enter image description here http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/868-cisco-router-gre-ipsec.html

In the example above, R1:

R1(config)# interface Tunnel0
R1(config-if)# ip address
R1(config-if)# tunnel source
R1(config-if)# tunnel destination

and R2:

R2(config)# interface Tunnel0
R2(config-if)# ip address
R2(config-if)# tunnel source
R2(config-if)# tunnel destination

When a packet with dst IP address arrives to R1, how does R1 know where to send it? It checks its routing table and knows that is directly connected? Anyway, it adds new IP header (dst IP set to -tunnel destination) and GRE header to that packet.

When R2 receives the packet, it knows the packet was addressed to its FE0/1 interface and it matches the tunnel source IP address that was set up on R2. So it removes the outer IP and GRE header, leaving the packet with dst IP and routes it forward (not in this case of course, but it would if the dst IP was different).

Suppose there was another router - R3. Is it possible to set up a tunnel between R1 and R3 using the same network -

When R1 pings the tunnel interface of R2 -, how does it know how to send it there? It probably checks his own Tunnel0 configuration: oh, I should send it to, which is in the same subnet as my Tunnel0 interface Then it checks tunnel destination address to learn it's In other words, it can't directly ARP because it's not a physical connection.

Let's say I add R3 with Tunnel1 interface whose public IP is Next I configure Tunnel1 on R1:

R1(config)# interface Tunnel1
R1(config-if)# ip address
R1(config-if)# tunnel source
R1(config-if)# tunnel destination

Pinging from R1 probably wouldn't work, because now I have two tunnels on R1 using the same subnet (R1-R2 and R1-R3). R1 has no idea which tunnel I mean here and therefore it doesn't know the tunnel destination.

TLDR Does it mean we need a different subnet for each tunnel? If so, shouldn't all tunnel subnets be /30? We only need two IPs for a tunnel - source and destination.

1 Answer 1


A 'normal' GRE tunnel is a used as a point-to-point connection. A /30 (or even /31) would be a better use of your subnet space. There also exist multipoint GRE tunnels, such as DMVPN. Here you can have multiple tunnel endpoints connected to one tunnel interface. In that case, you will want a bigger subnet.

  • Do you know how R1 finds out the MAC of when it pings that address? is configured on another router so it has no idea where it is initially, right? It probably does need to find out its MAC address to communicate. Commented Dec 9, 2015 at 10:57
  • It actually doesn't need the MAC address of The packet is encapsulated in GRE and then sent over IP to R1 will look up the MAC address for the next hop towards and use that. So does every router along the way, until the last router, which will look up the MAC for itself. R2 receives a packet for with it's own MAC address, decapsulates the outer IP and sees the GRE encapsulation, knowing that it is destined for interface Tunnel 0. Then it proceeds as if it received the packed on a physical interface named Tu0.
    – JelmerS
    Commented Dec 9, 2015 at 11:08
  • It knows to send it to because that's the only tunnel from R1. But if R1 had more tunnels, how it would know to send it to I can't undestand that. It chooses the right tunnel based on the matching subnet? Commented Dec 9, 2015 at 11:18
  • There needs to be a mapping between the tunnel IP's and the Router IP. With a simple point-to-point gre tunnel, everything that goes to (next hop) would be sent to the other side of the tunnel. In an multipoint GRE, there needs to be a mapping between Tunnel IP for router A and the Public IP for router A. NHRP is a protocol that can map this for you.
    – JelmerS
    Commented Dec 9, 2015 at 11:41
  • Ok, but if I use point-to-point GRE, like here and decide to ping (tunnel address on the upper right router) from the router on the left (call it R1), then R1 first needs to determine what tunnel to send it through and it does this by scanning his tunnels to find the one with a subnet containing, right? Commented Dec 9, 2015 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.