Generic Routing Encapsulation

GRE is a tunnelling protocol which encapsulate original IP package with a GRE header and a new IP header in order to route across network.

┌────────────┬───────────────┬────────────┬───────────┬─────────┬────────────┐
│ Eth header │ New IP header │ GRE header │ IP header │ Payload │ Eth tailer │
└────────────┴───────────────┴────────────┴───────────┴─────────┴────────────┘
     14             20            4-16         20                      4          Bytes

A GRE header are 4 to 16 bytes.

RFC 2784

    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |C|       Reserved0       | Ver |         Protocol Type         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Checksum (optional)      |       Reserved1 (Optional)    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

RFC 2890

    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |C| |K|S| Reserved0       | Ver |         Protocol Type         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Checksum (optional)      |       Reserved1 (Optional)    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         Key (optional)                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                 Sequence Number (Optional)                    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

---

Configure GRE Tunnel

Example: R1 and R2 are two routers connecting to Internet. Below are configurations on R1 to form a GRE tunnel with R2.

! Create a tunnel interface, assign an interface number and an IP address
R1(config)# interface Tunnel0
R1(config-int)# ip address 192.168.100.1 255.255.255.0

! Define the source physical interface or source IP address
R1(config-int)#tunnel source GigabitEthernet0/0

! Define the destination public IP address of the remote router
R1(config-int)# tunnel destination 203.0.13.2

! Adjust MTU and TCP MSS
R1(config-int)# mtu 1460
R1(config-int)# ip tcp adjust-mss 1420

MTU = Standard MTU (1500) - New IP Header (20) - GRE Header (16) - VLAN Tag (4)

---

GRE over IPsec

IPsec doesn't support multicast and broadcast, so it can't be used on some protocols (like OSPF).
GRE tunnel supports multicast/broadcast transmission, but no encryption for original packets.
GRE-over-IPsec combines the GRE's flexibility and IPsec's security.

     ┌───────────────┬────────────┬──────── Encrypted ────────────────────┐
     │               │            │┌───────────┬────────────┬────────────┐│
     │ New IP Header │IPsec Header││ IP Header │ GRE Header │  IP Packet ││
     │               │            │└───────────┴────────────┴────────────┘│
     └───────────────┴────────────┴───────────────────────────────────────┘

Configure GRE over IPsec

Configure IPsec

! --- PHASE 1: IKEv2 Keyring & Profile ---
crypto ikev2 keyring MY_KEYRING
 peer ROUTER_B
  address 203.0.113.2
  pre-shared-key local MySecurePassword123
  pre-shared-key remote MySecurePassword123
!
crypto ikev2 profile IKEv2_POLICY
 match identity remote address 203.0.113.2 255.255.255.255
 identity local address 203.0.113.1
 authentication local pre-share
 authentication remote pre-share
 keyring local MY_KEYRING

! --- PHASE 2: IPsec Transform-Set & Profile ---
crypto ipsec transform-set MY_TRANSFORM_SET esp-aes 256 esp-sha256-hmac
 mode transport
!
crypto ipsec profile IPSEC_TUNNEL_PROFILE
 set transform-set MY_TRANSFORM_SET
 set ikev2-profile IKEv2_POLICY

Apply IPsec profile to GRE tunnel interface

R1(config)# interface Tunnel0
R1(config-int)# tunnel protection ipsec profile IPSEC_TUNNEL_PROFILE
R1(config-int)# mtu 1400
R1(config-int)# ip tcp adjust-mss 1360

IPsec adds an extra 56 to 72 bytes of overhead depending on the encryption algorithm. So, adjust MTU and MSS accordingly.