GRE Tunnels Explained: Encapsulation and Limitations for Network+
GRE — Generic Routing Encapsulation — wraps one protocol's packets inside IP packets so they can cross a network that would not otherwise carry them. It creates a virtual point-to-point link between two endpoints that may be many hops apart.
The exam tests one thing above all: GRE does not encrypt. It is a tunnelling protocol, not a security protocol, and the two are easy to conflate.
How encapsulation works
The original packet becomes the payload. GRE adds its own header, and an outer IP header is added with the tunnel endpoints as source and destination. The network in between routes the outer packet normally, with no knowledge of what is inside. At the far end the outer headers are stripped and the original packet continues on its way.
GRE is IP protocol number 47 — not a TCP or UDP port, which matters when writing firewall rules. A firewall that permits only TCP and UDP will silently drop GRE, and that is a classic troubleshooting scenario.
What it is for
Carrying traffic the underlying network will not route. Multicast and broadcast, and routing protocols that depend on them. This is the big one: IPsec in tunnel mode does not carry multicast, so a routing protocol like OSPF or EIGRP cannot run across a plain IPsec tunnel. Wrap it in GRE first and it works.
Connecting discontiguous networks — two private sites across the public internet, appearing as directly connected.
Carrying non-IP or mismatched protocols, such as IPv6 across an IPv4-only network.
Working around routing constraints, forcing traffic along a specific path.
GRE over IPsec
The combination that appears constantly, because each protocol supplies what the other lacks.
GRE carries multicast and routing protocols but provides no confidentiality, integrity or authentication. IPsec provides all three but will not carry multicast. Run GRE inside IPsec and you get a tunnel that supports dynamic routing and is encrypted.
If a scenario asks how to run OSPF between two sites over the internet securely, the answer is GRE over IPsec.
Note the ordering — GRE encapsulates first, then IPsec protects the GRE packet. And note the alternative CompTIA mentions: DMVPN builds on GRE with multipoint tunnels so spokes can establish dynamic tunnels directly with each other rather than hairpinning through the hub.
MTU and fragmentation
The practical problem GRE creates, and a reliable exam item.
Every layer of encapsulation adds overhead. A standard GRE header adds 24 bytes — 20 for the outer IP header and 4 for GRE. With a normal 1500-byte MTU, that leaves 1476 bytes for the original packet. Add IPsec and the usable payload drops further, often to around 1400.
When a full-size packet arrives and will not fit after encapsulation, it must be fragmented or dropped. If the packet has the Don't Fragment bit set, the router should return an ICMP message telling the sender to reduce its size — and this is where things break, because many firewalls block ICMP indiscriminately.
The symptom is distinctive and worth memorising: small packets work, large transfers fail. Pings succeed, SSH logins work, then a file transfer or a web page with large responses hangs. That is a path MTU discovery failure, almost always caused by blocked ICMP combined with a tunnel.
Remedies are lowering the tunnel MTU, adjusting TCP MSS clamping on the tunnel interface, or permitting the necessary ICMP types. MSS clamping is the usual answer because it fixes TCP without depending on ICMP.
Limitations
No encryption, no authentication and no integrity checking — anyone on the path can read and modify the payload. It is stateless, so the tunnel interface can stay up while the far end is unreachable, which makes keepalives or a routing protocol necessary to detect failure. It adds overhead and CPU load. And it is point-to-point unless you use multipoint GRE.
Troubleshooting
Tunnel will not come up: check that IP protocol 47 is permitted end to end, that the tunnel source and destination are reachable, and that the endpoints agree on addressing. Tunnel up but no traffic: check routing — traffic has to be directed into the tunnel interface. Recursive routing, where the route to the tunnel destination points through the tunnel itself, causes flapping. And intermittent failures on large transfers point at MTU.
What to remember
GRE encapsulates and does not encrypt. It is IP protocol 47, not a port. Its main value is carrying multicast and routing protocols that IPsec cannot, which is why GRE over IPsec is the standard pairing. It adds 24 bytes of overhead, and blocked ICMP plus reduced MTU produces the small-packets-work, large-transfers-fail symptom.
Comments
Post a Comment