Courseiva
← 300-410
Full test
mediumMultiple ChoiceObjective-mapped

GRE Tunnel Mode and Features: Transport Types and PMTUD

Examine this configuration on Router R4: ```

interface Tunnel0
 ip address 10.0.0.1 255.255.255.252

ipv6 address 2001:DB8:6::1/64 tunnel source GigabitEthernet0/0 tunnel destination 172.16.1.2 tunnel mode gre ip ``` What will be the effect?

Quick Answer

The correct answer is that the tunnel will successfully encapsulate both IPv4 and IPv6 payloads over IPv4. This is because the `tunnel mode gre ip` command establishes a generic routing encapsulation (GRE) tunnel over an IPv4 transport network, and GRE is a protocol-agnostic encapsulation method capable of carrying any Layer 3 protocol, including both IPv4 and IPv6. The IPv6 address configured on the tunnel interface allows IPv6 traffic to be routed into the tunnel, where it is encapsulated in IPv4 packets and forwarded to the tunnel destination. On the Cisco CCNP ENARSI 300-410 exam, this question tests your understanding of GRE tunnel mode and features, specifically how GRE differs from IP-in-IP tunnels, which only support IPv4 payloads. A common trap is assuming that `tunnel mode gre ip` restricts the payload to IPv4 only, but the key is that GRE itself is protocol-independent. Memory tip: GRE stands for Generic Routing Encapsulation—think “Generic” means any protocol goes, while “ip” only specifies the transport.

⚠ Common exam trap

Cisco often tests the misconception that 'tunnel mode gre ip' only supports IPv4 traffic, when in fact GRE is protocol-agnostic and can carry IPv6, IPX, or other Layer 3 protocols as payload.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The tunnel will successfully encapsulate both IPv4 and IPv6 payloads over IPv4.

The 'tunnel mode gre ip' command creates a generic routing encapsulation (GRE) tunnel over IPv4. GRE is protocol-agnostic and can encapsulate any Layer 3 protocol, including IPv4 and IPv6. The IPv6 address configured on the tunnel interface allows IPv6 traffic to be routed into the tunnel, where it is encapsulated in IPv4 packets and sent to the tunnel destination. Therefore, the tunnel will successfully carry both IPv4 and IPv6 payloads.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The tunnel will only carry IPv4 traffic because the mode is 'gre ip'.

    Why it's wrong here

    GRE can carry multiple protocols; 'gre ip' means transport is IPv4, but payload can be IPv4, IPv6, etc.

  • ✓

    The tunnel will successfully encapsulate both IPv4 and IPv6 payloads over IPv4.

    Why this is correct

    GRE allows multiprotocol payload; the IPv4 and IPv6 addresses on the tunnel interface are valid.

  • ✗

    The tunnel will fail because the tunnel source is an interface, not an IP address.

    Why it's wrong here

    Using an interface as tunnel source is valid and recommended.

  • ✗

    The tunnel mode should be 'ipv6ip' to carry IPv6 traffic.

    Why it's wrong here

    GRE can carry IPv6; ipv6ip is only for IPv6 over IPv4 without GRE.

About these practice questions

Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

3 more ways this is tested on 300-410

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Consider this configuration on Router R2: ``` interface Tunnel0 ipv6 address 2001:DB8:3::1/64 tunnel source GigabitEthernet0/0 tunnel mode gre ipv6 tunnel destination 2001:DB8:4::2 ``` Which statement is true?

medium
  • A.This tunnel can only carry IPv6 traffic.
  • B.The tunnel source and destination must be IPv4 addresses.
  • ✓ C.This tunnel will encapsulate packets using GRE over an IPv6 transport.
  • D.The tunnel mode should be 'ipv6ip' for IPv6 transport.

Why C: The configuration shows a tunnel with `tunnel mode gre ipv6`, which explicitly sets the tunnel to use GRE encapsulation over an IPv6 transport. The tunnel source and destination are IPv6 addresses, and GRE can carry multiple protocols (including IPv4, IPv6, and others) over the IPv6 transport. Therefore, option C is correct because the tunnel encapsulates packets using GRE over an IPv6 transport.

Variation 2. Given this configuration on Router R6: ``` interface Tunnel0 ipv6 address 2001:DB8:8::1/64 tunnel source 2001:DB8:9::1 tunnel destination 2001:DB8:10::2 tunnel mode gre ipv6 tunnel path-mtu-discovery ``` What is the effect?

medium
  • A.The tunnel will not work because path-mtu-discovery is not supported with GRE.
  • ✓ B.The tunnel will dynamically adjust the MTU based on the path MTU discovery.
  • C.The tunnel mode should be 'ipv6ip' for IPv6 transport.
  • D.The tunnel source and destination must be IPv4 addresses.

Why B: The `tunnel path-mtu-discovery` command enables Path MTU Discovery (PMTUD) for the GRE tunnel, which dynamically determines the maximum MTU along the path to the tunnel destination and adjusts the tunnel interface's MTU accordingly. This prevents fragmentation issues by allowing the tunnel to use the smallest MTU in the path. Option B correctly identifies this behavior.

Variation 3. Which authentication method is supported by default for GRE tunnels in Cisco IOS-XE?

medium
  • A.MD5 authentication
  • B.SHA-256 authentication
  • ✓ C.No authentication by default
  • D.Plain-text password authentication

Why C: GRE tunnels in Cisco IOS-XE do not include any built-in authentication mechanism by default. The GRE protocol (RFC 2784) defines a simple encapsulation method without authentication or encryption; any security features must be added externally, such as using IPsec to protect the tunnel traffic. Therefore, the correct answer is that no authentication is enabled by default.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.