Mar 27, 2000IETF 47 - Pyda Srisuresh1 Secure Remote Access with L2TP Pyda Srisuresh

Mar 27, 2000IETF 47 - Pyda Srisuresh2 Enterprise Trust Model Enterprise Intranet is trusted. Direct-Dial (PSTN) PPP/IP access is an extension of Intranet and is also trusted. Employees (on-site or remote) are trusted. L2TP/PPP/IP over a public Internet cannot be trusted because: –LAC & LNS are not in the same administrative domain. –Employee-to-Enterprise IP traffic can be prone to security violation by the Internet or the LAC.

Mar 27, 2000IETF 47 - Pyda Srisuresh3 Remote Access Server highlights Provides link-level authentication, authorization and accounting services. Static/Dynamic IP address assignment to remote user from an enterprise address pool. Provides host-route connectivity to remote user and monitors link status. Uses RADIUS to provide the AAA services so it can scale to large no. of remote users.

Mar 27, 2000IETF 47 - Pyda Srisuresh4 LNS as a NAS L2TP control messages allow an LNS to be virtually same as a NAS that physically terminates PPP sessions. L2TP adds tunneling overhead reducing the effective throughput and path MTU size. Remote user IP packets (embedded in PPP and transported over a public Internet) fail the enterprise trust model.

Mar 27, 2000IETF 47 - Pyda Srisuresh5 SRAS extensions to LNS LNS & IPsec Security gateway functions reside on the same SRAS node. 3 new security parameters configurable on a per-user basis on RADIUS. End user IP data traffic can be guaranteed to be IPsec secure (user-to-SRAS) in both directions with no additional admin. setups. IPsec/IKE SA monitoring can be linked to the virtual PPP link staying alive.

Mar 27, 2000IETF 47 - Pyda Srisuresh6 Proposed RADIUS parameters IPSEC_MANDATE - Mandate IPsec security on the user-to-SRAS data traffic. None (=0) - Not required. LNS_AS_RAS (=1) - Required when terminating on an LNS (i.e., virtual NAS). SRAS(=2) - Required on any NAS. SECURITY_PROFILE - An IPsec security profile name containing the following: Access control security filters Security preferences for Security Assocations Secury Key generation source - Manual or IKE Backup-NAT devices Management utilities enforcing NAT policies

Mar 27, 2000IETF 47 - Pyda Srisuresh7 Proposed RADIUS parameters cont. IKE_NEGOTIATION_PROFILE - An IKE negotiation profile name containing the following: IKE ID of the user and SRAS Preferred authentication approach and the associated parameters such as Pre-Shared-Key (or) a pointer to X.509 digital certificate ISAKMP security negotiation preferences for phase I

Mar 27, 2000IETF 47 - Pyda Srisuresh8 Limitations to SRAS approach IPsec Tunneling overhead on top of L2TP tunneling overhead further reduces throughput and effective path MTU size. Multiple IDentity and authentication requirements on end-user. Link level authentication is prone to session stealing over the Internet, unless better link authentication schemes are employed.