Site-to-site: router↔router, permanent tunnel between offices. Remote access: client↔gateway, often SSL/TLS. GRE over IPsec when you need routing protocols or multicast that plain policy-based IPsec won’t carry.

GRE is not encryption

GRE only encapsulates (protocol 47) — readable payload, no integrity, no auth. “GRE tunnel over the internet” = exposed data. GRE’s value: multicast + routing support; IPsec’s value: ESP crypto. Together = secure flexible overlay.

NAT-T

ESP is IP protocol 50 — no ports, so PAT can’t translate it. NAT-T wraps ESP in UDP 4500 so NAT devices can do their thing. Tunnel flapping through NAT? That’s the answer.

	GRE	IPsec
Encryption / auth	no	yes (ESP)
Multicast & routing protocols	yes	limited without GRE