tunnel mode gre ip
Configures a tunnel interface to use Generic Routing Encapsulation (GRE) as the tunnel mode, enabling the transport of multiprotocol packets over an IP network.
Definition: tunnel mode gre ip is a Cisco IOS interface config command. Configures a tunnel interface to use Generic Routing Encapsulation (GRE) as the tunnel mode, enabling the transport of multiprotocol packets over an IP network.
Overview
The `tunnel mode gre ip` command is a fundamental configuration for building VPN tunnels in Cisco IOS. It sets the encapsulation protocol for a tunnel interface to Generic Routing Encapsulation (GRE), which is a simple, stateless tunneling protocol that can encapsulate a wide variety of network layer protocols (e.g., IPv4, IPv6, IPX, AppleTalk) inside IP packets. GRE is widely used for connecting remote sites over the public internet, creating overlay networks, or enabling routing protocols like OSPF and EIGRP to run across non-contiguous networks.
Unlike IPsec, GRE does not provide encryption or authentication; it is often combined with IPsec to secure the tunnel. The command is entered in interface configuration mode for a tunnel interface (e.g., interface Tunnel0). When you apply this command, the tunnel interface will use GRE as the transport protocol, meaning that packets entering the tunnel are encapsulated with a GRE header and then an outer IP header.
The source and destination of the outer IP header are defined by the `tunnel source` and `tunnel destination` commands. GRE tunnels are point-to-point by default, but multipoint GRE (mGRE) is possible with `tunnel mode gre multipoint`. This command is essential for network engineers building site-to-site VPNs, DMVPN, or transporting non-IP traffic.
It is typically used when you need to carry multicast or broadcast traffic (e.g., routing protocol hellos) across a unicast-only network, which IPsec alone cannot do. Alternatives include IPsec tunnel mode (which provides encryption but is more complex and does not support multiprotocol), VXLAN (for data center overlays), or L2TPv3 (for Layer 2 extensions). The command is available in all IOS privilege levels (user EXEC can view, but configuration requires privileged EXEC).
It immediately affects the running configuration; no reload is needed. A common mistake is forgetting to configure the tunnel source and destination, or mismatching the tunnel mode on both ends. The command is supported in IOS, IOS-XE, and IOS-XR (with slight syntax differences).
Understanding GRE is critical for CCNA and CCNP candidates as it appears in VPN and routing protocol redistribution scenarios.
tunnel mode gre ipWhen to Use This Command
- Connecting two remote private networks over the internet using a GRE tunnel to route non-IP protocols or multicast traffic.
- Creating a site-to-site VPN overlay without encryption, often combined with IPsec for secure communication.
- Enabling dynamic routing protocols like OSPF or EIGRP between two sites across a public network.
- Transporting IPv6 traffic over an IPv4-only infrastructure.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| gre | gre | Specifies Generic Routing Encapsulation as the tunnel mode. This is the default mode for tunnel interfaces. It allows encapsulation of multiprotocol traffic inside IP packets. No additional parameters are needed for basic GRE. |
| ip | ip | Indicates that the delivery protocol (outer header) is IP. This is the only option for GRE tunnels in IOS. It must be specified after 'gre'. The full command is 'tunnel mode gre ip'. |
Command Examples
Basic GRE Tunnel Configuration
interface Tunnel0
ip address 10.0.0.1 255.255.255.252
tunnel source 192.168.1.1
tunnel destination 203.0.113.1
tunnel mode gre ipRouter(config)#interface Tunnel0 Router(config-if)#ip address 10.0.0.1 255.255.255.252 Router(config-if)#tunnel source 192.168.1.1 Router(config-if)#tunnel destination 203.0.113.1 Router(config-if)#tunnel mode gre ip Router(config-if)#end Router#
The command sequence creates a GRE tunnel interface (Tunnel0) with an IP address 10.0.0.1/30. The tunnel source is set to the local physical interface IP (192.168.1.1), and the destination is the remote peer's public IP (203.0.113.1). The 'tunnel mode gre ip' command explicitly sets the encapsulation to GRE over IPv4.
Verifying GRE Tunnel Status
show interfaces tunnel 0Tunnel0 is up, line protocol is up
Hardware is Tunnel
Internet address is 10.0.0.1/30
MTU 1476 bytes, BW 100 Kbit/sec, DLY 50000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source 192.168.1.1, destination 203.0.113.1
Tunnel protocol/transport GRE/IP
Key disabled, sequencing disabled
Checksumming of packets disabled
Tunnel TTL 255
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped outThe output shows the tunnel interface status: 'Tunnel0 is up, line protocol is up' indicates the tunnel is operational. The MTU is reduced to 1476 bytes due to GRE overhead. The tunnel source and destination IPs are displayed. 'Tunnel protocol/transport GRE/IP' confirms the mode. Key fields to monitor: interface status, MTU, and packet counters for errors.
Understanding the Output
The 'show interfaces tunnel X' command displays the status and configuration of a GRE tunnel. Key fields include: 'TunnelX is up, line protocol is up' – both must be 'up' for the tunnel to function. 'Internet address' shows the tunnel IP.
