IPSec & GRE Packet Size

[ZK916]

Hello,

We configured S2S IPSec VPN and GRE tunneling between 3 sites over Cellular(LTE/5G). When we tested the speed prior to configuring the IPSec and GRE tunnels, the throughput was at 50Mbs/dwn and 15/up. After configuring the IPSec and GRE tunnels, the throughput dropped quite significantly. 

It is my understanding that when adding those two protocols, the packet/payload size is impacted. I wanted to find out why the packet size gets impacted and what is the additional overhead that gets added to the packet/payload/frame?

Thanks in advance.

\
Best, ~ZK

[MHM Cisco World]

IPsec and GRE add a lot of overhead 
you can use 
cisco tool to calculate the overhead 

https://ipsec-overhead-calculator.netsec.us/

MHM

[marce1000]

 - I don't have much details about the Why's but you may want to reduce the MTU size on your tunnel to avoid fragmentation and improve performance , 

 M.

[mohamedlamine]

When using IPSec and GRE tunnels, the additional encapsulation and encryption from these protocols do introduce overhead, which can impact the overall throughput of the network. Here's how these protocols add overhead to the packet/payload:

1. IPSec Overhead: IPSec adds header information to each packet, including the IP header, ESP (Encapsulating Security Payload) header, and potentially AH (Authentication Header) if used. This additional header information increases the size of each packet, reducing the amount of payload data that can be transmitted in each packet.

2. GRE Overhead: GRE adds a new IP header to the original packet, encapsulating it for transmission over the tunnel. This additional header increases the overall size of the packet, reducing the available space for payload data.

3. Encryption Overhead: The encryption process itself adds additional bits to each packet to secure the data. This further increases the size of the packet and reduces the amount of actual data that can be transmitted.

All these factors combined can lead to a decrease in throughput compared to the baseline speed you observed before implementing the IPSec and GRE tunnels. Depending on the configuration and encryption algorithms used, the overhead can vary.

If you're experiencing a significant drop in throughput, you may want to investigate the specific configurations of IPSec and GRE, as well as consider potential optimizations or alternative solutions to improve network performance while still maintaining security.

I hope this helps clarify why the packet size gets impacted after configuring IPSec and GRE tunnels. 

[Joseph W. Doherty]

"It is my understanding that when adding those two protocols, the packet/payload size is impacted."

Correct.  (Unless we get very, very technical - discussing logical and/or physical considerations and what's the meaning of "impact ".  For example, when you add those protocols to a packet, usually logically you have the same packet carrying the same payload.  Physically, it can be quite impactful.)

Often, without mitigation, those protocols can much, or even very much, impact network performance.

"I wanted to find out why the packet size gets impacted and what is the additional overhead that gets added to the packet/payload/frame?"

Why - simply to carry the information the protocols require.

The required overhead is variable, often dependent on protocols being used and possibly specifically how the protocol is being used (its options).

Assuming you're aware of IP and/or TCP packet overheads, it's much the same for GRE and IPSec.  (Including, although not often encountered, IP and TCP overhead is variable too.)

A common application  GRE or IPSec, it's often applied to transit traffic, i.e. not at the source host.  Such applications, though, also have the common issue the transit packet cannot be sized increased without exceeding MTU.  For such situations, IP can often use its fragmentation feature to have a packet larger than MTU, which also adds its own overhead (with other "adverse" impacts).