Ccna routing and Switching Complete Study Guide

GRE over IPsec

As I just mentioned, GRE by itself provides no security—no form of payload confidentiality 

or encryption. If the packets are sniffed over the public networks, their contents are in 

plain-text, and although IPsec provides a secure method for tunneling data across an IP 

network, it has limitations.

IPsec does not support IP broadcast or IP multicast, preventing the use of protocols that 

need them, like routing protocols. IPsec also does not support the use of the multiprotocol 

traffic. GRE is a protocol that can be used to “carry” other passenger protocols like IP 

broadcast or IP multicast, as well as non-IP protocols. So using GRE tunnels with IPsec 

allows you to run a routing protocol, IP multicast, as well as multiprotocol traffic across 

your network.

With a generic hub-and-spoke topology (corp to branch, for example), you can 

implement static tunnels, typically GRE over IPsec, between the corporate office and 

branch offices. When you want to add a new spoke to the network, all you need to do is 

configure it on the hub router. The traffic between spokes has to traverse the hub, where it 

---

GRE Tunnels 

921

must exit one tunnel and enter another. Static tunnels can be an appropriate solution for 

small networks, but this solution actually becomes an unacceptable problem as the number 

of spokes grows larger and larger!