VTI interfaces can be added to groups, but rules have no effect
I created an interface group that includes a routed IPSec VTI interface (ipsec1000). Despite the fact that the VTI interface is a member of the group, traffic coming from the that interface is not evaluated by the interface group rules, traffic is only evaluated based on the Floating and IPSec rule sets (tabs). Being able to add the VTI interface to a group and not having it actually being taken into account when packet filtering occurs is causing confusion.
I see two solutions:
1. Remove the possibility of adding VTI interfaces to interface groups
2. Make the IPsec traffic coming through the VTI interface go through the interface group rules too in this order:
Second: Interface groups the VTI interface is a member of
Third: IPsec tab rules
I would prefer the second one ;-)
Currently, the only way of including the IPsec VTI interface into a group rule is to put all rules in the Floating tab, which is not very convenient.
#1 Updated by Viktor Gurov 4 months ago
better hide VTI interfaces, see #8686
#2 Updated by Jim Pingle 4 months ago
- Subject changed from Interface group rules are not parsed on incoming IPSec traffic on a VTI interface to VTI interfaces can be added to groups, but rules have no effect
- Target version set to 2.5.0
Updated subject. The underlying problem already has its own Redmine issue ( #8686 ) but this can be used for removing VTI interfaces from group assignment.