2

enter image description here http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/868-cisco-router-gre-ipsec.html

In the example above, R1:

R1(config)# interface Tunnel0
R1(config-if)# ip address 172.16.0.1 255.255.255.0
R1(config-if)# tunnel source 1.1.1.10
R1(config-if)# tunnel destination 2.2.2.10

and R2:

R2(config)# interface Tunnel0
R2(config-if)# ip address 172.16.0.2 255.255.255.0
R2(config-if)# tunnel source 2.2.2.10
R2(config-if)# tunnel destination 1.1.1.10

When a packet with dst IP 172.16.0.2 address arrives to R1, how does R1 know where to send it? It checks its routing table and knows that 172.16.0.2 is directly connected? Anyway, it adds new IP header (dst IP set to 2.2.2.10 -tunnel destination) and GRE header to that packet.

When R2 receives the packet, it knows the packet was addressed to its 2.2.2.10 FE0/1 interface and it matches the tunnel source IP address that was set up on R2. So it removes the outer IP and GRE header, leaving the packet with dst IP 172.16.0.2 and routes it forward (not in this case of course, but it would if the dst IP was different).

Suppose there was another router - R3. Is it possible to set up a tunnel between R1 and R3 using the same network - 172.16.0.0/24?

When R1 pings the tunnel interface of R2 - 172.16.0.2, how does it know how to send it there? It probably checks his own Tunnel0 configuration: oh, I should send it to 172.16.0.2, which is in the same subnet as my Tunnel0 interface 172.16.0.1. Then it checks tunnel destination address to learn it's 2.2.2.10. In other words, it can't directly ARP 172.16.0.2 because it's not a physical connection.

Let's say I add R3 with Tunnel1 interface 172.16.0.4/24 whose public IP is 3.3.3.10. Next I configure Tunnel1 on R1:

R1(config)# interface Tunnel1
R1(config-if)# ip address 172.16.0.3 255.255.255.0
R1(config-if)# tunnel source 1.1.1.10
R1(config-if)# tunnel destination 3.3.3.10

Pinging 172.16.0.2 from R1 probably wouldn't work, because now I have two tunnels on R1 using the same subnet (R1-R2 and R1-R3). R1 has no idea which tunnel I mean here and therefore it doesn't know the tunnel destination.

TLDR Does it mean we need a different subnet for each tunnel? If so, shouldn't all tunnel subnets be /30? We only need two IPs for a tunnel - source and destination.

Improve this question

1 Answer 1

Reset to default
2

A 'normal' GRE tunnel is a used as a point-to-point connection. A /30 (or even /31) would be a better use of your subnet space. There also exist multipoint GRE tunnels, such as DMVPN. Here you can have multiple tunnel endpoints connected to one tunnel interface. In that case, you will want a bigger subnet.

Improve this answer
6
  • Do you know how R1 finds out the MAC of 172.16.0.2 when it pings that address? 172.16.0.2 is configured on another router so it has no idea where it is initially, right? It probably does need to find out its MAC address to communicate.
    – user4205580
    Dec 9, 2015 at 10:57
  • It actually doesn't need the MAC address of 172.16.0.2. The packet is encapsulated in GRE and then sent over IP to 2.2.2.10. R1 will look up the MAC address for the next hop towards 2.2.2.10 and use that. So does every router along the way, until the last router, which will look up the MAC for 2.2.2.10 itself. R2 receives a packet for 2.2.2.10 with it's own MAC address, decapsulates the outer IP and sees the GRE encapsulation, knowing that it is destined for interface Tunnel 0. Then it proceeds as if it received the packed on a physical interface named Tu0.
    – JelmerS
    Dec 9, 2015 at 11:08
  • It knows to send it to 2.2.2.10 because that's the only tunnel from R1. But if R1 had more tunnels, how it would know to send it to 2.2.2.10? I can't undestand that. It chooses the right tunnel based on the matching subnet?
    – user4205580
    Dec 9, 2015 at 11:18
  • There needs to be a mapping between the tunnel IP's and the Router IP. With a simple point-to-point gre tunnel, everything that goes to (next hop) 172.16.0.0/24 would be sent to the other side of the tunnel. In an multipoint GRE, there needs to be a mapping between Tunnel IP for router A and the Public IP for router A. NHRP is a protocol that can map this for you.
    – JelmerS
    Dec 9, 2015 at 11:41
  • Ok, but if I use point-to-point GRE, like here and decide to ping 192.168.1.2 (tunnel address on the upper right router) from the router on the left (call it R1), then R1 first needs to determine what tunnel to send it through and it does this by scanning his tunnels to find the one with a subnet containing 192.168.1.2, right?
    – user4205580
    Dec 9, 2015 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.