1

This is a general knowledge question I can't wrap my head around. I've set up many of IPSec tunnels throughout the years both for site-to-site and to direct internet traffic through a tunnel.

I just learned of "route based IPSec" and I've always done it policy based where you set the left and right subnets. These subnets explicitly appear in the IPSec SA.

The more I read about IPSec I've seen blog posts about IPSec over GRE and GRE over IPSec. What is the added benefit of the overhead of an additional header? I've always just routed traffic through tunnels without this and everything was fine

  • I think you may hit a better target audience at networkengineering.stackexchange.com – yoonix Sep 16 '16 at 5:26
  • IPSec can only be used to encrypt unicast packets. GRE is an encapsulation protocol which can transport unicast, multicast, broadcast or even non-IP protocols. So you might want to use a GRE tunnel to form routing neighborships between the main and branch offices and also use IPSec to secure the tunnel so that is encrypted and authenticated. – Mark Riddell Sep 16 '16 at 7:21
  • @MarkoPolo - I was under the assumption that the original IP header was "stuffed" into the encrypted payload of the IPSec packet, just like GRE does but GRE is obviously unencrpypted. Under this assumption GRE would make things redundant. – jdoe Sep 16 '16 at 15:02
  • IPSec Tunnel mode will indeed encrypt the entire IP packet including the original IP address. The original packet is encapsulated into a new set of headers. IPSec Transport mode does not encrypt the original IP header information. In either mode, IPSec can still only be used to encrypt Unicast packets which is why GRE is still useful - typically, you tunnel your packets within GRE and then encrypt the GRE packet with IPSEC. – Mark Riddell Sep 17 '16 at 14:11
  • @MarkoPolo - Why wold IPSec care though? Let's say the original packet has a src of 192.168.1.100 and a DST of 224.0.0.50 (some multicast address). How is this any different than a src of 192.168.1.100 and a dst of 10.5.50.50? The packet is fundamentally the same or am I missing something? – jdoe Sep 19 '16 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.