L2TP, IPsec or Private APN: Bringing SIMs onto Your Network
Once a fleet must reach your systems privately, the question is how its traffic gets from the mobile network into yours. There are three common answers, and they differ most in who authenticates and addresses each SIM, and what you have to run. This guide compares them.
The three approaches at a glance
| L2TP to your LNS | Private APN over IPsec | Private APN by interconnect | |
|---|---|---|---|
| What arrives at your network | Each SIM as a PPP session | Routed traffic from the fleet's private network | Routed traffic, over a direct link |
| Who authenticates each SIM | Your RADIUS | The provider | The provider |
| Who assigns addresses | You, from RADIUS | The provider, to your plan | The provider, to your plan |
| What you run | An LNS and RADIUS | An IPsec endpoint | A router on the interconnect |
| Encrypted in transit | Only if carried in IPsec or over a private link | Yes | Not exposed to the internet |
| Per-SIM accounting | In your own RADIUS records | From the provider's portal or API | From the provider's portal or API |
| Best when | You already run subscriber infrastructure | You want a private fleet with the least to operate | Your systems live in AWS, Azure or an MPLS WAN |
L2TP to your own LNS
With L2TP, the provider tunnels each SIM's data session to your LNS as a PPP session, exactly as wholesale broadband is delivered. Your RADIUS decides whether the SIM may connect and gives it its address; your LNS applies your policy and records its usage.
It suits ISPs, MSPs and platform operators who already run an LNS and RADIUS for broadband: SIMs become one more kind of subscriber on infrastructure they know. The cost is that you operate that infrastructure, and L2TP itself does not encrypt, so the tunnels travel inside IPsec or over a private interconnect where that matters. Our technical guide to L2TP data SIMs covers tunnels, RADIUS and MTU in detail.
A private APN delivered over IPsec
With a private APN, the provider's mobile core places the fleet on a private network and addresses each SIM, to a plan you agree. That network is delivered to yours through an IPsec tunnel, so the fleet and your systems share one private address space end to end.
You run nothing more than an IPsec endpoint, which most firewalls already are. The provider handles authentication and addressing, and you see each SIM's usage in its portal or API rather than your own RADIUS. It is the simplest way to get a private, encrypted fleet. Our guide to private APNs sets out what isolation does and does not give you.
A private APN delivered by interconnect
The same private network can be delivered without a tunnel: directly into an AWS or Azure environment, or onto an existing MPLS WAN. Traffic never crosses the internet, and devices reach cloud-hosted systems with nothing in between.
This suits fleets whose platforms already live in a cloud account, and organisations whose sites are already on a corporate WAN. It needs the interconnect to be set up once, and then behaves like any other private network.
How to choose
Start from what you already run. If you operate an LNS and RADIUS for broadband subscribers, L2TP puts SIMs into the same tools, with your own addressing and accounting. If you do not, a private APN gives you a private fleet without new infrastructure: over IPsec to wherever your systems are, or by interconnect where they live in the cloud or on a WAN.
The choices are not exclusive. A provider can deliver one fleet by L2TP and another over IPsec, and a single fleet can reach a cloud platform and a support network by different paths.
What Netavo offers for each
| Approach | Netavo |
|---|---|
| L2TP to your LNS | Each SIM tunnelled to your LNS, from more than one LAC, over an on-net NNI, inside IPsec or over the internet; or terminated on Netavo BNG |
| Private APN over IPsec | A private SIM network on our own mobile core, delivered over IPsec, with static or dynamic private addressing |
| Private APN by interconnect | The same network delivered into AWS or Azure, or onto an existing MPLS WAN |
Common questions
What is the difference between L2TP SIMs and a private APN?
With L2TP, each SIM's session is delivered to your own LNS and your RADIUS authenticates and addresses it. With a private APN, the provider's core authenticates and addresses SIMs on a private network delivered to you.
Which is more secure, L2TP or IPsec?
They do different jobs. L2TP carries sessions but does not encrypt; IPsec encrypts. L2TP tunnels are often carried inside IPsec, or over a private interconnect, where encryption in transit is needed.
Do I need my own RADIUS server for IoT SIMs?
Only for L2TP delivery, where your RADIUS authenticates and addresses each SIM. A private APN delivered over IPsec or by interconnect needs no RADIUS of your own.
Can SIMs reach AWS or Azure without crossing the internet?
Yes. A private SIM network can be delivered directly into AWS or Azure by cloud interconnect.
Related services and sectors
L2TP Data SIMs: Mobile Data Delivered to Your LNS
Mobile data SIMs tunnelled over L2TP to your own LNS, authenticated and addressed by your RADIUS, like a broadband subscriber.
Explore L2TP data SIMs →Static IP and Private APN SIMs for IoT Fleets
Static public or private IP SIMs on a private APN network, reached by IPsec, cloud interconnect, MPLS or L2TP.
Explore static IP SIMs →IoT & Mobile Data
Global multi-network SIMs on our own mobile core, with internet access or a private network for device fleets.
Explore IoT →ISPs & Network Operators
Wholesale broadband, transit, backhaul and addressing for UK ISPs and altnets, with Netavo BNG software for subscriber termination and CGNAT.
Explore ISPs and operators →Industrial IoT & Remote Assets
Connect unattended industrial equipment to central systems with multi-network SIMs, private networking and data pooled across a device fleet.
Explore industrial IoT →Not sure which suits your fleet?
Tell us what you run today and where your systems are. An engineer will recommend an approach.
Work with us →