L2TP/IPSec: Mutual authentication BEFORE user can access VPN

Question

I came across a question

You are the network administrator for your company. You have deployed Windows Server 2008 on all server computers in your company.

You have deployed the Network Policy and Access Service role on a Windows Server 2008 R2 server named SRV_NPS. You need to configure SRV_NPS as a virtual private network (VPN) server. You need to ensure that both user and machine authentication is required BEFORE gaining access to the VPN server.

Which authentication method should you use?

The choices are

L2TP/IPSec

EAP-TLS

SSTP

SSTP

I chose EAP-TLS because I thought both user and machine get authenticated, but the answer is L2TP/IPSec because they say user and machine are authenticated BEFORE user can access the VPN.

But I cannot understand how this is different than EAP-TLS. How would EAP-TLS allow user access to VPN before mutual authentication. Please clarify.

Answer 1

EAP-TLS is just an implementation of SSL/TLS. Which does not bind any particular client to a machine. EAP-TLS uses X.509 certificates to authenticate clients to a server. But certificates aren't tied to a specific machine. ClientA's certificate isn't bound to IP address 1.1.1.1, it's just what is presented to identify the client.

L2TP/IPSec however does provide both user and machine authentication. IPSec establishes a secure tunnel by using security policies. An IPSec security policy is stored in a table and is referenced using a Security Parameters Index (SPI). Each SPI is bound to an IP address. If an incoming encrypted packet does not have both the correct SPI and IP address it won't be processed. L2TP provides the user authentication mechanism. Once the IPSec tunnel is established an L2TP tunnel is brought up.

L2TP's RFC2661 Section 9.4:

IPsec also defines access control features that are required of a compliant IPsec implementation. These features allow filtering of packets based upon network and transport layer characteristics such as IP address, ports, etc. In the L2TP tunneling model, analogous filtering is logically performed at the PPP layer or network layer above L2TP. These network layer access control features may be handled at the LNS via vendor-specific authorization features based upon the authenticated PPP user, or at the network layer itself by using IPsec transport mode end-to-end between the communicating hosts. The requirements for access control mechanisms are not a part of the L2TP specification and as such are outside the scope of this document.

This implies that IPSec provides network layer access controls as I stated above, but not performed by L2TP.

L2TP provides user authentication in a kind of first cousin twice once removed type of way. L2TP is a tunneling protocol that runs Point-to-Point Protocol (PPP) through that tunnel. PPP provides mechanisms for user authentication; using either Password Authentication Protocol (PAP, which is deprecated) or Challenge Handshake Authentication Protocol (CHAP).