Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Once I run setkey with the following config file,

add esp 2000 -E aes-ctr 0x3333333333333333333333333333333333333333;
add esp 2000 -E aes-ctr 0x3333333333333333333333333333333333333333;

...it causes an error message (File Exists), and only one entry is shown with setkey -D. It seems that destination IP+SPI pair should be unique, (but multiple adds with the same source IP+SPI are OK), I wonder if it's intentional, and why ?

UPDATE: It seems that for incoming IPSEC packets, add rules work regardless of the source IP. i.e. when I have any of the two rules above on host, incoming packets from any source IP with SPI 2000 are accepted and decrypted. This explains why I get the error message for the second line, but I still don't quite understand why the source IP is ignored.

share|improve this question
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.