WAN, VPN & GRE

Overview

A WAN connects geographically dispersed LANs. Organizations choose dedicated private links, provider MPLS services, or VPN overlays across the public Internet. GRE adds a virtual point-to-point tunnel that can carry multiple protocols — usually wrapped in IPsec for encryption on untrusted paths.

LAN, WAN, and MAN

These terms describe scope, not a specific technology:

Private WAN vs VPN

A private WAN uses links dedicated to one organization (leased lines, MPLS VPN). A VPN builds an encrypted virtual tunnel across shared infrastructure — usually the Internet — so remote sites appear logically connected.

jdepew88 notes that VPNs have largely replaced leased-line-only designs for cost reasons, while leased lines remain where guaranteed bandwidth and SLA matter.

MPLS VPN (CCNA awareness)

MPLS uses label switching in the provider core — forwarding decisions use labels, not destination IP alone, inside the SP network.

CE routers do not run MPLS; only PE/P routers do.

Internet access technologies

Legacy leased lines (serial PPP/HDLC) still appear in exam scenarios but Ethernet/fiber and Internet VPN are more common in modern designs.

Site-to-site IPsec process

1. Sending router encrypts original packet with session key
2. Encapsulates with VPN header + new outer IP header
3. Sends across Internet to peer router
4. Receiving router decrypts and forwards original packet to destination

Only tunnel endpoints (typically Internet-facing routers) build the VPN — internal hosts send plain IP to their site router.

GRE over IPsec

GRE alone is not encrypted but carries multicast/broadcast and multiple L3 protocols. GRE over IPsec wraps GRE inside encrypted IPsec — flexibility plus security.

DMVPN (awareness)

DMVPN lets spokes build a full mesh of IPsec tunnels dynamically via a hub — combines hub-and-spoke configuration simplicity with spoke-to-spoke efficiency. CCNA awareness only; configuration is beyond scope.

Site-to-site vs remote-access VPN

Remote-access often uses Cisco AnyConnect or browser TLS (HTTPS) to a concentrator — distinct from branch CAPWAP tunnels to a WLC (Wireless Configuration).

WAN connection options

Enterprise / primary links (Panagiss + jdepew88):

Backup / branch / home: DSL, cable, 4G/5G — lower cost, often no corporate SLA; common as Internet VPN backup.

Leased lines and serial encapsulation (jdepew88 WAN.md)

Point-to-point serial links provide a dedicated permanent connection between two sites. jdepew88 walks through encapsulation change at the WAN edge:

1. LAN (Ethernet) — IP packet inside Ethernet frame
2. Router strips L2 — forwards across WAN using HDLC or PPP on the serial link
3. Remote router — strips HDLC/PPP, re-encapsulates in Ethernet toward the destination host

CSU/DSU sits at the customer demarc on digital leased lines — connects the telco circuit to the router (DTE). The CSU/DSU provides clocking (DCE) for synchronous serial. A modem converts analog phone lines; CSU/DSU connects digital lines to digital routers.

Telco demarc — the boundary where provider responsibility ends and customer responsibility begins.

MPLS VPN

MPLS runs on provider P (provider) and PE (provider edge) routers. Customer CE routers peer at Layer 3 with PE — the provider core is transparent to customer routing.

WAN topology patterns

IPsec (jdepew88 VPNs.md)

IPsec protects IP packets at the network layer. Three protocols to know:

Modes:

• Transport — encrypts payload; original IP header visible. Host-to-host when endpoints are VPN peers.
• Tunnel — new outer IP header (gateway public IPs). Site-to-site default when routers build the tunnel.

Key exchange: IKE with Diffie-Hellman groups lets peers derive a shared secret over an insecure channel. Attackers cannot feasibly compute the secret without private values. The shared key feeds symmetric ciphers (AES) for bulk encryption.

Authentication: pre-shared key (simple labs) or digital certificates (scale).

Out-of-band key delivery — exchanging secrets via a separate channel (phone call) — contrasts with in-band IKE negotiation.

! Phase 1 — IKE policy
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
! Phase 2 — IPsec transform set
crypto ipsec transform-set TS1 esp-aes esp-sha-hmac
mode tunnel
! Crypto map on Internet interface
crypto map VPN-MAP 10 ipsec-isakmp
set peer 203.0.113.2
set transform-set TS1
match address VPN-TRAFFIC

GRE overlay tunnels (jdepew88 GRE Tunnels.md)

GRE (Generic Routing Encapsulation, RFC 2784) builds a virtual point-to-point link:

• Carries multiple Layer 3 protocols (IPv4, IPv6, multicast)
• Supports routing protocols across the tunnel
• No encryption or authentication — clear text on the Internet
• Common pattern: GRE inside IPsec — GRE transports; IPsec encrypts

Packet structure: outer delivery IP header (tunnel endpoint public IPs) + 4-byte GRE header + inner payload.

jdepew88 lab pattern: R1/R5 act as PCs (no ip routing, ip default-gateway). R2/R4 build Tunnel0 between public IPs 4.1.1.1 and 4.1.2.2. R3 routes only on the outer header — inner traffic is invisible to path logic but not encrypted without IPsec.

interface Tunnel0
ip address 10.1.3.1 255.255.255.252
tunnel mode gre ip
tunnel source 4.1.1.1
tunnel destination 4.1.2.2
!
router eigrp 100
network 10.0.0.0

Design patterns

Typical branch (CCNA scenario):

1. Primary WAN — MPLS or dedicated link to HQ
2. Internet circuit — site-to-site IPsec backup or primary VPN
3. Optional GRE over IPsec — carry multicast routing or dynamic IGP across the tunnel
4. Wireless at branch — lightweight APs join HQ WLC over CAPWAP (often inside site-to-site IPsec); FlexConnect can switch guest/staff VLANs locally (Wireless Configuration)

Troubleshooting

Exam checklist

• Compare leased line, MPLS, Ethernet WAN, and Internet VPN tradeoffs
• Name CE, PE, and P router roles in MPLS
• Explain site-to-site vs remote-access VPN
• Describe IPsec encapsulation steps at a high level
• Explain why GRE over IPsec exists (multicast + encryption)
• Identify hub-and-spoke hairpin limitation
• Know HDLC/PPP role on serial WAN links and CSU/DSU clocking