Generic Routing Encapsulation

What is generic routing encapsulation? Firstly, let us start with the basics. Generic Routing Encapsulation (GRE) is a tunneling protocol Cisco Systems developed to provide a way for remote systems to communicate over the Internet. It is based on the Point-to-Point Protocol (PPP) and uses the IP address to form the tunnel. GRE provides a secure, reliable, and efficient means of transmitting data over a public network, such as the Internet.

GRE is a layer 3 protocol, meaning it works at the IP level of the network. It enables a router to encapsulate packets of a particular protocol and send them to another router, decapsulated and forwarded to their destination. This is useful for tunneling, where data must traverse multiple networks and different types of hardware.

GRE encapsulates data in a header containing information about the source, destination, and other routing information. The GRE header is then encapsulated in an IP header containing the source and destination IP addresses. When the packet reaches the destination router, the GRE header is stripped off, and the data is sent to its destination.

Before you proceed, you may find the following posts helpful for pre-information:

1. Dead Peer Detection
2. IPsec Fault Tolerance
3. Dynamic Workload Scaling 
4. Cisco Switch Virtualization
5. WAN Virtualization
6. VPNOverview

• A key point: Video on multi-cloud. An IPsec use case.

The following video you may find helpful is on the multi-cloud. Connecting to the cloud and in multi-cloud scenarios may call for protection with IPsec protection. What differentiates the hybrid cloud from the public & private cloud is the data flow between public and private resources. And Multi-Cloud is a particular case of hybrid cloud computing. One connection method to a multi-cloud could be IPsec tunnels.

Back to basic with GRE tunnels

• What is a GRE tunnel?

A GRE tunnel supplies connectivity to a wide variety of network layer protocols. GRE works by encapsulating and forwarding those packets over an IP-based network. The authentic use of GRE tunnels provided a transport mechanism for non-routable legacy protocols such as DECnet and IPX. With GRE, we add header information to a packet when the router encapsulates the packet for transit on the GRE tunnel.

The new header information contains the remote endpoint IP address as the destination. The new IP headers permit the packet to be routed between the two tunnel endpoints, and this is done without inspection of the packet’s payload. After the packet reaches the remote endpoint, the GRE termination point, the GRE headers are removed, and the original packet is forwarded from the remote router. Both GRE and IPsec tunnels are used in solutions for SD WAN SASE and SD WAN Security. Both of these solutions would abstract the complexity of configuring these technologies.

• Topologies and routing protocol support

Numerous technologies connect remote branch sites to HQ or central hub. P2P Generic Routing Encapsulation ( GRE network ) over IPsec is an alternative design to classic WAN technologies like ATM, Frame Relay, and Leased lines. GRE over IPsec is a standard deployment model to connect several remote branch sites to one or more central sites. Design topologies include the hub-and-spoke, partial mesh, and full mesh.

Both partial and full-mesh topologies experience limitations in routing protocol support. A full mesh design is limited by the overhead required to support a design with a full mesh of tunnels. Following a full mesh requirement, a popular design option would be to deploy DMVPN. Regarding the context of direct connectivity from branch to hub only, hub-and-spoke is by far the most common design.

• DMVPN (Dynamic Multipoint VPN)

DMVPN is based on the principle of dynamic spoke-to-spoke tunneling, allowing for dynamic routing and scalability. It also provides the ability to create a dynamic mesh topology, allowing for multiple paths between remote sites. This allows for increased redundancy and improved performance.

DMVPN also offers the ability to establish a secure tunnel over an untrusted network, such as the Internet. This is achieved with a series of DMVPN phases. DMVPN phase 3 offers better flexibility by using IPSec encryption and authentication, ensuring that all traffic sent over the tunnel is secure. This makes DMVPN an excellent choice for businesses connecting multiple sites over an unsecured network.

GRE Network: Head-end Architecture 

Single-tier and dual tier

Head-end architectures include a single-tier head-end where the point-to-point GRE network and crypto functionality co-exist on the same device. Dual-tier designs are where the point-to-point GRE network and crypto functionality are not implemented on the same device. Dual tier designs, the routing and GRE control planes are located on one device while the IPsec control plane is housed on another.

“Tunnel protection” requires the same source and destination IP address for the GRE and crypto tunnels. Implementations of dual-tier separate these functions, resulting in the different IP addresses for the GRE and crypto tunnels. Tunnel protection is invalid with dual-tier mode.

GRE over IPsec

GRE-over-IPsec allows traffic to be encrypted before it is sent over the Internet, protecting it from interception and modification. It is also widely used for setting up site-to-site VPNs, allowing two or more offices to share data securely over the Internet.

