Interfaces and Hardware Component Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Interfaces and Hardware Component Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

GRE tunnels

Updated: July 31, 2026

Want to summarize with AI?

Log in

This topic describes Generic Routing Encapsulation (GRE) tunnels on the Cisco 8000 Series Router, including how they encapsulate a payload of one protocol inside an outer IP packet for delivery between two tunnel endpoints.

The Generic Routing Encapsulation is a tunneling protocol that

  • provides a simple approach to transport packets of one protocol over another protocol through encapsulation

  • encapsulates a payload inside an outer IP packet while the system delivers this inner packet to a destination network, and

  • behaves as a virtual point-to-point link between two endpoints that identify this link using the tunnel source and tunnel destination address.

Other IP routers along the way do not parse the payload (the inner packet); they only parse the outer IP packet as they forward it toward the GRE tunnel endpoint. Upon reaching the tunnel endpoint, GRE encapsulation is removed and the payload is forwarded to the packet's ultimate destination.

Table 1. Feature History Table

Feature Name

Release Information

Description

Network Virtualization using Generic Routing Encapsulation hash field selections

Release 26.2.1

You can now improve load balancing for Network Virtualization using Generic Routing Encapsulation (NVGRE) traffic by excluding the NVGRE payload from the hash calculation. This feature optimizes traffic distribution across multiple paths, preventing uneven load caused by hashing on the NVGRE payload.

The feature works by modifying the Cisco Express Forwarding (CEF) load-balancing hash algorithm to exclude the NVGRE payload field. This adjustment ensures that the hash calculation uses only relevant header fields, leading to better traffic distribution and network performance.

This feature introduces these changes:

CLI:

  • cef platform load-balancing nvgre payload exclude

  • show cef platform load-balancing

GRE tunnel

Release 26.1.1

Introduced in this release on: Centralized Systems (8400 [ASIC:K100]) )(select variants only*)

*This feature is now supported on Cisco 8404-SYS-D routers.

GRE tunnel

Release 25.4.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8711-48Z-M

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

Disabling time-to-live (TTL) decrement at GRE encapsulation

Release 25.1.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8712-MOD-M

  • 8011-4G24Y4H-I

Disabling time-to-live (TTL) decrement at GRE encapsulation

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

*This feature is now supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 88-LC1-12TH24FH-E

  • 88-LC1-36EH

  • 88-LC1-52Y8H-EM

GRE tunnel

Release 24.4.1

Introduced in this release on: Fixed Systems(8200, 8700)(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*).

The Generic Routing Encapsulation (GRE) feature that transports packets of one protocol over another protocol in a simplified manner using encapsulation is now supported on the following hardware.

*This feature is now supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 8712-MOD-M

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

  • 88-LC1-36EH

Disabling time-to-live (TTL) decrement at GRE encapsulation

Release 7.3.2

This feature allows you to disable the time-to-live (TTL) decrement of the incoming packets. The result is that encapsulation of the original incoming packet takes place without any change in the TTL value.

This feature avoids dropping incoming packets with a TTL value equal to one after GRE encapsulation.

Before this release, the TTL value of incoming packets was decremented by one before GRE decapsulation.

This feature introduces the tunnel ttl disable command.

GRE tunnel

Release 7.3.1

Generic Routing Encapsulation (GRE) provides a simple approach to transporting packets of one protocol over another protocol using encapsulation. This capability is now extended to the Cisco 8000 Series Routers.

This feature supports:

  • Unidirectional GRE encapsulation

  • Unidirectional GRE decapsulation

And introduces the following commands:

  • show interface tunnel-ip <> accounting (encap)

  • show interface tunnel-ip <> accounting (decap)

Outer-header hashing support for MPLSoGRE and IPoGRE traffic

Release 7.3.1

This feature allows load-balancing of GRE traffic in transit routers. A transit node distributes incoming GRE traffic evenly across all available ECMP links in a GRE tunnel topology. A hashing function uses GRE outer and inner header tuples such as source IP, destination IP, protocol, and router ID to determine traffic entropy. This capability is now extended to the Cisco 8000 Series Routers.

A tunnel configured using encapsulation mode performs encapsulation of IPv4/IPv6 payload inside the GRE header. A tunnel configured using decapsulation mode performs the opposite. Here, outer GRE header is decapsulated and the inner IPv4/IPv6/MPLS payload is forwarded to the next hop router. Both encapsulation and decapsulation tunnel interfaces collect statistics periodically. The statistics can be displayed on demand using the CLI commands show interface tunnel-ip1 accounting and show policy-map type pbr address-family ipv4 statistics. For more information, see Unidirectional GRE encapsulation (GREv4) and Unidirectional GRE decapsulation (GREv4).

To perform load-balancing of GRE traffic in transit routers, a transit node distributes incoming GRE traffic evenly across all available ECMP links in a GRE tunnel topology. Furthermore, to determine traffic entropy, a hashing function uses GRE outer and inner header tuples such as source IP, destination IP, protocol, and router ID.

