Is L2TP as secure as IPSEC for VPNs?

Question

Is it as secure to use L2TP for VPN access, rather than IPSEC? Am I introducing any risks by using L2TP?

Giacomo Verticale · Accepted Answer · 2011-01-09 00:04:51Z

up vote 4 down vote accepted

L2TP does not provide any confidentiality or authentication. A common setup is using L2TP along with IPSEC (see RFC 3193).

EDIT: L2TP does provide tunnel end-point authentication. It does not provide encryption and message authentication.

edited Jan 9 '11 at 0:04

answered Jan 8 '11 at 23:10

Giacomo Verticale
26625

	In almost all cases when someone says "L2TP VPN" they mean L2TP/IPSEC VPN. While it is possible to set up a pure L2TP tunnel it is rarely done in practice. – bahamat Jan 9 '11 at 10:30
	Ah yes I guess I did mean L2TP/IPSEC VPN then. – Simon Hodgson Jan 10 '11 at 13:15

1 Answer