'MTU' is typically 1476 bytes (1500 minus 24 bytes GRE+IP header). 'Tunnel source/destination' shows the physical endpoints. 'Tunnel protocol/transport GRE/IP' confirms the mode.
'Input/output rate' indicates traffic load. Error counters like 'input errors', 'CRC', 'output errors' should be zero; non-zero values indicate problems. 'Reliability 255/255' is ideal; lower values suggest packet loss.
'txload/rxload' show bandwidth utilization (1/255 is minimal).
Configuration Scenarios
Site-to-Site GRE Tunnel with OSPF Routing
Two branch offices need to exchange internal routing information securely over the internet. A GRE tunnel provides a virtual point-to-point link, and OSPF runs over it to dynamically exchange routes.
Topology
R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2
R1(Tunnel0)---172.16.0.0/30---(Tunnel0)R2Steps
- 1.Step 1: Configure physical interfaces with IP addresses and ensure reachability.
- 2.Step 2: Create tunnel interfaces on both routers.
- 3.Step 3: Set tunnel mode to GRE IP.
- 4.Step 4: Configure tunnel source and destination using the physical interface IPs.
- 5.Step 5: Assign an IP address to the tunnel interface (from a private subnet).
- 6.Step 6: Enable OSPF on the tunnel interface.
- 7.Step 7: Verify OSPF adjacency and routing table.
! R1 Configuration interface GigabitEthernet0/0 ip address 10.0.12.1 255.255.255.252 no shutdown ! interface Tunnel0 ip address 172.16.0.1 255.255.255.252 tunnel mode gre ip tunnel source GigabitEthernet0/0 tunnel destination 10.0.12.2 ! router ospf 1 network 172.16.0.0 0.0.0.3 area 0 ! ! R2 Configuration interface GigabitEthernet0/0 ip address 10.0.12.2 255.255.255.252 no shutdown ! interface Tunnel0 ip address 172.16.0.2 255.255.255.252 tunnel mode gre ip tunnel source GigabitEthernet0/0 tunnel destination 10.0.12.1 ! router ospf 1 network 172.16.0.0 0.0.0.3 area 0
Verify: Use 'show ip ospf neighbor' to verify OSPF adjacency (should show FULL state). Use 'show ip route' to see routes learned via OSPF over the tunnel. Use 'ping 172.16.0.2' from R1 to test tunnel reachability.
Watch out: Both ends must have matching tunnel mode and IP addresses. A common mistake is forgetting to configure 'tunnel source' and 'tunnel destination' or using the wrong interface IP. Also, ensure the physical interfaces have a route to each other.
GRE Tunnel for Non-IP Protocol Transport (IPX)
A legacy network uses IPX protocol for a Novell NetWare application. The two sites are connected via an IP-only WAN. A GRE tunnel can encapsulate IPX packets inside IP to transport them across the WAN.
Topology
R1(Gi0/0)---192.168.1.0/30---(Gi0/0)R2
R1(Tunnel0)---IPX Network: 100---(Tunnel0)R2Steps
- 1.Step 1: Configure physical interfaces with IP addresses.
- 2.Step 2: Create tunnel interfaces and set mode to GRE IP.
- 3.Step 3: Configure tunnel source and destination.
- 4.Step 4: Enable IPX routing and assign IPX network to tunnel interface.
- 5.Step 5: Verify IPX connectivity.
! R1 Configuration interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.252 no shutdown ! interface Tunnel0 ipx network 100 tunnel mode gre ip tunnel source GigabitEthernet0/0 tunnel destination 192.168.1.2 ! ipx routing ! ! R2 Configuration interface GigabitEthernet0/0 ip address 192.168.1.2 255.255.255.252 no shutdown ! interface Tunnel0 ipx network 100 tunnel mode gre ip tunnel source GigabitEthernet0/0 tunnel destination 192.168.1.1 ! ipx routing
Verify: Use 'show ipx interface tunnel 0' to verify IPX network. Use 'show ipx route' to see IPX routes. Use 'ping ipx 100.0000.0000.0001' (or appropriate IPX address) to test connectivity.
Watch out: IPX must be enabled globally with 'ipx routing'. The IPX network number must be the same on both ends of the tunnel. Also, ensure that the physical interfaces have IP connectivity; otherwise, the tunnel will not come up.
Troubleshooting with This Command
When troubleshooting GRE tunnels, the first step is to verify that the tunnel interface is up/up. Use 'show interfaces tunnel 0' to check the interface status. If the tunnel is down/down, it usually indicates a misconfiguration of the tunnel source or destination, or lack of IP connectivity between the physical endpoints.
Ping the tunnel destination IP from the source router to confirm reachability. If the tunnel is up/up but traffic is not passing, check the tunnel mode on both ends—they must match. Use 'show running-config interface tunnel 0' to verify the configuration.
Another common issue is MTU problems; GRE adds 24 bytes of overhead (20 IP + 4 GRE), which can cause fragmentation. Use 'ping size 1472 df-bit' from the tunnel source to test. If the ping fails, reduce the MTU on the tunnel interface with 'ip mtu 1400'.
