GRE vs IP-in-IP

I recently built a small lab to understand how GRE and IP-in-IP tunnels actually behave, not just from configuration but also from control plane + packet level.

🧩 Initial State: Interfaces

Here’s how the topology looked before bringing up the tunnel:

R3(config)#do sh ip int br
Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/0        10.0.23.3       YES manual up                    up
FastEthernet1/0        unassigned      YES unset  administratively down down
FastEthernet2/0        unassigned      YES unset  administratively down down
Loopback0              3.3.3.3         YES manual up                    up
Tunnel0                172.16.13.2     YES manual up                    down

R2(config)#do sh ip int br
Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/0        10.0.12.2       YES manual up                    up
FastEthernet1/0        10.0.23.2       YES manual up                    up
FastEthernet2/0        unassigned      YES unset  administratively down down

R1(config)#do sh ip int br
Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/0        10.0.12.1       YES manual up                    up
FastEthernet1/0        unassigned      YES unset  administratively down down
FastEthernet2/0        unassigned      YES unset  administratively down down
Loopback0              1.1.1.1         YES manual up                    up
Tunnel0                172.16.13.1     YES manual up                    down

🔧 GRE Tunnel Configuration

On R1:

do sh running-config | section Tunnel
interface Tunnel0
 ip address 172.16.13.1 255.255.255.252
 tunnel source 10.0.12.1
 tunnel destination 10.0.23.3
R1(config)#ip route 10.0.23.3 255.255.255.255 10.0.12.2
R1(config)#do wr
Building configuration...
[OK]
R1(config)#
*Apr 11 11:30:30.511: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up

Tunnel comes UP even if remote side is not configured

This is because:

• GRE only checks underlay reachability
• It does NOT validate remote tunnel state

🔧 R3 Tunnel Config

R3(config)#do sh running-config | section Tunnel
interface Tunnel0
 ip address 172.16.13.2 255.255.255.252
 tunnel source 10.0.23.3
 tunnel destination 10.0.12.1
R3(config)#ip route 10.0.12.1 255.255.255.255 10.0.23.2

Running OSPF over GRE

R1(config-router)# network 172.16.13.0 0.0.0.3 area 0
R1(config-router)# network 1.1.1.0 0.0.0.255 area 0
R1(config-router)#do wr
Building configuration...
[OK]
R1(config-router)#
*Apr 11 11:43:34.343: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Tunnel0 from LOADING to FULL, Loading Done

On R3:

R3(config)#router ospf 1
R3(config-router)# router-id 3.3.3.3
R3(config-router)# network 172.16.13.0 0.0.0.3 area 0
R3(config-router)# network 3.3.3.0 0.0.0.255 area 0
R3(config-router)#do wr
Building configuration...

*Apr 11 11:43:34.315: %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.1 on Tunnel0 from LOADI

Verification:

R1(config)#do ping 3.3.3.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/34/52 ms

Failure Scenario

Shutting tunnel on R1:

R1(config)#int tunnel0
R1(config-if)#shut
R1(config-if)#
*Apr 11 11:53:53.187: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Tunnel0 from FULL to DOWN, Neighbor Down: Interface down or detached
*Apr 11 11:53:55.171: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
*Apr 11 11:53:55.175: %LINK-5-CHANGED: Interface Tunnel0, changed state to administratively down

But on R3:

R3(config)#do sh ip int br
Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/0        10.0.23.3       YES manual up                    up
FastEthernet1/0        unassigned      YES unset  administratively down down
FastEthernet2/0        unassigned      YES unset  administratively down down
Loopback0              3.3.3.3         YES manual up                    up
Tunnel0                172.16.13.2     YES manual up                    up

👉 Key Learning:

GRE tunnel is unidirectional state-aware

• One side down ❌
• Other side still shows up ✅

Use BFD for fast + symmetric failure detection

🔁 IP-in-IP Configuration Difference

Only change:

R1(config)# do show running-config | section int
interface Loopback0
 ip address 1.1.1.1 255.255.255.0
interface Tunnel0
 ip address 192.168.13.1 255.255.255.252
 tunnel source 10.0.12.1
 tunnel mode ipip
 tunnel destination 10.0.23.3

👉 Just one line:

tunnel mode ipip

🔬 Packet-Level Understanding

🔹 IP-in-IP Packet

Src: 10.0.12.1
Dst: 10.0.23.3
Protocol: IPIP (4)
TTL: 255

👉 Meaning:

• Outer = underlay
• Inner = tunnel packet
• No extra header

🔹 GRE Packet (Key Differences)

• Protocol = 47
• GRE header present
• Payload type defined (IPv4)

GRE vs IP-in-IP

• Protocol Number

GRE → 47

Get Aman Singh’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

IPIP → 4

• Encapsulation

GRE → Outer IP + GRE header + Inner IP

IPIP → Outer IP + Inner IP (no extra header)

• Header Presence

GRE → Has GRE header (defines payload type)

IPIP → No additional header

• Overhead

GRE → ~24 bytes

IPIP → ~20 bytes

• Multicast Support

GRE → Supported

IPIP → Not supported

• Flexibility

GRE → Can carry multiple protocols

IPIP → Only IP (unicast)