A cikin tarihin juyin halitta na hanyoyin sadarwa masu zaman kansu, L2TP (Layer 2 Tunneling Protocol) ya kasance gada mai mahimmanci tsakanin tsoffin hanyoyin sadarwa na dial-up da tsaro na zamani na cryptographic. An fayyace shi a hukumance a cikin RFC 2661, L2TP wani ka'ida ce ta matakin zama wacce ta haɗa mafi kyawun siffofi na tsoffin tsarin guda biyu: PPTP na Microsoft (Point-to-Point Tunneling Protocol) da L2F na Cisco (Layer 2 Forwarding).
Yana aiki a Layin Haɗin Bayanai (Layer 2) na tsarin OSI, babbar manufar L2TP ita ce ta rufe fayilolin Point-to-Point Protocol (PPP) don a iya ɗaukar su a cikin hanyoyin sadarwa masu sauƙin kaya kamar IP, Frame Relay, ko ATM.
⚠️ Riddaɗin Bayyana Gaskiya
Daga mahangar binciken tsaro kawai, L2TP na bayyana a sarari. Yana gina hanyar sadarwa ta kama-da-wane amma ba ya ba da motar sulke; ba shi da wani tsarin ɓoye bayanai na asali ko hanyoyin tabbatar da asali. Domin kare bayanan da ke tafiya, ana haɗa shi da tsarin Tsaro na Intanet kusan ko'ina, wanda ya haifar da gunkin L2TP/IPsec.
Tsarin Haɗin L2TP: LAC zuwa LNS
Don fahimtar yadda L2TP ke haɗa iyakokin yanki, dole ne ku fahimci ƙarshen gine-gine na asali guda biyu:
- LAC (L2TP Mai Tattara Hanyar Shiga): Mai fara ramin. Wannan ita ce na'urar (kamar sabar shiga hanyar sadarwa ta ISP ko abokin ciniki na gida) wacce ke ƙare haɗin gida kuma tana tura zirga-zirga zuwa cikin ramin L2TP.
- LNS (Sabar Hanyar Sadarwa ta L2TP): Mai karɓa da wurin ƙarshe na tashar tunnel. LNS yana warware fakitocin L2TP masu shigowa, ya fitar da firam ɗin PPP na asali, kuma ya haɗa mai amfani mai nisa zuwa cibiyar sadarwar kamfani.
How Data Moves Through L2TP/IPsec
Ƙaddamarwa & Tunneling
The client device packages traffic into standard PPP frames. The LAC wraps these frames inside an L2TP header.
Naɗin Sirri (IPsec)
Domin fakitin L2TP ya fito fili, IPsec ya kama shi. Yin amfani da Encapsulating Security Payload (ESP), IPsec ya rufa asirin dukkan fakitin L2TP kuma ya sanya hannu don tabbatar da ingancin bayanai.
wucewa
Ana aika fakitin ta hanyar UDP ta hanyar hanyoyin sadarwar jama'a ta amfani da tashoshi 1701, 500, ko 4500.
Cire kumburi a LNS
LNS ta karɓi fakitin, tana amfani da IPsec don buɗe shi da kuma tabbatar da asalinsa, ta cire taken jigilar L2TP, kuma ta miƙa bayanan PPP masu tsabta ga cibiyar sadarwar keɓaɓɓiyar da aka nufa.
Zurfafa Binciken Fasaha: Mahimman Fasaloli & Ka'idoji
L2TP yana da ingantaccen aiki na musamman a cikin mahallin kamfanoni masu rikitarwa saboda wasu damar da ba na al'ada ba:
- Taimakon Multi-Protocol: Ba kamar tsarukan zamani waɗanda kawai ke jigilar zirga-zirgar IP na asali ba, L2TP ta rufe fakitin PPP na yau da kullun. Wannan yana ba ta damar jigilar tsarukan gado marasa IP a cikin hanyar sadarwa ta IP ta asali.
- Tabbatarwa Mai Sauƙi: Yana shiga cikin tsarin AAA (Authentication, Authorization, and Accounting) masu ƙarfi, yana tallafawa tsarin tabbatarwa kamar PAP, CHAP, MS-CHAPv2, da EAP.
- Rabuwar Tashoshi Biyu: L2TP ya raba jirgin sarrafawa (da ke kula da ƙirƙirar tunnel, ci gaba da rayuwa, da rushewa) da tsauri daga jirgin bayanai (da ke ɗaukar kaya na ainihi), yana inganta kwanciyar hankali na wucewa.
Weighing the Pros and Cons of L2TP/IPsec
Fa'idodin
- Tallafin Asali Mai Yaduwa: L2TP/IPsec an haɗa shi kai tsaye a cikin kernels na Windows, macOS, iOS, Linux, da Android. Da wuya ya buƙaci masu amfani su sauke aikace-aikacen software na ɓangare na uku na waje.
