IPSec over GRE vs GRE over IPSec

[UCrypto]

Dear All,

May I know pros and cons for two type of VPN for data connectivity. if we want to carry video streaming over VPN , which one is the best solution without pixelated ?

[Philip D'Ath · Accepted solution]

People only do GRE over IPSec.  GRE provides the system with something that looks like a routable interface.

You would just use IPSEC, and not IPSEC over GRE.  IPSEC over GRE would gain you nothing (compared to just IPSec) and add extra processing and overhead.

[UCrypto]

Hi Philip D'Ath,
Thanks ,I would like to know which one can get good quality video stream between GRE over IPSec and IPSec only ?

[Philip D'Ath]

IPSec only will have the least overhead.

[UCrypto]

Hi Philip D'Ath,
May i know if i use IPSec ,what is the best practice of tunnel MTU size ? If i use IPsec encryption with ESP-AES-256, it will take 73 bytes . 20 for IP Header . So 1500 -73=1427 - 20 = 1407 . Do we need to set MTU 1400 ? Am i Right?

[Philip D'Ath]

I'd go with 1400 as you have suggested.

[UCrypto]

We need to secured connectivity and want to carry video traffic only. video traffic are unicast traffic and using RTSP protocol .our bandwidth is 100 M .May i know if i have 10 VPN link and i would like to know packet loss of only one VPN link ,can i check in router ? how can i see which traffic is drop and with traffic is passed ?

[Philip D'Ath]

VPNs don't usually do so well with packet loss. If it gets to bad you'll sell the VPN flapping up and down.