Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

GRE Tunnel Key Support

Learn about GRE tunnel key, its benefits, and configuration.

Generic Routing Encapsulation (GRE) is a tunneling protocol used to transport packets from one network to another securely and efficiently. The GRE creates a virtual point-to-point link to safely route incompatible protocols, multicast traffic, or private IP addresses across an intermediary network such as the Internet.

Configuring GRE between two routers, encapsulates the original data packet carrying the actual payload inside two additional headers:

  • IP header
  • GRE header

IP header is a routable public IPv4/IPv6 header applied to the GRE packet so it can travel across the physical transit network.

The GRE header contains:

  • A 4-bit "Version" field (always 0)
  • A 4-bit "Flags" field (with bits for checksum, routing, key, sequence, etc.)
  • A 16-bit "Protocol Type" field (indicating the payload's Ethertype)
  • An optional 32-bit "Key" field
  • An optional 32-bit "Sequence Number" field

SRX devices support GRE tunneling between endpoints based on source IP and destination IP. SRX devices process each GRE tunnel based on the source IP, destination IP tuple. SRX devices do not include GRE headers or insert GRE keys into outbound packets. As a result, multiple GRE tunnels between identical endpoint IPs cannot be differentiated.

Enabling GRE key support includes a 32-bit key field in each GRE header. Routers at the far end can match the key during both transmission and reception. This functionality enables the following capabilities:

  • Differentiate multiple GRE tunnels: Two GRE tunnels with identical source and destination IPs can be distinguished using unique GRE keys.
  • Verification: Adds keys to outgoing GRE packets and validates keys in incoming GRE packets.

Limitation

When configuring the same source and destination IP, then routing-instance destination should be different.

The GRE key is not used for multiplexing; VR ID continues to control demultiplexing.

Configuration and Verification

Enable keyed GRE by configuring the key per GRE logical interface along with the tunnel source and destination.

set interfaces gr-0/0/0 unit 0 tunnel source <src-ip>

set interfaces gr-0/0/0 unit 0 tunnel destination <dst-ip>

set interfaces gr-0/0/0 unit 0 tunnel key <key>

set interfaces gr-0/0/0 unit 0 tunnel routing-instance destination <VR1>

set interfaces gr-0/0/0 unit 0 family inet address <ip-address>

set interfaces gr-0/0/0 unit 1 tunnel source <src-ip>

set interfaces gr-0/0/0 unit 1 tunnel destination <dst-ip>

set interfaces gr-0/0/0 unit 1 tunnel key <key>

set interfaces gr-0/0/0 unit 1 tunnel routing-instance destination <VR2>

set interfaces gr-0/0/0 unit 1 family inet address <ip-address>

Example: