Layer 2 Tunneling Protocol (L2TP)
A tunnelling protocol that carries PPP frames across an IP network; it provides no strong encryption of its own, so it is commonly paired with IPsec as L2TP/IPsec for VPNs.
The Layer 2 Tunneling Protocol builds a tunnel across an IP network and carries Point-to-Point Protocol frames through it, so a remote user or site appears directly connected to the network at the far end. Version 2 is defined in RFC 2661, and version 3, which generalises it to carry other layer 2 traffic, in RFC 3931. L2TP combined two earlier tunnelling designs: Layer 2 Forwarding and the Point-to-Point Tunneling Protocol.
The key point is what L2TP does not do. It provides encapsulation, not confidentiality: the tunnel on its own has no strong encryption and only limited authentication of the tunnel endpoints. For a VPN, L2TP is therefore commonly run inside IPsec, a combination specified in RFC 3193 and known as L2TP/IPsec. IPsec, with keys negotiated by Internet Key Exchange, supplies encryption and integrity, while L2TP supplies the PPP session, including user authentication and address assignment. The layering adds overhead, and some firewalls and address translation devices handle it poorly.
Exam relevance: a scenario is likely to ask which protocol protects the data in an L2TP VPN. Candidates are expected to recognise that the answer is IPsec rather than L2TP, and to set L2TP apart from PPTP, whose own encryption is widely regarded as weak.