Skip to main content
10 votes
Accepted

What is the difference between L2TP vs GRE

L2tp and GRE are totally diffrent protocols GRE is a simple IP packet encapsulation protocol. a GRE tunnel is used when packets need to be sent from one network to another, without being parsed or ...
Mr.lock's user avatar
  • 1,733
5 votes
Accepted

Use cases for GRE over IPSEC

Running multicast or multicast based routing protocols does not necessarily require GRE-over-IPsec. "Tunnel based" or "route based" VPN (tunnel mode ipsec ipv4 a.k.a. IPsec Virtual Tunnel Interfaces ...
Marc 'netztier' Luethi's user avatar
5 votes
Accepted

How IPsec tunnel mode work without GRE

So what's the difference between GRE+IPsec and IPsec only? In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet. The ...
Ron Trunk's user avatar
  • 67.7k
5 votes

GRE, guarantee 1500 bytes MTU for end hosts

When there's additional overhead eating into the MTU size, there are three basic approaches: increase outer MTU/frame size, decrease inner MTU, or live with fragmentation. Routers may fragment (for ...
Zac67's user avatar
  • 85.5k
4 votes
Accepted

Regarding Multicast over the internet

Why is multicast not supported over the internet ? There is only one multicast range. Sharing that range across the Internet would mandate an address allocation scheme akin to public unicast ...
Zac67's user avatar
  • 85.5k
4 votes

OSPF on tunnel interfaces

Yes, what's important to the router is layer 3 interfaces. You can think of a layer 3 interface as a logical construct, which can be be tied to a VLAN, physical or tunnel interface.
JFL's user avatar
  • 19.7k
4 votes
Accepted

Scaling VXLAN tunnels in openvswitch

You could solve this by running VXLAN on the hypervisor using software like FRR. That would imply that you run a full mesh BGP setup between your hypervisors, or use route reflectors. Then, you can ...
Teun Vink's user avatar
  • 17.4k
3 votes
Accepted

Regarding front door vrf concept

You have to at least create static host routes pointing to the endpoint IPs of your tunnel to make sure they remain established. Front door vrf is handy if your endpoint is using a dynamic IP address,...
John K.'s user avatar
  • 969
3 votes

Regarding Multicast over the internet

The multicast use case for the GRE tunnel is typically to allow the routers on either side of the link to run a routing protocol between each other. Say you've got an office in Boston with 10 IP ...
Sheep's user avatar
  • 31
3 votes

Regarding Multicast over the internet

A1: Because normally you need to run PIM protocol in order to achieve end-to-end connectivity for multicast network. PIM doesn't normally run between ISP boundaries. It would be pretty complicated and ...
ar_'s user avatar
  • 1,133
3 votes
Accepted

Gre Tunnel issue

There is not a lot to go on in your output there, but try removing qos pre-classify from the tunnel interface - it may be that you have misconfigured qos settings causing traffic to be dropped.
Benjamin Dale's user avatar
3 votes
Accepted

qos inside vpn, possible or not ? I read yes and no

Possible? Generally, yes. However, you need to consider the tunnel outside as well. How effective QoS works depends on a large number of parameters only some of which you have control over. QoS ...
Zac67's user avatar
  • 85.5k
3 votes

GRE over IPSec Transport vs. Tunnel Mode

No, it should not be GRE. In both cases as shown (IPSec tunnel mode and transport mode), it's always IPsec encrypting GRE (and whatever it may contain). Therefore, the outermost header has to be ...
Marc 'netztier' Luethi's user avatar
3 votes
Accepted

what is the purpose of GRE in UDP encapsulation if its unidirectional

The use case is passing flow hashes from the overlay network to the underlay network. Higher level protocols generally don't like to have their packets reordered, it makes stream reassembly and ...
Peter Green's user avatar
  • 13.4k
2 votes
Accepted

