A network designer has provisioned a router to use IPsec to encrypt the traffic over a GRE tunnel going to a web server at a remote location. From the router, the network designer can ping the web…

The GRE tunnel endpoint addresses are correctly configured since the router can already ping the remote server; changing them does not address the packet sizing issue.

The IPsec configuration is functionally working since encrypted traffic is reaching the destination (pings succeed); the problem is the cumulative overhead it adds to GRE, not a configuration error.

GRE encapsulation adds at least 24 bytes of header overhead and IPsec adds additional bytes for its headers and trailer, reducing the effective MTU available for user payload below 1500 bytes; lowering the MTU on the GRE tunnel interface ensures packets are sized correctly before encapsulation, preventing fragmentation-related failures that affect large TCP sessions while leaving small ICMP pings unaffected.

Changing the GRE encapsulation type does not reduce the combined header overhead introduced by stacking GRE and IPsec, which is the root cause of the MTU problem.