What is L2TP/IPsec and how does it work?

Have you come across L2TP/IPsec while setting up a VPN connection? L2TP/IPsec combines two networking technologies to create an encrypted VPN connection. Businesses have used it for remote access for years. In this guide, we’ll explain how L2TP/IPsec works and where it’s useful. You’ll also learn about its security limitations, device compatibility, and setup process.

What is L2TP/IPsec?

L2TP stands for Layer 2 Tunneling Protocol. It creates a tunnel that carries network traffic between connected devices, but it doesn’t encrypt that traffic on its own.

IPsec stands for Internet Protocol Security. It provides the encryption and authentication mechanisms used to protect the L2TP connection.

Together, these technologies create the L2TP VPN protocol with IPsec protection. The two systems handle different tasks to establish a protected connection. Data source: RFC 3193

How does L2TP/IPsec work?

When you start an L2TP/IPsec connection, your device communicates with the VPN server to establish the required security settings. The process involves four main stages.

Step 1. IPsec security negotiation

Your device and the VPN server negotiate security settings using Internet Key Exchange (IKE). They agree on compatible authentication methods and establish the keying information needed for the connection.

Step 2. IPsec protection

The devices establish IPsec security associations that define how they will protect traffic. IPsec commonly uses Encapsulating Security Payload (ESP) to provide encryption and integrity protection.

Step 3. L2TP tunnel creation

Once IPsec protection is established, L2TP negotiates the tunnel and session. It commonly carries Point-to-Point Protocol (PPP) traffic, which supports user authentication and network configuration.

Step 4. Data transmission

Your supported network traffic travels through the L2TP tunnel under IPsec protection. The server processes the traffic according to its routing and security policies.

Key features of L2TP/IPsec

L2TP/IPsec offers several capabilities that explain why organizations have used it for remote connections.

# Established networking technology: You can find support for L2TP/IPsec in various operating systems and networking products. However, availability varies by software version and device.

# Encrypted communication: IPsec protects traffic based on the configured security algorithms. Protection depends on proper authentication and implementation.

# NAT traversal: Compatible configurations can use UDP encapsulation to support connections through routers using Network Address Translation.

# Business network integration: Organizations can configure L2TP/IPsec to connect authorized users with internal networks and existing systems.

These features don’t make L2TP/IPsec the best option for every situation. Compare it with currently supported alternatives before deploying a new VPN service.

L2TP/IPsec ports and network requirements

You may need to check network ports when troubleshooting an L2TP/IPsec connection. The exact requirements depend on the server and IPsec configuration.

Port or protocol	Purpose
UDP 500	IKE negotiation
UDP 4500	IPsec traffic using NAT traversal
UDP 1701	L2TP communication
ESP (IP protocol 50)	IPsec-protected traffic when used without UDP encapsulation

You usually don’t need to configure these manually with a managed VPN client. Network administrators should follow their server documentation before changing firewall rules.

L2TP vs PPTP vs OpenVPN

You may encounter L2TP/IPsec alongside PPTP and OpenVPN when comparing VPN connection options.

Feature	L2TP/IPsec	PPTP	OpenVPN
Encryption	Provided by IPsec	Older security mechanisms	Configurable modern encryption
Authentication	IPsec and PPP mechanisms	Legacy methods	Multiple supported methods
Transport	L2TP with IPsec	TCP control and GRE	UDP or TCP
Current recommendation	Mainly existing deployments	Not recommended	Suitable for many modern deployments

PPTP has serious security weaknesses and shouldn’t be used for sensitive communications. OpenVPN offers configurable transport and authentication options, making it useful for many current VPN deployments.

L2TP/IPsec may remain necessary when you maintain an existing system. However, support alone doesn’t make an older configuration suitable for new security requirements.

How to set up L2TP/IPsec on different devices

Before you start your L2TP/IPsec VPN setup, confirm that your VPN server supports this connection type. You’ll need the server address and authentication details from your provider or network administrator.

Windows

Windows includes built-in L2TP/IPsec client support. 

• Open Settings > Network & internet > VPN
• Select Add VPN
• Choose Windows as the VPN provider and enter the server address. 
• Select the appropriate L2TP/IPsec option
• Provide the required credentials, and save your connection

macOS and iOS

Apple devices support L2TP/IPsec configurations, although available setup options can vary by operating-system version. Open the VPN settings and check whether you can create the required connection type.

Enter the server information and authentication details provided by your administrator. Use Apple’s current documentation for your specific device.

Linux

You can configure L2TP/IPsec on Linux using compatible networking software. Some deployments use tools such as strongSwan and xl2tpd. 

You’ll need to configure both the IPsec settings and the L2TP connection. Follow the documentation for your Linux distribution.

Android

Older Android versions supported L2TP/IPsec through built-in VPN settings. Many newer devices no longer offer those legacy connection options.

Check which VPN types your phone supports before attempting a manual setup. Your administrator may recommend a newer protocol and framework instead.

L2TP/IPsec security best practices

• You should review L2TP/IPsec security carefully if you’re maintaining an existing connection. 
• Outdated authentication settings and weak shared credentials can create unnecessary risks.
• Use strong credentials and verify server identity. 
• Keep your devices updated and choose security settings recommended for your environment.

If you manage a business network, review access permissions and connection logs in line with your organization’s privacy policies. 

Also maintain a migration plan for newer VPN technologies as they become available.

Common L2TP/IPsec connection problems

Sometimes your VPN won’t connect even when your internet works normally. Start troubleshooting with a few basic checks.

Problem	What you should check
Authentication failure	Username, password, and required authentication settings
Connection timeout	Server availability and network connectivity
IPsec negotiation error	Certificates, shared keys and security configuration
Frequent disconnections	Network stability and router compatibility
Slow connection	Server load, network quality and packet-size settings

If you’re using a company network, contact your administrator before changing firewall settings. Avoid disabling security software just to establish a VPN connection.

When should you use L2TP/IPsec?

You may still need L2TP/IPsec when your organization operates an existing VPN system that depends on it. Some older remote-access deployments and networking equipment still support the protocol.

For a new VPN deployment, consider alternatives such as IKEv2/IPsec, OpenVPN and WireGuard. Your choice should depend on security requirements, device compatibility, and administrative support.

Microsoft no longer enables L2TP by default for new Windows Server 2025 remote access installations. This reflects the move toward newer connection technologies.

Conclusion

L2TP/IPsec combines an established tunneling protocol with IPsec security mechanisms. You may still encounter it in business networks and older remote access configurations. Before using L2TP/IPsec, check your device compatibility and security requirements to decide whether it’s appropriate for your connection.

Frequently asked questions