3Com 3032 Configuration Manual page 609

Figure 182 Call setup flow of L2TP channel
(4) Request
tunnl message
PSTN/ISDN
PC
(1)
Call Setup
(2)
PPP LCP Setup
PAP or CHAP authentication
(3)
RADIUS Aut hent i cat i on
14) Optional second time CHAP challenge(
V. Features of L2TP
Flexible identity authentication mechanism and high security
L2TP protocol by itself does not provide connection security, but it can depend
on the authentication (e.g. CHAP and PAP) provided by PPP, so it has all security
features of PPP. L2TP can be integrated with IPSec to fulfill data security, so it is
difficult to attack the data transmitted with L2TP. As required by specific
network security, L2TP adopts channel encryption technique, end-to-end data
encryption or application layer data encryption on it to improve data security.
Multi-protocol transmission
L2TP transmits PPP packets, so multiple protocols can be encapsulated in
PPP packets.
Supports the authentication of RADIUS server
LAC requires the authentication of RADIUS with user name and password.
RADIUS server receives authentication request of the user, fulfils the
authentication and returns the configuration information to establish the
connection to LAC.
Supports internal address allocation
LNS can be put behind the Intranet firewall. It can dynamically distribute and
manage the addresses of remote users and support the application of private
RADIUS Server
(5) AV Pairs
Tunnel messae(
WAN
Router A
LAC
(6) Tunnel establishment
(7) SCCRQ message [ LAC challenge ]
(8)
SCCRP message [ LNS CH AP response, CHAP challenge ]
(9) SCCCN message [ Authentication passes£ ¬ LAC CHAP response ]
(10) Authentication passes )
(11) user CHAP response + response identifier + PPP negotiation parameters
(15) CHAP response
(18) Authentication passes
VPDN and L2TP Overview
RADIUS Server
Access request
(12)(16)
Access response
(13)(17)
(13)
(12)
(16) (17)
PC
Router B
PC
LNS
RADIUS Aut hent i cat i on
605