- Tsayayyen Zama Mai Dorewa: Yana da matuƙar dogaro don kiyaye hanyoyin haɗin kai-fili zuwa-fili na hankali a kan hanyoyin tafiyar da sadarwa masu rikitarwa na kamfani (enterprise WAN routing).
Rashin Amfani
- Hukuncin Runguma Biyu: Saboda fakitin bayanai an tsara su da kanun PPP, sannan an nannade su a cikin kanun L2TP, kuma a karshe an sake nannade su a cikin kanun IPsec, nauyin bayanai yana da yawa sosai. Wannan sake nannade sau biyu yana rage karfin sarrafa CPU da kuma rage ingancin gudanarwa.
- Matsalolin MTU & Rage guntuwa: Babban tarin header yana tilasta injiniyoyin cibiyar sadarwa su rage wucin gadi da Babbar Rukunin Watsawa (MTU) girma (sau da yawa har zuwa 1400 ko 1280 bytes). Idan ba a inganta ba, wannan yana haifar da rarrabuwar fakiti, yana haifar da jinkiri mai yawa da katsewar haɗi.
- Rashin Ƙarfin Fayawal: L2TP ta dogara kawai ga bayanan tashoshin tashoshi na musamman: UDP 1701 (hanyar sadarwa L2TP), UDP 500 (musayar maɓalli IKE), da UDP 4500 (Hanyar NAT). Saboda waɗannan tashoshi an tsara su kuma sun bambanta, cibiyoyin sadarwa na gidan yanar gizo da ISPs na iya toshe su cikin sauƙi.
Kwatanta Ka'idojin Zamani
| Fasalin Protocol | L2TP/IPsec | OpenVPN | WireGuard |
|---|---|---|---|
| Matakin Rufe Bayanai | Mai dogaro (IPsec) | Asali (OpenSSL) | Na asali (ChaCha20/Poly1305) |
| Gudun Aiki | Matsakaici/A hankali | Matsakaici | Sauri Sosai |
| Rikitarwar Tushen Lambobi | Babba / Tari na Gado | Mai rikitarwa / Babba | Mai sauki sosai (~layuka 4,000) |
| Ƙetarewar Firewall | Mara kyau (Ƙayyadaddun tashoshin UDP) | Kyakkyawan (Yana iya kwaikwayi HTTPS TCP 443) | Matsakaici (UDP mai iya daidaitawa) |
| Tallafin OS na Asali | Mai kyau (Mai ginawa) | Mai wuya (Yana buƙatar manhajar abokin ciniki) | Haɓaka (Linux na asali/na tushen app) |
Tambayoyin Fasaha
Q: Me yasa masu sana'ar tsaro ke lakabi da L2TP “deprecated” idan yana amfani da IPsec mai ƙarfi?
Yayyana IPsec ɗin kanta ya kasance mai aminci lokacin amfani da ƙananan maɓalli kamar AES-256, tsarin gabaɗayan L2TP ya tsufa. Girman code dinsa yana ƙara fage na harin da za a iya yi, kuma tsarin shirin dual-encapsulation dinsa bai dace da zamani na sauri ba idan aka kwatanta da mafita masu sauki kamar WireGuard.
Q: Ta yaya NAT Traversal (NAT-T) ke aiki tare da L2TP/IPsec?
Saboda fakitin IPsec AH da ESP na iya karyewa yayin wucewa ta hanyar sadarwa da ke yin Network Address Translation (NAT yana canza shugabannin IP, wanda ke lalata binciken mutuncin IPsec), NAT-T tana rufe fakitin IPsec da aka rufa a cikin fakitin UDP na daidaitattun akan tashar 4500. Wannan yana yaudarar mai sadarwa na gida don wuce da zirga-zirgar VPN cikin aminci ba tare da lalata sa hannun cryptographic ba.
Q: Shin L2TP na iya aiki lafiya ba tare da IPsec ba?
A zahiri eh, amma bai kamata a saita shi ta wannan hanyar akan hanyoyin sadarwa na jama'a ba. Ba tare da IPsec ba, hanyar L2TP tana aiki gaba ɗaya a bayyane. Duk wanda yake da kayan aikin gano fakiti na asali (kamar Wireshark) zai iya karanta bayanan kamfani na ku, bayanan shiga kamfani, da cikakkun bayanan zaman ku cikin sauƙi.
Q: Me yasa na'urori da yawa a bayan router guda na gida wani lokaci suke kasa haɗawa da VPN na L2TP/IPsec lokaci guda?
