GRE and IPsec Tunnels

What it is

A tunnel carries one network's packets inside another network's packets, so two distant sites can act as if they were connected directly.

GRE builds the tunnel and can carry many kinds of traffic, but it adds no security. IPsec adds encryption and integrity, but on its own it is more limited in what it carries. The two are often combined, so that GRE provides the flexibility and IPsec provides the protection.

How it works

GRE first, then IPsec on top of it.

GRE basics

Generic Routing Encapsulation (GRE) is IP protocol 47. A GRE tunnel is a point to point virtual interface on each router. The original packet gets a GRE header and a new outer IP header.

R1(config)# interface Tunnel0
R1(config-if)# ip address 172.16.0.1 255.255.255.252
R1(config-if)# tunnel source GigabitEthernet0/0
R1(config-if)# tunnel destination 203.0.113.2

R2 mirrors this, with its own tunnel address and with the source and destination swapped. The tunnel interface comes up once the source is up and the destination is reachable through the routing table.

GRE can carry multicast and routing protocol traffic, such as OSPF and EIGRP, across the tunnel. Plain IPsec cannot do that on its own, which is the main reason to combine them.

The tunnel adds header bytes, so the effective MTU is smaller than the physical one. You can lower it on the tunnel interface to avoid fragmentation.

R1(config-if)# ip mtu 1400
R1(config-if)# ip tcp adjust-mss 1360

Recursive routing

A tunnel can fail if the router learns the tunnel destination through the tunnel itself. This is called recursive routing, and the router reports it and takes the tunnel down. Use a route to the tunnel destination that points out of the physical interface, and do not advertise the underlay networks over the tunnel.

IPsec basics

IPsec is a framework that protects IP packets. It has two stages.

• IKE (Internet Key Exchange) authenticates the peers and builds a secure channel. IKE uses UDP port 500, and UDP port 4500 when NAT traversal is needed.
• IPsec SA protects the data. It uses ESP (protocol 50), which encrypts and authenticates, or AH (protocol 51), which authenticates but does not encrypt.

IKE has two versions. IKEv2 is the newer one and is preferred, though IKEv1 is still in use.

Two modes decide how much of the packet is wrapped. Tunnel mode encrypts the whole original packet and adds a new IP header. Transport mode keeps the original IP header and protects only the payload.

Tunnel mode is the usual choice between sites.

Protecting a GRE tunnel

A simple, widely used approach is an IPsec profile applied to the tunnel interface. This IOS XE example uses IKEv1 style commands, and the exact commands depend on the software release.

R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# hash sha256
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 14
R1(config)# crypto isakmp key MYSECRET address 203.0.113.2
R1(config)# crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
R1(cfg-crypto-trans)# mode tunnel
R1(config)# crypto ipsec profile PROF
R1(ipsec-profile)# set transform-set TSET
R1(config)# interface Tunnel0
R1(config-if)# tunnel protection ipsec profile PROF

Both ends need matching policy: the same encryption, hash, authentication method, group and transform set. Newer software supports IKEv2 with its own proposal, policy, keyring and profile, but the idea is the same.

You can also use the tunnel itself as an IPsec tunnel with tunnel mode ipsec ipv4, which is called a virtual tunnel interface. The commands available depend on the software release.

Verifying

R1# show interfaces tunnel 0
R1# show crypto isakmp sa
R1# show crypto ipsec sa
R1# show ip route

show interfaces tunnel 0 should show the interface up. show crypto isakmp sa should show the peer in the active state.

show crypto ipsec sa shows the counters of encrypted and decrypted packets. If the encrypt counter rises but the decrypt counter does not, the problem is at the far end or in the path back.