The Windows Server and Windows VPN client support a number of VPN protocols,
so administrators have to understand these protocols in order to
select the best protocol available for them.
In Windows Server,
the most common protocol or the most popular one is
Internet Key Exchange version 2, or IKEv2.
On Windows Servers specifically, SSTP is supported,
that's the secure Socket Tunneling Protocol,
and Windows Server and Windows client also support two additional protocols,
L2TP, or Layer 2 Tunneling Protocol,
as well as Point‑to‑Point Tunneling Protocol,
and we'll talk about each of these in detail.
IKEv2 is an open standard protocol, and it uses IPsec for providing security,
privacy, and protection.
IKEv2 uses UDP ports 500 and 4500, and as you can guess,
has some operational limitations.
Not all firewalls allow outbound UDP 500 and 4500 and,
in fact,
oftentimes those ports are proactively blocked because
they're known VPN transport ports.
Also,
IKEv2 has a number of performance issues associated with it due to some
operational challenges and limitations with Windows,
so you might find that the performance lacks when using IKEv2.
SSTP is another protocol supported by Windows,
and it is a Microsoft proprietary protocol,
so you can only take advantage of this protocol if you're
using a Windows Server infrastructure.
SSTP uses TLS for protection instead of IPsec and,
as such, uses the standard HTTPS port of TCP port 443.
This makes SSTP very firewall friendly and really the
best choice for user‑based connections.
And, in addition, it offers the best performance.
Two additional protocols,
L2TP and PPTP are supported in Windows Server and Windows client.
L2TP has been deprecated in favor of IKEv2.
L2TP doesn't provide a lot of real advantages,
If you need to use L2TP you can likely just use IKEv2 instead.
PPTP, of course, has been deprecated as insecure.
No one should be using PPTP anymore.
There are tools available on the internet that would allow an
attacker to easily break this communication.
It is as secure as the Wi‑Fi Wired Equivalency Protocol, WEP.
So no one's using WEP anymore, no one should be using PPTP as well.
So the question invariably comes up, which protocol should I use?
Should I use IKEv2, or should I use SSTP, and the answer is it depends.
So for IKEv2,
you're going to have to use IKEv2 if you're using a device tunnel connection.
The device tunnel for Windows, always on VPN,
requires IKEv2, it does not support SSTP,
so you must use IKEv2 for the device tunnel.
Also, you will use IKEv2 if you're using non‑Microsoft VPN devices.
So if you're using Cisco, Check Point, Palo Alto,
what have you,
the protocol of choice there will be IKEv2 for the
interoperability capabilities.
IKEv2 should also be used when the highest level of security is required.
To make that clear, IKEv2 is a secure protocol as well as SSTP,
but the options to tweak or tune IKEv2 to a very high
level of security are greater than SSTP,
so you would use IKEv2 when the highest level of security was required.
SSTP is best for the user tunnel, and again,
this is because it runs on TLS, it uses TCP port 443,
so it's ubiquitously available, and provides the best user experience.
SSTP again,
is available to you if you're using the Windows Server infrastructure,
whether that's RRAS or the Azure VPN gateway,
and remember, SSTP does provide very good security.
The security level of SSTP is probably satisfactory for 99%
of the deployments there are in the world.
If you have nation state adversaries,
probably IKEv2 is going to be your best bet, but SSTP is still a very, very good and very secure transport.