IPSec & GRE

Securing Traffic Across the Internet

VPN tunneling protocols that protect data in transit

Your company has two offices — HQ in Jacksonville and a branch in Atlanta. They need to communicate securely over the public Internet. You need to build a VPN tunnel. But what protocols make that tunnel work? Let's break down IPSec and GRE.

AH & ESP

Authentication Header (51) and Encapsulating Security Payload (50)

IKE

Internet Key Exchange — the handshake. UDP ports 500 and 4500.

GRE

Generic Routing Encapsulation — Protocol 47. Tunneling without encryption.

10 Slides  |  N10-009 Objective 1.4  |  Chapter 2

The Problem: Sending Sensitive Data Over the Internet

Jacksonville
HQ Office
10.10.1.0/24
Public Internet
Untrusted
Atlanta
Branch Office
10.10.2.0/24

Without Protection

Data travels as plaintext across shared ISP infrastructure. Anyone on the path can intercept and read it — packet sniffing, man-in-the-middle attacks.

IPSec Creates an Encrypted Tunnel

Even if traffic is captured on the public Internet, the payload is encrypted and cannot be read without the session keys.

GRE — Tunnel Without Encryption

GRE wraps packets inside IP headers, creating a virtual tunnel. It does NOT encrypt — data is still readable. But GRE can carry protocols IPSec alone cannot (multicast, IPv6, routing updates).

GRE over IPSec = Best of Both

GRE handles encapsulation and multicast. IPSec provides encryption and authentication. Together they give you a fully functional, secure tunnel.

IPSec Overview

What is IPSec?

IPSec is a suite of protocols — not a single protocol. It operates at Layer 3 (Network layer) and protects IP packets end-to-end. It defines how to authenticate, encrypt, and integrity-check traffic between two endpoints.

Transport Mode

Encrypts only the payload (data). The original IP header remains intact and visible. Used for host-to-host communication.

Original
IP Hdr
IPSec
Hdr
Encrypted
Payload

IP header visible — routing works normally

Tunnel Mode

Encrypts the entire original packet (IP header + payload) and wraps it in a new outer IP header. Used for site-to-site VPN gateways.

New
IP Hdr
IPSec
Hdr
Encrypted (Orig IP Hdr + Payload)

Original addresses hidden — new outer IP routes through Internet

Jacksonville → Atlanta Scenario

The firewalls at both sites use Tunnel Mode. Each firewall wraps the internal packet in a new IP header addressed to the other firewall's public IP. Internal RFC 1918 addresses stay hidden from the Internet.

AH — Authentication Header Protocol 51

What AH Does

  • Integrity: Ensures the data has not been tampered with in transit
  • Authentication: Confirms the data came from the claimed source
  • Anti-replay: Sequence numbers prevent replayed packets

What AH Does NOT Do

No encryption. The payload is completely visible to anyone who captures the traffic. AH provides zero confidentiality.

AH Header Fields

  • Next Header: Protocol of the protected data
  • SPI: Security Parameters Index — identifies the SA
  • Sequence Number: Anti-replay protection
  • Authentication Data: HMAC over the packet

AH Packet Structure

IP Hdr
AH Hdr
(SPI, Seq)
Payload
(Cleartext)
Auth
Data

Payload is NOT encrypted — readable by anyone

NAT Incompatibility

AH authenticates the entire IP header including source and destination IP addresses. When NAT modifies those addresses, the authentication check fails. AH breaks behind NAT.

Exam Tip

AH = Authentication + Integrity, but NO encryption. If a question asks about confidentiality or encryption, AH is the wrong answer. AH cannot pass through NAT.

ESP — Encapsulating Security Payload Protocol 50

What ESP Provides

  • Confidentiality: Payload is fully encrypted (AES, 3DES)
  • Integrity: Hash over the encrypted payload
  • Authentication: Confirms the packet source
  • Anti-replay: Sequence numbers prevent reuse

This is what virtually all real-world VPNs use — ESP in Tunnel Mode.

NAT Traversal (NAT-T)

ESP does not authenticate the outer IP header (unlike AH), so NAT address modification does not break it. When NAT is detected between endpoints, NAT-T wraps ESP inside UDP port 4500, allowing it to pass through NAT devices.

ESP Packet Structure (Tunnel Mode)

New
IP Hdr
ESP
Hdr
Encrypted
(Orig IP + Payload)
ESP
Trailer
ESP
Auth

Entire original packet is encrypted — payload cannot be read

ESP Header Fields

  • SPI: Identifies the Security Association
  • Sequence Number: Anti-replay protection
  • Payload Data: Encrypted original packet
  • ESP Trailer: Padding + next header type
  • ESP Auth: Integrity check value (HMAC)

Exam Tip

ESP does everything AH does, plus encryption. ESP works with NAT (via NAT-T on UDP 4500). Protocol number 50.

