+ rv = ipip_add_tunnel (IPIP_TRANSPORT_IP4, ~0,
+ &local_ip, &remote_ip, 0, 0, &child->sw_if_index);
+
+ child->local_sa = ikev2_mk_local_sa_id (child->sw_if_index);
+ child->remote_sa = ikev2_mk_remote_sa_id (child->sw_if_index);
+
+ rv |= ipsec_sa_add_and_lock (child->local_sa,
+ local_spi,
+ IPSEC_PROTOCOL_ESP, encr_type,
+ &loc_ckey, integ_type, &loc_ikey, flags,
+ 0, salt_local, &local_ip, &remote_ip, NULL);
+ rv |= ipsec_sa_add_and_lock (child->remote_sa,
+ remote_spi,
+ IPSEC_PROTOCOL_ESP, encr_type,
+ &rem_ckey, integ_type, &rem_ikey,
+ (flags | IPSEC_SA_FLAG_IS_INBOUND),
+ 0, salt_remote, &remote_ip, &local_ip, NULL);
+
+ u32 *sas_in = NULL;
+ vec_add1 (sas_in, child->remote_sa);
+ rv |=
+ ipsec_tun_protect_update (child->sw_if_index, child->local_sa, sas_in);