mediumMultiple Choice
GRE Tunnel Mode and Features: Transport Types and PMTUD
Examine this configuration on Router R4: ```
interface Tunnel0 ip address 10.0.0.1 255.255.255.252
ipv6 address 2001:DB8:6::1/64 tunnel source GigabitEthernet0/0 tunnel destination 172.16.1.2 tunnel mode gre ip ``` What will be the effect?
Quick Answer
The correct answer is that the tunnel will successfully encapsulate both IPv4 and IPv6 payloads over IPv4. This is because the `tunnel mode gre ip` command establishes a generic routing encapsulation (GRE) tunnel over an IPv4 transport network, and GRE is a protocol-agnostic encapsulation method capable of carrying any Layer 3 protocol, including both IPv4 and IPv6. The IPv6 address configured on the tunnel interface allows IPv6 traffic to be routed into the tunnel, where it is encapsulated in IPv4 packets and forwarded to the tunnel destination. On the Cisco CCNP ENARSI 300-410 exam, this question tests your understanding of GRE tunnel mode and features, specifically how GRE differs from IP-in-IP tunnels, which only support IPv4 payloads. A common trap is assuming that `tunnel mode gre ip` restricts the payload to IPv4 only, but the key is that GRE itself is protocol-independent. Memory tip: GRE stands for Generic Routing Encapsulation—think “Generic” means any protocol goes, while “ip” only specifies the transport.
⚠ Common exam trap
Cisco often tests the misconception that 'tunnel mode gre ip' only supports IPv4 traffic, when in fact GRE is protocol-agnostic and can carry IPv6, IPX, or other Layer 3 protocols as payload.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The tunnel will successfully encapsulate both IPv4 and IPv6 payloads over IPv4.
The 'tunnel mode gre ip' command creates a generic routing encapsulation (GRE) tunnel over IPv4. GRE is protocol-agnostic and can encapsulate any Layer 3 protocol, including IPv4 and IPv6. The IPv6 address configured on the tunnel interface allows IPv6 traffic to be routed into the tunnel, where it is encapsulated in IPv4 packets and sent to the tunnel destination. Therefore, the tunnel will successfully carry both IPv4 and IPv6 payloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The tunnel will only carry IPv4 traffic because the mode is 'gre ip'.
Why it's wrong here
GRE IP mode still encapsulates IPv4 and IPv6 payloads; the 'ip' denotes the transport protocol, not the passenger protocol. It is tempting to read 'gre ip' as IPv4-only, but IPv6 can traverse it, so the tunnel carries both.
- ✓
The tunnel will successfully encapsulate both IPv4 and IPv6 payloads over IPv4.
Why this is correct
GRE with tunnel mode gre ip carries any passenger protocol, so IPv4 and IPv6 packets are both encapsulated inside the outer IPv4 header defined by the tunnel source and destination. The dual-stack addresses on Tunnel0 confirm both families are intended.
- ✗
The tunnel will fail because the tunnel source is an interface, not an IP address.
Why it's wrong here
GRE tunnel source accepts an interface name, and the router resolves it to that interface's address, so the tunnel establishes normally. It is tempting because an explicit IP is common, but referencing an interface is valid and often preferred for dynamic addressing.
- ✗
The tunnel mode should be 'ipv6ip' to carry IPv6 traffic.
Why it's wrong here
The 'tunnel mode gre ip' setting carries IPv4 payloads over GRE; the IPv6 address on the interface does not require ipv6ip mode. It is tempting because IPv6 is configured, but ipv6ip is for IPv6-over-IPv4 tunnels without GRE, which is not this design.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Consider this configuration on Router R2: ``` interface Tunnel0 ipv6 address 2001:DB8:3::1/64 tunnel source GigabitEthernet0/0 tunnel mode gre ipv6 tunnel destination 2001:DB8:4::2 ``` Which statement is true?
medium- A.This tunnel can only carry IPv6 traffic.
- B.The tunnel source and destination must be IPv4 addresses.
- ✓ C.This tunnel will encapsulate packets using GRE over an IPv6 transport.
- D.The tunnel mode should be 'ipv6ip' for IPv6 transport.
Why C: The configuration shows a tunnel with `tunnel mode gre ipv6`, which explicitly sets the tunnel to use GRE encapsulation over an IPv6 transport. The tunnel source and destination are IPv6 addresses, and GRE can carry multiple protocols (including IPv4, IPv6, and others) over the IPv6 transport. Therefore, option C is correct because the tunnel encapsulates packets using GRE over an IPv6 transport.
Variation 2. Given this configuration on Router R6: ``` interface Tunnel0 ipv6 address 2001:DB8:8::1/64 tunnel source 2001:DB8:9::1 tunnel destination 2001:DB8:10::2 tunnel mode gre ipv6 tunnel path-mtu-discovery ``` What is the effect?
medium- A.The tunnel will not work because path-mtu-discovery is not supported with GRE.
- ✓ B.The tunnel will dynamically adjust the MTU based on the path MTU discovery.
- C.The tunnel mode should be 'ipv6ip' for IPv6 transport.
- D.The tunnel source and destination must be IPv4 addresses.
Why B: The `tunnel path-mtu-discovery` command enables Path MTU Discovery (PMTUD) for the GRE tunnel, which dynamically determines the maximum MTU along the path to the tunnel destination and adjusts the tunnel interface's MTU accordingly. This prevents fragmentation issues by allowing the tunnel to use the smallest MTU in the path. Option B correctly identifies this behavior.
Variation 3. Which authentication method is supported by default for GRE tunnels in Cisco IOS-XE?
medium- A.MD5 authentication
- B.SHA-256 authentication
- ✓ C.No authentication by default
- D.Plain-text password authentication
Why C: GRE tunnels in Cisco IOS-XE do not include any built-in authentication mechanism by default. The GRE protocol (RFC 2784) defines a simple encapsulation method without authentication or encryption; any security features must be added externally, such as using IPsec to protect the tunnel traffic. Therefore, the correct answer is that no authentication is enabled by default.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.