L2TP/IPsec VPN - Still considered secure?

Forums › IT Pro and developers › L2TP/IPsec VPN - Still considered secure?

Paul1977

5171 posts

Uber Geek
+1 received by user: 2192

#310802 23-Nov-2023 09:35

I understand recent versions of Android have dropped support for L2TP VPNs, I believe over security concerns. I don't use Android, but this got me thinking about L2TP in general.

I know L2TP on it's own doesn't encrypt data packets, but when done over IPsec it does. So is L2TP over IPsec still considered a secure and acceptable method of VPN communications for businesses, or is that now considered insecure as well?

BlakJak

1329 posts

Uber Geek
+1 received by user: 735

Trusted

#3163508 25-Nov-2023 13:11

IPSEC provides the secure bit. What would you use L2TP for exactly?

No signature to see here, move along...

BlakJak

1329 posts

Uber Geek
+1 received by user: 735

Trusted

#3163509 25-Nov-2023 13:13

Let's put it another way. If you want to bridge your network _at layer 2_ then you're going to need something like L2TP. IPSEC in my experience is usually used layer 3.

So it'll come back to what you're trying to do, if you want a Layer 2 bridge over an untrusted network and thus want encryption you're going to need to layer it over the top of something else.

If you control the carrier networks maybe you don't need network layer encryption and just require a L2 Bridge.

So it's not whether L2TP is still appropriate for "business communications" but whether it's the right tool for the job.

These days there are only limited requirements for Layer 2 extensions to remote locations.

No signature to see here, move along...

Paul1977

5171 posts

Uber Geek
+1 received by user: 2192

#3164315 27-Nov-2023 09:00

BlakJak: Let's put it another way. If you want to bridge your network _at layer 2_ then you're going to need something like L2TP. IPSEC in my experience is usually used layer 3. So it'll come back to what you're trying to do, if you want a Layer 2 bridge over an untrusted network and thus want encryption you're going to need to layer it over the top of something else. If you control the carrier networks maybe you don't need network layer encryption and just require a L2 Bridge. So it's not whether L2TP is still appropriate for "business communications" but whether it's the right tool for the job. These days there are only limited requirements for Layer 2 extensions to remote locations.

@BlakJak We're assessing a new cloud hosted product, and they have specified that for some of their communications they use "Layer 2 Tunnelling Protocol (L2TP)/IPsec". It's not clear exactly what communications this is used for though, it's just one of the things listed under their "Encryption" section. Not sure if that helps you. Thanks.

gehenna

8667 posts

Uber Geek
+1 received by user: 3883

Moderator

Trusted

Lifetime subscriber

#3164317 27-Nov-2023 09:04

Source and destination info will probably give you a better understanding of what the product is trying to do.

BlakJak

1329 posts

Uber Geek
+1 received by user: 735

Trusted

#3164339 27-Nov-2023 10:11

Paul1977:

BlakJak: Let's put it another way. If you want to bridge your network _at layer 2_ then you're going to need something like L2TP. IPSEC in my experience is usually used layer 3. So it'll come back to what you're trying to do, if you want a Layer 2 bridge over an untrusted network and thus want encryption you're going to need to layer it over the top of something else. If you control the carrier networks maybe you don't need network layer encryption and just require a L2 Bridge. So it's not whether L2TP is still appropriate for "business communications" but whether it's the right tool for the job. These days there are only limited requirements for Layer 2 extensions to remote locations.

@BlakJak We're assessing a new cloud hosted product, and they have specified that for some of their communications they use "Layer 2 Tunnelling Protocol (L2TP)/IPsec". It's not clear exactly what communications this is used for though, it's just one of the things listed under their "Encryption" section. Not sure if that helps you. Thanks.

You may need to ask why.

But a common scenario with cloud hosting might be to have two 'adjacent' platforms that're actually in different platforms (or availability zones, perhaps) and so to create a virtual Layer 2 connection despite the fact that only a Layer 3 channel is available.

So that'd be L2TP.

Adding IPSEC would ensure protection of the data in transit when it's going across public cloud internet infrastructure.

So it's probably a good thing they've thought of having IPSEC.

No signature to see here, move along...