- rv = ipip_add_tunnel (IPIP_TRANSPORT_IP4, ~0,
- &a->local_ip, &a->remote_ip, 0,
- IPIP_TUNNEL_FLAG_NONE, IP_DSCP_CS0, &sw_if_index);
+ if (~0 == a->sw_if_index)
+ {
+ /* no tunnel associated with the SA/profile - create a new one */
+ rv = ipip_add_tunnel (IPIP_TRANSPORT_IP4, ~0,
+ &a->local_ip, &a->remote_ip, 0,
+ TUNNEL_ENCAP_DECAP_FLAG_NONE, IP_DSCP_CS0,
+ TUNNEL_MODE_P2P, &sw_if_index);
+
+ if (rv == VNET_API_ERROR_IF_ALREADY_EXISTS)
+ {
+ if (hash_get (km->sw_if_indices, sw_if_index))
+ /* interface is managed by IKE; proceed with updating SAs */
+ rv = 0;
+ }
+ hash_set1 (km->sw_if_indices, sw_if_index);
+ }
+ else
+ {
+ sw_if_index = a->sw_if_index;
+ vnet_sw_interface_admin_up (vnet_get_main (), sw_if_index);
+ }
+
+ if (rv)
+ {
+ ikev2_elog_peers (IKEV2_LOG_ERROR, "installing ipip tunnel failed! "
+ "loc:%d.%d.%d.%d rem:%d.%d.%d.%d",
+ a->local_ip.ip4.as_u32, a->remote_ip.ip4.as_u32);
+ return;
+ }