IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
- which transport protocol is used and to which protocol layer (OSI layer)
they must be assigned (see also S 4.90 Use of cryptographic procedures on
the various layers of the ISO/OSI reference model);
- which protocols can be transmitted over the tunnel connection;
- which cryptographic procedures for implementing the tunnel are supported;
- whether the tunnel end points are authenticated;
- and whether it is possible to have several parallel tunnels on one instance
of the transport protocol used.
The tunnel protocol is essentially responsible for
- management of the tunnel(s): establishment, maintenance and termination,
- negotiation of the cryptographic procedures to be used to implement the
tunnel: key exchange procedures, encryption procedures and signature
procedures,
- assembly and disassembly of the data packets of the protocols which can
be transmitted through the tunnel, and
- encryption and decryption of the data packets.
In the RAS environment, the following tunnel protocols have been
established:
- Layer 2 protocols:
- Point to Point Tunnelling Protocol (PPTP) and
- Layer 2 Tunnelling Protocol (L2TP): L2TP is a combination of
PPTP and the Layer 2 Forwarding (L2F) protocol developed by
Cisco which forwards Point to Point Protocol (PPP) packets from a
PPP server over a WAN connection to an L2F-capable router which
then disassembles them and feeds them into a network.
- The Layer 3 specification IPsec (Internet Protocol Security).
The protocols possess the characteristics summarised in the following table.
Tunnel
protocol
Layer Transported
protocols
PPTP 2 IP, IPX,
NetBEUI
L2TP 2 IP, IPX,
NetBEUI
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Required
underlying
protocol
Number of
tunnels
supported
IP 1 No
IP, X.25, Frame
Relay, ATM
Several Yes
IPsec 3 IP IP 1 Yes
Tunnel
authentic
ation
All the protocols can establish secure connections to a LAN over an insecure
switched network through the use of cryptographic procedures, thus protecting
the confidentiality and integrity of the data. Depending on the particular
protocol, it is possible to establish one or more tunnel connections.