GRE Tunnel

[Melvinb1981]

Good Day,

In what scenario would you ever configure just a GRE tunnel between Branches without IPSEC (encryption)?

Regards,  

[Georg Pauwen]

Hello,

it depends on what level of protection you need. Have a look at the link below. The main difference is that simple GRE tunnels can carry multicast traffic, and can participate in dynamic routing (e.g. EIGRP, RIP, OSPF), whereas IPSec tunnels cannot...

https://ipwithease.com/gre-vs-ipsec/

[Melvinb1981]

Thanks for the reply,

What i am getting at is using gre over ipsec as that supports multicast correct, this in turn allows you to use the routing protocols that support multicast.

Im just unsure why you would use gre seperately as its not encrypted

Regards,

[Joseph W. Doherty · Accepted solution]

Yes, that's correct; i.e. you can do multicast across a GRE/IPSec tunnel. (Or a [IPSec] VTI tunnel too.)

Generally, you see pure GRE tunnels used "internally" or perhaps across a "private" (non-Internet) WAN. That said, unless you're worried about your service provider(s) snooping your traffic, it's not all that easy for a 3rd party to snoop your GRE traffic on the Internet unless they've got control over a provider's device your traffic transits. Even then it can be a bit difficult.

As to why do GRE w/o encryption, it's so you can usually obtain a higher data transfer rates, first because there's less overhead, second, often devices do not offer the same level of performance for encrypted traffic as they might for non-encrypted traffic.