Home / server / Questions / 1162657
Accepted
user165568
Asked: 2024-07-17 20:10:52 +0800 CST

Is IpSec transform standardized for L2TP?

  • 772

None of the L2TP/IPsec implementations I have (seem to) have any configuration possible for key exchange. My routers allow encryption and hash selection for raw IpSec. The version of Windows I use allows encryption and hash selection at the 'firewall'. But in all cases where algorithm selection is possible, it seems to have no effect on the native L2TP/IPsec client.

Is that just an accident of history, or does L2TP/IPsec imply a standard selection of hash and encryption algorithms for key exchange?

ipsec

1 Answers

  1. Best Answer

    First of all, there's no "exchange" for cipher suites, it's more of "announcing". The initiator shows its possible algos for/as each phase is happening and the responder decides whether it allows/supports these or not. In case it does not, it sends NO_PROPOSAL_CHOSEN (not indicating the allowed set on it's side and this complicates things). As about the Windows stock client - you can say that the proposal set is merely hardcoded depending on the OS version, with more modern algos for more recent versions; but for Linux/FreeBSD/JunOS/IOS this is also true, because the cipher set depends directly on the kernel version used.

    P.S. You can view the proposals that the initiator send for both phases, IKE and IPSec, by slightly altering the log level for your ISAKMP/IPSec daemon on the security gateway.

    • 1