Many sources site GRE as supporting broadcast/multicast and IPsec does not. Both GRE and IPsec are merely tunneling protocols. Therefore there is nothing inherent about tunneling protocols which prevents Multicast/Broadcast.

What is it specifically about IPsec that does not allow for Multicast/Broadcast traffic to flow through the tunnel?

By comparison, it might be also helpful to also answer: What is it specifically about GRE that does allow for Multicast/Broadcast?

  • 1
    who said that IPSec does not support multicast traffic? rfc4301 mentions multicast SAs in sec 4.6 (datatracker.ietf.org/doc/html/rfc4301#section-4.6). And rfc4303 mentions different types of multicast (datatracker.ietf.org/doc/html/rfc4303#section-2.1). It does however say that multicast traffic require special support. The answer seems to be in the way security associations (SAs) are designed, i.e., how does IPSec associate correct security parameters to packets with multicast addresses.
    – Effie
    Commented Sep 11, 2021 at 15:06
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Commented Dec 23, 2021 at 21:37

2 Answers 2


GRE and IPsec aren't one-to-many technologies. Thus multicast/broadcast doesn't have much meaning. That said, there are ways to push multicast across either system -- both sender and receiver -- but few systems actually support it. It's far easier, and less headache, to setup multicast routing.

(This is even more true when tunnel interfaces are being used, i.e. routed interfaces.)


IPSec works in both tunnel and transport mode. In transport mode, a security association is set up between the two endpoints. To set up a "multipoint" SA requires a different mechanism for authentication and encryption.

I assume the committee decided that broadcast traffic wan't important enough to create a separate mechanism for multipoint security associations. Current implementations, such as GETVPN, FlexVPN and DMVPN all require additional components to exchange and manage keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.