Comparing the Different Tunneling Protocols

Table below compares the four different tunneling protocols that are available in Windows 7 and Windows Server 2008 R2.

Comparison of VPN Tunneling Protocols Supported by Windows 7 and Windows Server 2008 R2

Microsoft recommendations for choosing the right tunneling protocol for providing VPN access to your corporate network are as follows:

• For client computers running Windows 7 and VPN servers running Windows Server 2008 R2, implement IKEv2 as your tunneling protocol. In addition to providing data confidentiality, data integrity, and data origin authentication (to confirm that the data was sent by the authorized user), IKEv2 provides resiliency to VPN connections using MOBIKE, which enables VPN connections to be maintained when the underlying Layer 2 network connectivity changes.
• For client computers running Windows 7 and VPN servers running Windows Server 2008 RTM or SP2, use SSTP as a fallback tunneling protocol. This way, whenever an IKEv2 tunnel connection is blocked due to a firewall configuration or some other issue, the client can use SSTP to achieve VPN connectivity to the corporate network. For more information about the order in which different tunneling protocols are used during a VPN connection attempt, see the section titled "Understanding the VPN Connection Negotiation Process" later in this tutorial.
• For client computers running Windows 7 that need to connect to VPN servers running older versions of Windows, use L2TP/IPsec if a PKI is available; otherwise use PPTP.

Note Microsoft may remove support for L2TP/IPsec and PP TP in future versions of Windows, so enterprises deploying Windows 7 should implement IKEv2 with SSTP fallback as their VPN solution wherever possible.