Comparing GRE and IPSec

Tunneling provides a mechanism to transport packets of one protocol within another protocol.

The protocol that is carried is called as the passenger protocol, and the protocol that is used for carrying the passenger protocol is called as the transport protocol.

The tunnels behave as virtual point-to-point links that have two endpoints identified by the tunnel source and tunnel destination addresses at each endpoint.

Tunnel feature is implemented as a virtual interface to provide a simple interface for configuration.

The tunnel interface is not tied to specific "passenger" or "transport" protocols, but rather, it is an architecture that is designed to provide the services necessary to implement any standard point-to-point encapsulation scheme. Each tunnel is confiured as a seperate point-to-point link.

Tunneling has the following three primary components:

• Passenger protocol, which is the protocol you are encapsulating (AppleTalk, Banyan VINES, CLNS, DECnet, IP, or IPX)
• Carrier protocol, which is one of the following encapsulation protocols:
  • Generic route encapsulation (GRE), Cisco's multiprotocol carrier protocol
  • Cayman, a proprietary protocol for AppleTalk over IP
  • EON, a standard for carrying CLNP over IP networks
  • NOS, IP over IP compatible with the popular KA9Q program
  • Distance Vector Multicast Routing Protocol (DVMRP) (IP in IP tunnels, defined by RFC 20036)
• Transport protocol, which is the protocol used to carry the encapsulated protocol (IP only)

Generic Routing Encapsulation (GRE) is one of the available tunneling mechanisms which uses IP as the transport protocol and can be used for carrying many different passenger protocols.

Generic Routing Encapsulation (GRE), defined by RFC 2784, is a simple IP packet encapsulation protocol. GRE is used when IP packets need to be sent from one network to another, without being parsed or treated like IP packets by any intervening routers.

For example, in Mobile IP, a mobile node registers with a Home Agent. When the mobile node roams to a new network, it registers with a Foreign Agent there. Whenever IP packets addressed to the mobile node are received by the Home Agent, they can be relayed over a GRE tunnel to the Foreign Agent for delivery. It does not matter how the Home Agent and Foreign Agent communicate with each other; hops in between just pass along the GRE packet. Only the GRE tunnel endpoints i.e., the two Agents actually route the encapsulated IP packet.

The IP Security (IPsec) Encapsulating Security Payload (ESP), defined by RFC 2406, also encapsulates IP packets. However, it does so for a different reason: to secure the encapsulated payload using encryption. IPsec ESP is used when IP packets need to be exchanged between two systems while being protected against eavesdropping or modification along the way.

For example, in a site-to-site VPN, a source host in network "A" transmits an IP packet. When that packet reaches the edge of network "A," it hits a VPN gateway. VPN gateway "A" encrypts the private IP packet and relays it over an ESP tunnel to a peer VPN gateway at the edge of network "B." VPN gateway "B" then decrypts the packet and delivers it to the destination host. Like GRE, it doesn't really matter how the two VPN gateways communicate with each other; hops in between just pass along the ESP packet. But unlike GRE, someone at those hops could not possibly look at or change the encapsulated IP packet, even if they wanted to. That's because cryptographic algorithms have been applied to scramble the IP packet and detect any modification or replay.

Network redundancy (resiliency) is an important consideration in the decision to use GRE tunnels, IPSec tunnels, or tunnels which utilize IPSec over GRE. GRE can be used in conjunction with IPSec to pass routing updates between sites on an IPSec VPN. GRE encapsulates the clear text packet, then IPSec (in transport or tunnel mode) encrypts the packet.This packet flow of IPSec over GRE enables routing updates, which are generally multicast, to be passed over an encrypted link. IPSec alone can not achieve this, because it does not support multicast.

GRE (protected by IPSec) allows configuring redundant GRE tunnels from a remote site router to redundant headquarter routers. Routing protocols can be employed to delineate the "primary" and "secondary" headquarter routers. Upon loss of connectivity to the primary router, routing protocols will discover the failure and route to the secondary gateway, thereby providing network redundancy.

In summary, use GRE where IP tunneling without privacy is required; it's simpler and thus faster. But use IPsec ESP where IP tunneling and data privacy are required. Use GRE and IPSec together in scenarios when in need of privacy and propagating routing updates over the tunnel for network resilience.