Creating a GRE Site - Netskope Technical Documentation

To create an GRE site:

Go to Settings > Security Cloud Platform > GRE.
Click Create New and then New GRE Site.
In the New GRE Site window, for Site Name, enter a name for the GRE site.
In the Basic Settings tab:
- Source IP Address: Enter the source peer IP address (i.e., exit public IP) of the router or firewall that Netskope will receive packets from. Netskope identifies traffic belonging to your organization through your router or firewall IP addresses.
  
  If you’re creating a high-capacity GRE tunnel with a maximum bandwidth of 3 or 5 Gbps, you must provide a source IP address. Also, If the source IP changes, you must notify Netskope immediately since it requires a configuration update that must be planned through a maintenance window.
- Primary Netskope POP: Select the closest primary Netskope point of presence (POP) in your country. Appended to each POP is a specific day (e.g, Day-1, Day-2, etc.), which is the release deployment day where Netskope upgrades the particular POP with the latest software. Netskope typically upgrades a different set of POPs on different days. For optimal performance, Netskope recommends:
  - Using the geographically closest POPs.
  - Configuring at least two POPs for each egress location in your network.
  - Ensure your POPs fall on different release deployment days. For example, if your primary POP is appended with (Day-1), your failover POP must have a different day appended to it, such as (Day-2), for better resiliency. Following are some important caveats:
    - Netskope notifies you if the deployment is rescheduled due to unforeseen circumstances.
    - If the POP deployment is temporarily delayed to the next day, the Netskope UI still shows the original deployment day.
    - You can’t select any new POPs until they’re fully operational.
- Failover Netskope POP: Select the second closest Netskope POP in your country to use as the backup/failover site. For optimal performance, see the previous recommendations. At any point, you can click to swap the primary and failover POP.
- Sort Netskope POPs by geographical distance: Select to sort the Netskope POP list by the closest geographical distance. You can search for the nearest POP by entering an IP address or longitude and latitude coordinates.
- Maximum Bandwidth: Enter the maximum bandwidth for the GRE tunnel. The tunnel size can be up to 5 Gbps.
  
  The 3 or 5 Gbps options are in Beta. To enable them, contact your Netskope Sales Representative or Support. To learn more: High-Capacity GRE Tunneling.
(Optional) In the Advanced Settings tab:
- Traffic Type: Choose the type of traffic traversing the GRE site. You can use this option to classify your tunnel traffic and a build usage report.
  - User
  - IoT
  - Mixed
  - Machine
  - Guest Wifi
- Additional Netskope POP: You can select a maximum of 8 more POPs; however additional POPs are best-effort. For licensed high-capacity tunnels, additional Netskope POPs are not supported. For optimal performance, Netskope recommends:
  - Using the IP address or geographical coordinates to locate the geographically closest POPs.
  - Configuring at least two POPs for each egress location in your network.
  - Ensure your POPs fall on different release deployment days. For example, if your primary POP is appended with (Day-1), your failover POP must have a different day appended to it, such as (Day-2), for better resiliency.
    
    To enable this feature, contact your Netskope Sales Representative or Support.
- Vendor: Choose the vendor of the third-party router or firewall that’s associated with the GRE site. If you are using VMware SASE for your GRE tunnel, choose VeloCloud; otherwise, choose Default.
- Trust X-Forwarded-For Header: Select to trust IP addresses contained in the X-Forwarded-For (XFF) HTTP header at the tunnel level. If you trust XFF at the tenant level, you can’t select this option.
  - Apply to all traffic: Use the XFF HTTP header to identify all user traffic going through the GRE tunnel.
  - Apply to specific NAT/proxy IP(s): Use the XFF HTTP header to identify traffic from specific NAT and proxy IP addresses going through the GRE tunnel. Click +Add Another to add multiple IP addresses.
Click Save and Copy POPs Info to save the GRE site and copy the Netskope POP info to your clipboard. You need this information to establish the primary and backup GRE tunnels on your router/firewall.

