 is a simple stateless protocol that allows for the tunneling of IP in IP. GRE tunnels can be used to form VPNs, connecting remote sites by using private IP addresses via a public network. These tunnels are configured between provider edge routers and are transparent to the rest of the network. GRE VPNs currently have simple support for QoS. By default, the DSCP value in each payload header is copied into the tunnel header. This means that any QoS policy for IP packets can be applied to GRE-encapsulated packets as well. An added benefit is that GRE VPNs provide adjacencies directly between customer routers. GRE VPNs provide a complete separation between customer and provider rout- ing (see Figure 9.21). Customers can run their own routing protocols across the VPN and have no interaction with provider protocols. An internal gateway protocol dedi- cated to customers, such as OSPF or IS-IS, can be run across a provider network with strict separation from the provider's internal or external routing protocols. If custom- ers are transitioning from a private enterprise network, they may be able to use this approach to preserve much of their internal gateway protocol configuration. Key concepts in GRE VPNs include multiple contexts and multiple interfaces: Contexts-A GRE router's VPN solutions all rely on contexts, which are virtual routers running within single physical devices. A context has its own IP address space, routing table, user authentication, logging and Provider Routing IP Backbone Figure 9.21 IP GRE VPNs debugging functions, and other attributes. Customers get a dedicated con- text for each VPN. Interfaces-Virtual or logical interfaces enable physical ports or circuits to be individually mapped to different contexts through simple configuration commands. An interface is a logical entity that holds an IP address and is configured as part of a context. Interfaces are independent of physical ports and circuits. An interface can pass traffic only when it is bound to, or asso- ciated with, a physical port or ci