An enterprise uses separate routed networks at its headquarters and regional sites, yet one application must retain a consistent reachability model while packets cross a transport provider that knows nothing about the internal addressing scheme. This is where overlay and tunneling vocabulary becomes useful. A tunnel can carry one packet inside another, an encryption layer can protect it, and a mapping system can separate an endpoint’s identity from its current location. Those are different functions, and confusing them produces both troubleshooting and security failures.
The 350-401 ENCOR v1.2 Virtualization domain asks candidates to configure and verify VRF, GRE and IPsec technologies and to describe LISP and VXLAN. The already published VRF and VXLAN specialist explores separate routing tables and Ethernet overlays. This treatment focuses on why GRE needs a reachable underlay, what IPsec adds, and how LISP’s endpoint-to-location model differs from merely wrapping traffic in a new IP header.
Start with underlay reachability and the tunnel contract
A tunnel is not an alternative to routing. Before two GRE endpoints can exchange any encapsulated traffic, each tunnel source must be able to reach the remote tunnel destination over the underlay. That underlay might be a private routed backbone, an MPLS service, or the public internet. A tunnel interface can be administratively up even when routing, filtering, or a carrier failure makes the remote endpoint unusable; treat interface state as one clue, not the whole proof of connectivity.
Document the outer source and destination addresses, the inner addressing plan, effective MTU, expected routing adjacencies and the path over which outer packets will travel. Avoid recursively routing the destination of the tunnel through the tunnel itself. Such recursive resolution can bring a new overlay down as soon as a more attractive route is learned. Keep a separate control route to the outer endpoint and validate how it behaves during failover.
Understand what GRE does—and what it does not protect
Generic Routing Encapsulation (GRE) wraps selected traffic in a new delivery header so that routers can forward an inner protocol across an outer IP network. A straightforward point-to-point GRE tunnel can connect routing instances across networks that would otherwise carry only ordinary IP unicast. GRE itself does not encrypt the user’s payload or authenticate the remote router, so sending sensitive data over the open internet with only GRE is a security design error.
Consider two offices running OSPF between tunnel endpoints. The GRE transport can carry the routing messages, but the engineer must distinguish the tunnel-facing OSPF adjacency from the static or dynamic route used to reach the GRE outer destination. When an adjacency drops, inspect the underlay path, tunnel source and destination, access lists that may block protocol 47, inner IP addresses, and the routing protocol’s own authentication and neighbor requirements. Changing the OSPF area will not repair a carrier path that never passes GRE packets.
Use IPsec to meet confidentiality and integrity requirements
IPsec adds cryptographic protection, peer authentication and integrity checks under supported modes and negotiated policies. GRE-over-IPsec combines the encapsulation flexibility of GRE with the protection of IPsec; some site-to-site designs use route-based IPsec or virtual tunnel interfaces without requiring a separate GRE layer. The right choice depends on routing requirements, supported platforms, remote peer behavior and operational simplicity, not a blanket rule that stacking more protocols is always safer.
Troubleshooting begins by separating successful security negotiation from actual protected traffic. A peer can establish an IKE security association while an expected child security association does not match the intended flows, while routing directs packets to a different path, or while NAT and provider filtering break the data exchange. Inspect peer identity, crypto parameters, protected selectors or tunnel binding, security association counters, and return traffic. The Cisco GRE-over-IPsec configuration treatment gives a related implementation context, but release-specific command syntax must always be checked against the running IOS XE platform.
Budget encapsulation overhead before traffic grows
Every additional header consumes part of the available path MTU. A packet that fits a plain routed interface can fragment or disappear after GRE and IPsec overhead if intermediate links prohibit fragmentation or filter needed ICMP messages. This often appears as a deceptively selective failure: a small ping works, but large application transactions time out. Do not assume a healthy tunnel interface proves that the original path MTU remains safe for every workload.
In a controlled test, send different payload sizes with the appropriate don’t-fragment behavior, observe TCP MSS negotiation where relevant, and check counters for drops or fragmentation. Adjust MTU and MSS only after understanding the actual overlay and underlay requirements. An indiscriminate global reduction may hide one defect while making other flows less efficient. Document the expected encapsulation stack so future engineers know why an interface has an unusual MTU policy.
