A VPN is an encrypted tunnel over an insecure network (usually the internet) that connects networks or users securely as if they were directly connected.
Facts
| Point | Info |
|---|---|
| OSI layer | Layer 3 (IPsec), Layer 2/3 (GRE over IPsec) |
| Standard | IPsec = IETF (RFC 4301 etc.) |
| Encryption | AES (3DES = legacy, don’t use) |
| Authentication | Pre-shared key, certificates |
| Key exchange | IKEv1 / IKEv2 (UDP 500); NAT-T = UDP 4500 |
| Protocols | AH (IP proto 51), ESP (IP proto 50) |
| Use cases | WAN, branch, remote access, cloud |
Why does it exist?
The internet is insecure (sniffable), unauthenticated (spoofing) and shared. Without VPN data can be read, altered and the sender spoofed. Typical scenarios: branch ↔ HQ, remote user ↔ company, datacenter ↔ cloud.
How it solves it
A VPN creates an encrypted tunnel between two peers: IKE negotiates keys (Diffie-Hellman) → IPsec establishes Security Associations (transform sets: AES, SHA) → data is encrypted and sent → receiver decrypts. Recovery: Dead Peer Detection (DPD) and rekey before lifetime expiry.
VPN types
- Site-to-site IPsec: router ↔ router, permanent tunnel between locations
- Remote access: client ↔ VPN gateway, home office; often SSL or IPsec
- GRE over IPsec: GRE builds the tunnel, IPsec encrypts – used in DMVPN
Key terminology
| Term | Explanation |
|---|---|
| IKE | Key exchange protocol |
| SA | Security Association |
| ESP | Encryption + integrity |
| AH | Integrity only (rarely used) |
| NAT-T | IPsec through NAT (UDP 4500) |
| Transform set | Encryption/integrity parameters |
| Tunnel mode | Encrypts the whole IP packet |
| Transport mode | Encrypts the payload only |
GRE – Generic Routing Encapsulation
A GRE tunnel is NOT encrypted. GRE only encapsulates: an L3 packet inside a new IP packet (tunnel source/destination). It allows routing protocols and multicast over the internet – but provides no encryption, no integrity, no authentication. The data is still readable.
Original IP packet → GRE header → new IP header (tunnel src/dst)Why use GRE at all? Because IPsec alone: doesn’t carry routing protocols/multicast directly (policy-based) and is less flexible. GRE + IPsec = encrypted, integrity-protected, authenticated and routing-friendly – the perfect WAN overlay.
GRE configuration
! Side A
interface Tunnel0
ip address 10.255.255.1 255.255.255.252
tunnel source Ethernet0/1
tunnel destination 192.168.255.148
keepalive 10 3
! Side B (mirror)
interface Tunnel0
ip address 10.255.255.2 255.255.255.252
tunnel source Ethernet0/2
tunnel destination 192.168.255.204
keepalive 10 3
! test: ping 192.168.255.148 source e0/1Comparison
| Feature | GRE | IPsec |
|---|---|---|
| Encapsulation | ✔ | ✔ |
| Encryption | ❌ | ✔ |
| Authentication | ❌ | ✔ |
| Routing support | ✔ | Limited |
| Multicast | ✔ | ❌ |
Exam tips ⚠️
- “GRE tunnel over the internet” → 🔥 not encrypted
- “Secure GRE tunnel” → 🔥 GRE over IPsec
- “Which protocol provides encryption?” → 🔥 IPsec, not GRE
- AH ≠ encryption; ESP can encrypt and authenticate
- Routing over VPN → GRE over IPsec; many sites → DMVPN; NAT in between → NAT-T (UDP 4500)