Bug #11134

VTI interfaces can be added to groups, but rules have no effect

Added by Jocelyn Viau 4 months ago. Updated 3 months ago.

Target version:
Start date:
Due date:
% Done:


Estimated time:
Affected Version:
Affected Architecture:
Release Notes:


I created an interface group that includes a routed IPSec VTI interface (ipsec1000). Despite the fact that the VTI interface is a member of the group, traffic coming from the that interface is not evaluated by the interface group rules, traffic is only evaluated based on the Floating and IPSec rule sets (tabs). Being able to add the VTI interface to a group and not having it actually being taken into account when packet filtering occurs is causing confusion.

I see two solutions:
1. Remove the possibility of adding VTI interfaces to interface groups
2. Make the IPsec traffic coming through the VTI interface go through the interface group rules too in this order:
First: Floating
Second: Interface groups the VTI interface is a member of
Third: IPsec tab rules

I would prefer the second one ;-)

Currently, the only way of including the IPsec VTI interface into a group rule is to put all rules in the Floating tab, which is not very convenient.


Associated revisions

Revision 7a2fb6e9 (diff)
Added by Viktor Gurov 4 months ago

Hide VTI interfaces from Interface Group member list. Issue #11134


#2 Updated by Jim Pingle 4 months ago

  • Subject changed from Interface group rules are not parsed on incoming IPSec traffic on a VTI interface to VTI interfaces can be added to groups, but rules have no effect
  • Target version set to 2.5.0

Updated subject. The underlying problem already has its own Redmine issue ( #8686 ) but this can be used for removing VTI interfaces from group assignment.

#3 Updated by Renato Botelho 4 months ago

  • Status changed from New to Feedback
  • Assignee set to Viktor Gurov

PR has been merged. Thanks!

#4 Updated by Alhusein Zawi 4 months ago

working as expected .

VTI interface is not showing up on interface groups assignment. (removed)


#5 Updated by Alhusein Zawi 4 months ago

  • Status changed from Feedback to Resolved

#6 Updated by Jim Pingle 3 months ago

  • Category changed from Rules / NAT to Interfaces

Also available in: Atom PDF