Tunnels
Encapsulation types
Junos tunnel interfaces are named by type: gr- for GRE, ip- for IP-in-IP, vt- for virtual tunnels, lt- for logical tunnels, and st-. Configuration binds source and destination, then treats the tunnel as an ordinary interface: set interfaces gr-0/0/0 unit 0 tunnel source 10.1.1.1 destination 10.2.2.2 family inet address 192.168.1.1/30. The outer header consumes bytes, so the tunnel MTU must be reduced by the overhead - 24 bytes for GRE (20-byte IP header plus 4-byte GRE header). Otherwise large packets fragment or vanish when the DF bit is set. Junos offers clear-dont-fragment-bit, copy-dont-fragment-bit, and path MTU discovery to manage this.
What tunnels are for
GRE is unencrypted and carries multicast and non-IP protocols, which makes it useful for routing protocols across a provider. IP-in-IP is the lighter alternative. IPsec adds confidentiality through IKE and ESP. VXLAN with EVPN is the data-centre overlay on QFX, using a VTEP source interface and EVPN signalling.
Traps
- Tunnel endpoints must be reachable in the underlying routing table; a recursive or missing route silently breaks the tunnel.
- Traffic inside a tunnel does not automatically inherit filtering applied to the physical interface - filter the tunnel interface.
- MTU mismatch produces the classic symptom where pings succeed and large transfers hang.
- GRE provides no encryption; do not describe it as a VPN in the cryptographic sense.
Worked example
A 1500-byte physical path carrying GRE leaves 1476 bytes of payload. If an application insists on 1500-byte packets with DF set, either clamp MSS, enable path MTU discovery, or let Junos clear the DF bit.