As you might imagine, even though there are advantages for router-based encryption, there are also some tradeoffs. First, when you are considering router-based encryption, be sure to ask your router vendor how much processing tax the encryption function will cost you in router performance. Also, remember that with the router-based encryption, the traffic to be encrypted must go through the router. Thus, you are adding both the IP overhead and the encryption overhead.
Pricing also has to be considered.
The bottom line on Layer 2 vs. Layer 3 encryption is that the ultimate decision will end up being based more on personal preferences than hard technologies. Both work, but neither is perfect. Networks that are almost exclusively based on IP and routers may tend to use router-based encryption, while those with a broader range of protocols based on frame relay access devices and switches may lean more toward Layer 2 encryption. Steven Taylor , consultant and broadband packet evangelist, and Joanie Wexler, an independent networking technology editor and writer, team up to bring you this analysis and commentary. Taylor specializes in education and market analysis, and Wexler adds incisive reporting and research.