GRE Configuration Guide for Cisco 881 ISR

By user , 22 February 2026

This example illustrates how to configure a GRE tunnel between a Cisco 881 ISR and ZIA Public Service Edges. As shown in the figure, two GRE tunnels are configured between the gateway WAN port, fa4, which has a static public IP address, <Tunnel Source IP> (e.g., 192.0.2.2), and two ZIA Public Service Edges in two different data centers with the IP, <Primary DC VIP> (e.g., 216.66.5.49) and <Secondary DC VIP> (e.g., 199.168.149.179).

Image removed.

The following text in red represents the IP address values that you need to know or provide, based on your network setup for the GRE tunnels:

  • <Tunnel Source IP>: The IP address of the tunnel source which is from your organization (e.g., 192.0.2.2).
  • <Internal IP Range>: The internal range of IP addresses assigned by Zscaler for your organization (e.g., 172.18.58.120-172.18.58.127).
  • <Primary DC VIP>: The IP address of the primary tunnel destination, which is the GRE virtual IP address of Zscaler's primary data center (e.g., 216.66.5.49).
    • <Primary Internal Router IP>: The internal virtual IP of the router (i.e., tunnel source) for the GRE tunnel associated with the primary data center (e.g., 172.18.58.121).
    • <Primary Internal ZIA Public Service Edge IP>: The internal virtual IP of the tunnel destination on the primary data center (e.g., 172.18.58.122).
  • <Secondary DC VIP>: The IP address of the secondary tunnel destination, which is the GRE virtual IP address of Zscaler's secondary data center (e.g., 199.168.149.179).
    • <Secondary Internal Router IP>: The internal virtual IP of the router (i.e., tunnel source) for the GRE tunnel associated with the secondary data center (e.g., 172.18.58.125).
    • <Secondary Internal ZIA Public Service Edge IP>: The internal virtual IP of the tunnel destination on the secondary data center (e.g., 172.18.58.126).

The router receives ingress traffic on ports fa0, fa1, fa2, and fa3. They forward internet traffic to the WAN gateway port, fa4, which uses the GRE tunnel interfaces tunnel 2700 and tunnel 2800 to send the internet traffic through the GRE tunnel to the Zscaler service. The router performs NAT on the other traffic that it sends directly to the internet. For more information on configuring a GRE tunnel, see Configuring GRE Tunnels.

Configuring GRE Tunnel for Cisco 881 ISR

This guide covers only the configuration details of GRE tunnels between the Cisco 881 ISR and the ZIA Public Service Edges. For any other specific information about the Cisco 881 ISR, refer to the Cisco documentation.

Perform the following tasks to configure the GRE tunnels from a Cisco 881 ISR router running iOS version 15.1 to ZIA Public Service Edges in different data centers. Refer to the Cisco documentation for information about the commands provided in this procedure.

Ensure to alter the sample configuration values provided in this article to suit your deployment needs.

Verifying GRE Tunnel Configuration on Cisco 881 ISR

In the ZIA Admin Portal, you can go to Analytics > Tunnel Insights to see data as well as monitor the health and status of your configured GRE tunnels. To learn more, see About Insights and About Insights Logs.

On the Cisco router, you can perform the following verification steps to monitor and troubleshoot the GRE tunnels. These steps are applicable to both IOS 12.2.X and 15.X.

Comments