GRE with Static Routes

[visitor68]

The purpose of using GRE encapsiulation over IPSec is to allow multicast routing updates to flow between the hub and spoke routers.

Is there another purpose for running GRE with IPSec?

If only static routing is used, is there a need for GRE?

In a second set of questions...

If GRE is used, one can leverage DMVPN to facilitate configuration and adding spokes.

If GRE is not used, is there a mechanism native to IPSec to make the adding of spokes streamlined in the same way GRE streamlines the process?

Thanks

[Lei Tian]

Hi,

GRE can be used to support some legacy layer 3  protocols as well.

GETVPN doesnt require GRE, but it  will automatically create tunnel using the original IP header.

HTH,

Lei  Tian

[Federico Coto Fajardo]

GRE is encapsulation and IPsec is encryption (IPsec can also do encapsulation, but it is avoided when using GRE)
DMVPN facilitates the GRE tunnels in that it make it dynamic (you no longer need to define statically all the endpoint IP of the GRE devices)
GETVPN is a relative new technology which does not use GRE
VTI is another way to send multicast between routers.

Federico.

[visitor68]

I am looking for more specific and informative answers that address my questions. I already know what GRE and IPSec are.

[Federico Coto Fajardo]

I thought we pretty much gave you the answer, if you're looking for more detailed information shoot the question again with exactly what you want to know.

Federico.

[Laurent Aubert]

Hi,

The first implementation of IPSec within IOS (crypto-map based) doesn't support multicast traffic encapsulation so adding the GRE layer was the workaround so GRE encapsulate multicast and IPSec encrypt GRE packets which are unicast.

So yes this was the main purpose of having GRE on top of IPSec. The other advantage is you can encapsulate other protocol like IPX and transport it over an IP backbone.

With static routing, GRE layer is not mandatory but it will make your backup routing policy more complex (need to rely on IKE DPD and RRI) and globaly slower than having a dynamic routing protocol.

For Hub&Spoke topology, DVTI is a good alternative to mGRE. Configuration is similar to Dial-In based on virtual-template (each tunnel is associated to a virtual-access interface). Please refer to the following link for more information:

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtIPSctm.html

HTH

Laurent.

[visitor68]

Thanks, Laurent