AH vs ESP — Side-by-Side

Feature AH  Protocol 51 ESP  Protocol 50
Encryption NO YES
Authentication YES YES
Data Integrity YES YES
Anti-Replay YES YES
NAT Compatible NO — fails behind NAT YES — with NAT-T (UDP 4500)
What it covers Entire packet incl. IP header Payload only (outer IP hdr not authenticated)
Protocol Number 51 50
Real-world use Rarely deployed — mostly exam content Standard in all production VPNs

Key Insight

In practice, ESP has replaced AH in almost every deployment. AH is heavily tested on the exam because the encryption vs. no-encryption distinction is a classic distractor question. Know it cold: ESP = encryption + auth. AH = auth only, no encryption.

IKE — Internet Key Exchange UDP 500 UDP 4500

Before Jacksonville and Atlanta can pass any encrypted traffic, their firewalls must first agree on who they are and what encryption to use. That negotiation is IKE's job.

Phase 1 — IKE SA (Management Channel)

  • Firewalls authenticate each other (pre-shared key or certificates)
  • Agree on: encryption algorithm, hash, DH group, lifetime
  • Establish a secure, encrypted channel used to conduct Phase 2
  • Uses UDP port 500
  • Two modes: Main Mode (6 messages, more secure) or Aggressive Mode (3 messages, faster but weaker)

Phase 2 — IPSec SA (Data Tunnel)

  • Negotiates the actual IPSec tunnel parameters
  • Agree on: ESP or AH, encryption algorithm, HMAC, lifetime, traffic selectors
  • Produces two unidirectional SAs — one each way
  • Quick Mode — 3 messages, protected by Phase 1 channel
  • When NAT is present, uses UDP port 4500 (NAT-T)

Security Association (SA)

An SA is a one-way agreement between two peers defining the cryptographic parameters for that direction of traffic. Every IPSec tunnel has at minimum two SAs — one in each direction.

Exam Tip

IKE Phase 1 = authenticate + establish secure channel (UDP 500). IKE Phase 2 = negotiate the actual tunnel (still UDP 500, or UDP 4500 with NAT-T). If asked what port IPSec uses to negotiate: UDP 500.

GRE — Generic Routing Encapsulation Protocol 47

What GRE Does

GRE creates a virtual point-to-point tunnel by encapsulating packets inside IP. The original packet — regardless of its type — becomes the payload of a new IP packet.

  • Can tunnel any protocol: IPv6 over IPv4, IPX, multicast, routing protocol updates
  • Adds a GRE header (4 bytes) + new IP header (20 bytes) = 24 bytes overhead
  • Overhead can cause MTU issues — fragmentation or path MTU discovery required

GRE Packet Structure

Outer
IP Hdr
GRE
Hdr
Original Packet
(any protocol)

+24 bytes overhead per packet (20B outer IP + 4B GRE)

GRE Has No Security

GRE provides no encryption, no authentication, no integrity checking. Traffic inside a GRE tunnel is fully readable. GRE is a dumb pipe — it moves packets, nothing more.

Why GRE over IPSec?

IPSec alone cannot carry multicast traffic or dynamic routing protocols (OSPF, EIGRP use multicast). GRE can. The combination:

  • GRE layer: Encapsulates multicast, routing updates, any protocol
  • IPSec layer: Encrypts the GRE tunnel traffic end-to-end

Jacksonville and Atlanta can run OSPF across the VPN because GRE carries the multicast OSPF hellos, and IPSec encrypts everything.

Exam Tip

GRE = tunneling without security. Protocol 47. If a question involves sending multicast or routing protocol traffic across a VPN, GRE over IPSec is the answer.

Protocol Numbers — Quick Reference

These appear in the Protocol field of the IP header — they tell the receiving host what is encapsulated inside the IP packet.

1
ICMP
Ping, traceroute, unreachable messages
6
TCP
Reliable, connection-oriented transport
17
UDP
Fast, connectionless transport
47
GRE
Generic Routing Encapsulation — tunneling only
50
ESP
IPSec Encapsulating Security Payload — encryption + auth
51
AH
IPSec Authentication Header — auth only, no encryption

How this looks in Wireshark / a packet capture:

Internet Protocol Version 4 Source: 10.0.1.1 Destination: 203.0.113.10 Protocol: ESP (50) <-- receiving host knows IPSec ESP is inside Total Length: 156 TTL: 64 [Next layer: ESP, SPI=0xc3f72a11, Seq=142] [Payload: Encrypted — cannot decode without keys]

Summary — Jacksonville and Atlanta Are Connected

IKE Phase 1 authenticated both firewalls (UDP 500). Phase 2 negotiated ESP encryption (Protocol 50). GRE (Protocol 47) wraps the OSPF multicast traffic so routing updates flow between sites. The tunnel is live. All traffic between the two offices is encrypted and authenticated end-to-end.

AH
51
Auth + Integrity
No encryption. Breaks NAT.
ESP
50
Encrypt + Auth + Integrity
Works with NAT-T (UDP 4500)
GRE
47
Tunneling — No Security
Carries multicast, routing protocols
IKE
500
Negotiation (UDP)
4500 = NAT-T. Ph1 = auth. Ph2 = tunnel.

Key Distinctions for N10-009

  • AH authenticates but does NOT encrypt — fails with NAT
  • ESP encrypts AND authenticates — the standard choice
  • GRE = tunneling only, zero security on its own
  • IKE = negotiation, not the tunnel itself
  • GRE over IPSec = multicast support + full encryption