IPsec over GRE vs GRE over IPsec
"IPsec over GRE" and "GRE over IPsec" sound like the same thing said two ways. They are not. They are two different designs with the encapsulation layers stacked in the opposite order, and the order changes
GRE
Generic Routing Encapsulation, the simple tunneling protocol that sits behind countless enterprise overlays. Articles tagged GRE cover how it works, packet format, Cisco IOS XE configuration, keepalives, MTU, GRE over IPsec, and routing protocol support.
Latest posts
IPv6 over IPv4 Tunnels: Manual, GRE, and 6to4 Compared
Sometimes you have IPv6 islands that need to talk to each other, but the network in between is IPv4-only and you cannot change it (a provider core, a legacy WAN, a merged network you do not fully control). The
GRE over IPsec: Why Tunnels and Encryption Belong Together
Configure GRE over IPsec on Cisco IOS XE with IKEv2 and IPsec profiles. Modern and legacy configs, MTU planning, OSPF over the tunnel, and gotchas.
Troubleshooting DMVPN: NHRP, Tunnel State, and Spoke-to-Spoke Failures
DMVPN failures cluster hard. After the underlay itself, almost every broken cloud comes down to a spoke that cannot register, a tunnel that is up/up while silently eating packets, or shortcuts that never form. So instead of writing another
Securing DMVPN with IPsec Profiles (IKEv2)
Everything DMVPN sends is cleartext. GRE is an envelope with the contents printed on the outside, and a DMVPN cloud over the internet without encryption is a packet capture away from a very bad week. The fix is IPsec applied
Routing Over DMVPN: EIGRP and OSPF Design Choices
NHRP builds the tunnels; the routing protocol decides what flows through them, and DMVPN is unusually opinionated about how you run one. A hub that relays routes between spokes on a single multipoint interface trips over split horizon, next-hop
DMVPN Phase 3 Configuration on Cisco IOS XE
This is the complete, working DMVPN Phase 3 build: one hub, two spokes, a router simulating the internet underlay, EIGRP over the top, every command shown and every verification step captured from live IOS XE 17.18 devices. Nothing here
DMVPN Phase 1 vs Phase 2 vs Phase 3: What Actually Changes
Ask what separates DMVPN Phase 1 from Phase 2 from Phase 3 and you will usually get a memorized answer: "Phase 1 is hub-and-spoke, Phase 2 adds spoke-to-spoke, Phase 3 adds redirects." True, and
NHRP Deep Dive: Registration, Resolution, and Redirects
Every interesting thing DMVPN does, it does with NHRP. Spokes appearing on the hub without configuration? NHRP registration. Spoke-to-spoke tunnels forming on demand? NHRP resolution. Phase 3's ability to summarize routes and still cut hub-free
DMVPN Explained: mGRE + NHRP + Routing in One Overlay
DMVPN has a reputation for being complicated, and it is entirely undeserved. The technology is three well-understood pieces (multipoint GRE, NHRP, and a routing protocol) assembled so that each covers a gap the others leave. Once you can say
GRE on Linux: ip tunnel add Commands and Examples
Configure GRE tunnels on Linux with ip tunnel add. Cisco-to-Linux interop, MTU, MSS clamping, IPsec, gretap (L2), and persistence with systemd-network
GRE Tunnel Troubleshooting: Recursive Routing and Five More Failures
The field guide for GRE failures on Cisco IOS XE, rebuilt around a real CML capture of a recursive-routing flap. The %ADJ-5-PARENT looped chain that lands just before %TUN-5-RECURDOWN, the administrative distance comparison that causes it, and three fixes: a static /32, filtering the transport...