华为防火墙 三层技术-IP业务配置指导-GRE配置

如 图 1-3 所示，IPv6 network 1 和IPv6 network 2 是运行IPv6 协议的网络，IPv4 network 1 和IPv4 network 2 是运行IPv4 协议的网络。在Device A和Device B之间建立GRE隧道，可以使IPv6 network 1 和IPv6 network 2、IPv4 network 1 和IPv4 network 2 通过骨干网互不影响地进行通信，实现两地 互通。
1-1
1.1.2 GRE隧道原理
图1-2 IPv6 协议网络通过 GRE 隧道互连
下面以 图 1-2 的网络为例说明IPv6 协议的报文通过GRE隧道穿越IPv4 网络进行传输的过程。 (1) Device A 从连接 IPv6 network 1 的接口收到 IPv6 报文后，查找路由表判定此报文需要通过
i
1 GRE
1.1 GRE简介
GRE（Generic Routing Encapsulation，通用路由封装）协议用来对任意一种网络层协议（如 IPv6） 的数据报文进行封装，使这些被封装的数据报文能够在另一个网络（如 IPv4）中传输。封装前后数 据报文的网络层协议可以相同，也可以不同。封装后的数据报文在网络中传输的路径，称为 GRE 隧道。GRE 隧道是一个虚拟的点到点的连接，其两端的设备分别对数据报文进行封装及解封装。
1.1.1 GRE封装后的报文格式
图1-1 GRE 封装后的报文格式
如 图 1-1 所示，GRE封装后的报文包括如下几个部分： • 净荷数据（Payload packet）：需要封装和传输的数据报文。净荷数据的协议类型，称为乘客
协议（Passenger Protocol）。乘客协议可以是任意的网络层协议。 • GRE 头（GRE header）：采用 GRE 协议对净荷数据进行封装所添加的报文头，包括封装层
目录
1 GRE··················································································································································· 1-1 1.1 GRE简介 ···········································································································································1-1 1.1.1 GRE封装后的报文格式···········································································································1-1 1.1.2 GRE隧道原理 ·························································································································1-2 1.1.3 GRE安全机制 ·························································································································1-2 1.1.4 应用场景 ·································································································································1-3 1.1.5 协议规范 ·································································································································1-5 1.2 配置GRE over IPv4 隧道···················································································································1-5 1.3 配置GRE over IPv6 隧道···················································································································1-6 1.4 GRE显示和维护 ································································································································1-8 1.5 GRE典型配置举例·····························································································································1-8 1.5.1 GRE over IPv4 隧道典型配置举例··························································································1-8 1.5.2 GRE over IPv6 隧道典型配置举例························································································1-11 1.6 常见配置错误举例 ···························································································································1-13
进行 GRE 封装，使其成为普通的单播报文。然后，IPsec 就可以对其进行进一步的处理。 • 简化 IPsec 的配置。由于所有报文都先经过 GRE 封装后再进行 IPsec 处理，因此只要根据
GRE 隧道的源/目的端地址来定义需要 IPsec 保护的数据流即可，不需要关注原始报文的源/ 目的地址，从而简化了 IPsec 的配置。 GRE 和 IPsec 还有另外一种配合方式，即 IPsec over GRE 隧道。但这种方式不能充分利用二者的 优势，一般不推荐使用。 关于 IPsec 的详细介绍请参见“安全配置指导”中的“IPsec”。
GRE 隧道模式的 Tunnel 接口（本例中为 Tunnel0）转发，并将报文发给相应的 Tunnel 接口。 (2) GRE 隧道模式的 Tunnel 接口收到此 IPv6 报文后，先在报文前封装上 GRE 头，再封装上 IPv4
头。IPv4 头中的源地址为隧道的源端地址（本例中为 Device A 的 GigabitEthernet1/0/1 接口 的 IP 地址），目的地址为隧道的目的端地址（本例中为 Device B 的 GigabitEthernet1/0/1 接 口的 IP 地址）。 (3) Device A 根据封装的 IPv4 头中的目的地址查找路由表，将封装后的 IPv4 报文通过 GRE 隧道 的实际物理接口（GigabitEthernet1/0/1）转发出去。 (4) 封装后的 IPv4 报文通过 GRE 隧道到达隧道的目的端设备 Device B 后，由于报文的目的地是 本设备，且 IPv4 头中的协议号为 47（表示封装的报文为 GRE 报文），Device B 将此报文交 给 GRE 协议进行解封装处理。 (5) GRE 协议先剥离掉此报文的 IPv4 头，再对报文进行 GRE Key 验证、校验和验证、报文序列 号检查等处理，处理通过后再剥离掉报文的 GRE 头，将报文交给 IPv6 协议进行后续的转发 处理。
1-2
2. GRE校验和验证 通过 GRE 校验和验证可以检查报文的完整性。 发送方根据 GRE 头及 Payload 信息计算校验和，并将包含校验和信息的报文发送给对端。接收方 对接收到的报文计算校验和，并与报文中的校验和比较，如果一致则对报文进行进一步处理，否则 丢弃该报文。
1.1.4 应用场景
如 图 1-6 所示，GRE可以和IPsec（IP Security，IP安全）配合使用，通过建立GRE over IPsec隧 道，对路由协议、语音、视频等数据先进行GRE封装，再对封装后的报文进行IPsec处理。二者配 合使用的优势如下： • 提高数据在隧道中传输的安全性。 • 解决 IPsec 只能处理单播报文的问题。GRE 可以支持组播、广播和非 IP 报文，先对这些报文
GRE 主要有以下几种应用场景。 1. 通过单一协议的骨干网连接采用不同协议的网络 图1-3 通过单一协议的骨干网连接采用不同协议的网络
IPv6 network 1
IPv6 network 2
Device A
Internet GRE tunnel
Device B
IPv4 network 1
IPv4 network 2
数、版本、乘客协议类型、校验和信息、Key 信息等内容。添加 GRE 头后的报文称为 GRE 报文。对净荷数据进行封装的 GRE 协议，称为封装协议（Encapsulation Protocol）。 • 传输协议的报文头（Delivery header）：在 GRE 报文上添加的报文头，以便传输协议对 GRE 报文进行转发处理。传输协议（Delivery Protocol 或者 Transport Protocol）是指负责转发 GRE 报文的网络层协议。设备支持 IPv4 和 IPv6 两种传输协议：当传输协议为 IPv4 时，GRE 隧道 称为 GRE over IPv4 隧道；当传输协议为 IPv6 时，GRE 隧道称为 GRE over IPv6 隧道。