Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it as secure to use L2TP for VPN access, rather than IPSEC? Am I introducing any risks by using L2TP?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

L2TP does not provide any confidentiality or authentication. A common setup is using L2TP along with IPSEC (see RFC 3193).

EDIT: L2TP does provide tunnel end-point authentication. It does not provide encryption and message authentication.

share|improve this answer
    
In almost all cases when someone says "L2TP VPN" they mean L2TP/IPSEC VPN. While it is possible to set up a pure L2TP tunnel it is rarely done in practice. –  bahamat Jan 9 '11 at 10:30
    
Ah yes I guess I did mean L2TP/IPSEC VPN then. –  Simon Hodgson Jan 10 '11 at 13:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.