No password interaction is performed at this point. The corporate gateway completes the authentication by either accepting or rejecting the connection. When the connection is accepted, the corporate gateway can pursue another phase of authentication at the PPP layer. For each L2F tunnel established, L2F tunnel security generates a unique random key to resist spoofing attacks. Within the L2F tunnel, each multiplexed session maintains a sequence number to prevent the duplication of packets.
Cisco provides the flexibility of allowing users to implement compression at the client end.
Authorization When providing a traditional dialup service, the ISP is required to maintain per-user profiles defining the authorization. Thus a security server could interact with the NAS to provide policy-based usage to connecting users, based on their authentication. This process can become burdensome to the ISP, especially if providing access to remote users on behalf of corporations that require constant change to this policy. In a virtual dialup service, the burden of providing detailed authorization based on policy statements is given directly to the remote user's corporation. This setup frees the ISP from having to maintain a large database of individual user profiles based on many different corporations.