Hot answers tagged

9

L2tp and GRE are totally diffrent protocols GRE is a simple IP packet encapsulation protocol. a GRE tunnel is used when packets need to be sent from one network to another, without being parsed or treated like IP packets by any intervening routers. a GRE tunnel interface comes up as soon as it is configured and it stays up as long as there is a valid ...


7

The most and noticeable different is layer of tunneling. PPPOE is a Layer 2 (Data Link Layer) tunneling protocol while L2TP is a Layer 3 (Network Layer) tunneling protocol. This means that PPPOE can create a tunnel between devices in a broadcast domain (such as devices connect to the same switch) but L2TP can create a tunnel between two IP-based device ...


6

PPTP, PPPoE, and L2TP all provide OSI Layer 2 services. That is, the user of these protocols (usually, a network layer protocol suite) thinks it's running over a "normal" link layer. However, each of these protocols provides the link layer service by transporting packets over another service, rather than over the physical layer. PPTP provides PPP (link ...


5

You should turn loop guard on those ports... if rstp blocks a port and looses bpdus, it will unblock and form an unmanaged loop unless stp loopguard is on the port. If an rstp port looses bpdus on a loopguard port, the port will disable in a loop inconsistent state until it starts receiving bpdus again.


4

Let's say that it is a 'new protocol heavily based on L2TPv2'. It shares a lot of the messages, constructs, flows with L2TPv2 but it is not strictly backwards compatible. It does have an L2TP 'compatibility' scheme as indicated in section 4.7 of the RFC, but that comes with limitations. The most significant changes are actually listed directly in the RFC: ...


4

In real life, you can't stick to the OSI model entirely. It's helpful and necessary as a guide on how to structure the components in a complex network but you can't always say that's layer x. Tunneling is wrapping packets or frames from one layer and using another transport mechanism to transport them where you need them. At the tunnel end you unwrap the ...


4

Fixed layer count models and tunneling don't match up very well. Our stack might look something like. Appliction data. TCP (inner network) IP (inner network) Ethernet framing (inner network) L2TPv3 UDP (outer network) IP (outer network) Ethernet framing (outer network) Ethernet medium access control Ethernet physical What layer we regard L2TP as depends ...


4

Testing that kind of features using GNS3 is simply waste of time. You're emulating at run-time complex software, and on top of that, you're adding complex features. There's no sense in 'trying' 7200 as 7200 are long EoS: http://www.cisco.com/c/en/us/products/collateral/routers/7200-series-routers/end_of_life_c51-681414.html Download CSR 1000v and test in ...


3

The same question was asked on the Information Security SE. Here's my answer to that question: L2TP/IPSec uses IPsec to protect the L2TP tunnel. So the real question is, why use L2TP? Layer two tunneling protocol, as the name implies, provides a layer 2 link over an arbitrary L3 network. So, for example, if you needed to have a single VLAN ...


3

PPP is independent of the underlying transport, PPPoE requires to be run on Ethernet (or a like tunnel). But of course, you can also run L2TP with PPPoE (RFC 3817).


3

Note that layer three and above protocols can be encapsulated inside the protocols you mention but not layer two (or below). One way to look at it is that you build a protocol stack from the bottom up. So first we put down layers 1, 2, and 3. Then for layer 4 we put PPTP (for example) and that starts a NEW layer 2 on top of (inside of) the "real" layers 1, 2,...


2

Or does it use the MAC address of the router as the destination of its frame? Yes, that's exactly right. The VPN router typically utilizes proxy ARP to answer ARP queries on behalf of the actual destination host. When the packets are received by the router, they're forwarded on to the actual destination host. From Wikipedia: Proxy ARP is a technique ...


2

Looking over the config you provided, it appears that your split tunnel ACL is only allowing connection to the 192.168.20.x adresses: access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0 access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.20.0 255.255.255.224 Your ACL should have an entry for every network to ...


2

You need to set up split-tunneling on ASA. That will allow you being able to access the Internet whilst using the tunnel. By default you shouldn't ever use "Default Gateway on Remote Network", so untick it.


2

Well, You can extend the LANs with L2TPv3 and protect the setup with IPsec. Here's example configuration: https://www.softether.org/index.php?title=4-docs/2-howto/L2TP//IPsec_Setup_Guide_for_SoftEther_VPN_Server/Cisco_IOS_L2TPv3//IPsec_Edge-VPN_Router_Setup And here's another one, modern, using FlexVPN - unfortunately, depending on your IOS version, you ...


2

Tunneling protocols like L2TP, GRE, IPSEC and MPLS don't fit well into the OSI model. L2TP tunnels (encapsulates) L2 frames in UDP so it can be transported over layer 3.


2

K, it turned out that the version I was using is no longer supported! using the latest stable release I managed to achieve the L2TPv3 tunnel and pass traffic through it.


2

As mentioned here, Juniper SRX cannot act as L2TP client.


1

Forget L2 VPN, it doesn't scale. Use routed/L3 VPN. Create a global addressing plan, so customer networks are all uniquely addressed. Allow space for future growth. If there's ambiguity, resolve it by renumbering. This actually spares you a great deal of pain later on. You will need a VPN gateway at each location, IPsec preferred. Connect all customers per ...


1

There are at least three ways I can think of to fix this issue, and I would attempt a solution in the following order: Craft your NAT statements differently (or remove the applicable NAT) so that the VPN clients do not have a static NAT when talking with location A. This would effectively cause the traffic to get NATted and would break it. Apply the vpn-...


1

L2tp is primarily for vpn it is a combination of pptp and cisco's l2f or layer 2 forwarding. GRE is cisco's generic route epcapsulation basically creating an ip tunnel to carry "other" traffic accross an ip backbone. it must be terminated on the outside or closet points of the tunnel.


1

To put it simply, tunneling is the process of encapsulating data (think of it as putting inside a capsule) into another form of data so the network devices directly interact with the outside capsule... The easiest concept of encapsulation to explain is a VPN encrypted tunnel(Virtual Private Network) where the original data is concealed in the header of ...


1

So I have found the answer a year later while I was reading about IKEv1 vs IKEv2. L2TP/IPSec makes it possible to use a username/password, because L2TP is built on top of ppp. With GRE, that wouldn't be possible to authenticate with a username/password. In IKEv2, you can use a username/password directly, so there is no need for L2TP.


1

I found the problem. I did not think this would be it so I overlooked it multiple times but after trying it, it worked. I feel so silly now. On the virtual template 1 I changed ppp authentication ms-chap-v2 remote-access To this ppp authentication ms-chap ms-chap-v2 remote-access VPN connects and all is working.


1

I was in contact with ubiquiti support and got this response: Unfortunately, it isn't possible to configure the remote access VPN (L2TP/IPSEC) on Edgerouter to work when the client is not behind NAT.


1

I'm not very familiar with Cisco, but is it possible that you need to use "secret" instead of password @l2tp-class?


Only top voted, non community-wiki answers of a minimum length are eligible