L2TP

Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol used to support virtual private networks by encapsulating PPP frames within IP tunnels. It was developed by the IETF as a standard that combines features from the older L2F and PPTP approaches to provide a vendor-neutral method for creating VPN connections over IP networks. The original specification is in RFC 2661, with subsequent documents clarifying interoperability with PPP and tunneling control messages.

Operation is based on establishing a tunnel between two endpoints and then creating one or more PPP sessions inside that tunnel. L2TP uses UDP port 1701 for its control channel and carries PPP frames inside L2TP data packets. A tunnel is identified by a tunnel ID and can contain multiple sessions identified by session IDs. While PPP within the tunnel can perform its own authentication and compression negotiation, L2TP itself does not provide encryption or data integrity.

Security and deployment: Because L2TP does not provide encryption or integrity protection by itself, VPN implementations almost always run L2TP over IPsec (forming L2TP/IPsec) to provide confidentiality and authentication for the tunnel. IPsec also handles integrity and anti-replay protection. NAT traversal is commonly achieved with NAT-T, which encapsulates IPsec in UDP to pass through NAT devices. L2TP is widely supported on major operating systems and networking equipment, making it a common choice for remote-access VPNs and certain site-to-site deployments.

Variations and status: There is an extended version known as L2TPv3 that broadens the protocol’s use cases, including the ability to transport layer 2 frames beyond PPP. In practice, L2TP is most commonly seen as L2TP/IPsec for secure VPNs, with alternatives such as PPTP, OpenVPN, IKEv2/IPsec, and WireGuard available.