l2tp

Pre-Alpha. This page describes behavior that may change.

Ze includes a native L2TPv2 (RFC 2661) LNS/LAC implementation for use as a BNG (Broadband Network Gateway) component. It terminates L2TP tunnels over UDP, runs PPP negotiation (LCP, authentication, IPCP/IPv6CP), assigns peer IPs, and hands the kernel data plane to the l2tp_ppp module via netlink. Subscriber routes are tracked for redistribution into BGP.

Configuration

l2tp {
    enabled true;
    shared-secret <secret>;       // CHAP-MD5 tunnel auth (RFC 2661 S4.2)
    hello-interval 60;             // seconds of peer silence before HELLO
    max-tunnels 0;                 // 0 = unbounded (16-bit ceiling)
    max-sessions 0;                // per-tunnel, 0 = unbounded
}

environment {
    l2tp {
        server main {
            ip 0.0.0.0;
            port 1701;
        }
    }
}

Presence of l2tp {} with any content implies the subsystem is enabled. Set enabled false to disable explicitly.

PPP negotiation

Ze handles the full PPP negotiation stack:

Layer	Protocol	Status
Link	LCP	Working. Option negotiation, proxy LCP.
Auth	PAP	Working.
Auth	CHAP-MD5	Working.
Auth	MS-CHAPv2	Working.
Network	IPCP	Working. IP address assignment.
Network	IPv6CP	Working. Interface identifier negotiation.

LCP Auth-Protocol Nak/Reject fallback is supported. Periodic CHAP re-auth is configurable via ze.l2tp.ncp.reauth-interval.

CLI commands

Read commands

Command	Output
show l2tp	Aggregate counters: tunnel count, session count, listener count.
show l2tp tunnels	Array of tunnel summaries.
show l2tp tunnel <id>	One tunnel's detail (AVPs, capabilities, session list).
show l2tp sessions	Array of session summaries (flattened across tunnels).
show l2tp session <id>	One session's detail (PPP state, assigned IP, speeds).
show l2tp statistics	Protocol counters.
show l2tp listeners	Bound UDP endpoints.
show l2tp config	Effective runtime config; shared-secret redacted.

Destructive commands

Command	Effect
l2tp tunnel teardown <id>	Sends StopCCN Result Code 6 (administrative).
l2tp tunnel teardown-all	Same, for every live tunnel.
l2tp session teardown <id>	Sends CDN Result Code 3 (administrative).
l2tp session teardown-all	Same, for every live session.

Reload semantics

Field	Reload behaviour
shared-secret	Hot-apply; takes effect on new SCCRQs.
hello-interval	Hot-apply; new tunnels use the new interval.
max-tunnels	Hot-apply at next admission decision.
max-sessions	Hot-apply at next admission decision.
enabled flip	Rejected with WARN. Restart required.
Listener endpoint change	Rejected with WARN. Restart required.

Route redistribution

When a PPP NCP (IPCP or IPv6CP) completes, the subsystem emits a route-change event on the EventBus with the assigned peer IP as a /32 (IPv4) or /128 (IPv6) prefix. The bgp-redistribute plugin discovers L2TP as a producer and advertises the prefixes to BGP peers:

redistribute {
    import l2tp {
        family [ ipv4/unicast ipv6/unicast ];
    }
}

See also

• In-tree L2TP guide for the full reference.
• Plugins for the plugin list.

Adapted from main/docs/guide/l2tp.md.