What is GRE, and how much overhead does it add?
Show the answer
Say this first
GRE (Generic Routing Encapsulation) wraps a packet inside a new IP header so it can cross another network. It is IP protocol 47. The basic GRE header is 4 bytes, so GRE over IPv4 adds 24 bytes: 20 for the new IP header and 4 for GRE. It carries multicast and other protocols, which is why routing protocols run over it, but it has no encryption or authentication of its own.
Go deeper
Header
The basic header holds flags, a version and a protocol type (the EtherType of the payload, 0x0800 for IPv4). Optional fields add 4 bytes each: checksum, key (used to tell tunnels apart) and sequence number. RFC 2784 defines GRE and RFC 2890 adds the key and sequence fields.
Why people use it
- Carries multicast and broadcast, so OSPF, EIGRP and PIM work across it.
- Carries IPv6 over an IPv4 core, and other payloads.
- Gives you a tunnel interface with an IP address that you route into like any link.
IOS basics
interface Tunnel0
ip address 172.16.0.1 255.255.255.252
tunnel source GigabitEthernet0/0/0
tunnel destination 203.0.113.2tunnel mode gre ip is the default. On a 1500-byte underlay the tunnel IP MTU defaults to 1476.
Line protocol
A GRE tunnel interface comes up when the tunnel source is up and the router has a route to the tunnel destination that does not point back into the tunnel. GRE has no handshake, so up/up does not prove the far end is alive.
They will ask next
The tunnel shows up/up but the far router is powered off. Why?
Nothing in GRE checks the far end. Enable
keepalive 10 3on the tunnel interface (10-second period, 3 retries) so the line protocol drops after missed keepalives, or rely on routing protocol hellos across the tunnel to withdraw routes.What does a firewall need to allow for plain GRE?
IP protocol 47 between the two tunnel endpoints. GRE has no ports, so it is not TCP or UDP, and PAT devices often cannot translate it. Once GRE is protected by IPsec the firewall only sees ESP or UDP 4500.
Traps
- Calling GRE secure. It is clear text; anyone on the path can read it and inject packets.
- Forgetting the 24 bytes when sizing the tunnel MTU and TCP MSS.