GRE Tunnel as SD-WAN Gateway

Why are you using GRE Tunnels? 

Use Route Based VPN (Tunnel Interfaces). 

We prefer to use GRE for 2 reasons:

1- Low bandwidth on WAN link which causes stability and performance issues over IPSEC tunnel. Also encryption is not needed.

2- HQ firewall also has site to site connection with third party devices and we need a universal method for all site to site connections. 

I am alarming by your comment. 

I would highly encourage you not to use an GRE Tunnel without any kind of Encryption over WAN. 

The second point is not clear to me either. What do you mean by that? 

We do not need encryption on tunnel because application traffic that passes the tunnel uses encryption and we do not need another layer of encryption.

By second part, I mean, we also have site to site connections with other BOs that are not using Sophos Firewall as edge FW/Router and we prefer to use a single method for communicating with other sites. For other branches we use GRE.

I would challenge that design decision but if you want to go through. I did not install a GRE Tunnel in 5 Years. Found this tech to be old and unflexible. 

Thanks, I know this is not optimal solution but under circumstances, with GRE we have better result.

Thanks, I know this is not optimal solution but under circumstances, with GRE we have better result.