> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/network-ddos/faq/setting-up-gre.md).
# Setting up GRE
## Important considerations when using GRE tunnels
{% hint style="warning" %}
When implementing GRE tunnels with the Link11 network, several key technical considerations are essential to ensure both functionality and performance:
1\. **Tunnel Configuration & Firewall**
* At least one GRE tunnel to the DDoS-Cluster is required for protection; we recommend two or more.
* Ensure no firewall rules are blocking the GRE tunnel (protocol 47) or interfering with its operation.
2\. **MTU and TCP-MSS Settings**
* Due to a 24-byte GRE header overhead, adjust your settings to prevent packet fragmentation.
* Set the GRE tunnel **MTU** to **1476**.
* Set the **TCP-MSS** to **1436** on the tunnel and all relevant egress interfaces.
3\. **Handling High Traffic Volumes (>5 Gb/s)**
* For large traffic volumes, use multiple GRE tunnels instead of a single high-capacity tunnel.
* This best practice prevents performance issues caused by:
* **Single-Thread CPU Limitations**
* **Traffic Saturation** from microbursts
* **Disruption to TCP Synchronization**
{% endhint %}
## How to setup GRE from customer environment to Link11
The basic example of setting up a simple GRE Tunnel with example Router A Source IP 2.4.6.8 & Router B 62.64.66.68 looks like this on a CISCO:
```
Router A:
interface Tunnel0
ip address 192.168.1.1 255.255.255.0
tunnel source 2.4.6.8
tunnel destination 62.64.66.68
tunnel mode gre ip
Router B
interface Tunnel0
ip address 192.168.1.2 255.255.255.0
tunnel source 62.64.66.68
tunnel destination 2.4.6.8
tunnel mode gre ip
```
The same configuration on a Juniper looks like:
```
Router A:
set interfaces gr-0/0/0 unit 0 tunnel source 2.4.6.8
set interfaces gr-0/0/0 unit 0 tunnel destination 62.64.66.68
set interfaces gr-0/0/0 unit 0 family inet address 192.168.1.1/24
set interfaces gr-0/0/0 unit 0 family inet mtu 1400
Router B
set interfaces gr-0/0/0 unit 0 tunnel source 62.64.66.68
set interfaces gr-0/0/0 unit 0 tunnel destination 2.4.6.8
set interfaces gr-0/0/0 unit 0 family inet address 192.168.1.2/24
set interfaces gr-0/0/0 unit 0 family inet mtu 1400
```
This setup will establish a GRE between two devices. Please keep in mind that GRE is a stateless protocol and also dependent from the group Level Access:
* The CE Router will not notice any UP/DOWN for the GRE.
* If the related access link has packet loss, CRC errors or disconnects, it will also affect the information passing the GRE.
This example shows the same GRE Setup but with BGP advertisement Router A 2.4.6.8 & Router B 62.64.66.68 with 160.136.0.0/13 from AS721 (bogon) over the AS34309 (link11):
For a Cisco Router this looks like:
```
Router A
interface Tunnel0
ip address 192.168.1.1 255.255.255.0
tunnel source 2.4.6.8
tunnel destination 62.64.66.68
tunnel mode gre ip
router bgp 34309
neighbor 192.168.1.2 remote-as 210378
neighbor 192.168.1.2 update-source Loopback0
network 160.63.240.0 mask 255.255.248.0
Router B
interface Tunnel0
ip address 192.168.1.2 255.255.255.0
tunnel source 62.64.66.68
tunnel destination 2.4.6.8
tunnel mode gre ip
router bgp 210378
neighbor 192.168.1.1 remote-as 34309
neighbor 192.168.1.1 update-source Loopback0
network 160.63.240.0 mask 255.255.248.0
```
The same configuration on a Juniper looks like:
```
Router A
set protocols bgp group GRE type internal
set protocols bgp group GRE local-address 192.168.1.1
set protocols bgp group GRE family inet unicast
set protocols bgp group GRE neighbor 192.168.1.2
set protocols bgp group GRE neighbor 192.168.1.2 remote-as 34309
set protocols bgp group GRE neighbor 192.168.1.2 soft-reconfiguration inbound
set policy-options policy-statement announce-160-63-240-0/21 term 1 from protocol direct
set policy-options policy-statement announce-160-63-240-0/21 term 1 then accept
set protocols bgp group GRE neighbor 192.168.1.2 export announce-160-63-240-0/21
Router B
set protocols bgp group GRE type internal
set protocols bgp group GRE local-address 192.168.1.2
set protocols bgp group GRE family inet unicast
set protocols bgp group GRE neighbor 192.168.1.1
set protocols bgp group GRE neighbor 192.168.1.1 remote-as 210378
set protocols bgp group GRE neighbor 192.168.1.1 soft-reconfiguration inbound
set policy-options policy-statement announce-160-63-240-0/21 term 1 from protocol direct
set policy-options policy-statement announce-160-63-240-0/21 term 1 then accept
set protocols bgp group GRE neighbor 192.168.1.1 export announce-160-63-240-0/21
```