Project

General

Profile

Actions

Bug #9592

closed

VTI interface down because interface number created is greater than ipsec32768

Added by Steven Perreau almost 5 years ago. Updated about 3 years ago.

Status:
Resolved
Priority:
Normal
Category:
IPsec
Target version:
Start date:
06/18/2019
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.4-p3
Affected Architecture:

Description

In some conditions, when creating a VTI interface for routed IP, the interface number allocated is very high.

<opt9>
<descr><![CDATA[HO_SY1_WAN]]></descr>
<if>ipsec52000</if>
<enable></enable>
<spoofmac></spoofmac>
<mtu>1440</mtu>
<mss>1440</mss>
</opt9>

This seems to be happening with firewalls that already have a large number of traditional ipsec p1/p2 tunnels. The first VTI p2 I made started with ipsec52000 and the interface is permanently offline / down. Any additional VTI interfaces I create get an even higher interface number such as ipsec53000.

Obviously this breaks the VTI and you cannot get routed IP to work.

Actions

Also available in: Atom PDF