topic inspecting l2tp traffic using AIM-IPS in Network Security

inspecting l2tp traffic using AIM-IPS

thedinuka — Sun, 10 Mar 2019 11:34:09 GMT

Hi All,

I have an IPS module in a ASA via which we are planning to send l2tp traffic. Would it be possible for the IPS to insoect this traffic as it normmaly does with other traffic ?

Thanks

Re: inspecting l2tp traffic using AIM-IPS

andrew100 — Wed, 25 Mar 2009 14:36:00 GMT

Hi,

Yes this is possible for the IPS to inspect as the traffic is decrypted before it is processed by the AIP-SSM.

This is providing the ASA with the module in is terminating the l2TP connection 🙂

Thanks

Andy

Re: inspecting l2tp traffic using AIM-IPS

thedinuka — Thu, 26 Mar 2009 02:18:07 GMT

Thanks for the response. But two points I need to clarify

We would not be using the ASA to terminate the l2tp tunnel. It will simply pass through the ASA to a router at which the tunnel is terminated.

Also, by default l2tp traffic is not encrypted right ? It is just encapsulation. It it was decrypted, then I know for sure that the IPS will not be able to inspect it. But since it is not, then theoretically the IPS should be capable of inspecting it.

the question is whether my hypothesis here is correct ?

thanks again

Re: inspecting l2tp traffic using AIM-IPS

marcabal — Thu, 26 Mar 2009 17:04:36 GMT

To inspect l2tp traffic the sensor software has to understand that their is an additional header on the packet in order to understand how to get to the packet inside the tunnel header.

Unfortunately the Cisco IPS Sensor software has not been coded to recognize an l2tp header and so does not know how to get to the underlying packet.

The Cisco IPS Sensor has only been coded to recognize and analyze packets within GRE, MPLES, IPV4inIPV4, and IPV4inIPV6 tunnels.

Re: inspecting l2tp traffic using AIM-IPS

thedinuka — Fri, 27 Mar 2009 03:21:15 GMT

Hi, Many thanks for the short and sweet answer. So the IPS will not inspect the l2tp traffic. Since it doesn't identify the traffic type, will it drop these ?

Din

Re: inspecting l2tp traffic using AIM-IPS

marcabal — Fri, 27 Mar 2009 14:02:33 GMT

The IPS will do some very basic signature checking on the first IPv4 packet header.

If the first header looks fine, then it should pass the packet through without further analysis.