GRE OVER IPSEC VERSUS IPSEC OVER GRE AND THROUGHPUT

[sarahr202]

Hi there,

I understand the difference between GRE over IPSEC ( IP SEC is transport  for GRE) and IPSEC OVER GRE ( GRE is a transport), just focusing only on throughput,  which one provides a better throughput on a given platform  , GRE over IPSEC or IPSEC over GRE?  

I was watching a video tutorials where author claims throughput will go down  when using  IPSEC OVER GRE as compared to GRE OVER IPSEC

.Thanks and have a great weekend!!

[Georg Pauwen · Accepted solution]

Hello,

as I understand it, with GRE over IPSec, all traffic including the GRE overhead is encrypted, while with IPSec over GRE, only the specified interesting traffic gets encrypted. So GRE over IPSec has a slightly lesser throughput, since more traffic has to be encrypted.

Obviously the video you watched states the opposite...do you have the link to the video ?

[sarahr202]

Thanks gpauwen.

The video is INE 's Video on GRE over IPSEC (  CCIE R/S V5), unfortunately, there is no link for it.

when are you planning to take lab exam?

Good luck!! 

[Georg Pauwen]

Hello,

one addition: if you use GRE over IPSec, configuring IPSec in transport mode will save about 20 bytes in overhead (that is because GRE tunnel endpoints and IPSec peers are the same).

The exam: I took the exam 5 times between 2002 and 2004, and I failed it 5 times. I ran out of money after that. Maybe I should update the profile...

[sarahr202]

Thanks gpauwen

It may or may not , because encryption/ hashing algorithm negotiated requires " Target data " to be  multiple of  " block size" of the algorithm chosen, so we may end up with same size packet after encryption/hashing in Transport mode as well because of padding .

I wish you good luck in your study and appreciate your response.

Thanks and have a nice weekend!!