Regarding Gre tunnel encapsulation

Q1: Inner Source: 1.1.1.1 Inner Dest: 4.4.4.4 Outer source: 172.16.0.1 Outer Dest: 192.16.0.2 Q2: The source address is the tunnel source, 172.16.0.1 (for R1-R4 traffic). The inner and outer ...
Ron Trunk's user avatar
  • 67.7k
2 votes
Accepted

Two channels between two switches

Depending on your actual goal, there are several possibilities. Load balancing your flows 'at will' requires them to be split across different VLANs or very delicate fine tuning. VLANs with spanning ...
Zac67's user avatar
  • 85.5k
2 votes

Qos implementation

Unless you have a specific agreement with your ISP and the whole path is under the control of you and your ISP, no there's no QoS on the Internet. All Internet router will simply ignore all QoS ...
JFL's user avatar
  • 19.7k
2 votes
Accepted

How to use ACL to deny sending packages to the GRE tunnel?

On R0 you need to deny ip 172.16.0.0/24 172.17.0.0/24 for the appropriate port/VLAN and vice versa on R1 deny ip 172.17.0.0/24 172.16.0.0/24 Make sure you put a 9999 permit ip any any (or ...
Zac67's user avatar
  • 85.5k
2 votes
Accepted

Why does GRE tunnel has lesser TxBS/RxBS than its physical interface?

(from comment) The overhead is only visible (and countable) outside the tunnel. Roughly you should see (outer packet header + GRE header) * number of packets more traffic on the outside (physical) ...
Zac67's user avatar
  • 85.5k
2 votes
Accepted

Traffic sent to GRE Tunnel fails, but GRE Tunnel is up and OSPF adjacencies are formed

It turns out the Palo Alto tunnel inspection policy was the root of the issue. Once I disabled the policy in each firewall, I was able to ping through the tunnel. I used traceroute to verify from ...
Ben's user avatar
  • 157
2 votes
Accepted

Why does IPsec not support Multicast/Broadcast?

GRE and IPsec aren't one-to-many technologies. Thus multicast/broadcast doesn't have much meaning. That said, there are ways to push multicast across either system -- both sender and receiver -- but ...
Ricky's user avatar
  • 32.3k
2 votes

GRE tunnel bridging and MTU mismatch

Moving to using jumbo frames on the 'WAN' link between the networks (where you are using GRE for some unexplained reason) would also work since there would no longer be an issue with the frame size ...
FrameHowitzer's user avatar
2 votes

GRE Source IP Spoofing

The original RFC 1701 GRE allows for a sequence number, and attacker in the situation you describe would need to know what that is. TCP has something similar with a sequence number. The following RFC ...
Ron Maupin's user avatar
  • 99.9k
2 votes

GRE Source IP Spoofing

Cloudflare is mistaken. You can indeed spoof (lie about) the origin of GRE traffic, and DDoS attackers DO. Thus you would not know where the traffic actually came from. BUT, if the additional features ...
Ricky's user avatar
  • 32.3k
2 votes

what is the purpose of GRE in UDP encapsulation if its unidirectional

I was going through this feature of GRE called GRE-in-UDP encapsulation. The RFC says it is unidirectional and the tunnel traffic is not expected to be returned back to the UDP source port values used ...
Mike Pennington's user avatar
1 vote

PPP CHAP Authentication password requirement

The username and password sent by router 1 doesn’t have to be the same as what is received from router 2. @RickyBeam thanks for the feedback. !!!! Script for R1 !!!! username ISP password cisco123 ...
dcrearer's user avatar
  • 499
1 vote
Accepted

MPLS over GRE tunnel with Linux iproute2

It turned out that I forgot to accept mpls input as well as to turn of rp_filter on machine a. Doing the following worked out the problem: sysctl -w net.ipv4.conf.all.rp_filter=0 sysctl -w net.mpls....
KireinaHoro's user avatar
1 vote

Encrypt Gre tunnel traffic

You should be able to set up IPsec between the two devices. Then run GRE through the IPsec tunnel to allow multicast. This may help. https://support.rackspace.com/how-to/configure-a-site-to-site-vpn-...
Out_Of_Names's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible