What is GRE?

Generic Routing Encapsulation (GRE) is a lightweight tunneling protocol that wraps packets from one network-layer protocol inside another, letting traffic – including non-IP protocols – cross an intermediate network such as the internet. GRE adds no encryption of its own, so it is often paired with IPsec, or used alone where confidentiality is not required.

Key takeaways

• GRE wraps one network-layer protocol’s packets inside another for transit.
• It adds no encryption by itself – pair it with IPsec for confidentiality.
• VOS supports point-to-point, point-to-multipoint, and Ethernet-over-GRE tunnels.
• A GRE key separates multiple tunnels that share the same endpoints.
• Cloud providers like AWS Transit Gateway offer GRE as a tunnel protocol.

On this page: Why it matters · How it works · Types · GRE & Versa · FAQ

Why is GRE important?

GRE predates most modern VPN technology and remains a simple way to build a routable tunnel between two points on an IP network. Because it is stateless – no negotiation, no session setup – it deploys with almost no overhead and works even when the payload isn’t IP, from legacy protocols to bridged Ethernet frames.

That simplicity also makes GRE useful as infrastructure. Unlike a policy-based IPsec tunnel, a GRE tunnel is a real virtual interface, so a routing protocol can run over it to advertise reachability dynamically. Cloud providers exploit this directly: AWS Transit Gateway and other cloud transit hubs offer GRE alongside IPsec so a remote device can peer with BGP across the tunnel – which is why GRE still shows up throughout cloud, carrier, and SD-WAN designs decades after it was defined.

What is GRE?

A GRE tunnel wraps each original packet in a GRE header – which records the encapsulated protocol type and, optionally, a key and sequence number – and then in a new outer IP header addressed to the remote tunnel endpoint. The receiving device strips both headers and forwards the original packet as if it had arrived natively, so the tunnel behaves like a single hop regardless of the real routers between the endpoints.

GRE itself carries no cryptographic state: no authentication, no encryption, no integrity check. Two endpoints simply agree on source and destination addresses and start encapsulating; there is no equivalent of IKE negotiating keys first. That is by design – GRE is a delivery mechanism, not a security protocol – which is why designers layer IPsec underneath GRE whenever the path isn’t already trusted.

Types of GRE tunnels

Point-to-point GRE connects exactly two fixed endpoints over IPv4 and is the most common form – a single source and destination address define the tunnel. Point-to-point IPv6 GRE is the same model over an IPv6 delivery network. Ethernet over GRE bridges Layer 2 frames rather than routed packets, supporting VLAN-tagged subinterfaces; it’s used, among other things, to backhaul mobility traffic through low-end residential gateways.

Point-to-multipoint GRE lets a single tunnel interface reach many remote endpoints instead of one fixed peer, using NHRP (Next Hop Resolution Protocol) to map each peer’s address dynamically rather than hardcoding every destination. A GRE key ties the model together: an optional identifier in the GRE header that separates multiple tunnels sharing the same source and destination addresses, so a device terminating several tunnels to one peer can still tell them apart.

GRE & Versa

VOS configures GRE as a tunnel (tvi) interface with four supported types: point-to-point GRE, point-to-point IPv6 GRE, Ethernet-over-GRE, and point-to-multipoint GRE, the last built on static NHRP mapping. Each tunnel takes a source and destination address, a routing instance, an MTU, and an optional GRE key; point-to-multipoint GRE additionally maps a remote router’s loopback to its NBMA transport address so VOS builds the tunnel and host route automatically, carrying MPLS-over-GRE encapsulation for L3VPN data. Full field-by-field steps are in Configure Interfaces.

Beyond device interfaces, Site-to-Site Tunnels workflows let a VOS CPE device build GRE tunnels to cloud and third-party peers as an alternative to IPsec: AWS Transit Gateway supports GRE with BGP peering across it, and Zscaler GRE tunnels are provisioned as a redundant pair for branch connectivity.

Frequently asked questions

What is the difference between GRE and IPsec?

GRE encapsulates packets but does not encrypt or authenticate them; IPsec encrypts and authenticates but is policy-based rather than a routable interface. Many deployments combine both – GRE over IPsec – for a routable tunnel with IPsec’s confidentiality and integrity guarantees.

Does GRE encrypt traffic?

No. GRE only encapsulates packets for delivery; it provides no confidentiality, integrity checking, or authentication. Traffic sent over a plain GRE tunnel is as visible to intermediate networks as unencapsulated traffic, which is why sensitive traffic is usually layered with IPsec.

What is a GRE key used for?

A GRE key is an optional field in the GRE header that identifies a tunnel when multiple tunnels share the same source and destination addresses. It lets the receiving device distinguish which logical tunnel an arriving packet belongs to, without relying on addressing alone.

Can GRE carry non-IP traffic?

Yes. GRE encapsulates traffic from any network-layer protocol, not just IP, which is part of why it predates and outlives many special-purpose tunneling schemes. Ethernet-over-GRE takes this further, bridging Layer 2 frames – including VLAN-tagged traffic – inside the tunnel.

What is point-to-multipoint GRE?

Point-to-multipoint GRE lets one tunnel interface reach several remote endpoints instead of a single fixed destination, using NHRP to map each peer’s address dynamically as devices join. It underlies hub-and-spoke and mesh designs where the remote destination isn’t known in advance.

More on GRE

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about GRE, these are worth looking at next.