IPsec tunnel mode encrypt a whole IP packet and sends it as the payload of another IP packet. I have always used GRE as the encapsulation layer when doing IPsec encryption. However, how could I have the same behavior with a router that supports IPsec but does not implements GRE ?
3
-
2You've answered your own question in your first sentence: IPsec tunnel mode encrypts a whole IP packet and sends it as the payload of another IP packet. What part are you confused about?– Ron TrunkCommented Feb 25, 2019 at 13:12
-
So what's the difference between GRE+IPsec and IPsec only ?– NakruleCommented Feb 25, 2019 at 13:48
-
2You have a GRE tunnel protected by IPSec. If you drop the GRE tunnel part, IPSec is usually carried as a UDP stream.– RickyCommented Feb 25, 2019 at 16:47
Add a comment
|
1 Answer
So what's the difference between GRE+IPsec and IPsec only?
In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet.
The most common reason for doing this is to allow broadcast and multicast across the tunnel. Neither is supported by IPSec alone. GRE can also encapsulate non-IP traffic, which IPsec does not support.
answered Feb 25, 2019 at 14:02
-
1
tunnel mode ipsec ipv4(or the preferred vendor's equivalent of "tunnel based vpn" or "interface based vpn") will nicely support multicast routing across the tunnel and will allow the multicast based IGPs to form their adjacencies and neighborships, without the need for GRE. Non-IP protocols of course won't work, which they might with GRE. Commented Feb 25, 2019 at 16:32