To create an GRE site:

Go to Settings > Security Cloud Platform > GRE.
Click Create New and then New GRE Site.
In the New GRE Site window, for Site Name, enter a name for the GRE site.
In the Basic Settings tab:
- Source IP Address: Enter the source peer IP address (i.e., exit public IP) of the router or firewall that Netskope will receive packets from. Netskope identifies traffic belonging to your organization through your router or firewall IP addresses.
  
  If you’re creating a high-capacity GRE tunnel with a maximum bandwidth of 3 or 5 Gbps, you must provide a source IP address. Also, If the source IP changes, you must notify Netskope immediately since it requires a configuration update that must be planned through a maintenance window.
- Primary Netskope POP: Select the closest primary Netskope point of presence (POP) in your country. Appended to each POP is a specific day (e.g, Day-1, Day-2, etc.), which is the release deployment day where Netskope upgrades the particular POP with the latest software. Netskope typically upgrades a different set of POPs on different days. For optimal performance, Netskope recommends:
  - Using the geographically closest POPs.
  - Configuring at least two POPs for each egress location in your network.
  - Ensure your POPs fall on different release deployment days. For example, if your primary POP is appended with (Day-1), your failover POP must have a different day appended to it, such as (Day-2), for better resiliency. Following are some important caveats:
    - Netskope notifies you if the deployment is rescheduled due to unforeseen circumstances.
    - If the POP deployment is temporarily delayed to the next day, the Netskope UI still shows the original deployment day.
    - You can’t select any new POPs until they’re fully operational.
- Failover Netskope POP: Select the second closest Netskope POP in your country to use as the backup/failover site. For optimal performance, see the previous recommendations. At any point, you can click to swap the primary and failover POP.
- Sort Netskope POPs by geographical distance: Select to sort the Netskope POP list by the closest geographical distance. You can search for the nearest POP by entering an IP address or longitude and latitude coordinates.
- Maximum Bandwidth: Enter the maximum bandwidth for the GRE tunnel. The tunnel size can be up to 5 Gbps.
  
  The 3 or 5 Gbps options are in Beta. To enable them, contact your Netskope Sales Representative or Support. To learn more: High-Capacity GRE Tunneling.
(Optional) In the Advanced Settings tab:
- Traffic Type: Choose the type of traffic traversing the GRE site. You can use this option to classify your tunnel traffic and a build usage report.
  - User
  - IoT
  - Mixed
  - Machine
  - Guest Wifi
- Additional Netskope POP: You can select a maximum of 8 more POPs; however additional POPs are best-effort. For licensed high-capacity tunnels, additional Netskope POPs are not supported. For optimal performance, Netskope recommends:
  - Using the IP address or geographical coordinates to locate the geographically closest POPs.
  - Configuring at least two POPs for each egress location in your network.
  - Ensure your POPs fall on different release deployment days. For example, if your primary POP is appended with (Day-1), your failover POP must have a different day appended to it, such as (Day-2), for better resiliency.
    
    To enable this feature, contact your Netskope Sales Representative or Support.
- Vendor: Choose the vendor of the third-party router or firewall that’s associated with the GRE site. If you are using VMware SASE for your GRE tunnel, choose VeloCloud; otherwise, choose Default.
- Trust X-Forwarded-For Header: Select to trust IP addresses contained in the X-Forwarded-For (XFF) HTTP header at the tunnel level. If you trust XFF at the tenant level, you can’t select this option.
  - Apply to all traffic: Use the XFF HTTP header to identify all user traffic going through the GRE tunnel.
  - Apply to specific NAT/proxy IP(s): Use the XFF HTTP header to identify traffic from specific NAT and proxy IP addresses going through the GRE tunnel. Click +Add Another to add multiple IP addresses.
Click Save and Copy POPs Info to save the GRE site and copy the Netskope POP info to your clipboard. You need this information to establish the primary and backup GRE tunnels on your router/firewall.