2.2 Configure and verify data path virtualization technologies
📘CCNP Encore (350-401-ENCORE-v1.1)
Tunneling is a method of sending data from one network to another network securely or transparently, as if the two networks were directly connected, even when they are separated by intermediate networks like the Internet.
Two of the most important tunneling technologies are GRE (Generic Routing Encapsulation) and IPsec (IP Security).
1. GRE (Generic Routing Encapsulation)
Definition:
GRE is a tunneling protocol used to encapsulate packets from one protocol inside another protocol. Usually, it encapsulates IP packets inside another IP packet.
Key Points for Exam:
- GRE creates a virtual point-to-point link between two routers over an IP network.
- It can encapsulate any Layer 3 protocol, not just IPv4. This is why it’s flexible for IT networks.
- GRE does not provide encryption by itself — it only encapsulates the traffic.
Why use GRE in IT environments:
- Connect two private networks over the Internet.
- Carry routing protocols like OSPF or EIGRP across networks that normally wouldn’t pass these protocols.
GRE Header:
- GRE adds a small header to the original packet so the router at the other end knows how to decapsulate it.
- Overhead: GRE adds 24 bytes for IPv4, 38 bytes for IPv6.
GRE Configuration Example (simplified for exam):
On Router1:
interface Tunnel0
ip address 10.10.10.1 255.255.255.0
tunnel source 192.168.1.1
tunnel destination 192.168.2.1
On Router2:
interface Tunnel0
ip address 10.10.10.2 255.255.255.0
tunnel source 192.168.2.1
tunnel destination 192.168.1.1
Explanation:
tunnel sourceis the public IP of the local router.tunnel destinationis the public IP of the remote router.- Now both routers can send packets to each other through the tunnel, as if they were directly connected.
Exam Tip:
- Remember, GRE alone does not encrypt traffic. If the exam asks for security, GRE needs to be paired with IPsec.
2. IPsec (IP Security)
Definition:
IPsec is a protocol suite used to encrypt and secure IP packets over a network like the Internet.
Key Points for Exam:
- Provides confidentiality, integrity, and authentication:
- Confidentiality: Encrypts data so no one can read it.
- Integrity: Ensures data is not modified in transit.
- Authentication: Confirms the identity of the devices sending the data.
- Operates in two modes:
- Transport Mode: Encrypts only the payload (useful for end-to-end communication between hosts).
- Tunnel Mode: Encrypts the entire original packet (used between gateways/routers, common in site-to-site VPNs).
Why use IPsec in IT environments:
- Securely connect branch offices over the Internet.
- Protect sensitive data like customer information or internal communications.
IPsec Components:
- IKE (Internet Key Exchange): Negotiates keys for encryption.
- ESP (Encapsulating Security Payload): Provides encryption and optional integrity.
- AH (Authentication Header): Provides integrity only (less common now).
Exam Tip: Remember: IPsec always provides security, GRE does not.
3. GRE over IPsec (GRE+IPsec)
Definition:
- When you combine GRE and IPsec, you get both flexibility and security:
- GRE allows you to encapsulate routing protocols.
- IPsec encrypts the GRE tunnel to secure the traffic.
Why use GRE+IPsec:
- OSPF, EIGRP, or BGP cannot be encrypted by IPsec alone if directly applied to the original packet.
- GRE carries the routing traffic, IPsec encrypts the GRE packets.
Configuration Concept (Exam-level simplified):
- Configure GRE tunnel between routers.
- Apply IPsec to encrypt GRE traffic (site-to-site VPN).
Exam Tip:
- For exam questions: If the question asks about routing protocol over a secure connection, the correct answer is usually GRE over IPsec.
4. Verification Commands (Important for Exam)
- Check the GRE tunnel status:
show ip interface brief
show ip route
ping <tunnel-endpoint-IP>
- Check IPsec VPN status:
show crypto isakmp sa
show crypto ipsec sa
Tip: Look for active tunnels and encrypted packets to confirm functionality.
5. Key Exam Points to Remember
| Topic | Key Points |
|---|---|
| GRE | Encapsulates packets, no encryption, supports multiple protocols, flexible. |
| IPsec | Encrypts data, provides integrity and authentication, secure over Internet. |
| GRE + IPsec | Encapsulates + secures routing protocols, commonly used in branch-office VPNs. |
| Modes | Tunnel mode (full packet encryption) vs Transport mode (payload only). |
| Verification | show ip interface brief, ping, show crypto ipsec sa, show crypto isakmp sa. |
✅ Summary for the Exam:
- GRE: Flexible tunneling, no encryption.
- IPsec: Secure tunneling, encryption, integrity, authentication.
- GRE + IPsec: Combines flexibility and security, used for site-to-site VPNs carrying routing protocols.
- Know configuration basics, purpose, and verification commands.
- Remember GRE adds overhead, IPsec encrypts data.
