GRE/IPSEC and IPSEC VPN tunnels

GRE is used as a it provides pure tunneling see GRE for full information. To make secure the GRE tunneling we use GRE/IPSec or IPSec VPN tunnel, as it is one way of setting up private site-to-site connection by utilizing public network (the Internet). Since it is utilizing public network, there would be no need to have dedicated physical circuit to interconnect the sites, hence requiring low overhead to setup while maintain private and secure connection.

With site-to-site IPSec VPN, there is a IP routing in place to interconnect multiple subnet. This IP routing could be static routing or dynamic routing. In a small network where there is only one path connecting two sites, then static routing should be sufficient. When there are multiple paths connecting two sites, then dynamic routing (i.e. EIGRP, OSPF) should be used to have optimal connection just like i did for our office as we have multiple sites to connect and communicate so we used dynamic routing (EIGRP) although we use DMVPN (i will talk about it in next blogs).

Note that IPSec tunneling technology is only able to support static routes and basic IP interconnection. When there are more advance IP interconnections needed, such as running Novell IPX, dynamic routing, and load balancing between the sites, then IPSec tunneling itself is unable to support. For such advance IP interconnections, GRE tunneling is the choice. The downside of GRE tunneling is that GRE tunnel is less-secure tunnel compared to IPSec tunnel.

As we use dynamic routing and decided to use public network and also want to have a secure connection, so the workaround is to run GRE over IPSec. IPSec will then be encrypting the GRE tunnel securely and GRE tunnel will be providing the advance IP interconnection support. The Header will look like this (Rough sketch form me sorry for so simple :(



For the detail configuration of GRE and VPN look at my blogs.

I hope this will be informative for you.

Cheers :)