Hi folks,
I have one problem about IPSec and L2TP which confused me:

As IPSec is able to implement VPN, so why bother to combine L2TP and IPSec together?

Thanks in advance.

IPSec is able to work in transport mode and tunnel mode. In tunnel mode it provides a VPN in a similar manner as L2TP.

L2TP solely provides tunneling, and does not provide security.

However, one can operate IPSec transport mode over an L2TP tunnel. If one uses IPSec in tunnel mode, they do not require L2TP.

The reason why there are two modes is that in transport mode, only the payload is encrypted and therefore all routing information is retained. This was foreseen to potentially be important to some network architectures, so they could choose to use the transport mode and then use L2TP to provide VPN for any users which were remote, but retain the routing information; which makes sense if you're going to use IPSec internally within an office. It would encrypt the payloads to make them secure but not alter the frame headers. I'm just not sure it's used a lot like that.

1 members found this post helpful.

IPSec does not support multicast traffic. So to protect this you would use L2TP to encapsulate the Multicast, then IPSec the L2TP payload. As one example.

1 members found this post helpful.

Thanks, this is really helpful.