Also, check for ACLs that might block GRE protocol (IP protocol 47). Use 'show access-lists' to verify. For routing issues, ensure that the tunnel IP addresses are in the same subnet and that routing protocols are configured correctly.
Use 'debug tunnel' with caution in production, but it can show encapsulation failures. A healthy GRE tunnel will show 'Tunnel0 is up, line protocol is up' and 'Encapsulation TUNNEL'. The 'show ip route' should show the tunnel network as directly connected.
If the tunnel is up but OSPF adjacency is not forming, verify OSPF network type (default is point-to-point) and that multicast is allowed (GRE supports multicast). Use 'show ip ospf interface tunnel 0' to see OSPF details. Another diagnostic command is 'show ip interface tunnel 0' to check if the tunnel is enabled for routing.
If the tunnel is up but no traffic flows, check the routing table for the destination network—it should point to the tunnel interface. Finally, use 'traceroute' to see the path; if it goes through the physical interface instead of the tunnel, there is a routing issue. Correlate with 'show ip cef' to see how CEF is forwarding traffic.
In summary, systematic verification of physical connectivity, tunnel configuration, and routing is key.
CCNA Exam Tips
GRE tunnels reduce the MTU by 24 bytes (20 IP + 4 GRE); remember this for MTU-related questions.
GRE does not provide encryption; it is often used with IPsec for secure tunnels.
The tunnel source and destination must be reachable via IP routing; otherwise the tunnel will not come up.
GRE can encapsulate multicast traffic, making it suitable for routing protocols like OSPF over VPNs.
Common Mistakes
Forgetting to configure a tunnel IP address – the tunnel interface must have an IP in the same subnet as the remote tunnel IP.
Using the wrong tunnel source or destination IP (e.g., using private IPs when the tunnel goes over the internet).
Not enabling the tunnel interface with 'no shutdown' – by default, tunnel interfaces are up but may be administratively down.
tunnel mode gre ip vs tunnel source [intf|ip]
Both 'tunnel mode gre ip' and 'tunnel source [intf|ip]' are interface configuration commands used to set up a GRE tunnel. They are often confused because they are both required for a functional tunnel, but they serve distinct purposes: one defines the encapsulation protocol, while the other specifies the tunnel's source address or interface.
| Aspect | tunnel mode gre ip | tunnel source [intf|ip] |
|---|---|---|
| Scope | Defines the tunneling protocol as GRE over IP | Specifies the local source end of the tunnel |
| Configuration mode | Interface configuration mode for the tunnel interface | Interface configuration mode for the tunnel interface |
| Persistence | Persistent in running-config; must be present for tunnel to come up | Persistent in running-config; must be present for tunnel to come up |
| Precedence | Must be set before the tunnel can pass traffic | Must be set before the tunnel can pass traffic |
| Typical use | Used to enable multiprotocol transport over IP (e.g., routing protocols, multicast) | Used to define the local address for the tunnel endpoint, often a loopback or physical interface |
| Effect on tunnel | Sets the encapsulation type to GRE (protocol 47) for outer IP header | Determines the source IP in the outer IP header of GRE packets |
Use tunnel mode gre ip when you need to encapsulate any Layer 3 protocol (e.g., IP, IPv6, CLNS) over an IP network using GRE.
Use tunnel source [intf|ip] when you need to specify the local address from which the tunnel will originate, often to ensure reachability or to use a loopback for stability.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the command syntax is identical to classic IOS: 'tunnel mode gre ip'. However, some platforms may require the 'ip' keyword explicitly; omitting it may default to 'gre' but it's best to include 'ip'. In NX-OS (Cisco Nexus switches), the equivalent command is 'tunnel mode gre' (without 'ip') under interface tunnel configuration.
NX-OS also supports 'tunnel mode gre multipoint' for mGRE. The 'ip' parameter is not used in NX-OS. For ASA firewalls, GRE tunnels are not natively supported; instead, use IPsec with 'tunnel-mode' or 'transport-mode' for VPNs.
ASA can terminate GRE tunnels only if using a separate router or using the 'crypto ipsec' with GRE over IPsec. In IOS-XR (e.g., ASR 9000), the command is 'tunnel mode gre' under interface tunnel configuration, and the source/destination are configured with 'tunnel source' and 'tunnel destination' similar to IOS. However, IOS-XR uses a different configuration hierarchy (commit model).
For IOS versions, the command has been consistent from 12.x to 16.x, but in older versions (12.0), the default tunnel mode was 'gre ip', so the command was optional. In 15.x and later, it's good practice to explicitly set it. There are no major output differences between versions for 'show interfaces tunnel'.
Always check the specific platform documentation for any caveats.
Related Commands
show ip route
Displays the IP routing table showing all known routes, their source protocols, administrative distances, metrics, next-hops, and outgoing interfaces.
tunnel destination [ip]
Specifies the destination IP address for a tunnel interface, used to define the remote endpoint of a point-to-point VPN tunnel.
tunnel source [intf|ip]
Specifies the source interface or IP address for a tunnel interface, used to define the tunnel's source address for VPN or overlay networks.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions