Skip to main content
IMMUNITYSEC

Port 1701: Layer 2 Tunneling Protocol

L2TP tunnels PPP sessions between an access concentrator and a network server and runs over UDP port 1701 (RFC 2661). Remote access VPNs typically run it inside IPsec, a combination defined in RFC 3193 and known as L2TP/IPsec. Windows Routing and Remote Access lists L2TP on UDP 1701.

1701
UDP

Port Details

Port
1701
Transport
UDP
Service
L2TP
IANA service name
l2f, l2tp
Range
User port (1024-49151)
Related ports
5004500

Security Exposure

RFC 3193 relies on IPsec to give L2TP tunnel authentication, privacy protection, integrity checking and replay protection, so L2TP sent without IPsec lacks those properties. An internet-facing L2TP endpoint also adds VPN attack surface for credential guessing against the PPP layer. Microsoft has deprecated L2TP and PPTP in Windows Server, citing well-documented vulnerabilities, and new RRAS setups in Windows Server 2025 do not accept L2TP connections by default.

Hardening

  • +Accept L2TP only when it is protected by IPsec and drop UDP 1701 packets that arrive outside an IPsec security association.
  • +Plan migration to IKEv2 or SSTP, the tunnel types Microsoft recommends in place of L2TP.
  • +Leave L2TP disabled on Windows Server 2025 RRAS unless a legacy client population still requires it.
  • +Limit UDP 500, 4500 and 1701 at the firewall to the gateways that actually terminate L2TP/IPsec.

Monitoring

Watch for UDP 1701 traffic that is not carried inside ESP, and for tunnel setup attempts against hosts that are not designated VPN gateways. Track repeated PPP authentication failures on the VPN server.

Tools for Auditing and Monitoring L2TP

OPNsense

Free / Commercial
Network Security Tools

Open source FreeBSD firewall and routing platform with IDS integration and a paid business edition.

LicenseBSD-2-Clause
PlatformHardware, FreeBSD

Wireshark

Open Source
Network Monitoring Tools

Network packet analyzer and protocol inspection tool for capturing live traffic and debugging network communications in detail.

LicenseGPL-2.0-or-later
PlatformWindows, macOS, Linux, BSD

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Related Tool Categories

Network Monitoring Tools→

Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

Frequently Asked Questions

Is L2TP port 1701 TCP or UDP?→

L2TP uses UDP. RFC 2661 assigns UDP port 1701 as the destination for L2TP tunnel traffic.

Does L2TP encrypt traffic on its own?→

RFC 3193 describes how L2TP uses IPsec to provide tunnel authentication, privacy protection, integrity checking and replay protection. Deployments therefore pair L2TP with IPsec instead of running it alone.

Is L2TP still supported on Windows Server?→

Microsoft has deprecated L2TP and PPTP. Beginning with Windows Server 2025, new RRAS setups do not accept L2TP or PPTP connections by default, though administrators can still enable them.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 1701 is not guaranteed to be L2TP. Exploited-in-the-wild data from the CISA KEV catalog (CC0).