GRE Tunnels and VPN Tunnels

 
GRE is to run dynamic routing protocols across another network.

For example:

Branch Router -------- Internet -------- HQ Router
       |                                  |
     OSPF                              OSPF

Normally, the internet won't carry routing protocol packets between your routers. A GRE tunnel creates a virtual point-to-point link:

Branch Router ===== GRE Tunnel ===== HQ Router

Now both routers behave as if they're connected by a dedicated cable, allowing protocols like OSPF or EIGRP to exchange routes.


Common uses of GRE

  • Running dynamic routing protocols across an IP network (its most common use).
  • Transporting multicast and broadcast traffic, which plain IP forwarding often doesn't support.
  • Connecting branch offices over an existing IP network.
  • Carrying different Layer 3 protocols inside IP.
  • Creating overlay networks between routers.

Example

Suppose a company has:

  • Headquarters in one city
  • Branch office in another
  • An internet connection between them

Without GRE:

HQ Router ---- Internet ---- Branch Router

The routers can exchange ordinary IP traffic, but running OSPF between them is problematic.

With GRE:

HQ Router == GRE Tunnel == Branch Router

Now OSPF works normally, and each router learns the other's networks automatically.




GRE: A transport tunnel

Think of GRE as a virtual pipe.


VPN: A secure tunnel

A VPN is more like a locked pipe.




Simple analogy

  • GRE = Putting a letter into a larger envelope so it can be delivered through a particular mail system. Anyone can still open the envelope if it's not sealed.
  • VPN = Putting the letter into a locked, tamper-resistant box before shipping it. The contents remain confidential during transit.





Why GRE and IPsec are often used together

A common deployment is GRE over IPsec because each technology provides something the other lacks:

  • GRE provides:
    • Multicast support
    • Broadcast support
    • Dynamic routing protocol support
    • Encapsulation of various Layer 3 protocols
  • IPsec provides:
    • Encryption
    • Authentication
    • Integrity protection

The packet flow looks like this:

Application
     ↓
Original IP Packet
     ↓
GRE Encapsulation
     ↓
IPsec Encryption
     ↓
Internet

The remote router decrypts the IPsec packet, removes the GRE header, and forwards the original packet.


GRE use case: running OSPF through a GRE tunnel.

Topology

PC1 ---- R1 -------- Internet -------- R2 ---- PC2
        G0/0        G0/1      G0/1          G0/0

LAN1:      192.168.1.0/24
Internet:  10.0.12.0/24
LAN2:      192.168.2.0/24

GRE Tunnel:
R1 Tunnel0: 172.16.12.1/30
R2 Tunnel0: 172.16.12.2/30

The goal is:

  • R1 and R2 can already reach each other over the Internet.
  • Create a GRE tunnel.
  • Run OSPF over the tunnel.
  • PC1 and PC2 can then communicate.

Step 1: Configure the Internet interfaces

R1

conf t

interface g0/1
 ip address 10.0.12.1 255.255.255.0
 no shutdown

interface g0/0
 ip address 192.168.1.1 255.255.255.0
 no shutdown

ip route 10.0.12.0 255.255.255.0 g0/1

R2

conf t

interface g0/1
 ip address 10.0.12.2 255.255.255.0
 no shutdown

interface g0/0
 ip address 192.168.2.1 255.255.255.0
 no shutdown

ip route 10.0.12.0 255.255.255.0 g0/1

Verify:

R1# ping 10.0.12.2

It should succeed.

Step 2: Configure the GRE tunnel

R1

interface Tunnel0
 ip address 172.16.12.1 255.255.255.252
 tunnel source g0/1
 tunnel destination 10.0.12.2

R2

interface Tunnel0
 ip address 172.16.12.2 255.255.255.252
 tunnel source g0/1
 tunnel destination 10.0.12.1

Verify:

R1# ping 172.16.12.2

Step 3: Configure OSPF

R1

router ospf 1

network 192.168.1.0 0.0.0.255 area 0
network 172.16.12.0 0.0.0.3 area 0

R2

router ospf 1

network 192.168.2.0 0.0.0.255 area 0
network 172.16.12.0 0.0.0.3 area 0

After a few seconds:

R1# show ip ospf neighbor

You should see:

Neighbor ID     State     Address
2.2.2.2         FULL      172.16.12.2

Step 4: Verify routes

On R1:

show ip route

You should learn:

O 192.168.2.0/24

On R2:

O 192.168.1.0/24

Step 5: Test connectivity

Configure the PCs:

PC1

IP: 192.168.1.10
Mask: 255.255.255.0
Gateway: 192.168.1.1

PC2

IP: 192.168.2.10
Mask: 255.255.255.0
Gateway: 192.168.2.1

Now test:

PC1> ping 192.168.2.10

The ping should succeed.

