L2TP vs GRE over IPsec for Site-to-Site VPN
Describe site-to-site and remote access VPN deployment types such as virtual tunnel interfaces, standards-based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPN
Answer
Correct answer: B — GRE over IPsec cannot be used as a standalone protocol, and L2TP can.
An engineer is trying to decide between using L2TP or GRE over IPsec for their site-to-site VPN implementation. What must be understood before choosing a solution?
Community Insight
The core concept tested is that GRE is a non-secure tunneling protocol that requires IPsec (or another security layer) to function as a secure VPN, whereas L2TP can operate independently as a standalone tunneling mechanism before encryption is applied.
This question examines the fundamental differences between L2TP and GRE tunneling protocols when used with IPsec, focusing on their operational independence and encapsulation characteristics.
Many candidates select D, incorrectly assuming L2TP does not add a header; in reality, L2TP adds its own specific header, similar to how GRE adds its own, making this distinction false.
Community Discussion (33 comments)
XBfoundX
👍 1
Selected: B
I go with B, too, actually also L2TP added his own header. At this point I will choose B, because as many other mentioned GRE and IPSec are two protocols used togheter.
7d4c29f
👍 1
Selected: D
these two protocols is that GRE over IPsec adds its own additional GRE header on top of the IPsec header, providing greater flexibility for carrying multicast and routing protocol traffic
KKS789
👍 4
Selected: D
I think answer D is correct, L2TP and GRE both encapsulate packet of original header to another protocol, L2TP is open standard and used for dial-up link to established point-to-point tunnel but it does not encrypt traffic so IPSec is used to do it. However, GRE is encapsulating packet in IP and add new IP Header. GRE is carrier protocol and IP is used for transport. GRE over IP is plain text tunnelling with IPSec provide encryption.
kloug
👍 1
Answer b
Premium_Pils
👍 2
Selected: B
udp 1701 is used by the L2TP server, and L2TP adds it's own header, so we can exclude C and D. As I understand, it uses udp for encapsulation, so A is not a good answer either. B) it can be used as a standalone. B is a strange answer, because it is very recommended to use L2TP combined with IPsec. Still, I am going with B, because all the other answers seem to be incorrect.
Rododendron2
👍 2
Selected: B
team B)
Tthurston1
👍 1
Would have to vote B for this one as well... A is incorrect - L2TP IS a TUNNELING protocol. C is also incorrect - L2TP uses UDP and NOT TCP. D is also incorrect - L2TP includes an additional set of IP, UDP, and L2TP headers.
squirrelzzz
👍 3
Selected: B
GRE and IPSEC are two protocols
luismg
👍 1
You can have gre tunnels protected with IPSEC, it is common if you want direct layer 3 connectivity, run routing protocols between the GRE peers.
MPoels
👍 5
Selected: B
Cisco definition: Unlike encapsulation, tunneling allows a lower-layer protocol and a same-layer protocol to be carried through the tunnel." Like stalkr3 said before: L2TP carries a lower layer protocol (L2, like PPP). It is a tunneling protocol (hence the name) and not an encapsulation. https://www.cisco.com/c/en/us/td/docs/ios/12_4/interface/configuration/guide/inb_tun.html#wp1045601
nep1019
👍 4
Selected: D
I think it's D and here is why: Take a look at the L2TP header IN the IPSec packet in the diagram here: https://www.researchgate.net/figure/L2TP-over-IPsec-Encapsulation_fig10_330313436 It's not adding an additional header that GRE does as depicted in the diagram here in fig 14.1: https://www.ciscopress.com/articles/article.asp?p=773666&seqNum=2 GRE adds its own required header to the IPSec packet and L2TP does not. Its header is encapsulated within the IPSec packet.
ffaiz
👍 2
Selected: A
https://www.ibm.com/docs/en/i/7.4?topic=concepts-layer-2-tunnel-protocol L2TP is actually a variation of an IP encapsulation protocol. The L2TP tunnel is created by encapsulating an L2TP frame inside a User Datagram Protocol (UDP) packet, which in turn is encapsulated inside an IP packet. https://learningnetwork.cisco.com/s/question/0D53i00000KstmKCAR/difference-between-gre-and-ipsec https://www.cloudflare.com/learning/network-layer/what-is-gre-tunneling/ GRE is a tunneling protocol
haiderzaid
👍 2
A: is not correct since L2TP is frame encapsulation and gre over ipsec is not a single protocol. C: wrong D:L2TP also adds it own header So only B remaining ,its not clear for me but the other three answers seems wrong to me
haiderzaid
👍 2
i think B is write because GRE over ipsec is a combination of two protocols and cannot be used as standalone protocol, and L2TP can be used without security and encryption also we can use Ipsec to make it secure
stalkr3
👍 3
A is wrong. Per Cisco site:"Unlike encapsulation, tunneling allows a lower-layer protocol and a same-layer protocol to be carried through the tunnel." L2TP carries a lower layer protocol (L2, like PPP). It is a tunneling protocol (hence the name) and not an encapsulation.
achille5
👍 2
Selected: A
D is wrong, L2TP adds 8bytes of header ...Overhead is tallied for an IP header of 20 bytes, a UDP header of 8 bytes, and an L2TP header of 8 bytes.
