Which VPN type must be configured before enabling an L2VPN?

NSX-T L2VPN extends Layer 2 networks across different sites by encapsulating L2 frames and tunneling them over a Layer 3 underlay. To secure this traffic, NSX-T requires a pre-established secure tunnel. The required tunnel type is a route-based IPSec VPN. This creates a virtual tunnel interface (VTI) on the NSX Edge node. All traffic, including the encapsulated L2VPN traffic, is then routed through this secure VTI to the remote peer. Therefore, configuring a route-based IPSec VPN session is a mandatory prerequisite before you can configure and enable the L2VPN service itself.

A. Policy-based IPSec VPNs use access control lists to define which specific traffic is encrypted, which is not the flexible tunneling mechanism required for L2VPN services.
B. "Port-based IPSec VPN" is not a standard industry classification for IPSec VPNs. IPSec operates at the network layer (Layer 3), not based on transport layer ports.
C. SSL VPN is a distinct technology from IPSec VPN. The NSX-T L2VPN service is explicitly designed to operate over a route-based IPSec VPN tunnel, not an SSL tunnel.

1. VMware NSX-T Data Center 3.2 Documentation

"VPN Guide"

Section: "Configure an L2 VPN Session":

Under the "Prerequisites" subsection

the documentation explicitly states: "You must have a route-based IPSec VPN session configured between an NSX Edge node and the remote peer." This confirms that a route-based IPSec VPN is a mandatory preceding step.

2. VMware NSX 4.1 Documentation

"NSX Administration Guide"

Section: "L2 VPN Workflow":

This section outlines the high-level configuration steps. Step 2 is: "Configure a route-based IPSec VPN session between the NSX Edge node and the remote peer." This workflow reinforces that the IPSec VPN configuration must be completed before proceeding with the L2VPN service configuration.