Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Once I run setkey with the following config file,

add 1.1.1.1 2.2.2.2 esp 2000 -E aes-ctr 0x3333333333333333333333333333333333333333;
add 3.3.3.3 2.2.2.2 esp 2000 -E aes-ctr 0x3333333333333333333333333333333333333333;

...it causes an error message (File Exists), and only one entry is shown with setkey -D. It seems that destination IP+SPI pair should be unique, (but multiple adds with the same source IP+SPI are OK), I wonder if it's intentional, and why ?

UPDATE: It seems that for incoming IPSEC packets, add rules work regardless of the source IP. i.e. when I have any of the two rules above on host 2.2.2.2, incoming packets from any source IP with SPI 2000 are accepted and decrypted. This explains why I get the error message for the second line, but I still don't quite understand why the source IP is ignored.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.