Know routing, addressing and traffic policy.
Tunnel packet encapsulation
A tunnel lets traffic cross an intervening network using an outer packet. GRE is a tunnelling mechanism. It can carry traffic between tunnel endpoints, but ordinary GRE does not provide encryption or strong peer authentication on its own.
IPsec provides security services at the IP layer, according to the negotiated design and policy. A site-to-site VPN joins networks. A remote-access VPN connects an individual device or user to an organisation’s network. The right route and traffic policy are still required after a tunnel is established.
VPN troubleshooting procedure
- Can each endpoint reach the other endpoint’s outer address?
- Are tunnel parameters and security policies compatible?
- Which traffic is selected for the tunnel?
- Do both sides have routes for the intended inner networks?
- Are return traffic, packet size and access rules working?
For an introductory GRE lab, describe it as a tunnel exercise, not an encrypted VPN. Adding IPsec is an additional design step. Do not test a tunnel by sending someone else’s private traffic through an unknown endpoint.
Practical exercise
A GRE interface is up and the PCs can ping across it. Can you conclude that the traffic is encrypted?
Show the answer and explanation
No. GRE connectivity demonstrates the tunnel path, not encryption. Verify whether a separate encryption mechanism such as IPsec is configured and operating.
QUICK KNOWLEDGE CHECK
Check your understanding
Related labs and exercises
Sources & content checks
Technical references checked on 25 October 2026. These are original teaching explanations, not official Cisco course material. See how content and lab validation are described.
Your progress
Mark this complete when you can explain the example and do the exercise.