3Com 10014299 manual Methods of Implementing Vpdn, L2TP channel

602CHAPTER 43: CONFIGURING L2TP

Methods of Implementing VPDN

Figure 179 Networking diagram of typical VPDN application

Remote users

PC		LNS
LAC	Internet backbone
PSTN/ISDN	network
Access server	L2TP channel	Router
Remote users

Internal server

In this figure, LAC stands for L2TP Access Concentrator, which is a switch network device with a PPP end system and L2TP client-side processing ability. Usually, LAC is a NAS, which provides access service for users through PSTN/ISDN. LNS stands for L2TP Network Server, which is the device with a PPP end system and L2TP server-side processing ability.

LAC resides between the LNS and the remote system (remote users and remote branches) and is responsible for transmitting packets between them. It encapsulates the packets received from the remote system according to L2TP and sends them to the LNS, then de-encapsulates the packets from the LNS and sends them to the remote system. A local connection or PPP link can be used between the LAC and the remote system, but in a VPDN application, the PPP link is often adopted. Being an end of the L2TP tunnel, LNS is the peer device of LAC and is the logical terminating end of the PPP sessions transmitted by the LAC through the tunnel.

There are two methods to implement VPDN:

■NAS-originated VPN: NAS first establishes a tunnel with VPDN gateway using tunneling protocol, conveying the PPP connection to the gateways of enterprises. The current available protocols are L2F and L2TP.The advantage of the method is its transparency to users. After logging in once, the users can access the Intranet, which authenticates the users and distributes the internal addresses for users, avoiding consuming public addresses. The accounting of dial-up users can be implemented by the AAA at the LNS or LAC side. Users can access the network through various platforms. With the method, NAS should support VPDN protocol and the authentication system should support VPDN attributes. The gateway is usually a router or a VPN private gateway.

■Client-originated VPN: The client at the user end establishes a tunnel with the VPDN gateway. The client first calls and connects to the Internet, then establishes a tunnel connection with the enterprise gateway through special software for client (such as L2TP supported by Windows2000 platform). The advantage of the method is that there is no mode or geographical limit on accessing the Internet for users, independent of the ISP. The accounting of dial-up users can only be implemented through the AAA at the LNS side. The disadvantage of this method is that the users may be required to install special software.