What is the difference between a GRE tunnel and IPsec tunnel?

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Wireless networking How radio frequency (RF) of microwaves alter wireless signal strength Stolen laptop recovery using remote access and wireless network SSIDs How is wireless access point (AP) coverage affected by frequency? Wireless AP SSID and channel configuration for a distribution network How 802.11n wireless APs in Greenfield mode affect nearby networks Monitoring your network to detect rogue access points (APs) Will 802.11x wireless products be compatible with 802.11n? How to find an SSID and identify neighboring WLANs How to create a Wi-Fi hotspot How to stop channel interference on 802.11x wireless access points IP Networking What is IP? Connect your LAN to the Internet using static or dynamic NAT Using tracert and TTL to troubleshoot network connectivity problems Test your TCP/IP protocol stack to troubleshoot network connectivity Checking IP configuration to troubleshoot Windows network connectivity Does IPv6 abandon TCP/IP fragmentation? VLANs versus IP subnets: Why use a VLAN over IP subnetting? Difference between circuit-switching and packet-switching in examples Can Network Address Translation work without static IP addresses? Why are TCP/IP networks considered unsecured?

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary 32-bit IP addressing  (SearchNetworking.com) fixed-length subnet mask  (SearchNetworking.com) GARP (Generic Attribute Registration Protocol)  (SearchNetworking.com) route aggregation  (SearchNetworking.com) route summarization  (SearchNetworking.com) routing table  (SearchNetworking.com) subnet  (SearchNetworking.com) subnet mask  (SearchNetworking.com) variable-length subnet mask  (SearchNetworking.com) wildcard mask  (SearchNetworking.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

Generic Routing Encapsulation (GRE), defined by RFC 2784, is a simple IP packet encapsulation protocol. GRE is used when IP packets need to be sent from one network to another, without being parsed or treated like IP packets by any intervening routers.

For example, in Mobile IP, a mobile node registers with a Home Agent. When the mobile node roams to a new network, it registers with a Foreign Agent there. Whenever IP packets addressed to the mobile node are received by the Home Agent, they can be relayed over a GRE tunnel to the Foreign Agent for delivery. It does not matter how the Home Agent and Foreign Agent communicate with each other -- hops in between just pass along the GRE packet. Only the GRE tunnel endpoints -- the two Agents -- actually route the encapsulated IP packet.

The IP Security (IPsec) Encapsulating Security Payload (ESP), defined by RFC 2406, also encapsulates IP packets. However, it does so for a different reason: to secure the encapsulated payload using encryption. IPsec ESP is used when IP packets need to be exchanged between two systems while being protected against eavesdropping or modification along the way.

For example, in a site-to-site VPN, a source host in network "A" transmits an IP packet. When that packet reaches the edge of network "A" it hits a VPN gateway. VPN gateway "A" encrypts the private IP packet and relays it over an ESP tunnel to a peer VPN gateway at the edge of network "B." VPN gateway "B" then decrypts the packet and delivers it to the destination host. Like GRE, it doesn't really matter how the two VPN gateways communicate with each other -- hops in between just pass along the ESP packet. But unlike GRE, someone at those hops could not possibly look at or change the encapsulated IP packet, even if they wanted to. That's because cryptographic algorithms have been applied to scramble the IP packet and detect any modification or replay.

In summary, use GRE where IP tunneling without privacy is required -- it's simpler and thus faster. But use IPsec ESP where IP tunneling and data privacy are required -- it provides security features that are not even attempted by GRE.