+ if (del_old_ids)
+ {
+ ipip_tunnel_t *ipip = NULL;
+ u32 sw_if_index = sa->is_tun_itf_set ? sa->tun_itf : ~0;
+ if (~0 == sw_if_index)
+ {
+ ip46_address_t local_ip;
+ ip46_address_t remote_ip;
+ if (sa->is_initiator)
+ {
+ ip46_address_set_ip4 (&local_ip, &sa->iaddr);
+ ip46_address_set_ip4 (&remote_ip, &sa->raddr);
+ }
+ else
+ {
+ ip46_address_set_ip4 (&local_ip, &sa->raddr);
+ ip46_address_set_ip4 (&remote_ip, &sa->iaddr);
+ }
+
+ /* *INDENT-OFF* */
+ ipip_tunnel_key_t key = {
+ .src = local_ip,
+ .dst = remote_ip,
+ .transport = IPIP_TRANSPORT_IP4,
+ .fib_index = 0,
+ };
+ /* *INDENT-ON* */
+
+ ipip = ipip_tunnel_db_find (&key);
+
+ if (ipip)
+ sw_if_index = ipip->sw_if_index;
+ else
+ return res;
+ }
+
+ u32 *sas_in = NULL;
+ vec_add1 (sas_in, csa->remote_sa_id);
+ ipsec_tun_protect_update (sw_if_index, NULL, csa->local_sa_id, sas_in);
+ ipsec_sa_unlock_id (ikev2_flip_alternate_sa_bit (csa->remote_sa_id));
+ }
+