Windows Server 2022 — GRE tunnel stays up but no payload passes — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

GRE interface reports up, but encapsulated traffic is dropped, impacting branch connectivity and overlay applications.

Environment & Reproduction

Reproduced after MTU changes, upstream ACL updates, or route preference changes toward underlay links.

Root Cause Analysis

Most failures are MTU/fragmentation black holes, missing protocol 47 allowance, or return-path asymmetry.

Quick Triage

Test end-to-end path and verify protocol handling along underlay firewall devices.

Step-by-Step Diagnosis

Check effective MTU and packet counters on tunnel and physical interfaces.

Solution — Primary Fix

Set consistent MTU/MSS policy, permit protocol 47, and correct return routes.

Solution — Alternative Approaches

Migrate to IPsec encapsulation or route-based VPN where transit filters cannot be adjusted.

Verification & Acceptance Criteria

Sustained bidirectional traffic with no retransmission spikes and expected throughput.

Rollback Plan

Revert tunnel MTU, restore previous static routes, and remove temporary ACL changes.

Prevention & Hardening

Apply standardized tunnel templates and pre-change path MTU validation.

Related Errors & Cross-Refs

Commonly associated with BGP flap storms and edge firewall policy drift.

Related tutorial: View the step-by-step tutorial for Windows Server 2022.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn GRE and RRAS networking references.