Connecting Discontinuous Sub-networks to Establish a VPN
With GRE tunnels, you can connect discontinuous sub-networks to establish a VPN across a WAN.
Assume that two VPN sub-networks, Site 1 and Site 2, are deployed in two different cities. By setting up a GRE tunnel between the PEs, you can connect the two sub-networks to establish a VPN.
GRE, which applies to both L2VPNs and L3VPNs, can be used in either CPE-based VPN or network-based VPN scenarios:
In a CPE-based VPN scenario, both ends of the GRE tunnel reside on CEs, as shown in Figure 1.
In this mode, a CE refers to a CPE.
In a network-based VPN scenario, both ends of the GRE tunnel reside on PEs, as shown in Figure 2.
Usually, the VPN backbone network uses label switched paths (LSPs) as public network tunnels. If the core devices (Ps) on the backbone network provide only the IP function whereas the PEs at the network edge provide MPLS functions, LSPs cannot be used as public network tunnels. In this situation, you can use GRE tunnels instead of LSPs in Layer 2 or Layer 3 VPN solutions. Figure 3 shows the format of a private network packet transmitted on the VPN backbone network.
GRE tunnels can also be used as non-MPLS VPN backbone tunnels. In this case, the private network packet cannot contain the MPLS label when being transmitted on the VPN backbone network. Figure 4 shows the format of such a packet.
