer 3 encryption protocol such as

IPsec In computing, Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in ...

History

Published in 2000 as proposed standard RFC 2661, L2TP has its origins primarily in two older tunneling protocols for point-to-point communication:

Cisco Cisco Systems, Inc., commonly known as Cisco, is an American-based multinational corporation, multinational digital communications technology conglomerate (company), conglomerate corporation headquartered in San Jose, California. Cisco develo ...

's Layer 2 Forwarding Protocol (L2F) and

Microsoft Microsoft Corporation is an American multinational corporation, multinational technology company, technology corporation producing Software, computer software, consumer electronics, personal computers, and related services headquartered at th ...

's Point-to-Point Tunneling Protocol (PPTP). A new version of this protocol, L2TPv3, appeared as proposed standard RFC 3931 in 2005. L2TPv3 provides additional security features, improved encapsulation, and the ability to carry data links other than simply Point-to-Point Protocol (PPP) over an

IP network The Internet protocol suite, commonly known as TCP/IP, is a framework for organizing the set of communication protocols used in the Internet and similar computer networks according to functional criteria. The foundational protocols in the suit ...

(for example:

Frame Relay Frame Relay is a standardized wide area network (WAN) technology that specifies the physical and data link layers of digital telecommunications channels using a packet switching methodology. Originally designed for transport across Integrated ...

Ethernet Ethernet () is a family of wired computer networking technologies commonly used in local area networks (LAN), metropolitan area networks (MAN) and wide area networks (WAN). It was commercially introduced in 1980 and first standardized in ...

ATM ATM or atm often refers to: * Atmosphere (unit) or atm, a unit of atmospheric pressure * Automated teller machine, a cash dispenser or cash machine ATM or atm may also refer to: Computing * ATM (computer), a ZX Spectrum clone developed in Mo ...

, etc.).

Description

The entire L2TP packet, including payload and L2TP header, is sent within a

User Datagram Protocol In computer networking, the User Datagram Protocol (UDP) is one of the core communication protocols of the Internet protocol suite used to send messages (transported as datagrams in packets) to other hosts on an Internet Protocol (IP) networ ...

(UDP) datagram. A virtue of transmission over UDP (rather than TCP) is that it avoids the "TCP meltdown problem". It is common to carry PPP sessions within an L2TP tunnel. L2TP does not provide confidentiality or strong authentication by itself.

is often used to secure L2TP packets by providing confidentiality, authentication and integrity. The combination of these two protocols is generally known as L2TP/IPsec (discussed below). The two endpoints of an L2TP tunnel are called the L2TP access concentrator (LAC) and the L2TP network server (LNS). The LNS waits for new tunnels. Once a tunnel is established, the network traffic between the peers is bidirectional. To be useful for networking, higher-level protocols are then run through the L2TP tunnel. To facilitate this, an L2TP ''session'' is established within the tunnel for each higher-level protocol such as PPP. Either the LAC or LNS may initiate sessions. The traffic for each session is isolated by L2TP, so it is possible to set up multiple virtual networks across a single tunnel. The packets exchanged within an L2TP tunnel are categorized as either ''control packets'' or ''data packets''. L2TP provides reliability features for the control packets, but no reliability for data packets. Reliability, if desired, must be provided by the nested protocols running within each session of the L2TP tunnel. L2TP allows the creation of a virtual private dialup network (VPDN) to connect a remote client to its corporate network by using a shared infrastructure, which could be the Internet or a service provider's network.

Tunneling models

An L2TP tunnel can extend across an entire PPP session or only across one segment of a two-segment session. This can be represented by four different tunneling models, namely: *voluntary tunnel *compulsory tunnel — incoming call *compulsory tunnel — remote dial *L2TP multihop connectionIBM Knowledge Center: L2TP multi-hop connection
/ref>

