Why would you run GRE over IPsec instead of plain IPsec?
Show the answer
Say this first
Classic IPsec with a crypto map only protects unicast IP that matches an ACL. It has no interface to route into and cannot carry routing protocol multicast. GRE provides a real tunnel interface that carries multicast, and IPsec then encrypts the GRE packets. The result is dynamic routing across an encrypted tunnel, and an IPsec policy that is a single rule: GRE between the two public addresses.
Go deeper
How the layers fit
- A packet routed into Tunnel0 gets a GRE header and an outer IP header with the public tunnel source and destination.
- IPsec protects that GRE packet. The traffic selector is GRE, host to host:
local
198.51.100.1/32protocol 47 to remote203.0.113.2/32protocol 47. - Transport mode is the usual choice because GRE already provides the outer header with the right addresses. That saves 20 bytes per packet.
Modern IOS configuration
tunnel protection ipsec profile NAME on the GRE tunnel interface. No crypto map and no crypto ACL to
maintain.
When a plain VTI is enough
A static VTI (tunnel mode ipsec ipv4) is also a routed interface and runs routing protocols, with
less overhead because there is no GRE header. Choose GRE over IPsec when you need multipoint tunnels
(DMVPN), non-IPv4 payloads over one tunnel, or interop with a peer that expects GRE.
They will ask next
Transport or tunnel mode for GRE over IPsec?
Transport. The GRE packet's own IP header already says public address to public address, so tunnel mode would add a second identical header for 20 more bytes. Tunnel mode is needed when the GRE endpoints are not the same addresses as the IPsec endpoints.
What does the proxy ID look like in the show output?
Protocol 47 host to host.
show crypto ipsec sashowslocal ident (addr/mask/prot/port): (198.51.100.1/255.255.255.255/47/0)and the mirror for the remote address.
Traps
- Saying IPsec alone can run OSPF. A crypto map cannot. A VTI can, because it is an interface.