3

As per the RFC,

GRE (Generic Routing Encapsulation) specifies a protocol for encapsulation of an arbitrary protocol over another arbitrary network layer protocol.

I don't think I understand why GRE is needed at all. To encapsulate a protocol A in protocol B, can you not just send A packets as the data in B packets?

I know that GRE can be used to create a tunnel, and Section 3 of the current RFC mentions security considerations, but doesn't say anything more than that there should be some security in place.

In short, what benefits does GRE offer over "naive" encapsulation of protocols?

  • 2
    Actually you can send A packets as data in B packets, for example: ip in ip. However, ip in ip doesn't support multicast, while you can do multicast with GRE. There are various reasons why you pick a certain way to build a tunnel - it all depends on your requirements. – RedShift Aug 17 '14 at 8:44
  • 1
    Plus, with ipinip you're limited to tunneling IP traffic only. With GRE you can tunnel everything, some routers can even tunnel ethernet over GRE, how cool is that!? – RedShift Aug 17 '14 at 8:50
  • We use a GRE tunnel to encapsulate internet traffic to a web filter. – HAL Aug 18 '14 at 15:36
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 5:02
4

GRE is just a tunneling protocol - its main reason for existence is toplogy hiding/bypass.

Some examples include:

  • Tunneling MPLS across a network that may otherwise not support it - MPLS shims are not IP-based, therefore wrapping them in a GRE tunnel allows two routers to appear adjacent when there could be a number of intermediate IP-only devices.

  • Configuring EBGP sessions with neighbours that are not directly attached - this is often used by Anti-DDoS services to allow your prefixes to be advertised at their scrubbing stations, and traffic delivered directly to you even in cases where they may be multiple ASs away from your border

  • GRE over IPSEC is another common use that allows upper-layer routing-protocols to be established across IPSEC-based networks, avoiding the often static configuration and routing limitations posed by traditional (eg: Cisco-based) VPN deployments.

This is also an example of the open-ended security that the RFC mentions. This is not an oversight, merely a way of not excluding future technologies from being used (GREoSSL, GREoQuantumCryptography etc).

From the perspective of intermediary devices, the encapsulated traffic IS "Native" inside a GRE header, the fact that the payload is interpreted as additional headers on the terminating device is IMHO largely irrelevant.

GRE is just a protocol that most routers understand and it is simple enough that encap/decap doesn't burden the router too much.

Think of it another way - if you wanted to tunnel IP inside HTTP (perfectly possible, if somewhat inefficient) you would need to implement an HTTP server on all your routers. GRE is just a simpler, stateless, minimalist way to achieve the same thing.

  • 1
    EBGP sessions doesn't need GRE to establish in DDoS topologies - GRE is used only as tunnel for data plane traffic; GREoIPsec is used because IPsec doesn't support multicast, so it's required to run RIP, OSPF, EIGRP over IPsec tunnels; and GREoQuantumCryptography....? Does QuantymCryptography define it's own networking layer for GRE to be transported over it? – Łukasz Bromirski Aug 18 '14 at 7:27
  • Right - EBGP can be established without GRE, but the point of DDoS scrubbers is to get in-path to your data plane, so one isn't much good without the other. And yes, multicast is allowed, but even in a statically routed environment, not requiring changes to your proxy-ids when new prefixes are turned up. GREoQC is handled out-of-band, using some funky photonics that are over my head :P – Benjamin Dale Aug 22 '14 at 4:34
  • To clarify further - in IOS, IPSEC doesn't support multicast, this is not the case in Junos. – Benjamin Dale Aug 22 '14 at 5:16
0

GRE is also used for doing SPAN across networks via Layer 3. Check following article as an example. https://supportforums.cisco.com/document/139236/understanding-spanrspanand-erspan

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.