The network layer passes data down to the data link layer for transmission over the physical layer. The data link layer creates frames by adding the necessary checks and controls around that network layer data — a process called encapsulation. On a router’s serial interface, encapsulation must be explicitly configured to guarantee both ends of a link agree on the same framing method, since different WAN technologies use different encapsulation methods. The right choice of WAN encapsulation protocol depends on the specific WAN technology in use and the communicating equipment at both ends.
The important WAN encapsulation protocols are High-Level Data Link Control (HDLC), Point-to-Point Protocol (PPP), Frame Relay, X.25, Serial Line Internet Protocol (SLIP), and Asynchronous Transfer Mode (ATM). HDLC is the most common encapsulation protocol type, and most framing protocols in this list are based on it in some way.
High-Level Data Link Control (HDLC)
HDLC is the default encapsulation protocol on point-to-point connections, dedicated links, and circuit-switched links when both ends of the link use Cisco devices. It’s a synchronous, bit-oriented data link layer protocol, originally developed from IBM’s Synchronous Data Link Control (SDLC) and later standardized by ISO as ISO 13239.
HDLC provides both connection-oriented and connectionless services depending on the operating mode selected, and it includes flow control and error control through acknowledgment mechanisms. Cisco uses its own proprietary version, called Cisco HDLC (cHDLC), which adds a protocol-type field to the standard HDLC frame — a detail that matters in practice because Cisco’s cHDLC is not directly compatible with the standard HDLC implementations of other vendors, despite sharing the same name.
Point-to-Point Protocol (PPP)
PPP is another data link layer WAN encapsulation protocol, designed to send and receive multiprotocol data between two directly connected devices. PPP works over both synchronous and asynchronous circuits and supports multiple network layer protocols simultaneously, including IPv4 and IPv6.
PPP uses HDLC-based framing internally but is itself a byte-oriented protocol (using byte stuffing rather than bit stuffing), which distinguishes it from bit-oriented HDLC. PPP also includes built-in authentication mechanisms — PAP (Password Authentication Protocol) and CHAP (Challenge Handshake Authentication Protocol) — that HDLC lacks entirely. PPP is documented as RFC 1661 and remains widely used in broadband network communications, notably as the basis for PPPoE (PPP over Ethernet) in many DSL deployments.
Worked Example: Why PPP Replaced HDLC for Multi-Vendor Links
Consider a company connecting a Cisco router at headquarters to a non-Cisco router at a branch office over a leased line. If the engineer configures HDLC on both ends, the link may fail to establish properly, since Cisco’s proprietary cHDLC framing isn’t guaranteed to interoperate with another vendor’s HDLC implementation. Switching both ends to PPP resolves this immediately, since PPP is a fully standardized, vendor-neutral protocol supported consistently across virtually all router manufacturers. This exact scenario — HDLC working fine between two Cisco devices but failing between mixed-vendor equipment — is one of the most common real-world reasons network engineers choose PPP over HDLC for point-to-point WAN links.
Frame Relay
Frame Relay is a high-performance WAN encapsulation protocol operating at the physical and data link layers of the OSI reference model. It was originally designed to run across Integrated Services Digital Network (ISDN) interfaces, and it’s an industry-standard, packet-switched protocol capable of handling multiple virtual circuits simultaneously over a single physical connection.
Frame Relay’s key innovation was stripping out the time-consuming error correction and flow control processes that its predecessor, X.25, relied on — processes that made sense on the noisy analog lines X.25 was designed for, but became unnecessary overhead once cleaner digital lines became common. Today, Frame Relay is used over a variety of network interfaces, though it has been largely superseded by MPLS and Ethernet WAN in modern deployments.
X.25 / Link Access Procedure, Balanced (LAPB)
X.25 is a WAN encapsulation protocol suite defined by the ITU-T (then known as CCITT) in 1976 for packet-switched communications over WAN links. By 1980, it had become the most widely deployed WAN encapsulation protocol of its era.
X.25 allows several logical channels to share the same physical line and enables data exchange between terminals operating at different communication speeds. It defines how connections between DTE and DCE are established and maintained for remote terminal access and computer communications across public data networks. At the data link layer, X.25 specifies LAPB (Link Access Procedure, Balanced), derived from HDLC’s Asynchronous Balanced Mode. X.25 is the direct predecessor to Frame Relay and is generally considered the oldest widely deployed packet-switching technique, having been in commercial use before the OSI reference model itself became a formal standard.
Serial Line Internet Protocol (SLIP)
SLIP is a standard protocol for point-to-point serial connections carrying TCP/IP traffic. Developed in 1984, it was one of the earliest ways to run TCP/IP networking over a simple serial transmission line, used for TCP communication between two previously configured machines.
The classic historical example of SLIP in use is an older dial-up connection to a server: SLIP gave TCP/IP hosts dial-up access to the Internet by connecting to SLIP servers located at Internet Service Providers. SLIP has no built-in error detection, no support for protocols other than IP, and no authentication mechanism — limitations that led directly to PPP’s development as a more capable, general-purpose successor.
Asynchronous Transfer Mode (ATM)
ATM is an international standard for cell relay, in which multiple service types are conveyed using fixed-length cells rather than variable-length frames. Each ATM cell is exactly 53 bytes, and because cell processing happens in dedicated hardware rather than software, ATM achieves reduced transit delays compared to protocols requiring more complex per-frame processing. ATM commonly runs over high-speed transmission media such as E3, SONET, and T3 circuits.
