{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/", "slug": "dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection", "url": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/" }, "title": "Choose GRE endpoints for a tenant-to-physical-network connection", "summary": "Where do GRE endpoints sit when a tenant virtual network needs a provider-side physical service?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:17:02+00:00", "modified_at": "2026-09-08T18:17:13+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 2, "word_count": 223, "potentially_affected": "Use this review when designing a specific provider-side service path for a tenant.", "dse_recommendation": "Draw the tunnel endpoints and the traffic path to the physical service.", "primary_source": { "name": "GRE Tunneling in Windows Server 2016", "url": "https://learn.microsoft.com/en-us/windows-server/remote/remote-access/ras-gateway/gre-tunneling-windows-server", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s GRE implementation can encapsulate IPv4 and IPv6 through virtual point-to-point links over an IP network. In the documented tenant-to-physical-network scenario, one tunnel endpoint is a multitenant gateway and the other is a third-party device on the provider’s physical network. Layer 3 traffic is routed between tenant VMs and that device. Another documented scenario connects a VLAN-isolated physical load balancer to the virtual network through GRE. Microsoft documentation.

\n

Applicability

\n

Use this review when designing a specific provider-side service path for a tenant. Identify the gateway, physical device, tenant network, and required routing behavior. Confirm support on both endpoints before selecting this topology.

\n

DSE recommendation

\n

Draw the tunnel endpoints and the traffic path to the physical service. Have the tenant and provider network owners agree on which routes and service addresses are in scope. Record the third-party device’s role and the configuration owner at each end. Keep the endpoint design distinct from any separate performance, packet-size, or confidentiality requirement.

\n

Verification

\n

Test a representative tenant connection to the intended physical service and record the actual endpoint and routing context. Include a tenant that should not reach that service. Compare both results with the approved diagram and investigate an unexpected cross-tenant path before accepting the connection. Preserve the mapping for later device replacement.

\n

Official references

\n

Microsoft Learn: GRE Tunneling in Windows Server 2016. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft’s GRE implementation can encapsulate IPv4 and IPv6 through virtual point-to-point links over an IP network. In the documented tenant-to-physical-network scenario, one tunnel endpoint is a multitenant gateway and the other is a third-party device on the provider’s physical network. Layer 3 traffic is routed between tenant VMs and that device. Another documented scenario connects a VLAN-isolated physical load balancer to the virtual network through GRE. Microsoft documentation.\nApplicability\nUse this review when designing a specific provider-side service path for a tenant. Identify the gateway, physical device, tenant network, and required routing behavior. Confirm support on both endpoints before selecting this topology.\nDSE recommendation\nDraw the tunnel endpoints and the traffic path to the physical service. Have the tenant and provider network owners agree on which routes and service addresses are in scope. Record the third-party device’s role and the configuration owner at each end. Keep the endpoint design distinct from any separate performance, packet-size, or confidentiality requirement.\nVerification\nTest a representative tenant connection to the intended physical service and record the actual endpoint and routing context. Include a tenant that should not reach that service. Compare both results with the approved diagram and investigate an unexpected cross-tenant path before accepting the connection. Preserve the mapping for later device replacement.\nOfficial references\nMicrosoft Learn: GRE Tunneling in Windows Server 2016. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft’s GRE implementation can encapsulate IPv4 and IPv6 through virtual point-to-point links over an IP network. In the documented tenant-to-physical-network scenario, one tunnel endpoint is a multitenant gateway and the other is a third-party device on the provider’s physical network. Layer 3 traffic is routed between tenant VMs and that device. Another documented scenario connects a VLAN-isolated physical load balancer to the virtual network through GRE. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/remote/remote-access/ras-gateway/gre-tunneling-windows-server).\n\n## Applicability\n\nUse this review when designing a specific provider-side service path for a tenant. Identify the gateway, physical device, tenant network, and required routing behavior. Confirm support on both endpoints before selecting this topology.\n\n## DSE recommendation\n\nDraw the tunnel endpoints and the traffic path to the physical service. Have the tenant and provider network owners agree on which routes and service addresses are in scope. Record the third-party device’s role and the configuration owner at each end. Keep the endpoint design distinct from any separate performance, packet-size, or confidentiality requirement.\n\n## Verification\n\nTest a representative tenant connection to the intended physical service and record the actual endpoint and routing context. Include a tenant that should not reach that service. Compare both results with the approved diagram and investigate an unexpected cross-tenant path before accepting the connection. Preserve the mapping for later device replacement.\n\n## Official references\n\n[Microsoft Learn: GRE Tunneling in Windows Server 2016](https://learn.microsoft.com/en-us/windows-server/remote/remote-access/ras-gateway/gre-tunneling-windows-server). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/", "url": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose GRE endpoints for a tenant-to-physical-network connection", "item": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/", "url": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/", "headline": "Choose GRE endpoints for a tenant-to-physical-network connection", "description": "Where do GRE endpoints sit when a tenant virtual network needs a provider-side physical service?", "abstract": "Where do GRE endpoints sit when a tenant virtual network needs a provider-side physical service?", "articleBody": "Source facts\nMicrosoft’s GRE implementation can encapsulate IPv4 and IPv6 through virtual point-to-point links over an IP network. In the documented tenant-to-physical-network scenario, one tunnel endpoint is a multitenant gateway and the other is a third-party device on the provider’s physical network. Layer 3 traffic is routed between tenant VMs and that device. Another documented scenario connects a VLAN-isolated physical load balancer to the virtual network through GRE. Microsoft documentation.\nApplicability\nUse this review when designing a specific provider-side service path for a tenant. Identify the gateway, physical device, tenant network, and required routing behavior. Confirm support on both endpoints before selecting this topology.\nDSE recommendation\nDraw the tunnel endpoints and the traffic path to the physical service. Have the tenant and provider network owners agree on which routes and service addresses are in scope. Record the third-party device’s role and the configuration owner at each end. Keep the endpoint design distinct from any separate performance, packet-size, or confidentiality requirement.\nVerification\nTest a representative tenant connection to the intended physical service and record the actual endpoint and routing context. Include a tenant that should not reach that service. Compare both results with the approved diagram and investigate an unexpected cross-tenant path before accepting the connection. Preserve the mapping for later device replacement.\nOfficial references\nMicrosoft Learn: GRE Tunneling in Windows Server 2016. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:17:02+00:00", "dateModified": "2026-09-08T18:17:13+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-009-choose-gre-endpoints-for-a-tenant-to-physical-network-connection/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose GRE endpoints for a tenant-to-physical-network connection" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 223, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "GRE Tunneling in Windows Server 2016", "url": "https://learn.microsoft.com/en-us/windows-server/remote/remote-access/ras-gateway/gre-tunneling-windows-server" } } ] } }