Setting up a GRE-over-IPsec VPN begins with configuring the IPsec tunnel. This involves setting up a secure connection between the two nodes, which is done using the Internet Key Exchange (IKE) protocol. Once the IPsec tunnel is set up, the GRE tunnel is established between the two nodes and the endpoints are configured to exchange data.

Once the GRE-over-IPsec tunnel is set up, the traffic that passes through it is encrypted, preventing third parties from intercepting or modifying the data. This makes it an ideal solution for organizations that require secure communication and data transfer.

Preliminary design considerations

Diverse multi-protocol traffic requirements force the use of a Generic Routing Encapsulation ( GRE ) envelope within the IPsec tunnel. The p2p GRE tunnel is encrypted inside the IPsec crypto tunnel. Native IPsec is not multi-protocol and lacks IP multicast or broadcast traffic support. As a result, proper propagation of routing protocol control packets cannot occur in a native IPsec tunnel.

However, OSPF design cases allow you to run OSPF network type non-broadcast and explicitly configure the remote OSPF neighbors, resulting in OSPF over the IPsec tunnel without GRE. With a GRE over IPsec design, all traffic between hub and branch sites is first encapsulated in the p2p GRE packet before encryption.

GRE over IPSec Key Points

Redundancy

Redundant designs are implemented with the branch having two or more tunnels to the campus head. The head-end routers can be geographically separated or co-located. Routing protocols are used with redundant tunnels providing high availability with dynamic path selection. The head-end router can propagate a summary route ( 10.0.0.0/8 ) or a default route ( 0.0.0.0/0 ) to the branch sites, and a preferred routing metric will be used for the primary path. If OSPF is RP, the head-end selection is based on OSPF costs.

Recursive Routing

Each branch must add a static route to their respective ISP IP addresses for each head-end. The static avoids recursive routing through the p2p GRE tunnel. Recursive routing occurs when the route to the GRE tunnel source outside the IP address of the opposing router is learned via a route with a next-hop of the inside IP address of the opposing p2p GRE tunnel. Recursive routing causes the tunnel to flap and the p2p GRE packets to route into their p2p GRE tunnel. To overcome recursive routing, my best practice is to ensure that the outside tunnel is routed directly to ISP instead of inside the p2p GRE tunnel.

Recursive routing and outbound interface selection pose significant challenges in tunnel or overlay networks. Therefore, routing protocols should be used with utmost caution over network tunnels. A router can encounter problems if it attempts to reach the remote router’s encapsulating interface (transport IP address) via the tunnel. Typically, this issue occurs when the transport network is advertised into the same routing protocol as the overlay network.

Routers learn the destination IP address for tunnel interfaces through recursive routing. First, the IP address of the tunnel’s destination is removed from the routing table, making it unreachable.

Split tunneling

If the head-end advertises a summary route to the branch, split tunneling is enabled on all packets not destined for the summary. Any packets not destined for the summary are split-tunneled to the Internet. For example, split tunneling is not used for the branch sites in a design where the head-end router advertises a default route ( 0.0.0.0/0 ) through the p2p GRE tunnel.

• A key point: Additional information on Split tunneling.

Split tunneling is a networking concept allowing users to selectively route traffic from their local device to a local or remote network. It gives users secure access to corporate networks and other resources from public or untrusted networks. Split tunneling can also be used to reduce network congestion. For example, if a user is on a public network and needs to access a resource on a remote network, the user can set up a split tunnel to send only the traffic that needs to go over the remote network. This reduces the traffic on the public network, allowing it to perform more efficiently.

Control plane

Routing protocol HELLO packets initiated from the branch office force the tunnel to establish—routing protocol control plane packets to maintain and keep the tunnel up. HELLO, packets provide a similar function to GRE keepalives. Routing protocol HELLO operates at Layer 3, and GRE keepalives at Layer 2.

Branch router considerations

The branch router can have p2p GRE over IPSEC with a static or dynamic public address. The GRE and crypto tunnels are sourced from a static address with a static public IP address. With dynamic address allocation, the GRE is sourced from a loopback address privately assigned (non-routable), and the crypto tunnel is sourced from a dynamically assigned public IP address.

Generic routing encapsulation

Key design points

• About
• Latest Posts

Matt Conran

Public Speaker, Author and Consultant at Conran Insight

Matt Conran has more than 24 years of networking and security industry with entrepreneurial start-ups, government organizations, and others. He now focuses on public speaking, authoring content, consulting, and creating Elearning courses.

Latest posts by Matt Conran (see all)

• DMVPN - May 20, 2023
• Computer Networking - April 7, 2023
• eBOOK – SASE Capabilities - April 6, 2023