2.3 GRE Tunneling

Lesson Overview

Generic Routing Encapsulation (GRE) is a tunneling protocol that creates logical point-to-point connections between routers across an IP network. It enables remote enterprise sites to exchange traffic and run dynamic routing protocols over a virtual tunnel.

This lesson covers GRE fundamentals, tunnel configuration, packet encapsulation, routing, verification, and troubleshooting, including GRE over IPsec for secure communication.

Learning objectives

After completing this training, you will be able to:

1. Explain GRE tunneling concepts and enterprise use cases.

2. Describe GRE encapsulation and the end-to-end packet flow.

3. Distinguish underlay transport from overlay tunnel routing.

4. Configure a point-to-point GRE tunnel on Cisco IOS XE routers.

5. Implement static routing and OSPF over GRE.

6. Analyze GRE overhead, path MTU, fragmentation and TCP MSS.

7. Compare GRE, IPsec and GRE protected by IPsec.

8. Verify and troubleshoot connectivity, recursive routing, dropped traffic and security associations.

1. GRE fundamentals and why networks use tunnels

Generic Routing Encapsulation (GRE) is an IP tunneling mechanism defined by RFC 2784. It encapsulates an original packet inside GRE and a new outer delivery header so that it can cross an intermediary IP network. Point-to-point GRE presents a logical Layer 3 interface at each endpoint.

A company may have private IPv4 ranges at its branch and data center, while the provider only routes its WAN endpoint addresses. GRE allows the private-site packet to be forwarded through the intermediary network inside an outer packet whose source and destination are reachable WAN endpoints.

Typical uses: site-to-site logical connectivity; transit for routing protocols; multicast routing across an IP-only transport where the chosen implementation supports it; temporary migration connectivity; lab simulation; and, when protected with IPsec, encrypted inter-site connectivity.

Limitations: GRE has no native confidentiality, integrity/authentication or access-control enforcement. A tunnel does not add bandwidth, repair an unreachable underlay, or guarantee end-to-end delivery. Basic GRE is stateless, and a tunnel can appear operational while a far-end path is broken.

Protocol identification: Standard GRE over IPv4 is IP protocol 47. Do not confuse this with TCP port 47 or UDP port 47. Intermediate ACLs/firewalls must permit the correct GRE/IP protocol when raw GRE is used.

2. Architecture: physical transport and the logical tunnel

Generic Routing Encapsulation (GRE) uses two network layers to establish logical connectivity between remote enterprise sites:

1. Physical Transport Network (Underlay): The existing IP infrastructure that carries GRE-encapsulated packets between tunnel endpoints.

2. Logical GRE Tunnel (Overlay): A virtual point-to-point connection that enables remote routers to exchange traffic as though they were connected through a dedicated logical link.

The physical network provides actual packet transportation, while the logical tunnel provides connectivity between remote routing domains.

Key Concept: GRE does not create a new physical connection. It creates a logical interface that transports encapsulated traffic over an existing IP network. 

Figure 2: Physical WAN underlay and GRE overlay

Underlay: R1 WAN ↔ ISP-RTR ↔ R2 WAN. Its job is to carry packets between WAN endpoint IP addresses. It must be operational before the overlay can transport traffic.

Overlay: R1 Tunnel0 ↔ R2 Tunnel0. It appears as a directly connected logical link to the customer routers, even though packets actually traverse the ISP underlay.

2.1 Physical Transport Network (Underlay)

The underlay is the existing IP network that provides reachability between the GRE tunnel endpoints.

It may consist of:

• Enterprise WAN routers.

• ISP routers and backbone infrastructure.

• MPLS networks.

• Internet connections.

• Physical Ethernet or fiber links.

2.2 Logical GRE Tunnel (Overlay)

The overlay is a virtual network built on top of the existing physical transport.

GRE creates a logical point-to-point connection between R1 and R2 using virtual tunnel interfaces.

Figure 2.2: GRE logical overlay tunnel 

2.3 Addressing table

Interface naming: GigabitEthernet0/0/0 and GigabitEthernet0/0/1 are illustrative; adapt to the actual hardware. All configurations assume no pre-existing addresses or conflicting policies on these interfaces.

3. How GRE encapsulates a packet

When PC-BRANCH sends to DC-SERVER, the original packet has source 10.10.10.10and destination 10.20.20.10. The branch router chooses Tunnel0 from its overlay routing table. It encapsulates that original IP packet using a GRE header, then adds an outer IPv4 header from 198.51.100.1 to 203.0.113.2.

Figure 3: GRE packet encapsulation

Forward packet sequence:

1. PC-BRANCH forwards the destination IP packet to its default gateway, R1.

2. R1 looks up 10.20.20.10, selects a route using Tunnel0 and builds a GRE packet.

3. The outer IP destination 203.0.113.2 is resolved using the underlay routing table to the ISP next hop 198.51.100.2.

4. ISP-RTR forwards the outer IP packet based on its WAN destination; it does not need routes to the branch/data-center private LANs.

5. R2 recognizes its local tunnel destination, removes the outer IP and GRE headers, and performs ordinary IP forwarding on the original packet toward 10.20.20.10.

6. The return packet follows the reverse sequence using R2's Tunnel0 toward R1.

Header overhead: Standard GRE over IPv4 has a minimum 24-byte additional header (20-byte outer IPv4 header + 4-byte GRE header), excluding any Ethernet, optional GRE fields, or IPsec overhead. GRE does not modify the original source/destination IP addresses; it adds a transport wrapper.

4. Tunnel Source and Destination

4.1 Tunnel source

The tunnel source defines the outer source address used for GRE packets. Cisco IOS/IOS-XE can use a physical interface or an IP address. A loopback source is often preferred in resilient designs because the logical source remains up while at least one underlay path can still reach the remote loopback.

4.2 Tunnel destination

The tunnel destination is the outer IPv4 destination address. It must be reachable through the underlay. The…