VRF, GRE & IPsec Quick Reference

A VRF gives a single router multiple, completely separate routing tables. An interface belongs to exactly one VRF (or the global table) at a time — assigning it to a VRF removes it from the global table. Two VRFs can safely use identical, overlapping IP address ranges, because their routing tables never reference each other unless a route is deliberately leaked.

The most common real-world mistake: configuring an interface's IP address before assigning it to the VRF. VRF assignment clears existing IP configuration on most platforms — assign the VRF first, then the address.

GRE encapsulates a packet inside a new IP packet, creating a virtual point-to-point link across an existing IP network. It's protocol-agnostic and carries routing-protocol multicast/broadcast traffic that IPsec alone cannot. It provides zero encryption on its own — pair it with IPsec when confidentiality matters.

A tunnel stuck in up/down almost always means the router can't reach the configured tunnel destination address — check basic underlying IP reachability before anything else.

IKE Phase 1 builds a secure, authenticated management tunnel between two peers (commonly using a pre-shared key). Phase 2 then uses that tunnel to negotiate the parameters that actually protect data traffic and builds the real IPsec Security Associations.

The two phases fail independently. A Phase 1 SA showing READY only confirms authentication succeeded — it says nothing about whether Phase 2's transform set actually matches. Always check 'show crypto ipsec sa' for real, incrementing encaps/decaps counters, not just Phase 1 status.

An IPsec VTI (route-based) provides a real, routable tunnel interface a routing protocol can run over directly — unlike a traditional crypto-map (policy-based) approach, which only protects traffic matching a static ACL with no interface for a routing protocol to use.