GRE tunnels on Cisco IOS: configuration, MTU and common problems

What GRE does

GRE (Generic Routing Encapsulation, RFC 2784) is a simple tunnelling protocol. A router takes a packet, adds a small GRE header, then adds a new IP header addressed to the router at the far end of the tunnel. The network in between (often the internet) only sees the outer header and forwards it like any other packet. At the far end, the outer headers are removed and the original packet continues on its way.

The result is a virtual point-to-point link, called a tunnel interface, that behaves like a real cable. You can give it IP addresses, run OSPF or EIGRP over it, and send multicast or even non-IP traffic across it. Plain IPsec tunnels traditionally could not carry multicast, which is one reason GRE stayed popular.

Configuring a tunnel on Cisco IOS

Each end needs a tunnel interface with an inside address, a source (a local interface or address) and a destination (the far router's public address). The two ends must mirror each other.

interface Tunnel0
 description GRE to Branch
 ip address 172.16.99.1 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/0/0
 tunnel destination 203.0.113.20
 keepalive 5 3
router ospf 1
 network 172.16.99.0 0.0.0.3 area 0
 network 10.1.0.0 0.0.255.255 area 0

The default tunnel mode is GRE over IPv4, so tunnel mode gre ip rarely needs typing. Check it with show interfaces tunnel 0 and show ip ospf neighbor. A tunnel interface comes up as soon as the router has a route to the destination, even if the far end is missing; keepalive makes the interface go down when replies stop.

MTU, fragmentation and MSS

GRE adds 24 bytes (20 for the new IP header and 4 for the basic GRE header). A full 1500-byte packet no longer fits through a 1500-byte internet path, so it must be fragmented or dropped. Fragmentation costs router CPU and breaks some applications. Two settings prevent this:

• ip mtu on the tunnel tells the router the largest inner packet the tunnel can carry. 1476 is the GRE minimum reduction; 1400 is a common safe value that also leaves room for IPsec.
• ip tcp adjust-mss rewrites the maximum segment size in TCP handshakes, so hosts send smaller segments in the first place. Set it to the tunnel MTU minus 40.

Also make sure firewalls allow ICMP "fragmentation needed" messages, or path MTU discovery fails silently.

Recursive routing and other traps

The router must reach the tunnel destination through the real network. If a routing protocol running inside the tunnel advertises the destination's public network, the router may decide the best way to reach the far end of the tunnel is through the tunnel itself. That loop makes the tunnel flap, and IOS logs a "recursive routing" error. Prevent it by keeping public addresses out of the routing protocol that runs over the tunnel, or by using a static route to the tunnel destination via the physical next hop.

Other common problems: the outer traffic is blocked (GRE is IP protocol 47, not TCP or UDP, so a firewall or NAT device must allow it), the source and destination do not mirror each other, or the tunnel subnet does not match.

Security: GRE does not encrypt or authenticate anything. Across the internet, protect it with IPsec ("GRE over IPsec"), or use designs such as DMVPN or SD-WAN that combine tunnels with encryption. See VPNs and site-to-site IPsec.

Real-world example: a temporary routed link

A veterinary group bought a second practice whose router sat on a business broadband line. The IT contractor needed the new site's subnets in the group's OSPF domain within a week, before the SD-WAN rollout reached it. She built a GRE tunnel between the two routers, protected with an IPsec profile, set the tunnel MTU to 1400 and the MSS to 1360, and added a static route for the head office's public address via the broadband gateway so the tunnel destination was never learnt through OSPF. OSPF came up over the tunnel, the practice management system worked, and three months later the tunnel was removed when the SD-WAN edge arrived.