GRE over IPsec Fundamentals

In the previous lesson, you configured a site-to-site VPN using IPsec.
Traffic between the New York and San Francisco networks is now encrypted across the Internet.

However, a limitation remains.
IPsec alone cannot transport dynamic routing protocols. You cannot run OSPF or EIGRP directly over a standalone IPsec tunnel because IPsec only protects unicast IP traffic.

Figure 1 - IPsec cannot carry routing protocols

This limitation prevents routers from forming routing adjacencies directly through IPsec.

The answer is GRE over IPsec. You build a GRE tunnel first.
GRE can carry any traffic including multicast. Then you wrap that GRE tunnel inside IPsec to encrypt everything.

Figure 2 - GRE over IPsec topology