GRE over IPsec combines GRE’s ability to carry broadcast and multicast traffic with IPsec’s encryption for secure site-to-site communication. It is useful when routing protocols such as OSPF must exchange multicast messages across an internet-based tunnel. section 16.3.1
The encapsulation process works in two layers:
- GRE first encapsulates the original IP packet with a GRE header and a new IP header. section 16.3.1
- IPsec then encrypts the complete GRE packet and encapsulates it with an IPsec header and additional IP header. section 16.3.1
- The result is a tunnel within a tunnel: GRE supplies traffic flexibility, while IPsec supplies privacy and security. section 16.3.1
Routing between two sites
Hosts send ordinary, unencrypted traffic to their local router. The router applies GRE and IPsec before forwarding the packet across the internet; the remote router decrypts and processes it. This allows OSPF multicast traffic to cross the tunnel even though IPsec alone supports only unicast traffic. section 16.3.1
Figure 16.16 GRE over IPsec works by encapsulating an IP packet with GRE and IP headers, encrypting the GRE packet, and encapsulating the encrypted packet with IPsec and IP headers.
Trace the packet layers from the original IP packet through GRE encapsulation, IPsec encryption, and final outer encapsulation. section 16.3.1
GRE alone is not secure because it does not encrypt messages. IPsec alone cannot carry broadcast or multicast traffic. Combining them adds complexity but addresses both limitations. section 16.3.1 section 16.4
