L2TP vs PPTP
L2TP/IPSec and PPTP are similar in the following ways:
provide a logical transport mechanism to send PPP payloads;
provide tunneling or encapsulation so that PPP payloads based on any protocol can be sent across an IP network; rely on the PPP connection process to perform user authentication and protocol configuration.
Some facts about PPTP:
- advantages
- PPTP easy to deploy
- PPTP use TCP, this reliable solution allow to retransmit lost packets
- PPTP support
- disadvantages
- PPTP less secure with MPPE(up to 128 bit)
- data encryption begins after the PPP connection process (and, therefore, PPP authentication) is completed
- PPTP connections require only user-level authentication through a PPP-based authentication protocol
Some facts about L2TP(over PPTP):
- advantages
- L2TP/IPSec data encryption begins before the PPP connection process
- L2TP/IPSec connections use the AES(up to 256bit) or DESUup to three 56-bit keys)
- L2TP/IPSec connections provide stronger authentication by requiring both computer-level authentication through certificates and user-level authentication through a PPP authentication protocol
- L2TP use UDP. It is a faster, but less reliable, because it does not retransmit lost packets, is commonly used in real-time Internet communications
- L2TP more “firewall friendly” than PPTP — a crucial advantage for an extranet protocol due to most firewalls do not support GRE
- disadvantage
- L2TP require certificate infrastructure for issuing computer certificates
To summarize:
There’s no clear winner, but PPTP is older, more light-weight, works in most cases and clients are readily pre-installed, giving it an advantage in normally being very easy to deploy and configure (without EAP).
But for most of countries like UAE, Oman, Pakistan, Yemen, Saudi Arabia, Turkey, China, Singapore, Lebanon PPTP blocked by ISP or government so they need L2TP or SSL VPN
Reference : http://vpnblog.info/pptp-vs-l2tp.html
IPSec VS L2TP/IPSec
The reason people use L2TP is due to the need to provide login mechanism
to users. IPSec by itself is meant to by a tunneling protocol in a
gateway-to-gateway scenario (there are still two modes, tunnel mode &
transport mode). So vendors use L2TP to allow people to use their
products in client-to-network scenario. So, they use L2TP only for
logging and the rest of the session would be using IPSec. You have to
take in consideration two other modes; pre-shared-keys vs. certificates.
Reference : http://seclists.org/basics/2005/Apr/139
IPsec tunnel mode
When Internet Protocol security (IPsec) is used in tunnel mode, IPsec itself provides encapsulation for IP traffic only. The primary reason for using IPsec tunnel mode is interoperability with other routers, gateways, or end systems that do not support L2TP over IPsec or PPTP VPN tunneling. Interoperability information is provided at the Virtual Private Network Consortium Web site.
Reference : http://forums.isaserver.org/m_2002098668/mpage_1/key_/tm.htm#2002098668
Actually, IPsec in tunnel mode (as opposed to transport mode) transfers any traffic by encapsulating the original IP packets inside secured IP packets. The original IP packets can carry TCP, UDP or whatever other protocol. Does this render the L2TP as not having any advantage at all? – Alexey Polonsky – 2016-05-29T14:48:24.573
@AlexeyPolonsky You misunderstood. L2TP (or rather PPP) can transport layer 3 protocols different than IP (like AppleTalk or IPX) and L2TPv3 can even transport layer 2 protocols other than PPP (like Ethernet or Frame Relay). Neither of that is directly possible with plain IPsec. And the mode in which IPsec is used does not matter in regards to its ability to transport any IP packet, that is, the layer 4 protocol it transports is completely irrelevant in either mode. – ecdsa – 2016-07-21T13:51:34.423
2So basically, if I'm only concerned with IP, IPsec would be more efficient than L2TP/IPsec by virtue of having less overhead and would likely be more compatible overall. Assuming the VPN provider has implemented everything properly, there's no difference in security since that's coming from the IPsec layer which both utilize. Correct? – Chris Pratt – 2012-01-17T14:34:04.160
Correct. Between all the VPN options offered by your provider plain IPsec is the clear winner. – ecdsa – 2012-01-18T17:53:52.900
Cisco has plenty of marketing ploys, but I really don't see this as one. I've worked quite a bit with IPSec on Ciscos and other equipment; I haven't had the impression of 'Cisco IPSec' being referred to as if it were a product. IPSec configuration isn't identical even among Cisco models. – belacqua – 2013-03-26T20:04:46.217
5Cisco IPsec is mainly used in Apple products to denote plain IPsec in tunnel mode (with IKEv1 either in Main or Aggressive Mode). The VPN dialog in iOS features a large Cisco logo if IPSec is selected and on Mac OS X it is explicitly called Cisco IPSec, even though both operating systems use Racoon to actually implement it. – ecdsa – 2013-05-16T09:01:57.973