L2TP packet structure

An L2TP packet consists of : Field meanings: ; Flags and version: control flags indicating data/control packet and presence of length, sequence, and offset fields. ; Length (optional): Total length of the message in bytes, present only when length flag is set. ; Tunnel ID: Indicates the identifier for the control connection. ; Session ID: Indicates the identifier for a session within a tunnel. ; Ns (optional): sequence number for this data or control message, beginning at zero and incrementing by one (modulo 2¹⁶) for each message sent. Present only when sequence flag set. ; Nr (optional): sequence number for expected message to be received. Nr is set to the Ns of the last in-order message received plus one (modulo 2¹⁶). In data messages, Nr is reserved and, if present (as indicated by the S bit), MUST be ignored upon receipt.. ;Offset Size (optional): Specifies where payload data is located past the L2TP header. If the offset field is present, the L2TP header ends after the last byte of the offset padding. This field exists if the offset flag is set. ;Offset Pad (optional): Variable length, as specified by the offset size. Contents of this field are undefined. ;Payload data: Variable length (Max payload size = Max size of UDP packet − size of L2TP header)

L2TP packet exchange

At the time of setup of L2TP connection, many control packets are exchanged between server and client to establish tunnel and session for each direction. One peer requests the other peer to assign a specific tunnel and session id through these control packets. Then using this tunnel and session id, data packets are exchanged with the compressed PPP frames as payload. The list of L2TP Control messages exchanged between LAC and LNS, for handshaking before establishing a tunnel and session in voluntary tunneling method are

L2TP/IPsec

Because of the lack of confidentiality inherent in the L2TP protocol, it is often implemented along with

. This is referred to as L2TP/IPsec, and is standardized in

IETF The Internet Engineering Task Force (IETF) is a standards organization for the Internet and is responsible for the technical standards that make up the Internet protocol suite (TCP/IP). It has no formal membership roster or requirements and ...

RFC 3193. The process of setting up an L2TP/IPsec VPN is as follows: #Negotiation of IPsec

security association A security association (SA) is the establishment of shared security attributes between two network entities to support secure communication. An SA may include attributes such as: cryptographic algorithm and mode; traffic encryption key; and parame ...

(SA), typically through ''

Internet key exchange In computing, Internet Key Exchange (IKE, sometimes IKEv1 or IKEv2, depending on version) is the protocol used to set up a security association (SA) in the IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP.The Internet Key Exc ...

'' (IKE). This is carried out over UDP port 500, and commonly uses either a shared password (so-called "

pre-shared key In cryptography, a pre-shared key (PSK) is a shared secret which was previously shared between the two parties using some secure channel before it needs to be used. Key To build a key from shared secret, the key derivation function is typically u ...

s"), public keys, or X.509 certificates on both ends, although other keying methods exist. #Establishment of Encapsulating Security Payload (ESP) communication in transport mode. The IP protocol number for ESP is 50 (compare TCP's 6 and UDP's 17). At this point, a secure channel has been established, but no tunneling is taking place. #Negotiation and establishment of L2TP tunnel between the SA endpoints. The actual negotiation of parameters takes place over the SA's secure channel, within the IPsec encryption. L2TP uses UDP port 1701. When the process is complete, L2TP packets between the endpoints are encapsulated by IPsec. Since the L2TP packet itself is wrapped and hidden within the IPsec packet, the original source and destination IP address is encrypted within the packet. Also, it is not necessary to open UDP port 1701 on firewalls between the endpoints, since the inner packets are not acted upon until after IPsec data has been decrypted and stripped, which only takes place at the endpoints. A potential point of confusion in L2TP/IPsec is the use of the terms tunnel and secure channel. The term tunnel-mode refers to a channel which allows untouched packets of one network to be transported over another network. In the case of L2TP/PPP, it allows L2TP/PPP packets to be transported over IP. A secure channel refers to a connection within which the confidentiality of all data is guaranteed. In L2TP/IPsec, first IPsec provides a secure channel, then L2TP provides a tunnel. IPsec also specifies a tunnel protocol: this is not used when a L2TP tunnel is used.

Windows implementation

Windows has had native support (configurable in control panel) for L2TP since

Windows 2000 Windows 2000 is a major release of the Windows NT operating system developed by Microsoft and oriented towards businesses. It was the direct successor to Windows NT 4.0, and was released to manufacturing on December 15, 1999, and was official ...

