As per the RFC,

GRE (Generic Routing Encapsulation) specifies a protocol for encapsulation of an arbitrary protocol over another arbitrary network layer protocol.

I don't think I understand why GRE is needed at all. To encapsulate a protocol A in protocol B, can you not just send A packets as the data in B packets?

I know that GRE can be used to create a tunnel, and Section 3 of the current RFC mentions security considerations, but doesn't say anything more than that there should be some security in place.

In short, what benefits does GRE offer over "naive" encapsulation of protocols?

  • 2
    Actually you can send A packets as data in B packets, for example: ip in ip. However, ip in ip doesn't support multicast, while you can do multicast with GRE. There are various reasons why you pick a certain way to build a tunnel - it all depends on your requirements.
    – RedShift
    Aug 17, 2014 at 8:44
  • 1
    Plus, with ipinip you're limited to tunneling IP traffic only. With GRE you can tunnel everything, some routers can even tunnel ethernet over GRE, how cool is that!?
    – RedShift
    Aug 17, 2014 at 8:50
  • We use a GRE tunnel to encapsulate internet traffic to a web filter.
    – HAL
    Aug 18, 2014 at 15:36
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 10, 2017 at 5:02

2 Answers 2


GRE is just a tunneling protocol - its main reason for existence is toplogy hiding/bypass.

Some examples include:

  • Tunneling MPLS across a network that may otherwise not support it - MPLS shims are not IP-based, therefore wrapping them in a GRE tunnel allows two routers to appear adjacent when there could be a number of intermediate IP-only devices.

  • Configuring EBGP sessions with neighbours that are not directly attached - this is often used by Anti-DDoS services to allow your prefixes to be advertised at their scrubbing stations, and traffic delivered directly to you even in cases where they may be multiple ASs away from your border

  • GRE over IPSEC is another common use that allows upper-layer routing-protocols to be established across IPSEC-based networks, avoiding the often static configuration and routing limitations posed by traditional (eg: Cisco-based) VPN deployments.

This is also an example of the open-ended security that the RFC mentions. This is not an oversight, merely a way of not excluding future technologies from being used (GREoSSL, GREoQuantumCryptography etc).

From the perspective of intermediary devices, the encapsulated traffic IS "Native" inside a GRE header, the fact that the payload is interpreted as additional headers on the terminating device is IMHO largely irrelevant.

GRE is just a protocol that most routers understand and it is simple enough that encap/decap doesn't burden the router too much.

Think of it another way - if you wanted to tunnel IP inside HTTP (perfectly possible, if somewhat inefficient) you would need to implement an HTTP server on all your routers. GRE is just a simpler, stateless, minimalist way to achieve the same thing.

  • 1
    EBGP sessions doesn't need GRE to establish in DDoS topologies - GRE is used only as tunnel for data plane traffic; GREoIPsec is used because IPsec doesn't support multicast, so it's required to run RIP, OSPF, EIGRP over IPsec tunnels; and GREoQuantumCryptography....? Does QuantymCryptography define it's own networking layer for GRE to be transported over it? Aug 18, 2014 at 7:27
  • Right - EBGP can be established without GRE, but the point of DDoS scrubbers is to get in-path to your data plane, so one isn't much good without the other. And yes, multicast is allowed, but even in a statically routed environment, not requiring changes to your proxy-ids when new prefixes are turned up. GREoQC is handled out-of-band, using some funky photonics that are over my head :P Aug 22, 2014 at 4:34
  • To clarify further - in IOS, IPSEC doesn't support multicast, this is not the case in Junos. Aug 22, 2014 at 5:16

GRE is also used for doing SPAN across networks via Layer 3. Check following article as an example. https://supportforums.cisco.com/document/139236/understanding-spanrspanand-erspan

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.