secure; L2TP connections are clear text. L2TP is usually combined with IPsec to achieve the required privacy. Residential dialup access to the Inter- net uses similar technology. Broadband provides additional options, includ- ing the use of cable links, DSL links, or 802.11 in the wireless realm. Site-to-site VPNs-Site-to-site VPNs were developed for enterprises desir- ing to communicate over the public Internet but requiring data integrity authentication and privacy. The main approach has included the use of IPsec or GRE. However, many more options are now available, especially in the provider edge-based arena. As shown in Figure 9.20, provider edge- based VPNs are available as Layer 3 VPNs and Layer 2 VPNs. Layer 3 VPNs offer two choices: RFC 2547 and virtual routers. Layer 2 VPNs also offer two choices: virtual private wire service (VPWS) and Virtual Private LAN Services (VPLS). IP VPN User-to-Site Dialup Broadband PPP L2TP Cable/DSL IPsec 802.11 IPsec Figure 9.19 VPDN solutions Chapter 9 IP Services IP VPN User-to-Site Provider Customer Edge-Based Edge-Based IPsec L3 VPN L2 VPN Virtual RFC 2547 Routers Figure 9.20 Site-to-site VPN solutions The following sections describe the various types of site-to-site VPNs. IPsec VPNs IPsec has been around for quite some time and is offered by most service providers as a mechanism for tunneling traffic across the Internet to areas where the provider does not have POPs. In order to address the heightened security requirements, the customer or the provider managing the CPE routers can build IPsec security asso- ciations (not called tunnels unless using a specific type of security association, known as tunnel mode, described shortly) across the Internet to interconnect CPE. In order to authenticate and encrypt the user data, packets are forwarded across the shared Internet. IPsec uses a variety of protocol exchanges and encapsulations at the endpoints. IPsec is an IETF protocol suite that addresses basic data integrity and security. It covers encryption, authentication, and 