Cisco GRE Tunnel Lab: Step-by-Step Configuration Guide with EIGRP Verification
Hands-on Cisco IOS lab — build a point-to-point GRE tunnel, configure static routing, run EIGRP over the tunnel, and verify everything with show commands
What Is GRE?
GRE (Generic Routing Encapsulation) is a Cisco-developed tunneling protocol (RFC 2784) that wraps any IP packet inside a new outer IP header, creating a virtual point-to-point link between two routers across a public network. It runs on IP Protocol 47 — no TCP or UDP ports involved. The ISP in the middle sees only standard IP packets and has no knowledge of the private subnets tunneled inside.
Key properties: GRE is not encrypted — it only encapsulates. It supports multicast, meaning EIGRP, OSPF, and other routing protocols work natively over it. Each GRE packet adds 24 bytes of overhead (20B outer IP + 4B GRE header), reducing the effective MTU from 1500 to 1476 bytes.
Lab Topology & IP Addressing
The lab uses three routers. R-1 and R-3 are the tunnel endpoints. R-2 is a plain ISP router — it has no tunnel configuration at all and no awareness of the private loopback networks. The GRE tunnel runs transparently through it.
| Device | Interface | IP Address | Purpose |
|---|---|---|---|
| R-1 | Gi0/0 | 15.0.0.1/24 | Uplink to ISP |
| R-1 | Loopback1 | 192.168.1.100/24 | Simulated LAN |
| R-1 | Tunnel10 | 10.0.12.1/24 | GRE endpoint |
| R-2 (ISP) | Gi0/0 | 15.0.0.5/24 | Toward R-1 |
| R-2 (ISP) | Gi0/1 | 25.0.0.5/24 | Toward R-3 |
| R-3 | Gi0/0 | 25.0.0.2/24 | Uplink to ISP |
| R-3 | Loopback1 | 192.168.2.100/24 | Simulated LAN |
| R-3 | Tunnel10 | 10.0.12.2/24 | GRE endpoint |
Base Configuration — R-1, R-2, R-3
Configure physical interfaces and loopbacks on all three routers. R-2 only needs its two uplink interfaces — nothing else.
R-1
R-1(config)#interface GigabitEthernet0/0
R-1(config-if)#ip address 15.0.0.1 255.255.255.0
R-1(config-if)#no shutdown
R-1(config-if)#exit
R-1(config)#interface loopback 1
R-1(config-if)#ip address 192.168.1.100 255.255.255.0R-2 (ISP)
R-2(config)#interface GigabitEthernet0/0
R-2(config-if)#ip address 15.0.0.5 255.255.255.0
R-2(config-if)#no shutdown
R-2(config-if)#exit
R-2(config)#interface GigabitEthernet0/1
R-2(config-if)#ip address 25.0.0.5 255.255.255.0
R-2(config-if)#no shutdownR-3
R-3(config)#interface GigabitEthernet0/0
R-3(config-if)#ip address 25.0.0.2 255.255.255.0
R-3(config-if)#no shutdown
R-3(config-if)#exit
R-3(config)#interface loopback 1
R-3(config-if)#ip address 192.168.2.100 255.255.255.0Static Routes — Underlay Reachability
The GRE tunnel cannot come up until the tunnel destination IP is reachable through the physical network. Add static routes on all three routers before configuring any tunnel interfaces.
! R-1 — reach R-3's physical subnet and loopback
R-1(config)#ip route 25.0.0.0 255.255.255.0 15.0.0.5
R-1(config)#ip route 192.168.2.0 255.255.255.0 15.0.0.5
! R-3 — reach R-1's physical subnet and loopback
R-3(config)#ip route 15.0.0.0 255.255.255.0 25.0.0.5
R-3(config)#ip route 192.168.1.0 255.255.255.0 25.0.0.5
! R-2 — needed for cross-loopback ping tests
R-2(config)#ip route 192.168.1.0 255.255.255.0 15.0.0.1
R-2(config)#ip route 192.168.2.0 255.255.255.0 25.0.0.2Create the GRE Tunnel
With underlay reachability confirmed, create tunnel 10 on both R-1 and R-3. The tunnel mode defaults to gre ip — no explicit mode command needed. Source and destination are swapped on each end.
R-1 — Tunnel10
R-1(config)#interface tunnel 10
R-1(config-if)#ip address 10.0.12.1 255.255.255.0
R-1(config-if)#tunnel source 15.0.0.1
R-1(config-if)#tunnel destination 25.0.0.2
R-1(config-if)#exit
! Tunnel10 line protocol changed state to upR-3 — Tunnel10
R-3(config)#interface tunnel 10
R-3(config-if)#ip address 10.0.12.2 255.255.255.0
R-3(config-if)#tunnel source 25.0.0.2
R-3(config-if)#tunnel destination 15.0.0.1
R-3(config-if)#exit
! Tunnel10 line protocol changed state to upEIGRP over the Tunnel
Because GRE supports multicast, EIGRP hello packets flow through the tunnel and form a neighbor adjacency between R-1 and R-3. Configure EIGRP AS 100 on both routers, advertising only the tunnel subnet.
! R-1
R-1(config)#router eigrp 100
R-1(config-router)#no auto-summary
R-1(config-router)#network 10.0.12.0
! R-3
R-3(config)#router eigrp 100
R-3(config-router)#no auto-summary
R-3(config-router)#network 10.0.12.0
%DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.0.12.1 (Tunnel10) is upVerification & Show Commands
! Check tunnel state
R-1#show ip interface tunnel 10
Tunnel10 is up, line protocol is up
Internet address is 10.0.12.1/24
Tunnel source 15.0.0.1 (Gi0/0), destination 25.0.0.2
Tunnel protocol/transport GRE/IP
! Ping across tunnel
R-1#ping 10.0.12.2
!!!!! Success rate 100 percent (5/5)
! Cross-loopback ping
R-1#ping 192.168.2.100
!!!!! Success rate 100 percent (5/5)
! EIGRP neighbour table
R-1#show ip eigrp neighbor
0 10.0.12.2 Tu10 14 00:01:52 47 1470 0 1Quick Troubleshooting Reference
| Symptom | Cause | Fix |
|---|---|---|
| Tunnel up/down | No route to tunnel destination | Add static route to remote physical IP via physical next-hop |
| Tunnel down/down | Source interface is down | Bring up physical interface; check show ip int brief |
| Pings fail | Recursive routing loop | Ensure tunnel destination routes via physical interface, not Tunnel |
| No EIGRP neighbours | Wrong network statement or AS | Verify network 10.0.12.0 and matching AS on both ends |
| Large pings fail | MTU / fragmentation | Set ip tcp adjust-mss 1436 on tunnel interface |
All configurations verified on Cisco vIOS2 in EVE-NG. GRE protocol reference: RFC 2784.
