(usagi-users 03308) Re: setkey can't set SPD properly

> I want to ask why I can't set SPD properly.Or is it impossible to have two policies which only differ by templates.

Yes. To be exact, it is impossible to have two (or more) SPD entries
with the same selector (e.g. src/dst_range and upperspec in setkey(8)) for each
direction.

Regards,

-- 
Masahide NAKAMURA


Lv Liangying wrote:
> Hello, all
> 
> Now, I am testing ipv6 with TAHI. I met a problem and I think maybe it's sensible to post it here.
> I want to set two SPD with same IPsrc, same spi, but just different protocol. But I can't set this two entries.
> for example:
> I first run the script to set SPD
> 
> /sbin/setkey -c <<EOD
>  spdadd 3ffe:501:ffff:ff04::/64 3ffe:501:ffff:ff01::/64
>  any
>  -P in ipsec
>  esp/tunnel/3ffe:501:ffff:ff02:200:ff:fe00:a1a1-3ffe:501:ffff:ff00:200:f f:fe00:b0b0/require;
>  spddump;
>  EOD
> 
> It set correctly;
> then I run next script just change protocol
> 
> /sbin/setkey -c <<EOD
>  spdadd 3ffe:501:ffff:ff04::/64 3ffe:501:ffff:ff01::/64
>  any
>  -P in ipsec
>  ah/tunnel/3ffe:501:ffff:ff02:200:ff:fe00:a1a1-3ffe:501:ffff:ff00:200:f f:fe00:b0b0/require;
>  spddump;
>  EOD
> 
> It says file has already exists.
> 
> I want to ask why I can't set SPD properly.Or is it impossible to have two policies which only differ by templates.
> 
> Thank you in advance!
> 
> Best Regards
> Lv Liangying
> 
> 
>