GRE tunnel - Revision history

Yousra at 11:12, 17 February 2026

2026-02-17T11:12:50Z

@@ Line 198: / Line 198: @@
 *[https://libreswan.org/man/ LibreSwan doc]
 *[https://github.com/zoulasc/racoon2/ Racoon2 doc]
 Linked to {{T|2202}}

Duranzed: /* IPsec */

2026-02-17T11:06:27Z

IPsec

← Older revision		Revision as of 11:06, 17 February 2026
Line 23:		Line 23:
	Data transmitted through IPsec over a network is sent in multiple “packets.” These packets contain:		Data transmitted through IPsec over a network is sent in multiple “packets.” These packets contain:

	IP HEADER \| TCP HEADER \| PAYLOAD		* IP HEADER \| TCP HEADER \| PAYLOAD
	Source and destination IP address \| Port and sequence number \| Contains the data to be transmitted		Source and destination IP address \| Port and sequence number \| Contains the data to be transmitted

Duranzed: /* IPsec */

2026-02-17T11:03:59Z

IPsec

← Older revision		Revision as of 11:03, 17 February 2026
Line 16:		Line 16:
	To use IPsec, the sender and the receiver must share a public or private key. This key is used to encrypt the data before sending and decrypt it upon reception. This ensures that the data remains intact during transmission.		To use IPsec, the sender and the receiver must share a public or private key. This key is used to encrypt the data before sending and decrypt it upon reception. This ensures that the data remains intact during transmission.

	IPsec has two modes:		'''IPsec has two modes:'''

	* Tunnel mode		* Tunnel mode

Duranzed at 10:58, 17 February 2026

2026-02-17T10:58:24Z

← Older revision		Revision as of 10:58, 17 February 2026
Line 1:		Line 1:
			= IPsec =
			IPsec is a set of protocols used for security at the network layer of the OSI model.

			IP = Internet Protocol
			sec = secure

			Its purpose is to secure communications between two points in a network. This is done by adding encryption and authentication.

			When machines communicate over a public network, the communication is usually transmitted in plain text. This is dangerous if sensitive information is being sent. IPsec solves this problem by protecting data during transmission using IKE (Internet Key Exchange).

			* Phase 1: The two sites identify each other and negotiate parameters for the authentication and encryption methods to be used.
			* Phase 2: IPsec creates a tunnel to protect the data (virtual tunnel).

			Data transport is handled by the ESP (Encapsulation Security Protocol). It provides authentication, integrity, and encryption.

			To use IPsec, the sender and the receiver must share a public or private key. This key is used to encrypt the data before sending and decrypt it upon reception. This ensures that the data remains intact during transmission.

			IPsec has two modes:

			* Tunnel mode
			* Transport mode

			Data transmitted through IPsec over a network is sent in multiple “packets.” These packets contain:

			IP HEADER \| TCP HEADER \| PAYLOAD
			Source and destination IP address \| Port and sequence number \| Contains the data to be transmitted

			By default, the packet does not include any security.

			When using transport mode, an ESP header, ESP trailer, and ESP authentication are added. The TCP header, payload, and ESP trailer are encrypted.

			When using tunnel mode, a “NEW IP HEADER” is added, and the original IP header is encrypted along with the TCP header, payload, and ESP trailer.
			[[File:Ipsec-transport-mode-ip-packet.png\|ESP transport mode]]

	==IPsec solutions ==		==IPsec solutions ==

Duranzed: /* Incident */

2026-02-16T12:45:03Z

Incident

← Older revision		Revision as of 12:45, 16 February 2026
Line 187:		Line 187:
	'''gre0: if_output recursively called too many times''' --> this was the cause of the cut connections between router-001 and windriver.		'''gre0: if_output recursively called too many times''' --> this was the cause of the cut connections between router-001 and windriver.
	this error comes from the FreeBSD kernel file sys/net/if.c, in the function if_tunnel_check_nesting().		this error comes from the FreeBSD kernel file sys/net/if.c, in the function if_tunnel_check_nesting().
			* When creating a GRE tunnel between two machines and this one doesn't respond or cuts connectiong, proceed to destory the tunnel on both sides to allow traffic back.

	Recommandations :		Recommandations :

Duranzed: /* Incident */

2026-02-16T11:12:11Z

Incident

← Older revision		Revision as of 11:12, 16 February 2026
Line 182:		Line 182:
	* Established a rule: do not create GRE-over-GRE in the current infrastructure to avoid recursion and outages, if mandatory, always have KVM prepared and the VM itself to prevent any long server outage.		* Established a rule: do not create GRE-over-GRE in the current infrastructure to avoid recursion and outages, if mandatory, always have KVM prepared and the VM itself to prevent any long server outage.

	*Technical analysis:		Technical analysis:

	dmesg showed the following error:		dmesg showed the following error:

Duranzed: /* Incident */

2026-02-16T11:11:48Z

Incident

← Older revision		Revision as of 11:11, 16 February 2026
Line 185:		Line 185:

	dmesg showed the following error:		dmesg showed the following error:
	'''gre0: if_output recursively called too many times''' --> this was the cause to cut connections between router-001 and windriver.		'''gre0: if_output recursively called too many times''' --> this was the cause of the cut connections between router-001 and windriver.
	this error comes from the FreeBSD kernel file sys/net/if.c, in the function if_tunnel_check_nesting().		this error comes from the FreeBSD kernel file sys/net/if.c, in the function if_tunnel_check_nesting().

Duranzed: /* Incident */

2026-02-16T11:11:18Z

Incident

← Older revision		Revision as of 11:11, 16 February 2026
Line 185:		Line 185:

	dmesg showed the following error:		dmesg showed the following error:
	"gre0: if_output recursively called too many times" --> this was the cause to cut connections between router-001 and windriver.		'''gre0: if_output recursively called too many times''' --> this was the cause to cut connections between router-001 and windriver.
	this error comes from the FreeBSD kernel file sys/net/if.c, in the function if_tunnel_check_nesting().		this error comes from the FreeBSD kernel file sys/net/if.c, in the function if_tunnel_check_nesting().

Duranzed: /* Incident */

2026-02-16T11:10:01Z

Incident

← Older revision		Revision as of 11:10, 16 February 2026
Line 182:		Line 182:
	* Established a rule: do not create GRE-over-GRE in the current infrastructure to avoid recursion and outages, if mandatory, always have KVM prepared and the VM itself to prevent any long server outage.		* Established a rule: do not create GRE-over-GRE in the current infrastructure to avoid recursion and outages, if mandatory, always have KVM prepared and the VM itself to prevent any long server outage.

	Technical analysis:		*Technical analysis:

	dmesg showed the following error:		dmesg showed the following error:
	"gre0: if_output recursively called too many times" --> this was the cause to cut connections between router-001 and windriver.		"gre0: if_output recursively called too many times" --> this was the cause to cut connections between router-001 and windriver.

Duranzed: /* Incident */

2026-02-16T11:09:33Z

Incident

@@ Line 181: / Line 181: @@
 * Performed a controlled network interface restart.
 * Established a rule: do not create GRE-over-GRE in the current infrastructure to avoid recursion and outages, if mandatory, always have KVM prepared and the VM itself to prevent any long server outage.
 Linked to {{T|2202}}