Subject: Re: (radius) WG LAST CALL on L2TP RADIUS Drafts (fwd)

From: MegaZone <[email-masked]>
Date: Tue, 19 Jan 1999 22:07:43 -0800 (PST)

Once upon a time Mike O'Dell shaped the electrons to say...
>to say NO to Bad Ideas, no matter how much people

Fine.  But I still have not seen anything to indicate RADIUS L2TP support
is a "Bad Idea."  I consider the arguments on security to be spurious.
Just because I *can* shoot myself in the foot with my Glock doesn't mean I
don't have reason to have one.  It is *my* responsibility not to do so.
BTW I still have all my toes.

I'm in the VPN group at GTEI.  L2TP is something customers are *demanding*
and the vendor who provides it - wins.  If they need end to end security
then we'll show them the way to IPSec.  But the simple fact is many of
them don't give a damn about it and what they want is a way to extend their
private address space and/or non-IP protocols out to users in the world.

Filters are *NOT* viable.  Period.  Not with the dispsersed network.
Routing their IP addresses scattered as /32s across the world is NOT viable.

Tunneling is the best solution.  And it has to be transparent to the end
user - anything that requires mucking with their system is a market failure
before it appears.  Compulsory L2TP tunneling is simple and effective.  They
connect to a NAS and *poof* they're on their network.  The user has no need
to know that they are actually riding a tunnel.  Security doesn't enter into
it either.  Without the tunnel they'd be bare IP traffic anyway, no difference.

Any 'standard' that doesn't perform in the real world isn't worth the effort
of producing, because it will be stillborn.  L2TP already has widespread 
vendor acceptance.  Off hand I can't think of any respected vendor that 
isn't committed to it.  RADIUS is the de facto AAA protocol.  It isn't 
perfect, but it is what we have.  (Personally I think the DIAMETER group
is doing some nice work these days, for the future.)

There have been a number of arguments put forth in favor of the draft,
and aside from the "Bad Idea" comments I haven't seen any solid arguments
agaist it.

If any service provider or NAS vendor does not wish to support L2TP then
they do not have to.  Let the market decide.  I certainly don't expect all
of them to do so.  There are plenty of examples today of standards that
aren't universally supported.  That's fine, it is a free marketplace.

L2TP itself is not a secure tunnel media.  If you want security they you
want to stuff it into IPSec.

It'd also be nice if Gary Malkin's (now expired) draft on multichassis
MP using L2TP found support.  But that's not RADIUS related...

-MZ
-- 
<URL:mailto:[email-masked]> Gweep, Discordian, Author, Engineer, me..
Join ISP/C Internet Service Providers' Consortium <URL:http://www.ispc.org/>
"A little nonsense now and then, is relished by the wisest men" 781-788-0130
<URL:http://www.megazone.org/>  <URL:http://www.gweep.net/>  Hail Discordia!
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.