Brumik
👍 3
If you read the question carefully, the answer is B
davezz
👍 1
Yes B. C is obviously wrong. A is also wrong as L2TP is a tunnel protocol and what it encapsulates is the entire Ethernet frame, not just an IP packet, in addition, "GRE over IPsec" is not a protocol, it is using 2 protocols together. D is wrong too as L2TP does add its own header, just google for "L2TP header" and you will find the answer, the search resulted images are useful too.
luisseijuro
👍 3
Selected: D
https://ipwithease.com/gre-vs-l2tp/
CCNP21
👍 3
Selected: A
I believe A is correct. L2TP is actually a variation of an IP encapsulation protocol. GRE is a tunneling protocol which is used to transport multicast, broadcast and non-IP packets like IPX etc. IPSec is an encryption protocol.
Anonymous983475
👍 2
Selected: A
Only A makes sense
ITgeeek
👍 2
Selected: A
A is correct.
ITgeeek
👍 1
So correct answer is A, right?
Emlia1
👍 1
I prefer A
ureis
👍 1
L2TP is layer 2 only
kjubo
👍 1
Selected: B
so its B
kjubo
👍 1
i mean A :D
Hereim
👍 1
https://community.cisco.com/t5/routing/difference-between-l2tp-gre-mpls/td-p/2735611#:~:text=L2TP%20and%20GRE%20are%20both,for%20the%20data%20being%20tunneled.
Hereim
👍 3
L2TP is a Layer 2 protocol and GRE is a layer 3. IPSEC works at layer 3. As per the options, L2TP is an ip packet encapsulation (since its a layer 2 protocol), and therefore seems to be the best feasible correct option amongst the given choices; GRE over IPSEc is a tunnelling protocol (basically used for VPN). As per the question, which is asking in regards to "site to site VPN", L2TP cannot be used alone, you will need IPSEC at layer 3 whereas GRE over IPSEC can be used to achieve that. C is wrong D is wrong too
Initial14
👍 1
Agreed.
Initial14
👍 1
WRONG. I'd go with B. GRE and IPSEc are 2 different protocols ( GRE with it's own header and IPSEC also. So IPSEC + GRE cannot go as a single protocol, while L2TP can ( also, if L2TP would not add it's headers, this would not be tunneling protocol, you can also check how L2TP adds headers on google)
kjubo
👍 1
GRE is L2 without encryption and ipsec is L3 with it, so sometimes you can use Ipsec into Gre tunnel
Initial14
👍 1
Refer to Hereim answe
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because it accurately describes the architectural dependency of these protocols. GRE is a Layer 3 tunneling protocol that encapsulates packets but provides no security or authentication by itself; therefore, it cannot serve as a standalone secure VPN solution without an accompanying protocol like IPsec. L2TP (Layer 2 Tunneling Protocol), while often paired with IPsec for encryption, is fundamentally a tunneling protocol that can establish a tunnel connection independently of the encryption layer, allowing it to be used as a standalone transport mechanism before security policies are applied.Why the Other Options Are Wrong
Option A is incorrect because L2TP is indeed a form of encapsulation/tunneling, and GRE is also a tunneling protocol; the distinction isn't cleanly drawn this way. Option C is factually wrong regarding ports: L2TP uses UDP port 1701, not TCP 47 (which is GRE's protocol number). Option D is incorrect because both L2TP and GRE add their own headers to the payload; neither operates without adding framing overhead.Community Comment Notes
Community consensus heavily favors Option B, with users citing Cisco documentation that distinguishes tunneling from simple encapsulation based on layer handling. Several commenters correctly identified that L2TP carries Layer 2 frames (like PPP) through the tunnel, whereas GRE carries Layer 3 packets. One user noted that GRE is a carrier protocol requiring IP for transport, reinforcing why it isn't standalone in a secure context.Official Reference
Exam Strategy
When comparing tunneling protocols, always check if the protocol includes its own security features. If it doesn't (like GRE), it needs a companion protocol (like IPsec) to be a 'VPN'. If it's just a transport mechanism (like L2TP), it can technically exist without encryption, even if best practice dictates otherwise.
Frequently Asked Questions
Why is GRE considered not standalone?
GRE is a tunneling protocol that encapsulates packets but lacks built-in encryption or authentication, so it must rely on IPsec to provide security for a VPN.
Does L2TP add a header?
Yes, L2TP adds its own header to the payload, similar to how GRE adds its own header; they both introduce overhead to the original packet.