TechKnowSurge
Cisco CCNA 5.5 Cisco CCNA 1.2 Cisco CCNA 5.1
TechKnowSurge Catalog Videos GRE Tunnels
VideoNetworkFree

GRE Tunnels

Generic Routing Encapsulation (GRE) is a Cisco-developed tunneling protocol used to carry traffic, including routing protocol updates, across networks where direct transmission is not possible or desirable. This content covers GRE packet structure, its lack of native encryption, and how it combines with IPSec to secure tunneled communications.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Generic Routing Encapsulation (GRE) is a tunneling protocol developed by Cisco that creates logical tunnels between network endpoints, allowing traffic to traverse intermediate networks that an organization may not control or that are not configured to handle that traffic natively. A common use case is extending dynamic routing protocols such as EIGRP and OSPF across networks that do not support multicast, since GRE can carry multicast traffic inside a unicast tunnel, allowing routers at each end to exchange routing information as if they were directly connected. The GRE packet structure adds a GRE header and a new outer Layer 3 header to the original packet, with the outer header specifying the tunnel endpoints and the GRE header carrying additional metadata such as sequence numbers for packet reassembly. GRE itself provides no encryption, meaning the encapsulated payload and inner Layer 3 header are fully visible to anyone inspecting traffic in transit. To address this, GRE is frequently combined with IPSec, which encrypts the tunnel and protects the data end to end. The two can be combined in different orders: GRE over IPSec encapsulates GRE traffic inside an IPSec tunnel, encrypting everything that passes through it, while IPSec over GRE applies IPSec encryption first and then wraps that inside a GRE tunnel, leaving the outer GRE traffic unencrypted. The choice between these configurations depends on the specific security requirements, such as whether routing protocol exchanges need to be encrypted alongside other tunneled traffic or whether selective encryption of certain traffic flows is preferred.

What you'll learn

What's covered

GRE Protocol

Aligned to

Cisco CCNA
5.5 Describe IPsec remote access and site-to-site VPNs
1.2 Describe characteristics of network topology architectures
5.1 Define key security concepts

Key terms

Generic Routing Encapsulation
GRE
A tunneling protocol developed by Cisco that encapsulates a wide variety of network layer protocols inside point-to-point virtual links, enabling the transport of protocols that would not normally be routable. GRE tunnels are stateless and do not provide encryption, so they are often combined with IPsec for secure VPN deployments.
Encapsulation
The process of wrapping data with protocol headers as it passes down the layers of the OSI model.
Routing Protocol
A protocol used by routers to communicate and share routing information to determine the best path for data.
IPsec
A suite of protocols that authenticates and encrypts IP packets to provide secure communication over a network.
GRE over IPsec
An encapsulation method where traffic is first wrapped in a GRE tunnel and then encrypted by IPsec, securing the entire GRE packet including its inner payload.
IPsec over GRE
An encapsulation method where traffic is first encrypted by IPsec and then wrapped in a GRE tunnel, meaning the GRE layer itself is unencrypted while the inner IPsec payload remains protected.
Payload
The actual data content of a packet or message, excluding headers and metadata.

Transcript

One of the common tunneling protocols is the generic routing encapsulation protocol, or the GRE protocol.

What GRE Is For

The generic routing encapsulation protocol was created by Cisco, and it was for the idea of creating tunnels. One of the most common examples of where we would use this is so that way we can pass routing protocols across networks that we don't necessarily have control over, or maybe we don't want it to participate in the routing protocol.

For instance, let's say this is running EIGRP or OSPF. We want those to communicate, but it communicates via multicast, and if we don't have multicast set up throughout this network, then that is not traffic that's going to get from end to end here. We won't be able to pass that information back and forth. So if we don't have control over it, what we can do is we can use that GRE tunnel to pass that information, and when it gets unpacked on the other side, then it will pass those multicast onto the other side, and this router can start participating in OSPF or EIGRP, or whatever routing protocol we're using.

The GRE Packet

Here's what the GRE packet looks like. We have our regular packet, which has the payload and the layer 3 header on here, and then what we do is we add a separate layer 3 header, with once again the source and destination IP address, which will be the end of the tunnel. And then we have the GRE header, which has some additional information, things like a sequence number for reassembly. So this is the GRE packet.

GRE and Encryption

One thing to note about GRE is by itself it doesn't do any encryption. So the traffic that gets sent across here is still visible. Anyone that is taking a look at this can see the whole payload and the layer 3 header that it's encapsulating. So if we want to secure the communications of GRE, then we're going to have to do it over some other secure protocol like IPsec.

What that would look like is we have our original packet here, and we encapsulate that with the GRE packet here, and then it gets encapsulated again with IPsec, and the IPsec is for security and it will be encrypted then wherever it goes across the line until it comes out of that IPsec tunnel.

IPsec over GRE versus GRE over IPsec

I will note that there's also IPsec over GRE and GRE over IPsec, and the difference between IPsec over GRE and GRE over IPsec just means which one gets encapsulated first. So with GRE over IPsec, what happens is we've got whatever traffic that we're being tunneled with, the GRE tunnel then gets encapsulated with that, and then IPsec. Whereas we see with IPsec, it gets the IPsec tunnel first and then the GRE tunnel. So there's going to be some traffic that's unencrypted when it comes to this GRE tunnel, and the stuff that gets encrypted with the IP first then comes out and it's encrypted and safe and secure.

So where we'd see the difference between these two is maybe, for instance, our routing protocol: do we want our routing protocol communication to be encrypted, or do we not care about that and we want it just to be passed unencrypted, and then the rest of our traffic would be encrypted? So that would be an example of where we might want some traffic to be unencrypted and some.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →