L2 Transport or a Site-to-Site VPN: Connecting Your Data Centres
Do you need Ethernet between two sites or an encrypted connection between IP networks? Compare architecture, MTU, bandwidth and failure paths.
Two data centres need to exchange data. Options include Ethernet transport and a site-to-site VPN over existing internet connections. Start with one question: does the application actually need a shared Layer 2 connection, or is routed IP reachability between separate networks sufficient? Much of the design follows from that answer.
What each option connects
L2 transport provides an Ethernet connection between handoff points. You can carry VLANs or build your own IP connections on it, subject to the agreed handoff rules. Ethernet services do not all handle tags or large frames identically. The particular service must match your configuration.
A routed IPsec site-to-site VPN connects IP networks over an existing underlay, such as internet access. Routing and security rules determine which networks are reachable through the tunnel. IPsec can provide integrity and encryption; the actual mechanisms depend on its configuration.
L2 does not automatically mean encrypted
A connection separated from the public internet makes no promise about encryption. Decide which data needs encryption and where encryption should terminate. Encrypted IP connections can also run over L2 transport. Choosing transport and protecting payload data are separate decisions.
Four questions to guide the decision
- 1Does the application need Ethernet across both sites? Check its documented requirements. A shared broadcast domain also expands the area affected by configuration errors.
- 2What transfer time is acceptable? Describe the data volume, time window and concurrent load. Replication also depends on the delay the application tolerates and the backlog it can accommodate.
- 3Which MTU must work end to end? Tunnels add overhead. Check the usable packet size at the endpoints and test real applications.
- 4Which failure must the connection survive? Draw both paths with routers, ports, access circuits and sites. A second tunnel over the same circuit does not protect against that circuit failing.
Make bandwidth and latency requirements explicit
Layer 2 or Layer 3 alone determines neither latency nor guaranteed bandwidth. Compare the proposed services: capacity, measurement points, availability, fault resolution and any agreed delay values. With a VPN, endpoint performance and internet connection load also matter. Individual figures are of limited use without comparable measurement conditions.
Information for an L2 enquiry
- Exact locations A and B, including the data centres and handoff points
- Required bandwidth and planned start date
- Port type, VLAN requirements and required MTU
- Application, traffic profile and encryption requirements
- Required failure protection and any existing connections
AS51202 offers L2 connections within Frankfurt and Nuremberg and between the regions. Available paths and handoffs are checked against both locations. If your application only needs IP reachability, include a routed option in the comparison. What matters is which service meets your operational requirements.