TCP/IP Tutorial and Technical Overview - IBM Redbooks

22.14.2 Protocol overview
Because the host and the gateway share the same PPP connection, they can
take advantage of PPP's ability to transport protocols other than just IP. For
example, L2TP tunnels can support remote LAN access as well as remote IP
access. Figure 22-53 outlines a basic L2TP configuration.
Internet
LNS LAC
ISP
L2TP Tunnel
PPP Connection
Figure 22-53 Layer 2 Tunnel Protocol (L2TP) scenario
Dial
Connection
Referring to Figure 22-53, the following actions occur:
1. The remote user initiates a PPP connection.
2. The NAS accepts the call.
3. The NAS identifies the remote user using an authorization server.
4. If the authorization is OK, the NAS/LAC initiates an L2TP tunnel to the desired
LNS at the entry to the enterprise.
5. The LNS authenticates the remote user through its authentication server and
accepts the tunnel.
6. The LNS confirms acceptance of the call and the L2TP tunnel.
7. The NAS logs the acceptance.
8. The LNS exchanges PPP negotiation with the remote user.
9. End-to-end data is now tunneled between the remote user and the LNS.
L2TP is actually another variation of an IP encapsulation protocol. As shown in
Figure 22-54 on page 878, an L2TP tunnel is created by encapsulating an L2TP
frame inside a UDP packet, which in turn is encapsulated inside an IP packet
whose source and destination addresses define the tunnel's endpoints. Because
the outer encapsulating protocol is IP, clearly IPSec protocols can be applied to
this composite IP packet, thus protecting the data that flows within the L2TP
tunnel. AH, ESP, and ISAKMP/Oakley protocols can all be applied in a
straightforward way.
Chapter 22. TCP/IP security 877