Site-to-site VPN vs L2 tunnel: what changes for DR

TL;DR

A site-to-site VPN routes packets between different subnets. An L2 tunnel extends the same subnet. Result: with the VPN the local client "sees" a different cloud IP; with L2 it sees the same IP. The difference shows up in emergency reconfiguration.

The two technologies in 30 seconds

Site-to-site VPN (Layer 3)

Encrypted tunnel between two gateways. Routes packets across different subnets:

• Customer LAN: 192.168.10.0/24
• Cloud DR: 10.99.0.0/24
• VPN connection with NAT.

Local clients have to "point" to the new cloud IP to reach the recovered VM.

L2 tunnel

Extends the broadcast domain. The two networks become the same subnet:

• Customer LAN: 192.168.10.0/24
• Cloud DR: 192.168.10.0/24 (extension, not duplication)
• Connection via a Connector encapsulating ethernet frames.

Local clients talk directly to the recovered VM, not even knowing it is in the cloud.

The operational problem of VPN in DR

In the real DR scenario with classic VPN:

1. at disaster time, the client must re-resolve "ERP-server" → new IP;
2. internal DNS must be updated;
3. any hard-coded IPs in apps fail;
4. customer firewall and routing must accept the new IP.

Extra time: 30-90 real minutes.

L2 advantage

With L2 tunnel:

• recovered VM IP = same IP as primary;
• no DNS changes;
• no firewall changes;
• legacy apps work "magically".

Extra time: 0 minutes.

When VPN is enough

Cases where Layer 3 is OK:

• cloud-native workloads without legacy;
• failover of public web services (handled via dynamic DNS);
• very simple environments.

For the rest, L2 wins.

Cost comparison

Site-to-site VPN: often "free" (included in the customer firewall). Hidden cost: time on day X.

L2 tunnel (Sefthy): Connector cost (included in subscription) + DRaaS fee. Net cost: €50-100/month more than a classic VPN, but RTO 5× lower.

FAQ

Does L2 tunnel replace the corporate VPN?

No. The VPN for remote user access remains. The L2 tunnel is specific to DR and data replication.

Can I use both at the same time?

Yes, they are independent.

Does the L2 tunnel work behind CGNAT?

Yes, it is outbound. Classic VPNs often do not.

For the L2 pillar, L2 tunnel for DR. For layer 2 vs layer 3, Layer 2 vs Layer 3.