Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it as secure to use L2TP for VPN access, rather than IPSEC? Am I introducing any risks by using L2TP?

share|improve this question
up vote 4 down vote accepted

L2TP does not provide any confidentiality or authentication. A common setup is using L2TP along with IPSEC (see RFC 3193).

EDIT: L2TP does provide tunnel end-point authentication. It does not provide encryption and message authentication.

share|improve this answer
In almost all cases when someone says "L2TP VPN" they mean L2TP/IPSEC VPN. While it is possible to set up a pure L2TP tunnel it is rarely done in practice. – bahamat Jan 9 '11 at 10:30
Ah yes I guess I did mean L2TP/IPSEC VPN then. – Simon Hodgson Jan 10 '11 at 13:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.