Re: PPP-over-L2TP kernel support, new patch for review

[Benjamin LaHaise <bcrl@xxxxxxxxx>]

On Wed, Sep 22, 2004 at 09:07:06AM +1000, Herbert Xu wrote:
> Benjamin LaHaise <bcrl@xxxxxxxxx> wrote:
> >
> >> - Unlikely to integrate with the new native IPSEC stuff.
> > 
> > L2TP over IPSEC?  Are you insane?  You'd not be able to terminate more than 
> > a couple of dozen connections over it. =-)
> 
> Why not? L2TP over IPsec is the only reason I'm looking at L2TP at all.

CPU load.  The main reason I was forced to revisit L2TP (imo, it's a 
horrible protocol that suffers from too many bad decisions) was in its 
role for terminating DSL.  In this case one expects to be able to have 
tens of thousands of connections terminated by a single box, which 
means pushing hundreds of megabits of traffic.  The overhead of crypto 
operations in such a scenario makes it a far too costly choice.

                -ben