PlantUML DiagramGRE over IPsec
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
! Basic GRE tunnel between two routersinterface Tunnel0description GRE-to-R2ip address 10.255.0.1 255.255.255.252tunnel source 203.0.113.1tunnel destination 203.0.113.2tunnel mode gre ipno shutdownexit! Verifyshow interface Tunnel0show ip route | include Tunnel0
A GRE tunnel is a virtual point-to-point link between two routers over an IP network. Traffic sent into Tunnel0 is encapsulated in GRE, wrapped in a new IP header, and sent to the tunnel destination. The receiving router strips the outer header and forwards the inner packet — as if it were sent directly over a serial link.
| Feature | GRE | IPsec |
|---|---|---|
| Encryption | None | Yes (with ESP) |
| Multicast support | Yes | No (IPsec doesn't carry multicast) |
| Routing protocols | OSPF, EIGRP, BGP can run inside | Limited to unicast |
| Overhead | 24 bytes | Varies — 50-100+ bytes depending on mode |
| Config complexity | Simple | Complex |
| Typical use | Multicast, routing protocols over untrusted networks | Site-to-site with encryption |
The key reason GRE still exists: it can carry multicast. IPsec can't. If you want to run OSPF over a tunnel between two sites, IPsec alone won't work — OSPF uses multicast (224.0.0.5) to establish neighbors. GRE encapsulates the multicast, and then you can layer IPsec on top for encryption.
GRE over IPsec is the classic design for connecting two sites over the internet with full routing protocol support. Configure the GRE tunnel first, verify it works with a plain ping, then apply IPsec to encrypt the GRE traffic. The crypto ACL matches the GRE endpoints as interesting traffic.
GRE adds 24 bytes of overhead. IPsec adds another 50-100+ bytes depending on mode. That's 74-124+ bytes per packet on top of the original IP header. For a 1500-byte MTU, the encapsulated packet exceeds 1500 bytes, causing fragmentation or drops. Solution: reduce MTU on the tunnel interface (typically to 1400) or enable Path MTU Discovery.
! Reduce tunnel MTU to avoid fragmentationinterface Tunnel0ip mtu 1400ip tcp adjust-mss 1360exit! Verify MTU on tunnelshow interface Tunnel0 | include MTU
Configure a GRE tunnel between two lab routers using public IPs as tunnel sources and private IPs on the tunnel interface. Verify with `show interface Tunnel0` and by pinging the far end of the tunnel. Then run OSPF over the tunnel and confirm neighbor formation.
GRE is unencrypted encapsulation. IPsec is encrypted encapsulation without multicast. GRE over IPsec combines both. Section 17 continues with SD-WAN and modern software-defined architectures.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.