Cisco GRE Tunnel Configuration: Step-by-Step Example

Generic Routing Encapsulation (GRE) transports packets of one protocol inside another over a virtual point-to-point link. On Cisco IOS the tunnel is a logical interface whose endpoints are defined by tunnel source and tunnel destination — the classic use is connecting two private networks across the Internet without buying a leased line. This step-by-step example builds a GRE tunnel between two routers, tunes MTU and MSS for the encapsulation overhead, and verifies reachability end to end.

GRE Tunnel Topology

Router R1 (public IP 1.1.1.1) and R2 (public IP 2.2.2.2) each have a private LAN — 192.168.1.0/24 and 192.168.2.0/24. The tunnel itself uses the 172.16.1.0/24 network, and both tunnel interfaces must be in that subnet.

Configuring the GRE Tunnel on R1 and R2

R1(config)# interface Tunnel1
R1(config-if)# ip address 172.16.1.1 255.255.255.0
R1(config-if)# ip mtu 1400
R1(config-if)# ip tcp adjust-mss 1360
R1(config-if)# tunnel source 1.1.1.1
R1(config-if)# tunnel destination 2.2.2.2

R2(config)# interface Tunnel1
R2(config-if)# ip address 172.16.1.2 255.255.255.0
R2(config-if)# ip mtu 1400
R2(config-if)# ip tcp adjust-mss 1360
R2(config-if)# tunnel source 2.2.2.2
R2(config-if)# tunnel destination 1.1.1.1

Because GRE adds 24 bytes of overhead on top of a typical 1500-byte transport MTU, the tunnel MTU is lowered to 1400 and TCP MSS adjusted to 1360 — this keeps fragmentation and packet drops to a minimum. The tunnel source on one side must equal the tunnel destination on the other; the pair of addresses multiplexes GRE traffic so each router knows which tunnel a packet belongs to.

Adding Routing for the Remote LANs

The tunnel alone only connects the two endpoints. Static routes send each private LAN across the tunnel:

R1(config)# ip route 192.168.2.0 255.255.255.0 172.16.1.2
R2(config)# ip route 192.168.1.0 255.255.255.0 172.16.1.1

Dynamic routing (OSPF, EIGRP) over the tunnel also works, but watch for recursive routing: the router must never conclude that the best path to the tunnel destination goes through the tunnel itself, or the tunnel collapses.

Verifying the GRE Tunnel

R1# ping 172.16.1.2
R1# show interfaces tunnel 1
R1# show ip route 192.168.2.0

A 100 percent ping success to the far tunnel address proves the tunnel is up. If the tunnel is up but remote LAN hosts are unreachable, check the static routes and ACLs; if the tunnel is down, confirm both endpoints can route to each other's public addresses.

Keepalives and Tunnel Stability

By default GRE sends a keepalive every 10 seconds and declares the tunnel down after three missed replies — roughly 30 seconds after a real failure. Tune it per interface:

R1(config)# interface Tunnel1
R1(config-if)# keepalive 5
R1(config-if)# keepalive 3 2

For secure site-to-site connectivity GRE is usually wrapped in IPsec. Compare approaches with our Juniper SRX route-based IPsec VPN guide, and for tunnel-path diagnosis see MTU mismatch troubleshooting with the DF bit.

原文链接：https://community.cisco.com/t5/networking-knowledge-base/how-to-configure-a-gre-tunnel/ta-p/3131970