What is a tunnel interface used for on a cisco router?
What is the difference between setting up a VPN connection and a tunnel interface; or does this serve the same purpose?
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
Tunnel interfaces have many uses, including participating in a larger VPN configuration. A VPN setup usually has many parts, including encryption, authentication, routing, and finally, the tunneling. Tunneling is also used for IPv4/IPv6 coexistence setups, such as encapsulating IPv6 packets in IPv4 headers, creating GRE tunnels, and multicast tunneling. The point is that while tunnels may be part of a VPN setup, they do not necessarily represent the entire VPN configuration, but only the traffic encapsulation between endpoints.
A VPN tunnel uses IPSEC which encrypts the packets, usually between two LANs connected via the Internet. IPSEC tunnels have no multicast support which means that you can't run dynamic routing protocols like EIGRP, OSPF and ISIS over the tunnel.
There are also various forms of VPNs like DMVPN, SSL VPN and GET VPN.
A GRE tunnel can be used for many things, to support multicast, IPv6 or even CLNS which is used for ISIS. A GRE tunnel has no encryption which the VPN tunnel has.
To get support for both routing and encrypting the packets it is common to deploy IPSEC and GRE together so that it's supported to run dynamic routing protocols over it.
There are also other tunneling modes like IP in IP, 6to4, ISATAP and so on.
A tunnel give you a route-based VPN option. This allows you to run routing protocols over your tunnels which allows for better failover capabilities. You can also set up a single tunnel, then route many different prefixes over that same single tunnel. If the other side adds a new prefix, just add another static route to the existing tunnel. I also find it easier to do network-wide NAT for overlapping VPN subnets as the tunnel interface is just another layer3 point-to-point interface
Tunnels are also handy for times when you need to run two different VRFs over an interface that doesn't support many subinterfaces. A DSL link is an example. In this case you can run a tunnel over the normal link, and have that tunnel in a different VRF