Wannan iyakancewa ce ta gargajiya ta L2TP/IPsec da aka sani da matsalar Taswirar Abokin Ciniki guda ɗaya na NAT-T. Saboda L2TP ya dogara da tashoshi masu kayyade (UDP 4500 don NAT-T da UDP 500), yawancin masu jagorar mabukaci na yau da kullun ba za su iya taswirar rafukan bin diddigin SPI (Fihirisar Ma'aunin Tsaro) masu rufaffen shigowa iri ɗaya zuwa adiresoshin IP masu zaman kansu na ciki da yawa a lokaci guda ba. Yayin da ka'idojin zamani kamar OpenVPN da WireGuard ke canza tashoshin tushe da sauri don tallafawa ɗaruruwan zaman a lokaci guda daga cikin hanyar sadarwa ɗaya, L2TP/IPsec sau da yawa yakan rage ko kuma ya watsar da na'urar ta biyu da ke ƙoƙarin haɗawa daga bayan wannan katangar NAT ɗin.
Q: Menene hadarin tsaro na amfani da Pre-Shared Key (PSK) a cikin tura L2TP/IPsec?
Lokacin da L2TP/IPsec aka tura ta amfani da Maɓallin Rabawa (wanda galibi akan lakafta shi da "L2TP tare da Maɓallin Sirri"), kowane ma’aikaci ko mai amfani guda ɗaya yana amfani da kalmar sirri ɗaya tsaye don fara haɗin. Idan na’urar wani ma’aikaci ta lalace, ko tsohon ma’aikaci ya riƙe maɓallin, gabaɗayan hanyar sadarwa tana fallasa. Mahara za su iya amfani da wannan PSK da aka fallasa don kafa wuraren shiga na bogi da aiwatar da hare-haren ɓoye bayanai na Man-in-the-Middle (MITM) da aka yi niyya sosai. Don binciken kasuwanci mai babban tsaro, ƙaura daga PSK zuwa Takaddun Dijital na X.509 na mutum ta hanyar EAP-TLS ana ba da shawara a duniya.
Tambaya: Me yasa L2TP/IPsec ke fuskantar babban nauyin CPU idan aka kwatanta da sabbin hanyoyin sadarwa?
Matsalar aikin ta samo asali ne daga tsarin gine-gine da kuma ingancin crypto. L2TP yana tilasta bayanai ta hanyar tsarin software mai yawa a cikin iyakar user-space da kernel-space, yana aiwatar da double encapsulation (PPP a kan L2TP a kan IPsec). Bugu da ƙari, yana dogara ga tsoffin hanyoyin cryptographic. Sabbin madogara kamar WireGuard an rubuta su kai tsaye a cikin lambar kernel na OS, suna ƙetare dukkan tsarin PPP na tsohuwa, kuma suna amfani da ciphers masu aiki tare kamar ChaCha20-Poly1305. Wannan yana ba da damar sabbin tsare-tsare don cimma har zuwa 3–4x mafi girman aiki yayin da suke cin ƙaramin baturi da ƙarfin CPU akan na'urorin hannu.
Tambaya: Ta yaya L2TP/IPsec ke magance matakan binciken fakitoci masu zurfi (DPI) na zamani?
Yana da matukar wahala. Domin L2TP/IPsec ya dogara gaba daya akan wani takamaiman, bambancin tashar tashar tashar (UDP 1701, 500, da 4500) kuma yana barin sawun bayanan gaba daya ba a rufe yayin da hannun ke tafiya, abu ne mai sauqi qwarai ga kayan aikin Deep Packet Inspection (DPI) da katangar kamfanoni, masu samar da Intanet (ISPs), da tsarin tantancewa na kasa ke amfani da su. Ba kamar ka'idoji na tushen SSL kamar OpenVPN (wanda zai iya hadewa cikin sauki ta hanyar tafiyar da zirga-zirga ta hanyar TCP Port 443 don yin kama da daidaitaccen zirga-zirgar banki na HTTPS), ana iya gane L2TP/IPsec kuma a toshe shi nan take da doka guda daya ta katangar wuta (firewall).
Tambaya: Menene ya faru da zaman L2TP/IPsec mai aiki yayin da hanyar sadarwa ta faɗi ko ta mayar da ita kwatsam?
Ba kamar IKEv2 (wanda ke amfani da babbar faɗaɗa MOBIKE don canzawa daga Wi-Fi zuwa 5G ba tare da karyewa ba), L2TP/IPsec na yau da kullun yana tafiyar da canjin yanar gizo mara kyau. Saboda haɗin da ke ƙarƙashin yana daure da wata ƙaƙƙarfan zama na PPP (Point-to-Point Protocol), duk wani canji kwatsam a adireshin IP na waje na abokin ciniki yana sa tashar ta tsaya. L2TP Network Server (LNS) dole ne ta jira ƙarshen lokutan Dead Peer Detection (DPD) (yawanci ɗaukar dakika 30 zuwa 60) kafin ta rushe tashar da ta mutu a hukumance kuma ta ba da damar na'urar mai amfani ta sake tantancewa da sake kafa sabuwar haɗi.