Supported features on a GRE tunnel

A GRE tunnel supports the following features:

  • GRE or IP-in-IP tunnels support 16 unique source addresses. These 16 unique source addresses are repeated multiple times to configure 1000 encapsulation tunnels or 64 decapsulation tunnels.

  • GRE encapsulation supports the following features:

    • IPv4/IPv6 over GRE IPv4 transport

    • MPLS PoP over GRE IPv4 transport

    • ABF (Access List Based Forwarding) v4/v6 over GRE

    • VRF (Virtual Routing and Forwarding) support over GRE

  • GRE decapsulation supports the following features:

    • PBR-based GRE decapsulation configuration

    • CLI-based GRE decapsulation configuration

    • IPv4/IPv6 over GRE decapsulation

    • MPLS/SRTE over GRE decapsulation

    • A GRE tunnel in decapsulation mode has only tunnel source configured, without any tunnel destination address. This decapsulated GRE tunnel behaves like a P2MP (Point-to-multipoint) tunnel, which means that an incoming GRE packet can have any source IP address and matching destination IP address to the tunnel source configured. However, once a source IP address is used for decapsulated P2MP tunnel, it cannot be re-used with other decapsulation tunnels.

  • The command tunnel ttl disable is supported. This command controls TTL decrement of a packet being encapsulated. After configuring this command for a tunnel interface, TTL value of incoming packet is not decremented by one, and original incoming packet is encapsulated without changing the TTL. By default, tunnel ttl disable is not configured. This means that the TTL of incoming packets is decremented by one before GRE encapsulation.

    For example, consider an incoming packet that had the TTL value equal to one. On GRE encapsulation, the TTL value is decremented by one and becomes zero. Therefore the router will discard the packet and send an ICMP message back to the originating host. Using this feature, you can disable TTL decrement and avoid the packet discard.

Configuration example: Disable TTL decrement

Router# configure
Router(config)# interface tunnel-ip30016
Router(config-if)# tunnel ttl disable
Router(config-if)# commit

Limitations for configuring GRE tunnels

Observe the following limitations when you configure GRE tunnels:

  • GRE tunnels configured without any decapsulation or encapsulation mode support only ERSPAN feature.

  • Do not create multiple GRE/IP-in-IP tunnels with the same pair of source and destination IP address or interface name. Configure all tunnels with unique source-destination pairs. In an encapsulation or decapsulation tunnel where only either source or destination is mentioned, the source-destination pair should also be unique when compared to other encapsulation or decapsulation tunnels.

  • Bi-directional GRE tunnel is not supported.

  • Routing protocols over GRE tunnels are not supported.

  • Multicast over GRE is not supported.

  • GRE KA (Keep Alive) is not supported.

  • GRE parameters such as MTU (Maximum Transmission Unit) and key functionalities are not supported.

Configure a GRE tunnel

Use this procedure to configuring a GRE tunnel that involves creating a tunnel interface and defining the tunnel source and destination. The router supports only unidirectional GRE with either encapsulation or decapsulation mode.

Procedure

1.

Enter global configuration mode.

Example:

Router# configure
2.

Enter interface configuration mode for the tunnel-ip interface.

Example:

Router(config)# interface tunnel-ip1
3.

Assign an IPv4 address and subnet mask to the tunnel interface.

Example:

Router(config-if)# ipv4 address 101.0.1.2 255.255.255.0
4.

Assign an IPv6 address to the tunnel interface.

Example:

Router(config-if)# ipv6 address 101:0:1::2/64
5.

Set the tunnel mode to GRE IPv4 with either encapsulation or decapsulation.

Example:

Router(config-if)# tunnel mode gre ipv4 [encap | decap]
6.

Configure the tunnel source address.

Example:

Router(config-if)# tunnel source 2.2.1.1
7.

Configure the tunnel destination address.

Example:

Router(config-if)# tunnel destination 2.2.2.1/32
8.

Save the configuration.

Example:

Router(config-if)# commit
9.

Exit interface configuration mode.

Example:

Router(config-if)# exit

What to do next

Bi-directional GRE tunnel supports only ERSPAN.

To configure ABFv4/v6 over GRE, use this configuration:

router static
  address-family ipv4 unicast
  201.0.1.0/24 tunnel-ip1
  address-family ipv6 unicast
  201:0:1::0/64 tunnel-ip1

ipv4 access-list abf-gre
  1 permit ipv4 any any nexthop1 ipv4 201.0.1.2
ipv6 access-list abf6-gre
  1 permit ipv6 any any nexthop1 ipv6 201:0:1::2

interface HundredGigE0/0/0/24
  ipv4 address 24.0.1.1/24
  ipv6 address 24:0:1::1/64
  ipv4 access-group abf-gre ingress
  ipv6 access-group abf6-gre ingress
!

To configure MPLS PoP label over GRE, use this configuration:

router static
  address-family ipv4 unicast
  201.0.1.0/24 tunnel-ip1
  address-family ipv6 unicast
  201:0:1::0/64 tunnel-ip1

mpls static
  interface HundredGigE0/0/0/24
  lsp gre
    in-label 30501 allocate
    forward path 1 resolve-nexthop 201.0.1.2 out-label pop
!