GRE (protocol)

GRE (protocol)
Name	GRE (protocol)
Caption	Generic Routing Encapsulation header diagram
Introduced	1994
Standard	RFC 1701, RFC 2784, RFC 2890
Developer	Internet Engineering Task Force
Os	Cisco IOS, Juniper Junos, Linux kernel

GRE (protocol)

GRE is a tunneling protocol developed to encapsulate a wide variety of network layer protocols inside virtual point-to-point links over an IP network. Initially specified to support legacy protocol interoperability for systems such as Novell NetWare, Digital Equipment Corporation and early Sun Microsystems networks, GRE has since been adopted broadly across infrastructures run by vendors including Cisco Systems, Juniper Networks, and cloud providers like Amazon Web Services and Microsoft Azure. The protocol is standardized by the Internet Engineering Task Force and extended through multiple RFCs, providing a simple encapsulation mechanism used in conjunction with routing, VPN, and virtualization platforms.

Overview

GRE operates as a simple encapsulation method that wraps packets of one protocol family inside packets of another protocol family. GRE was first defined in RFC 1701 and evolved in RFC 2784 and RFC 2890 to address header fields and key/sequence semantics; these documents were produced under the auspices of the Internet Engineering Task Force. GRE is commonly implemented in commercial network operating systems from Cisco Systems and Juniper Networks as well as open-source stacks like the Linux kernel and FreeBSD. GRE enables interoperation with legacy systems from vendors such as Novell, Digital Equipment Corporation, and Sun Microsystems while integrating with modern network services from Amazon Web Services and Microsoft Azure. Network operators at organizations like Facebook, Google, and Netflix have used GRE for overlay experiments, hybrid cloud connectivity, and traffic engineering alongside protocols such as BGP and OSPF.

Protocol Operation

GRE encapsulates an inner payload by prepending a GRE header and carrying the result in an outer IP packet; at the outer layer, GRE is typically transported over IPv4 or IPv6. The encapsulation endpoint behavior is defined so that a GRE tunnel appears as a virtual point-to-point interface in routing suites such as Quagga, FRRouting, and vendor stacks like Cisco IOS and Juniper Junos. GRE supports optional fields—Key, Sequence Number, and Checksum—introduced and clarified across RFCs to support features like multipoint demultiplexing and reliable delivery when used with protocols such as MPLS and LDP. Control-plane interactions often involve dynamic routing protocols such as BGP, OSPF, and IS-IS running over the GRE tunnel interface to advertise network reachability between sites like those operated by AT&T and Verizon or between data centers used by Dropbox and Salesforce.

Packet Format and Encapsulation

The GRE header occupies a variable-length space beginning with a fixed 4-byte base header and optional fields defined by flag bits. The header layout and semantics are described in RFCs authored by the Internet Engineering Task Force and used in implementations from Cisco Systems and the Linux kernel. Key fields include Protocol Type (to indicate the encapsulated payload such as IPv4, IPv6, or EthernetII frames), optional Key for path identification used by service providers like AT&T or NTT Communications, Sequence Number for ordering in scenarios involving MPLS over GRE, and Checksum for error detection when interoperability with stacks like Juniper Junos is required. Encapsulation typically adds an IP header (IPv4 or IPv6) to carry GRE, so packet sizes interact with MTU constraints enforced in devices from Arista Networks, Hewlett Packard Enterprise, and Dell EMC.

Use Cases and Implementations

GRE is used for site-to-site tunnels, protocol multiplexing, mobility gateways, and overlay networks. Enterprises such as IBM and Oracle Corporation have deployed GRE for inter-data-center connectivity and legacy migration. Cloud providers like Amazon Web Services and Google Cloud Platform offer GRE-like tunnels or recommend GRE for legacy protocol transit when combined with IPsec for encryption. Network virtualization platforms from VMware and OpenStack can use GRE as an encapsulation option alongside alternatives such as VXLAN or NVGRE. Service provider architectures from Telefonica or Deutsche Telekom may combine GRE with MPLS and LDP for traffic separation. Open-source implementations include the Linux kernel ip_gre module, the Open vSwitch project, and routing daemons like FRRouting and Quagga.

Security Considerations

GRE provides no inherent confidentiality or integrity protection; it is purely an encapsulation mechanism standardized via the Internet Engineering Task Force. For secure deployments, operators combine GRE with IPsec or employ GRE within encrypted VPNs offered by Cisco Systems and Juniper Networks. GRE tunnels can be subject to spoofing, amplification, or traversal attacks if endpoints are not authenticated, and exposure has been observed in misconfigurations reported by vendors like Cisco and Juniper. Best practices promoted by organizations such as NIST recommend using authentication and encryption (for example, IPsec ESP) when sensitive traffic traverses untrusted networks like those operated by Comcast or across public internet exchanges such as LINX.

Performance and Scalability

GRE adds header overhead and influences MTU, leading to fragmentation if not accounted for by hosts or network devices from Arista Networks and Hewlett Packard Enterprise. Software-based GRE implementations in the Linux kernel or Open vSwitch may consume CPU cycles for high-throughput scenarios, prompting acceleration via hardware offload features in platforms from Intel Corporation and NVIDIA (Mellanox) NICs. Large-scale use in service-provider networks often pairs GRE with technologies for scale such as MPLS label stacking or overlay control planes used by operators like AT&T and Verizon. For cloud-scale deployments, teams at Google and Facebook have preferred encapsulations optimized for performance and scalability, sometimes replacing GRE with alternatives like VXLAN where large tenant counts and multicast scaling are primary concerns.

Category:Tunneling protocols