Question

A network engineer is designing GRE over IPsec connectivity from an on-premises Cisco IOS XE router to a native Google Cloud HA VPN gateway. The engineer initially proposed running a GRE tunnel encapsulated in IPsec directly to the Cloud VPN gateway endpoint. During validation, the tunnel to the native Cloud VPN gateway will not establish the GRE overlay. What is the correct explanation and remediation for connecting to the native Google Cloud VPN endpoint?

Accepted Answer

Google Cloud native HA VPN gateways do not support GRE; the engineer must use a plain IPsec tunnel (IKEv2 with a VTI) directly to the Cloud VPN endpoint and run BGP over the tunnel interface.

Answer

GRE will work once the engineer disables IKEv2 and switches to IKEv1 main mode, since Google Cloud only negotiates GRE keys during IKEv1.

Answer

The GRE tunnel fails because DPD is enabled; disabling Dead Peer Detection on both ends allows the GRE overlay to form over the native gateway.

Answer

The engineer must enable jumbo MTU of 9000 bytes on the tunnel, because native Cloud VPN gateways require GRE frames larger than 1500 bytes to complete the overlay handshake.