Overblog
Edit post Follow this blog Administration + Create my blog
Cisco & Cisco Network Hardware News and Technology

GRE tunnel vs. IPsec tunnel

August 14 2015 , Written by Cisco & Cisco Router, Network Switch Published on #Cisco & Cisco Network

In the article How to Configure a GRE Tunnel?” we talked about what tunneling is and how to configure a GRE Tunnel…In this article we continue to say something about the GRE tunnel and IPsec tunnel—what are the differences?

Encapsulating a packet for secure transportation on the network can be done using either GRE or IPsec protocols. This tip explains under what circumstances each protocol works best.

Generic Routing Encapsulation (GRE), defined by RFC 2784, is a simple IP packet encapsulation protocol. GRE is used when IP packets need to be sent from one network to another, without being parsed or treated like IP packets by any intervening routers.

For example, in Mobile IP, a mobile node registers with a Home Agent. When the mobile node roams to a new network, it registers with a Foreign Agent there. Whenever IP packets addressed to the mobile node are received by the Home Agent, they can be relayed over a GRE tunnel to the Foreign Agent for delivery. It does not matter how the Home Agent and Foreign Agent communicate with each other -- hops in between just pass along the GRE packet. Only the GRE tunnel endpoints -- the two Agents -- actually route the encapsulated IP packet.

The IP Security (IPsec) Encapsulating Security Payload (ESP), defined by RFC 2406, also encapsulates IP packets. However, it does so for a different reason: To secure the encapsulated payload using encryption. IPsec ESP is used when IP packets need to be exchanged between two systems while being protected against eavesdropping or modification along the way.

For example, in a site-to-site VPN, a source host in network "A" transmits an IP packet. When that packet reaches the edge of network "A" it hits a VPN gateway. VPN gateway "A" encrypts the private IP packet and relays it over an ESP tunnel to a peer VPN gateway at the edge of network "B." VPN gateway "B" then decrypts the packet and delivers it to the destination host. Like GRE, it doesn't really matter how the two VPN gateways communicate with each other -- hops in between just pass along the ESP packet. But unlike GRE, someone at those hops could not possibly look at or change the encapsulated IP packet, even if they wanted to. That's because cryptographic algorithms have been applied to scramble the IP packet and detect any modification or replay.

Use GRE where IP tunneling without privacy is required -- it's simpler and thus faster. But, use IPsec ESP where IP tunneling and data privacy are required -- it provides security features that are not even attempted by GRE.

So,

  • IPsec stands for Internet Protocol Security while GRE stands for Generic Routing Encapsulation.
  • IPsec is the primary protocol of the Internet while GRE is not.
  • GRE can carry other routed protocols as well as IP packets in an IP network while IPSec cannot.
  • IPsec offers more security than GRE does because of its authentication feature.

More Related Topics

Tips & Examples: Configuring a GRE Tunnel

Share this post
Repost0
To be informed of the latest articles, subscribe:
Comment on this post
S
People also make blanket statements like "GRE offers no protection" which unqualified would scare almost anyone away. To be fair, the next sentence really needs to explain that it is common to use GRE over IPSec, which gives you the best of both worlds.<br /> <br /> IPSec alone is still faster, but if you need a true tunnel, then GRE is the way to go, just make sure you also use IPSec for security.
Reply