Model LISP as a mapping problem, not another encrypted tunnel
Locator/ID Separation Protocol (LISP) distinguishes Endpoint Identifiers (EIDs), which represent destinations within a site or overlay, from Routing Locators (RLOCs), which indicate where their traffic can be sent through the routed infrastructure. Control-plane functions such as Map-Resolvers and Map-Servers participate in resolving the relationship. This approach can help mobility and scalable endpoint reachability because the identity and current attachment of an endpoint need not be conflated.
Imagine a campus fabric endpoint moving between access locations. An engineer should ask whether the old endpoint-to-location mapping was updated, which border or edge router knows the current locator, and whether the new underlay path can carry the encapsulated traffic. This is a different diagnostic from checking a GRE tunnel’s manually configured outer destination. The existing Cisco SD-Access architecture article explains where LISP-based control functions and VXLAN-based forwarding can work together in a fabric. LISP does not itself turn that fabric into a generic IPsec VPN.
Explain how VXLAN is different from GRE
VXLAN encapsulates Layer 2 frames in UDP/IP so that logical Layer 2 segments can be carried across a routed underlay; VNIs distinguish virtual networks. GRE generally offers a different tunnel model, often point-to-point, while VXLAN involves overlay segment identifiers and termination at virtual tunnel endpoints. Neither name guarantees that the encapsulated data is encrypted end to end. Security must come from the selected transport protection, access controls and architecture.
For a data center or campus overlay, consider which device learns endpoint location, how a VNI relates to a tenant or segment, and which gateways provide access to other networks. One incorrect endpoint mapping can strand users even when the underlay’s routing table looks normal. By comparison, a GRE tunnel failing because its remote public address is unreachable has a fundamentally different root cause. Engineers who lump both into “virtualization failure” usually troubleshoot the wrong control plane.
Verify with independent tests and operational evidence
Build a two-router GRE lab with a documented underlay default route and a small inner subnet. Verify outer reachability before enabling routing over the tunnel, then confirm the intended inner destination using a source-aware ping and traceroute. In a separate supported IPsec lab, test protected versus unprotected traffic, observe security association counters, and deliberately remove one required permission to prove the failure can be detected safely. No production secrets should be placed into lab notes or published configuration snippets.
Test failures deliberately: deny the remote outer address, introduce an MTU-sensitive payload, withdraw the route to a tunnel destination, or cause an incorrect return path. Record the actual observation and the boundary it proves. For LISP, a conceptual map exercise can show two EIDs and their RLOCs before and after endpoint movement; explain where mapping state must change and where underlay reachability must remain stable. The ability to distinguish mapping, encapsulation, encryption and routing is the durable skill these apparently similar technologies share.
An effective verification exercise also compares payload size and forwarding treatment across the layers. Send small probes first, then a larger packet with a known size and the relevant fragmentation behavior, and inspect the source and destination interface counters. The tunnel may carry a basic ICMP echo successfully while application traffic fails because encapsulation consumes the available MTU. Measure the real path rather than immediately disabling a security feature or globally lowering every server’s MTU. If encryption is added, verify that protected counters advance for the intended traffic selector and that a deliberate negative test does not leak traffic outside the authorized path.
A mapping or encapsulation change also needs a source-of-truth check. When an EID moves, record its expected location, the control component responsible for registration, its observed locator, and whether a stale mapping survives beyond the allowed convergence period. A fresh traceroute and the relevant device control-plane state should support the same conclusion. This discipline distinguishes delayed location convergence from an underlying link outage and avoids treating a transient cache entry as a permanent architecture failure.
Avoid building an overlay that survives only on a diagram
A production overlay needs operational ownership, certificate or key rotation for protected connections, high availability for critical gateways, route filtering, monitoring, and a decommissioning process. Audit who may create new tunnels and which prefixes they advertise. A secure tunnel can still offer a dangerous bypass if it advertises a broad route into an unrelated sensitive segment. Segmentation and change control matter as much as cryptography.
The exam asks different verbs for different technologies: configure and verify data-path virtualization for GRE and IPsec, but describe LISP and VXLAN concepts. Study those distinctions carefully, and verify the supported platform before reproducing any example commands. Enterprise networking becomes easier to reason about when a team can state what each layer knows: the underlay knows how to deliver outer packets, a mapping service knows endpoint location, the overlay knows the logical destination, and a security layer knows how to protect the transport between trusted peers.