Packet flow

PC1
 │
 ▼
R1
 │
 │ OSPF learns remote LAN
 ▼
GRE Tunnel
(172.16.12.1 <----> 172.16.12.2)
 │
 ▼
R2
 │
 ▼
PC2

This is the classic enterprise use of GRE: routers form an OSPF adjacency over the GRE tunnel, exchange routes, and traffic between the LANs is carried through the tunnel.





GRE tunnels and VPN tunnels are related concepts, but they solve different problems.

FeatureGeneric Routing Encapsulation (GRE)VPN Tunnel (e.g., IPsec, WireGuard, OpenVPN)
PurposeEncapsulate trafficSecure traffic
Encryption❌ None✅ Yes
Authentication❌ None✅ Yes
Supports routing protocols✅ YesDepends on the VPN technology
Multicast/Broadcast✅ YesUsually no (IPsec alone doesn't)
Typical useConnecting networks and carrying routing trafficSecure communication over untrusted networks

Comments

Post a Comment

Popular posts from this blog

🖧 VLAN (Virtual Local Area Network)

  🖧 VLAN (Virtual Local Area Network) 🧠 Top 5 Key Points Logical Network Segmentation: VLANs divide a physical network into multiple logical networks , thus breaking broadcast domain. Improved Security: Devices in different VLANs cannot communicate unless explicitly allowed via a router or Layer 3 switch . Reduces Broadcast Domains: Each VLAN is its own broadcast domain , minimizing unnecessary traffic. Better Management: Departments (HR, Sales, IT, etc.) can be grouped into different VLANs without changing physical cabling . Requires VLAN Tagging (802.1Q): VLAN information is carried between switches using 802.1Q trunking . VLAN Benefits: Improved security by isolating sensitive systems  Reduced broadcast traffic and better performance Smaller broadcast domains mean less unnecessary traffic and bandwidth saved.. Easy to troubleshoot.  Trunk can carry traffic for up to 4094 VLAN IDs ( ie 4094 subinterfaces ). . Complete Flow PC1 (No Tag) | ...
Read more

🌐 NAT (Network Address Translation)

Image
  🌐 NAT (Network Address Translation) 🧠 Top 6 Key Points Translates Private IPs to Public IPs: NAT converts internal (private) IP addresses into a single or multiple public IPs so that devices inside a LAN can access the Internet. Conserves Public IP Addresses: NAT allows multiple internal hosts to share one public IP, saving global address space. Improves Security: Internal IPs remain hidden from the outside world, reducing attack exposure. Types of NAT: Static NAT: One-to-one mapping (internal ↔ public).  ( Server) Dynamic NAT: Many-to-many mapping (pool of public IPs).  (  PAT (NAT Overload): Many-to-one mapping (most common).  Configured on Routers: NAT runs on routers at the boundary between private and public networks , translating IPs for outbound/inbound traffic. NAT Type Used Today 6 Common Use Static NAT ✅ Yes  (limited use 7 Publishing internal servers with a dedicated public IP Dynamic NAT ⚠️ Rarely L...
Read more

🛰️ OSPF (Open Shortest Path First)

  🛰️ OSPF (Open Shortest Path First) 🧠 Top 5 Key Points about OSPF Link-State Protocol → OSPF shares detailed information about network topology (not just hop count). Metric: Uses cost , calculated based on bandwidth (higher bandwidth = lower cost). Fast Convergence: Quickly detects and adapts to network changes. Supports VLSM & CIDR: Fully classless , allowing subnet flexibility. Area-Based Design: Supports hierarchical networks (Area 0 = Backbone, others connect to it). ⚙️ Additional Notes Works at Layer 3 (Network Layer) of the OSI model. Uses Dijkstra’s SPF (Shortest Path First) algorithm. Multicast addresses: 224.0.0.5 → All OSPF routers 224.0.0.6 → Designated Router (DR) and Backup DR OSPF uses Link-State Advertisements (LSAs) to exchange topology information. Each LSA type has a specific purpose. Here's a practical explanation of LSA Types 1–7 . 1. Type 1 – Router LSA Generated by: Every OSPF router Flooded within...
Read more