A company is attempting to steer traffic to Netskope using GRE tunnels. They notice that after the initial configuration, users cannot access…

The inability for users to access external websites after configuring a GRE tunnel to Netskope points to a fundamental failure in tunnel establishment, connectivity, or traffic routing. The three most probable causes are:

1. Incorrect Peer Configuration (B): The GRE tunnel is a point-to-point link. If the source IP address of the corporate network device is not correctly registered as the peer in the Netskope platform, Netskope will not accept the tunnel, causing a complete failure.

2. Firewall Blockage (C): GRE uses IP Protocol 47. Corporate firewalls often restrict outbound traffic to well-known protocols like TCP and UDP by default. If the firewall is not explicitly configured to permit Protocol 47 to Netskope's data centers, the tunnel packets will be dropped.

3. Incorrect Routing (D): Policy-Based Routing (PBR), often implemented with route maps, is required to direct user traffic into the GRE tunnel. If this policy is misconfigured or applied to the wrong interface, traffic will not be steered to Netskope, leading to a loss of access if direct internet paths are otherwise restricted.

A. GRE as a protocol does not use pre-shared keys. Keys are used for IPsec, which is an optional method to secure a GRE tunnel, not a universal requirement.

E. This is factually incorrect. Netskope fully supports GRE as a standard method for steering traffic from on-premises networks to the Netskope Security Cloud.

1. Netskope Official Documentation

"GRE for Traffic Steering": The configuration and troubleshooting sections explicitly state the requirements for a successful GRE tunnel. It specifies that the customer's public source IP must be registered in the Netskope UI (supporting option B)

that firewalls must allow IP protocol 47 (supporting option C)

and provides examples of using Policy-Based Routing to forward traffic into the tunnel (supporting option D). (Reference: Netskope Technical Documentation

"Steering Configuration > GRE"

Section: "Prerequisites" and "Troubleshooting Common Issues").

2. Farrel

A.

& Kireev

I. (2020). GRE Tunnels. In The RSpec-based Transport Tunnel Model (RFC 8752). IETF. This standards document defines the operation of GRE. Section 1 describes GRE as an encapsulation protocol that uses IP Protocol 47

highlighting why firewalls must be configured to allow it for tunnel connectivity. This supports the reasoning for option C.

3. MIT OpenCourseWare

6.829 Computer Networks

Fall 2002. Lecture 12: Tunneling. This course material explains that for a tunnel to function

there must be IP reachability between the tunnel endpoints and a routing mechanism to direct traffic into the tunnel. This principle supports the validity of options B (endpoint reachability/configuration) and D (routing mechanism).