GRE creates a tunnel by encapsulating an original network packet with additional headers. The outer packet carries the inner packet across an intermediate network, but GRE does not encrypt the original contents. section 16.3.1
Use GRE when tunnel flexibility matters more than standalone confidentiality:
- Carry broadcast and multicast traffic, unlike IPsec on its own, which supports only unicast traffic. section 16.3.1
- Support routing protocols such as OSPF, whose routing messages use multicast addresses 224.0.0.5 and 224.0.0.6. section 16.3.1
- Do not treat GRE alone as a VPN: anyone accessing tunnel traffic can read its contents. section 16.3.1
GRE over IPsec
Combine GRE with IPsec when a tunnel must carry multicast traffic securely. First, encapsulate the IP packet with a GRE header and a new IP header. Then encrypt the complete GRE packet and encapsulate it with IPsec and additional IP headers. The result is a tunnel within a tunnel: GRE supplies broadcast and multicast support, while IPsec supplies encryption. section 16.3.1
Figure 16.14 A tunnel is created by encapsulating a packet inside of another packet. This outer packet provides a “tunnel” for the inner packet to travel through without being exposed to the internet.
Trace how an outer packet provides a tunnel for an encapsulated inner packet. section 16.3.1
