3Com 3036, Configuration Manual

Page: 606 / 762

602 C
HAPTER
43: C
ONFIGURING
L2TP
Figure 179 Networking diagram of typical VPDN application
In this figure, LAC stands for L2TP Access Concentrator, which is a switch network
device with a PPP end system and L2TP client-side processing ability. Usually, LAC is
a NAS, which provides access service for users through PSTN/ISDN. LNS stands for
L2TP Network Server, which is the device with a PPP end system and L2TP
server-side processing ability.
LAC resides between the LNS and the remote system (remote users and remote
branches) and is responsible for transmitting packets between them. It
encapsulates the packets received from the remote system according to L2TP and
sends them to the LNS, then de-encapsulates the packets from the LNS and sends
them to the remote system. A local connection or PPP link can be used between
the LAC and the remote system, but in a VPDN application, the PPP link is often
adopted. Being an end of the L2TP tunnel, LNS is the peer device of LAC and is the
logical terminating end of the PPP sessions transmitted by the LAC through the
tunnel.
Methods of
Implementing VPDN
There are two methods to implement VPDN:
■
NAS-originated VPN: NAS first establishes a tunnel with VPDN gateway using
tunneling protocol, conveying the PPP connection to the gateways of
enterprises. The current available protocols are L2F and L2TP.The advantage of
the method is its transparency to users. After logging in once, the users can
access the Intranet, which authenticates the users and distributes the internal
addresses for users, avoiding consuming public addresses. The accounting of
dial-up users can be implemented by the AAA at the LNS or LAC side. Users
can access the network through various platforms. With the method, NAS
should support VPDN protocol and the authentication system should support
VPDN attributes. The gateway is usually a router or a VPN private gateway.
■
Client-originated VPN: The client at the user end establishes a tunnel with the
VPDN gateway. The client first calls and connects to the Internet, then
establishes a tunnel connection with the enterprise gateway through special
software for client (such as L2TP supported by Windows2000 platform). The
advantage of the method is that there is no mode or geographical limit on
accessing the Internet for users, independent of the ISP. The accounting of
dial-up users can only be implemented through the AAA at the LNS side. The
disadvantage of this method is that the users may be required to install special
software.
PC
PSTN/ISDN
Remote users
Access server
Remote users
Internal server
Internet backbone
network
L2TP channel
LAC
LNS
Router