Gre tunnel to protect IP.

[stephenw10]

There are no GRE states shows there, only TCP/UDP states on the GRE interface.

You need to look for gre states on WAN like:

[s_serra]

@stephenw10

[stephenw10]

Mmm, that looks OK then. The end end show similar states? Data ratios the same?

[s_serra]

@stephenw10

I guess so

Thanks

[stephenw10]

Ok that looks good.

Are you still seeing the extra traffic on the remote WAN? It could be there is simply no traffic right now.

Make sure the rules allowing GRE on WAN there only allow it from the local site.

Steve

[s_serra]

@stephenw10

On the local site I have the following rules.

[stephenw10]

Ok, so in that case the local site always has to establish the tunnel since it is not allowing gre in at all. That's fine.
What rules do you have at the remote site?

[s_serra]

@stephenw10

On the remote side it looks like this.

[stephenw10]

Ok, great so there are no rules explicitly allowing the GRE traffic. That means both sides have to open an outbound state to allow traffic back in. And that nothing else can connect using gre.

So whatever you're seeing it's not that.

Possibly just double counting on the WAN?

[s_serra]

@stephenw10

Well, I don't know what it could be. Thank you for your help.