I have a VPN service which gives me the option of connecting via PPTP, IPsec, or L2TP over IPsec. PPTP i know is inferior in terms of security and encryption, but I'm not really sure what the difference is between the two IPsec options.

Anecdotally, I've noticed that L2TP over IPsec seems to be much slower than plain IPsec, but that could be simply the servers, their configurations, or even the device on my end.

Is there any difference security-wise? Is one "better" than the other, or are they just functionally equivalent but differently implemented?

2 Answers 2


Cisco IPsec vs. L2TP (over IPsec)

The term Cisco IPsec is just a marketing ploy which basically means plain IPsec using ESP in tunnel mode without any additional encapsulation, and using the Internet Key Exchange protocol (IKE) to establish the tunnel. IKE provides several authentication options, preshared keys (PSK) or X.509 certificates combined with Extended Authentication (XAUTH) user authentication are the most common.

The Layer 2 Tunneling Protocol (L2TP) was has its origins in PPTP. Since it does not provide security features such as encryption or strong authentication it is typically combined with IPsec. To avoid too much additional overhead ESP in transport mode is commonly used. This means first the IPsec channel is established, again using IKE, then this channel is used to establish the L2TP tunnel. Afterwards, the IPsec connection is also used to transport the L2TP encapsulated user data.

Compared to plain IPsec the additional encapsulation with L2TP (which adds an IP/UDP packet and L2TP header) makes it a little less efficient (more so if it is also used with ESP in tunnel mode, which some implementations do).

NAT traversal (NAT-T) is also more problematic with L2TP/IPsec due to the common use of ESP in transport mode.

One advantage L2TP has over plain IPsec is that it can transport protocols other than IP.

Security-wise both are similar but it depends on the authentication method, the mode of authentication (Main or Aggressive Mode), the strength of the keys, the used algorithms etc.

  • 4
    So basically, if I'm only concerned with IP, IPsec would be more efficient than L2TP/IPsec by virtue of having less overhead and would likely be more compatible overall. Assuming the VPN provider has implemented everything properly, there's no difference in security since that's coming from the IPsec layer which both utilize. Correct? Jan 17, 2012 at 14:34
  • 2
    Correct. Between all the VPN options offered by your provider plain IPsec is the clear winner.
    – ecdsa
    Jan 18, 2012 at 17:53
  • Cisco has plenty of marketing ploys, but I really don't see this as one. I've worked quite a bit with IPSec on Ciscos and other equipment; I haven't had the impression of 'Cisco IPSec' being referred to as if it were a product. IPSec configuration isn't identical even among Cisco models.
    – belacqua
    Mar 26, 2013 at 20:04
  • 7
    Cisco IPsec is mainly used in Apple products to denote plain IPsec in tunnel mode (with IKEv1 either in Main or Aggressive Mode). The VPN dialog in iOS features a large Cisco logo if IPSec is selected and on Mac OS X it is explicitly called Cisco IPSec, even though both operating systems use Racoon to actually implement it.
    – ecdsa
    May 16, 2013 at 9:01
  • 1
    @AlexeyPolonsky You misunderstood. L2TP (or rather PPP) can transport layer 3 protocols different than IP (like AppleTalk or IPX) and L2TPv3 can even transport layer 2 protocols other than PPP (like Ethernet or Frame Relay). Neither of that is directly possible with plain IPsec. And the mode in which IPsec is used does not matter in regards to its ability to transport any IP packet, that is, the layer 4 protocol it transports is completely irrelevant in either mode.
    – ecdsa
    Jul 21, 2016 at 13:51


L2TP/IPSec and PPTP are similar in the following ways:

provide a logical transport mechanism to send PPP payloads; provide tunneling or encapsulation so that PPP payloads based on any protocol can be sent across an IP network; rely on the PPP connection process to perform user authentication and protocol configuration.

Some facts about PPTP:

  • advantages
    • PPTP easy to deploy
    • PPTP use TCP, this reliable solution allow to retransmit lost packets
    • PPTP support
  • disadvantages
    • PPTP less secure with MPPE(up to 128 bit)
    • data encryption begins after the PPP connection process (and, therefore, PPP authentication) is completed
    • PPTP connections require only user-level authentication through a PPP-based authentication protocol

Some facts about L2TP(over PPTP):

  • advantages
    • L2TP/IPSec data encryption begins before the PPP connection process
    • L2TP/IPSec connections use the AES(up to 256bit) or DESUup to three 56-bit keys)
    • L2TP/IPSec connections provide stronger authentication by requiring both computer-level authentication through certificates and user-level authentication through a PPP authentication protocol
    • L2TP use UDP. It is a faster, but less reliable, because it does not retransmit lost packets, is commonly used in real-time Internet communications
    • L2TP more “firewall friendly” than PPTP — a crucial advantage for an extranet protocol due to most firewalls do not support GRE
  • disadvantage
    • L2TP require certificate infrastructure for issuing computer certificates

To summarize:

There’s no clear winner, but PPTP is older, more light-weight, works in most cases and clients are readily pre-installed, giving it an advantage in normally being very easy to deploy and configure (without EAP).

But for most of countries like UAE, Oman, Pakistan, Yemen, Saudi Arabia, Turkey, China, Singapore, Lebanon PPTP blocked by ISP or government so they need L2TP or SSL VPN

Reference : http://vpnblog.info/pptp-vs-l2tp.html


The reason people use L2TP is due to the need to provide login mechanism to users. IPSec by itself is meant to by a tunneling protocol in a gateway-to-gateway scenario (there are still two modes, tunnel mode & transport mode). So vendors use L2TP to allow people to use their products in client-to-network scenario. So, they use L2TP only for logging and the rest of the session would be using IPSec. You have to take in consideration two other modes; pre-shared-keys vs. certificates.

Reference : http://seclists.org/basics/2005/Apr/139

IPsec tunnel mode

When Internet Protocol security (IPsec) is used in tunnel mode, IPsec itself provides encapsulation for IP traffic only. The primary reason for using IPsec tunnel mode is interoperability with other routers, gateways, or end systems that do not support L2TP over IPsec or PPTP VPN tunneling. Interoperability information is provided at the Virtual Private Network Consortium Web site.

Reference : http://forums.isaserver.org/m_2002098668/mpage_1/key_/tm.htm#2002098668

  • 2
    Thank you for the detailed response, but I already understood the difference between PPTP and L2TP. My question involves comparison/contrast of Cisco IPsec versus L2TP over IPsec -- unless you're implying that the difference is that Cisco IPsec uses PPTP, but I don't believe this is the case from what I've read. Jan 15, 2012 at 4:22
  • 1
    Sorry I misread your question. Cisco IPSec is just plain normal IPSec, there is nothing new about it. So your question is really IPsec VS L2TP/IPsec. Answer edited
    – chmod
    Jan 16, 2012 at 2:02
  • 2
    A minor correction - L2TP does not require certificate infrastructure. L2TP/IPSec supports password authentication without involving certificates.
    – Howard
    Nov 22, 2013 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.