About tunneled uplinks
Local site uplink settings include the option to enable generic routing encapsulation (GRE) tunnel mode. Enable this feature on uplinks that traverse a stateful firewall between appliances.
Without GRE, traffic attempting to switch midstream to an uplink that traverses a stateful firewall might be blocked. This is because firewalls, which typically need to track TCP connection state and sequence numbers for security reasons, may have only partial or no packet sequence numbers, so it blocks the attempt to switch to the secondary uplink and might drop these packets. To traverse the firewall, The most common examples of midstream uplink switching occur when:
• a high-priority uplink fails over to a secondary uplink that traverses a firewall.
• a previously unavailable uplink recovers and resumes sending traffic to a firewalled uplink.
• path selection is using application definitions to identify the traffic and doesn’t yet recognize the first packets of a connection before traversing a default uplink.
The GRE tunnel starts at the local appliance and ends at the remote one. Both appliances must be running RiOS 8.6.x or later. The tunnel configuration is local. The remote IP address must be a remote appliance’s in-path interface and the remote appliance must have path selection enabled. ICMP responses from the remote appliance use the same tunnel from which the ping is received. The remote appliance must also have GRE tunnel mode enabled if the user wants return traffic to go through a GRE as well.
GRE tunneled traffic can be optimized. GRE acceleration supports hub-and-spoke and spoke-to-spoke topologies, up to a maximum of 100 tunnels.
The GRE tunnel must be started and terminated between two routers. In addition, the default route for the appliances should be directed to the WAN. Multiple appliances can be used in a point-to-point tunnel, as long as all of them are inside the tunnel. The following figures show example GRE topologies.
Simple GRE optimization topology
Simple GRE optimization spoke-to-spoke topology
Physical appliance models CX 3080, 5080, 7080 and virtual models on KVM and ESXi platforms support GRE tunnel optimization.
The following features are supported with GRE tunnel optimization:
• TCP optimization and pass-through
• HTTP/HTTPS optimization
• SMB optimization
• NFS optimization
• Video over HTTP/HTTPS optimization
• MAPI optimization
• MX-TCP QoS support
• Simplified routing
• VLAN support
• Full transparency and correct addressing WAN visibility modes
The following features are not supported:
• Asymmetric routing
• QoS classification (except MX-TCP)
• Single-ended interception
• Policy-based routing (PBR)
• UDP and IPv6
• Port transparency WAN visibility mode (full transparency and correct addressing are supported)
• Path selection
• Double interception
• Interceptor support
The following traffic is not optimized with GRE tunnel optimization:
• Out-of-band (OOB) traffic is not optimized. If OOB connections are received from a GRE tunnel, they will be relayed instead of optimized.
• Checksum, key, and sequence numbers are not optimized.