Cisco AnyConnect clients need to transfer large files over the VPN sessions. Which protocol provides the best throughput?

SSL/TLS runs over TCP, and tunneling TCP application traffic inside a TCP-based VPN causes TCP meltdown, degrading throughput significantly for large transfers.

L2TP adds a layer of encapsulation overhead and typically requires IPsec for security, increasing header size and reducing effective throughput compared to DTLS.

DTLS (Datagram TLS) is UDP-based and is specifically used by Cisco AnyConnect to avoid the 'TCP meltdown' problem, where TCP retransmission logic at both the tunnel and application layers interferes with each other. For bulk data transfers, DTLS delivers significantly higher throughput by eliminating this double-retransmission overhead. Cisco AnyConnect negotiates DTLS as the preferred data channel when available precisely for this performance advantage.

IPsec IKEv1 has longer negotiation sequences and lacks the UDP-based transport optimizations that make DTLS efficient for bulk data over AnyConnect sessions.