--- /dev/null
+
+create packet-generator interface pg0
+set int mac addr pg0 4.5.6
+
+create sub-interfaces pg0 1
+create sub-interfaces pg0 2
+create sub-interfaces pg0 3
+
+ip table add 1
+ip table add 2
+ip table add 3
+
+set int ip table pg0.1 1
+set int ip table pg0.2 2
+set int ip table pg0.3 3
+
+set int ip address pg0.1 192.168.0.1/24
+set int ip address pg0.2 192.168.0.1/24
+set int ip address pg0.3 192.168.0.1/24
+
+set int state pg0 up
+set int state pg0.1 up
+set int state pg0.2 up
+set int state pg0.3 up
+
+ipsec sa add 2 spi 2 crypto-key 6541686776336961656264656f6f6579 crypto-alg aes-cbc-128 tunnel-src 192.168.0.1 tunnel-dst 192.168.0.2 tx-table-id 2
+ipsec sa add 3 spi 3 crypto-key 6541686776336961656264656f6f6579 crypto-alg aes-cbc-128 tunnel-src 192.168.0.1 tunnel-dst 192.168.0.2 tx-table-id 3
+
+ipsec spd add 1
+set interface ipsec spd pg0.1 1
+ipsec policy add spd 1 priority 100 outbound action bypass protocol 50
+ipsec policy add spd 1 priority 10 outbound action protect sa 2 local-ip-range 10.5.0.0 - 10.5.0.255 remote-ip-range 10.6.0.0 - 10.6.0.16
+ipsec policy add spd 1 priority 10 outbound action protect sa 3 local-ip-range 10.5.0.0 - 10.5.0.255 remote-ip-range 10.6.0.17 - 10.6.0.32
+
+ip route table 1 add 10.6.0.0/16 via 192.168.0.2 pg0.1
+set ip neighbor pg0.1 192.168.0.2 00:11:22:33:44:55
+set ip neighbor pg0.2 192.168.0.2 00:11:22:33:44:55
+set ip neighbor pg0.3 192.168.0.2 00:11:22:33:44:55
+
+trace add pg-input 100
+
+packet-generator new {
+ name ipsec2
+ limit 1
+ rate 1e4
+ node ethernet-input
+ interface pg0
+ size 100-100
+ data {
+ IP4: 1.2.3 -> 4.5.6 vlan 1
+ UDP: 10.5.0.1 -> 10.6.0.1
+ UDP: 4321 -> 1234
+ length 72
+ incrementing 100
+ }
+}
+
+packet-generator new {
+ name ipsec3
+ limit 1
+ rate 1e4
+ node ethernet-input
+ interface pg0
+ size 100-100
+ data {
+ IP4: 1.2.3 -> 4.5.6 vlan 1
+ UDP: 10.5.0.1 -> 10.6.0.22
+ UDP: 4321 -> 1234
+ length 72
+ incrementing 100
+ }
+}
u32 spd_id;
int is_add = 1;
clib_error_t *error = NULL;
+ int err;
if (!unformat_user (input, unformat_line_input, line_input))
return 0;
goto done;
}
- ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
+ err = ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
+ switch (err)
+ {
+ case VNET_API_ERROR_SYSCALL_ERROR_1:
+ error = clib_error_return (0, "no such spd-id");
+ break;
+ case VNET_API_ERROR_SYSCALL_ERROR_2:
+ error = clib_error_return (0, "spd already assigned");
+ break;
+ }
done:
unformat_free (line_input);
int is_add, rv;
u32 m_args = 0;
ip_dscp_t dscp;
+ u32 tx_table_id;
salt = 0;
error = NULL;
crypto_alg = IPSEC_CRYPTO_ALG_NONE;
udp_src = udp_dst = IPSEC_UDP_PORT_NONE;
dscp = IP_DSCP_CS0;
+ tx_table_id = 0;
if (!unformat_user (input, unformat_line_input, line_input))
return 0;
else if (unformat (line_input, "tunnel-dst %U",
unformat_ip46_address, &tun_dst, IP46_TYPE_ANY))
;
+ else if (unformat (line_input, "tx-table-id %d", &tx_table_id))
+ ;
else if (unformat (line_input, "inbound"))
flags |= IPSEC_SA_FLAG_IS_INBOUND;
else if (unformat (line_input, "use-anti-replay"))
}
rv = ipsec_sa_add_and_lock (id, spi, proto, crypto_alg,
&ck, integ_alg, &ik, flags,
- 0, clib_host_to_net_u32 (salt),
+ tx_table_id, clib_host_to_net_u32 (salt),
&tun_src, &tun_dst,
TUNNEL_ENCAP_DECAP_FLAG_NONE, dscp,
&sai, udp_src, udp_dst);