GRE tunnels on Cisco IOS: configuration, recursive routing, tunnel keys and MTU

What GRE does

Generic Routing Encapsulation (GRE, IP protocol 47) puts one packet inside another. Two routers each create a tunnel interface that behaves like a point-to-point link, even though the real path crosses an ISP or a corporate WAN. Because a tunnel looks like an ordinary interface, you can run OSPF or EIGRP over it, carry multicast and non-IP payloads, and route private addresses across a network that does not know them.

Basic configuration

! HQ router
interface Tunnel0
 description GRE to Branch 1
 ip address 172.31.0.1 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 keepalive 10 3
 tunnel source GigabitEthernet0/1
 tunnel destination 203.0.113.20
router ospf 1
 network 172.31.0.0 0.0.0.3 area 0
 network 10.1.0.0 0.0.255.255 area 0
! Branch router mirrors this with source and destination swapped

The tunnel source and destination are the outside (transport) addresses the routers can already reach. The tunnel's own IP address is an inside address in a small subnet used only for the tunnel. The tunnel interface comes up as soon as the router has a route to the destination, even if the far end is not configured, so add keepalive to make it go down when the other side stops answering. Check with show interfaces tunnel 0 and a ping to the far tunnel address.

Lowering the MTU to 1400 and clamping the TCP MSS leaves room for the extra headers, including IPsec if you add it later (see MTU, MSS and PPPoE).

Recursive routing

A common mistake is to let a routing protocol over the tunnel advertise the network that contains the tunnel destination. The router then learns that the best way to reach 203.0.113.20 is through Tunnel0. To send anything through Tunnel0, it must reach 203.0.113.20, which is through Tunnel0, and so on. IOS detects this loop, logs that the tunnel is temporarily disabled due to recursive routing, and brings the interface down. When the route disappears the tunnel comes up again, and the cycle repeats, so the tunnel flaps.

Fixes:

• Do not advertise the transport (outside) networks into the routing protocol running over the tunnel; use separate address ranges and precise network statements.
• Add a static route for the tunnel destination via the physical next hop, which has a lower administrative distance than the dynamic route.
• Filter the transport prefix with a distribute list on the tunnel.

Tunnel keys and multiple tunnels

A router can have many tunnels with the same source address. The optional tunnel key adds a number to the GRE header so the receiver can tell which tunnel a packet belongs to when source and destination alone are not enough, for example two tunnels between the same pair of addresses. Both ends must use the same key.

interface Tunnel1
 tunnel key 1001

The key is sent in clear text. It is an identifier, not a password, and gives no security.

Security and where GRE is used today

GRE provides no encryption or authentication. Across the internet it is almost always protected with IPsec, either GRE over IPsec or a virtual tunnel interface (VTI) that combines both (see VPNs and IPsec). Multipoint GRE (mGRE) is the basis of DMVPN, and GRE is also used to carry ERSPAN traffic and in many cloud and SD-WAN overlays.

Real-world example: a chain of dental surgeries linked each practice to head office with GRE over IPsec and OSPF. After a change, the tunnel to one practice went up and down every minute. The log showed recursive routing messages: the practice had started advertising its whole internet-facing /29, which included the head office tunnel destination, into OSPF. The engineer removed that network statement and added a static host route to the head office public address via the ISP. The tunnel stabilised and patient records synced again.