Home  Prev  cOS Stream 4.00.03 Administration Guide  Next

3.8. GRE Tunnels

Overview

The Generic Router Encapsulation (GRE) protocol is a simple, encapsulating protocol that can be used whenever there is a need to tunnel traffic across networks and/or through network devices.

Using GRE

GRE is typically used to provide a method of connecting two networks together across a third network such as the Internet. The two networks being connected together communicate with a common protocol which is tunneled using GRE through the intervening network. Some examples of reasons to use GRE might be the following:

GRE Security and Performance

A GRE tunnel does not use any encryption and is therefore not, in itself, secure. Any security must come from the protocol being tunneled. The advantage of GRE's lack of encryption is the high performance which is achievable because of the low traffic processing overhead.

The lack of encryption might be acceptable in some circumstances if the tunneling is done across an internal network that is not public.

Creating a GRE Tunnel

In cOS Stream, a GRE tunnel can be treated as a logical interface and has the same filtering, traffic shaping and other configuration capabilities as, for example, an Ethernet interface. Setting up a GRE tunnel requires the following steps:

  1. Create a new GRETunnel object. This requires at minimum, an IP address for both the local endpoint and the remote endpoint of the tunnel.

  2. Add a Route to the main routing table that routes traffic destined for the remote network into the tunnel.

  3. If required, add a Route that routes the tunnel endpoint IP address on the correct interface. This route is added to the routing table specified by the tunnel property RoutingTableMembership if it has been set. If it is not set, the main routing table is used by default.

[Caution] Caution: Check for possible looping in added routes

When configuring GRE routing, it is important to check that routes do not lead to looping of traffic. For example, outer GRE tunnel traffic routed back into the same tunnel.

Mandatory GRETunnel Properties

The following properties are required as a minimum when configuring a GRETunnel object:

Optional GRETunnel Properties

Some of the important optional properties that might be used with a GRE tunnel are the following:

A list of all properties can be found under the GRETunnel entry in the separate CLI Reference Guide.

GRE Tunnels and IP Rules

Network traffic coming from the GRE tunnel will be transferred to the cOS Stream main IP rule set for evaluation. The source interface of the network traffic will be the name of the associated GRE Tunnel.

The same is true for traffic in the opposite direction, that is, going into a GRE tunnel. Furthermore a Route has to be defined so that cOS Stream knows which traffic should be sent through the tunnel.

A Typical GRE Scenario

The diagram below shows a typical GRE scenario, where two firewalls labeled A and B must communicate with each other through the intervening internal network 172.16.0.0/16.

A Typical GRE Scenario

Figure 3.4. A Typical GRE Scenario

Any traffic passing between A and B is tunneled through the intervening network using a GRE tunnel. Since the network is internal and not passing through the public Internet, there is no need for encryption.

The setup for the two firewalls are described next.

Part 1. Setup for firewall A

Assuming that the network 192.168.10.0/24 is lannet on the lan interface, the steps for setting up cOS Stream on A are:

  1. In the address book set up the following IP objects:

    • remote_net_B: 192.168.11.0/24
    • local_gw: 172.16.0.1
    • remote_gw: 172.16.1.1
    • ip_GRE: 192.168.10.1

  2. Create a GRE Tunnel object called GRE_to_B with the following parameters:

    • IPAddress: ip_GRE
    • LocalEndpoint: local_gw
    • RemoteEndpoint: remote_gw
    • SessionKey: 1

  3. Define a route in the main routing table which routes all traffic to remote_net_B on the GRE_to_B GRE interface.
  4. Create the following entries in the main IP rule set that allow traffic to pass through the tunnel:
Name Action Src Int Src Net Dest Int Dest Net Service
To_B Allow lan lannet GRE_to_B remote_net_B all_services
From_B Allow GRE_to_B remote_net_B lan lannet all_services

The CLI commands for firewall A setup are given in Example 3.7, “GRE Tunnel Setup”.

Part 2. Setup for firewall B

Assuming that the network 192.168.11.0/24 is lannet on the lan interface, the steps for setting up cOS Stream on B are as follows:

  1. In the address book set up the following IP objects:

    • remote_net_A: 192.168.10.0/24
    • local_gw: 172.16.1.1
    • remote_gw: 172.16.0.1
    • ip_GRE: 192.168.11.1

  2. Create a GRE Tunnel object called GRE_to_A with the following parameters:

    • IPAddress: ip_GRE
    • LocalEndpoint: local_gw
    • RemoteEndpoint: remote_gw
    • SessionKey: 1

  3. Define a route in the main routing table which routes all traffic to remote_net_A on the GRE_to_A GRE interface.

  4. Create the following entries in the main IP rule set that allow traffic to pass through the tunnel:

Name Action Src Int Src Net Dest Int Dest Net Service
To_A Allow lan lannet GRE_to_A remote_net_A all_services
From_A Allow GRE_to_A remote_net_A lan lannet all_services

Checking GRE Tunnel Status

IPsec tunnels have a status of being either up or not up. With GRE tunnels this does not apply. The GRE tunnel is considered established if it exists in the configuration.

However, it is possible to get more information about a GRE tunnel by using the ifstat CLI command. For example, if a tunnel is called gre_interface then the following command can be used: 

System:/> ifstat my_gre_interface

Example 3.7. GRE Tunnel Setup

This example shows how to configure the GRE tunnel for firewall A from the setup scenario described previously in this section. The raw IP addresses will be used instead of references to address book objects.

Command-Line Interface

Add the GRE tunnel:

System:/> add Interface GRETunnel GRE_to_B
			LocalEndpoint=172.16.0.1
			RemoteEndpoint=172.16.1.1
			RoutingTableMembership=my_gre_rt
			IPAddress=192.168.11.1
			SessionKey=1

Add a route to send traffic to the remote network:

System:/> cc RoutingTable my_gre_rt
System:/RoutingTable/my_gre_rt> add Route Interface=GRE_to_B
			Network=192.168.11.0/24

The tunnel GRE_to_A would be configured in a similar way on firewall B.

Home  Prev   Next