{"record":{"id":"144d0c38e18899ea","repo":"cilium/cilium","slug":"ipsec-doesnt-support-strict-ingress-encryption","errorCode":null,"errorMessage":"IPSec doesnt support strict ingress encryption.","messagePattern":"IPSec doesnt support strict ingress encryption\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"daemon/cmd/daemon.go","lineNumber":42,"sourceCode":"\t// WireGuard and IPSec are mutually exclusive.\n\tif params.IPSecConfig.Enabled() && params.WireguardConfig.Enabled() {\n\t\treturn fmt.Errorf(\"WireGuard (--%s) cannot be used with IPsec (--%s)\", wgTypes.EnableWireguard, option.EnableIPSec)\n\t}\n\n\tif !params.IPSecConfig.DNSProxyInsecureSkipTransparentModeCheckEnabled() {\n\t\tif params.IPSecConfig.Enabled() && params.DaemonConfig.EnableL7Proxy && !params.DaemonConfig.DNSProxyEnableTransparentMode {\n\t\t\treturn fmt.Errorf(\"IPSec requires DNS proxy transparent mode to be enabled (--dnsproxy-enable-transparent-mode=\\\"true\\\")\")\n\t\t}\n\t}\n\n\tif params.IPSecConfig.Enabled() && params.DaemonConfig.TunnelingEnabled() {\n\t\tif err := ipsec.ProbeXfrmStateOutputMask(); err != nil {\n\t\t\treturn fmt.Errorf(\"IPSec with tunneling requires support for xfrm state output masks (Linux 4.19 or later): %w\", err)\n\t\t}\n\t}\n\n\tif params.IPSecConfig.Enabled() && params.DaemonConfig.EnableEncryptionStrictModeIngress {\n\t\treturn fmt.Errorf(\"IPSec doesnt support strict ingress encryption.\")\n\t}\n\n\tif params.DaemonConfig.EnableHostFirewall {\n\t\tif params.IPSecConfig.Enabled() {\n\t\t\treturn fmt.Errorf(\"IPSec cannot be used with the host firewall.\")\n\t\t}\n\t}\n\n\tif params.DaemonConfig.LocalRouterIPv4 != \"\" || params.DaemonConfig.LocalRouterIPv6 != \"\" {\n\t\tif params.IPSecConfig.Enabled() {\n\t\t\treturn fmt.Errorf(\"Cannot specify %s or %s with %s.\", option.LocalRouterIPv4, option.LocalRouterIPv6, option.EnableIPSec)\n\t\t}\n\t}\n\n\tif params.IPSecConfig.Enabled() || params.WireguardConfig.Enabled() {\n\t\tif !params.DaemonConfig.EnableCiliumNodeCRD {\n\t\t\treturn fmt.Errorf(\"CiliumNode CRD cannot be disabled when encryption is enabled with WireGuard (--%s) or IPsec (--%s)\", wgTypes.EnableWireguard, option.EnableIPSec)\n\t\t}","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/daemon/cmd/daemon.go#L24-L60","documentation":"Cilium's daemon refuses to start when IPSec encryption is combined with strict ingress encryption mode (--enable-encryption-strict-mode-ingress). IPSec's datapath cannot guarantee the strict inbound packet-drop semantics that strict mode requires, so initAndValidateDaemonConfig rejects this combination at startup rather than allowing a silently weaker policy.","triggerScenarios":"Running the cilium-agent with --enable-ipsec (IPSecConfig.Enabled()) while --enable-encryption-strict-mode-ingress is also set, during initAndValidateDaemonConfig in daemon/cmd/daemon.go.","commonSituations":"Operators migrating from WireGuard (which supports strict mode) to IPSec while keeping the strict-ingress flag; Helm values where encryption mode changed but encryptionStrictModeIngress stayed enabled; copying config from a WireGuard deployment to an IPSec one.","solutions":["Disable strict ingress encryption (remove --enable-encryption-strict-mode-ingress / set encryption.strictMode.ingress.enabled=false)","Switch encryption from IPSec to WireGuard (--enable-wireguard), which supports strict ingress mode","Upgrade to a Cilium version that supports strict mode with the chosen datapath, if available"],"exampleFix":"// before\nhelm upgrade cilium cilium/cilium --set encryption.enabled=true --set encryption.ipsec.enabled=true --set encryption.strictMode.ingress.enabled=true\n// after\nhelm upgrade cilium cilium/cilium --set encryption.enabled=true --set encryption.ipsec.enabled=true --set encryption.strictMode.ingress.enabled=false","handlingStrategy":"validation","validationCode":"if ipsecEnabled && strictModeIngressEnabled {\n    return fmt.Errorf(\"IPSec does not support strict ingress encryption; disable one of them before starting the agent\")\n}","typeGuard":null,"tryCatchPattern":"if err := initAndValidateDaemonConfig(params); err != nil {\n    if strings.Contains(err.Error(), \"strict ingress encryption\") {\n        // disable strict mode or switch to WireGuard\n    }\n    log.Fatal(err)\n}","preventionTips":["In Helm values, never set encryption.ipsec.enabled with encryption.strictMode.ingress.enabled simultaneously","Use strict ingress mode only with WireGuard encryption","Validate the rendered Cilium ConfigMap against option-compatibility rules in CI"],"tags":["cilium","ipsec","encryption","strict-mode","startup-validation"],"backgroundTag":"incompatible-cilium-encryption-options","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}