Layer 2 and Layer 3 VPNs and Using Secure Applications
Layer 2 versus Layer 3 tunnels
Layer 2 VPNs carry Ethernet or PPP frames: PPTP (MS-CHAPv2, treat as broken), L2TP (no encryption on its own), and L2TP/IPsec. Layer 3 VPNs carry IP: IPsec in tunnel mode (ESP encrypts and authenticates; AH authenticates only), negotiated by IKEv1 or IKEv2 with NAT traversal, and TLS/DTLS SSL VPNs, either clientless reverse proxy or full tunnel.
Where each belongs
WLAN security - WPA2/WPA3-Enterprise, 802.1X, CCMP - protects the wireless hop and authenticates the user to the network. A VPN protects traffic across an untrusted path such as a public hotspot, a guest network, or a branch link. They solve different problems: a VPN is not a substitute for WPA2-Enterprise on your own WLAN, and WPA2 does not protect frames after they leave the AP.
Secure application considerations
Always validate server certificates including chain, revocation and hostname; a user who clicks through a warning has no protection against an evil twin. Prefer IKEv2 for mobility and reconnection. Disable or strictly policy-control split tunneling on untrusted networks. Keep TLS versions current. Isolate guest clients so peer-to-peer traffic never reaches other guests.
Worked example
An employee at an airport hotspot must reach the corporate intranet. Correct answer: connect to the hotspot (open network, ideally with OWE or a captive portal on an isolated VLAN) and then establish an IPsec or TLS VPN to the corporate gateway, with certificate validation enforced. Relying on the hotspot being encrypted is the wrong answer; refusing to use the hotspot at all is impractical.
Rule of thumb
Public hotspot or untrusted path means VPN; corporate employee device on the corporate WLAN means 802.1X with EAP-TLS and CCMP. If both conditions apply, layer them.