E and other tunnels for multicast). The use of tunnels ensures that the tunnelled traffic may not exit from the tunnel. However, it is still possible for malicious users on the path between the tunnel end points to listen and inspect all the tunnelled payload traffic. It is also possible for an attacker to insert packets into a tunnelled stream. Since the packet content is normally encrypted it is, however, difficult to understand what is transferred. The lower part of Figure 6.21 shows layer 3 tunnelling with basic IP and transport protocols encapsulated by 'IPsec' and a new IP header, existing between IPsec gateways. The upper part of the figure shows an alternative to tunnelling, defined in the IPsec standard. See below. There are two main parts of a tunnelling protocol: setting up the tunnel (and tearing it down) encapsulating one protocol in another The tunnel technique has proven reliable. To provide a secure communication path from the employee to the intranet, a secure tunnel is created. 6.11.1 L2TP One of the most frequently used protocols today is the layer 2 tunnelling protocol (L2TP). Another tunnelling protocol is MIP (mobile IP). Security Transport "IPsec" Transport Payload Added headers Transport "IPsec" Tunnel Tunnel end point Figure 6.21 Layer 3 tunnelling L2TP is a secure protocol used for connecting VPNs over public lines such as the Internet. It is essentially a combination of two other secure communications protocols: PPTP and Cisco Systems' L2F. L2TP is a popular mechanism for accessing corporate networks. It provides a tunnelling facility that can be used both in a voluntary and in mandatory manner. In the voluntary case the user's PC establishes an L2TP connection to the corporate tunnel server over any ISP or Internet access method. In the mandatory case the ISP's remote access concentrator creates a tunnel from a specific user and to a specific destination automatically as the user logs in. This destination could be a particular kind of ISP or service, a server in a corporation that the 