Windows Vista Windows Vista is a major release of the Windows NT operating system developed by Microsoft. It was the direct successor to Windows XP, which was released five years before, at the time being the longest time span between successive releases of ...

added 2 alternative tools, an MMC snap-in called "Windows Firewall with Advanced Security" (WFwAS) and the " netsh advfirewall" command-line tool. One limitation with both of the WFwAS and netsh commands is that servers must be specified by IP address.

Windows 10 Windows 10 is a major release of Microsoft's Windows NT operating system. It is the direct successor to Windows 8.1, which was released nearly two years earlier. It was released to manufacturing on July 15, 2015, and later to retail on ...

added the
Add-VpnConnection
and
Set-VpnConnectionIPsecConfiguration

PowerShell PowerShell is a task automation and configuration management program from Microsoft, consisting of a command-line shell and the associated scripting language. Initially a Windows component only, known as Windows PowerShell, it was made open-sou ...

commands. A registry key must be created on the client and server if the server is behind a NAT-T device

L2TP in ISPs' networks

L2TP is often used by ISPs when internet service over for example

ADSL Asymmetric digital subscriber line (ADSL) is a type of digital subscriber line (DSL) technology, a data communications technology that enables faster data transmission over copper telephone lines than a conventional voiceband modem can provide. ...

or cable is being ''resold''. From the end user, packets travel over a wholesale network service provider's network to a server called a Broadband Remote Access Server ( BRAS), a protocol converter and router combined. On legacy networks the path from end user customer premises' equipment to the BRAS may be over an

network. From there on, over an IP network, an L2TP tunnel runs from the BRAS (acting as LAC) to an LNS which is an edge router at the boundary of the ultimate destination ISP's IP network. Se
example of reseller ISPs using L2TP

RFC references

* ''Cisco Layer Two Forwarding (Protocol) "L2F"'' (a predecessor to L2TP) * ''Point-to-Point Tunneling Protocol (PPTP)'' * ''Layer Two Tunneling Protocol "L2TP"'' * ''Implementation of L2TP Compulsory Tunneling via RADIUS'' * ''Secure Remote Access with L2TP'' * ''Layer Two Tunneling Protocol (L2TP) over Frame Relay'' * ''L2TP Disconnect Cause Information'' * ''Securing L2TP using

'' * ''Layer Two Tunneling Protocol (L2TP): ATM access network'' * ''Layer Two Tunneling Protocol (L2TP) Differentiated Services'' * ''Layer Two Tunneling Protocol (L2TP) Over ATM Adaptation Layer 5 (AAL5)'' * ''Layer Two Tunneling Protocol "L2TP" Management Information Base'' * ''Layer Two Tunneling Protocol Extensions for PPP Link Control Protocol Negotiation'' * ''Layer Two Tunneling Protocol (L2TP) Internet Assigned Numbers: Internet Assigned Numbers Authority (IANA) Considerations Update'' * ''Signaling of Modem-On-Hold status in Layer 2 Tunneling Protocol (L2TP)'' * ''Layer 2 Tunneling Protocol (L2TP) Active Discovery Relay for PPP over Ethernet (PPPoE)'' * ''Layer Two Tunneling Protocol - Version 3 (L2TPv3)'' * ''Extensions to Support Efficient Carrying of Multicast Traffic in Layer-2 Tunneling Protocol (L2TP)'' * ''Fail Over Extensions for Layer 2 Tunneling Protocol (L2TP) "failover"''

References

External links

Implementations

*Cisco
Cisco L2TP documentation
also rea

*Open source and Linux
xl2tpdLinux RP-L2TPOpenL2TPl2tpnsl2tpd
(inactive)
Linux L2TP/IPsec serverFreeBSD multi-link PPP daemonOpenBSD npppd(8)ACCEL-PPP - PPTP/L2TP/PPPoE server for Linux
*Microsoft: built-in client included with Windows 2000 and higher
Microsoft L2TP/IPsec VPN Client
for Windows 98/Windows Me/Windows NT 4.0 *Apple: built-in client included with Mac OS X 10.3 and higher.

Other

IANA assigned numbers for L2TP
- ''(where future standardization work is being coordinated)''
L2TP/IPSec with OpenBSD and npppdComparison of L2TP, PPTP and OpenVPN
{{Authority control Internet protocols Internet Standards Tunneling protocols Virtual private networks