Which of the following statements is false about GRE over IPsec?
A.
IPsec supports encapsulation in both tunnel and transport modes.
B.
Compared with tunnel mode, transport mode adds an additional outer IP header. As a result, the packet is longer and more likely to be fragmented. Therefore, GRE over IPsec in tunnel mode is recommended.
C.
IPsec protects data flows between the GRE tunnel source and GRE tunnel destination.
D.
GRE over IPsec first encapsulates packets using GRE and then protects the GRE packets using IPsec.
Option B is false because it reverses the encapsulation behavior. In IPsec transport mode, the IPsec security header is inserted after the existing IP header; a new outer IP header is not normally added. In tunnel mode, the complete original IP packet is encapsulated and a new outer IP header is added. Tunnel mode therefore generally introduces greater overhead and produces a longer packet than transport mode, not the reverse.
The remaining statements are correct. IPsec supports both transport and tunnel modes. GRE over IPsec performs GRE encapsulation first, allowing GRE to transport the original payload, and then applies IPsec protection to the resulting GRE packet. The IPsec security association is established between the GRE tunnel endpoints, protecting the GRE-encapsulated traffic as it traverses an untrusted transport network.
Huawei SD-WAN data channels can use either GRE or GRE over IPsec. GRE provides flexible overlay encapsulation, while IPsec adds confidentiality, integrity, origin authentication, and anti-replay protection for site-to-site traffic. Huawei specifically identifies IPsec encryption as the mechanism securing site-to-site SD-WAN services.
==================
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit