Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Once I run setkey with the following config file,

add esp 2000 -E aes-ctr 0x3333333333333333333333333333333333333333;
add esp 2000 -E aes-ctr 0x3333333333333333333333333333333333333333; causes an error message (File Exists), and only one entry is shown with setkey -D. It seems that destination IP+SPI pair should be unique, (but multiple adds with the same source IP+SPI are OK), I wonder if it's intentional, and why ?

UPDATE: It seems that for incoming IPSEC packets, add rules work regardless of the source IP. i.e. when I have any of the two rules above on host, incoming packets from any source IP with SPI 2000 are accepted and decrypted. This explains why I get the error message for the second line, but I still don't quite understand why the source IP is ignored.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.