0

While creating a vti tunnel/interface on a ubuntu-14.04 LTS system with following config, I am seeing the error Keys are not allowed with ipip and sit tunnels.

I have done a apt-get install iproute2* and updated..but

root@server:/usr/local/etc#

root@server:/usr/local/etc# uname -a
Linux server 3.13.0-24-generic #46-Ubuntu SMP Thu Apr 10 19:11:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

root@server:/usr/local/etc# ip tunnel add vti1 mode vti local 10.80.90.65 remote 2.2.2.34 okey 32 ikey 32


Keys are not allowed with ipip and sit tunnels

root@server:/usr/local/etc# ^C

root@server:/usr/local/etc# uname -a
Linux server 3.13.0-24-generic #46-Ubuntu SMP Thu Apr 10 19:11:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

root@server:/usr/local/etc# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 14.04 LTS
Release:        14.04
Codename:       trusty

root@server:/usr/local/etc# ip tunnel add vti1 mode vti local 10.80.90.65 remote 2.2.2.34 okey 32 ikey 32

Keys are not allowed with ipip and sit tunnels

root@server:/usr/local/etc#
==============================================================

the following is the man-help of the ip tunnel command on this system:

root@server:/usr/local/etc# ip tunnel help
Usage: ip tunnel { add | change | del | show | prl | 6rd } [ NAME ]
          [ mode { ipip | gre | sit | isatap | vti } ] [ remote ADDR ] [ local ADDR ]
          [ [i|o]seq ] [ [i|o]key KEY ] [ [i|o]csum ]
          [ prl-default ADDR ] [ prl-nodefault ADDR ] [ prl-delete ADDR ]
          [ 6rd-prefix ADDR ] [ 6rd-relay_prefix ADDR ] [ 6rd-reset ]
          [ ttl TTL ] [ tos TOS ] [ [no]pmtudisc ] [ dev PHYS_DEV ]

Where: NAME := STRING
       ADDR := { IP_ADDRESS | any }
       TOS  := { STRING | 00..ff | inherit | inherit/STRING | inherit/00..ff }
       TTL  := { 1..255 | inherit }
       KEY  := { DOTTED_QUAD | NUMBER }
root@server:/usr/local/etc#

What am I missing? What should I need to do further?

Tim
  • 31,888
  • 7
  • 52
  • 78
NRajK
  • 1
  • 1
  • 2

1 Answers1

1

ikey and okey are options referring to specific GRE (Generic Routing Encapsulation) tunnel feature that marks traffic flows between two endpoints. This is not an encryption, just a label that travels along the tunnel within GRE encapsulated packet.

VTI, in contrary, is not an encapsulation, it is a local feature on a specific Linux system that is primarily used to apply a particular IPsec policy to a traffic going through it.

So, to summarize, there's no need to use (i|o)key and (i|o)seq with VTI, as it would not do anything at all.

Peter Zhabin
  • 2,696
  • 9
  • 10