TCP/IP Tutorial and Technical Overview - IBM Redbooks

EAP typically runs over the link layer and has a number of deployment solutions
including:
► EAP MD5
► EAP-Tunneled TLS (EAP-TTLS)
► Lightweight EAP (LEAP)
► Protected EAP (PEAP)
When used in wireless communications, IEEE 802.1x defines how EAP is
encapsulated in LAN frames. The wireless EAP solution is typically activated
when a user connects to wireless access point (AP) and enters in authentication
credentials. The AP verifies the identity of the user through a RADIUS server
and, if the credentials are approved, access is granted to the user.
For further EAP details, refer to Chapter 23, “Port based network access control”
on page 889.
22.14 Layer 2 Tunneling Protocol (L2TP)
L2TP permits the tunneling of PPP. Any protocol supported by PPP can be
tunneled. This protocol extends the span of a PPP connection. Instead of
beginning at the remote host and ending at a local ISP's point of presence (PoP),
the virtual PPP link now extends from the remote host all the way back to the
corporate gateway. L2TP tunneling is currently supported over IP/UDP. The
specification is in RFC 2661.
L2TP is a consensus standard that came from the merging of two earlier
tunneling protocols: Point-to-Point Tunneling Protocol (PPTP) and Layer 2
Forwarding (L2F, described in RFC 2341). These earlier protocols did not
provide as complete a solution as the L2TP protocol; one addresses tunnels
created by ISPs and the other addresses tunnels created by remote hosts. L2TP
supports both host-created and ISP-created tunnels.
L2TP adds the ability to create a virtual private network where multiple protocols
and privately addressed IP, IPX, and AppleTalk (AT) are allowed. In addition,
L2TP gives remote users the ability to connect to a local ISP and tunnel through
the Internet to a home network, avoiding long distance charges. It also provides
a mechanism on which to solve the multiple box PPP multilink problem. (Calls
connecting to different physical routers that are destined for the same MP bundle
can be tunneled to the same endpoint where MP can be terminated for all links.)
Chapter 22. TCP/IP security 875