4

IPsec tunnel mode encrypt a whole IP packet and sends it as the payload of another IP packet. I have always used GRE as the encapsulation layer when doing IPsec encryption. However, how could I have the same behavior with a router that supports IPsec but does not implements GRE ?

  • 2
    You've answered your own question in your first sentence: IPsec tunnel mode encrypts a whole IP packet and sends it as the payload of another IP packet. What part are you confused about? – Ron Trunk Feb 25 at 13:12
  • So what's the difference between GRE+IPsec and IPsec only ? – Nakrule Feb 25 at 13:48
  • 2
    You have a GRE tunnel protected by IPSec. If you drop the GRE tunnel part, IPSec is usually carried as a UDP stream. – Ricky Beam Feb 25 at 16:47
5

So what's the difference between GRE+IPsec and IPsec only?

In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet.

The most common reason for doing this is to allow broadcast and multicast across the tunnel. Neither is supported by IPSec alone. GRE can also encapsulate non-IP traffic, which IPsec does not support.

  • 1
    tunnel mode ipsec ipv4 (or the preferred vendor's equivalent of "tunnel based vpn" or "interface based vpn") will nicely support multicast routing across the tunnel and will allow the multicast based IGPs to form their adjacencies and neighborships, without the need for GRE. Non-IP protocols of course won't work, which they might with GRE. – Marc 'netztier' Luethi Feb 25 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.