Real-World Deployment Context
Understanding encapsulation choice matters in practice, not just in theory. Consider a network engineer troubleshooting a newly provisioned serial WAN link that won’t pass traffic even though the physical cabling and CSU/DSU are already confirmed working correctly. One of the first things to check is whether both ends of the link are configured with matching encapsulation — a link with HDLC on one end and PPP on the other simply won’t establish a connection, since the two routers are framing data in fundamentally incompatible ways.
This mismatch is one of the most common and most easily overlooked causes of a WAN link that appears physically fine but never comes up at Layer 2, which is why checking encapsulation configuration is typically one of the very first troubleshooting steps for a serial WAN link that refuses to establish.
This same principle extends directly to migrations: an organization replacing legacy Frame Relay circuits with a new MPLS service needs to ensure the CE (Customer Edge) router’s WAN interface encapsulation matches what the new service actually expects, since simply swapping the physical circuit without updating the encapsulation configuration will leave the link non-functional even though the underlying technology has genuinely changed for the better.
Choosing the Right Encapsulation Protocol
Selecting a WAN encapsulation protocol comes down to matching the protocol’s capabilities to the specific link and equipment involved:
- Two Cisco devices on a dedicated point-to-point link: HDLC (specifically Cisco’s cHDLC) is the simplest default choice.
- A point-to-point link involving mixed-vendor equipment, or where authentication is needed: PPP is the standard choice, given its vendor-neutral design and built-in PAP/CHAP support.
- A single physical connection needing to reach multiple remote sites via virtual circuits: Frame Relay was the historical choice, though modern deployments increasingly favor MPLS or Ethernet WAN for this role.
- Legacy public data network access, or connecting to very old X.25-based infrastructure: X.25/LAPB remains relevant only in legacy contexts today.
- High-speed carrier backbone or DSL transport requiring guaranteed cell-based QoS: ATM, though increasingly rare in new deployments.
Troubleshooting and Exam Tips
- Remember HDLC is Cisco’s default serial encapsulation, but Cisco’s proprietary cHDLC isn’t guaranteed to interoperate with non-Cisco HDLC implementations — a classic cause of point-to-point link failures between mixed-vendor equipment.
- Know PPP’s two defining differentiators from HDLC: byte-oriented framing (vs. HDLC’s bit-oriented framing) and built-in PAP/CHAP authentication (which HDLC lacks).
- Remember the historical lineage: X.25/LAPB → Frame Relay → (conceptually) MPLS, each generation removing overhead that the previous generation’s noisier or slower infrastructure had required.
- SLIP is essentially obsolete today but remains a useful reference point for understanding why PPP was developed — SLIP’s lack of authentication, error detection, and multiprotocol support are exactly what PPP added.
- If a question describes fixed 53-byte cells and hardware-based cell switching, ATM is almost always the intended answer.
Conclusion
WAN encapsulation protocols define how the data link layer frames network layer data for transmission across a specific physical WAN link, and the right protocol depends entirely on the equipment and technology involved. HDLC serves as the default, simple choice between matching Cisco devices; PPP adds vendor-neutral framing and authentication for mixed environments;
Frame Relay and X.25 represent successive generations of packet-switched virtual-circuit technology; SLIP was an important but limited early TCP/IP-over-serial protocol; and ATM’s fixed-cell design served high-speed carrier backbones for years. Understanding how these protocols relate to each other — not just their individual definitions — is what makes WAN encapsulation genuinely useful CCNA knowledge rather than a list to memorize in isolation, and it’s a habit of thinking that transfers directly to real-world WAN troubleshooting.
Frequently Asked Questions
What is WAN encapsulation?
WAN encapsulation is the process by which the data link layer wraps network layer data in a frame format appropriate for a specific WAN link, adding the checks and controls needed for that link’s specific technology and equipment.
What is the difference between HDLC and PPP?
HDLC is bit-oriented and, in Cisco’s proprietary cHDLC form, may not interoperate with non-Cisco equipment. PPP is byte-oriented, fully vendor-neutral, and includes built-in PAP/CHAP authentication that HDLC lacks — making PPP the more common choice for mixed-vendor or authenticated links.
Is Frame Relay still used today?
Rarely for new deployments. Frame Relay has been largely superseded by MPLS and Ethernet WAN, though some legacy Frame Relay circuits remain in service.
What is the relationship between X.25 and Frame Relay?
Frame Relay was developed as a simplified successor to X.25, removing the extensive error correction and flow control that X.25 needed for noisy analog lines, since the cleaner digital lines available by the 1980s made that overhead largely unnecessary.
Why was SLIP replaced by PPP?
SLIP lacked error detection, authentication, and support for any protocol other than IP. PPP was developed specifically to address these gaps, adding multiprotocol support, built-in authentication via PAP/CHAP, and more robust framing.
How do I troubleshoot a WAN link that won’t come up at Layer 2?
One of the first checks is confirming both ends of the link use matching encapsulation — a router configured for HDLC on one end and PPP on the other will fail to establish a connection even if the physical cabling and CSU/DSU are working correctly, since the two ends are framing data in incompatible ways.
