IPSec doesnt support strict ingress encryption.

Error message

IPSec doesnt support strict ingress encryption.

What it means

Cilium's daemon refuses to start when IPSec encryption is combined with strict ingress encryption mode (--enable-encryption-strict-mode-ingress). IPSec's datapath cannot guarantee the strict inbound packet-drop semantics that strict mode requires, so initAndValidateDaemonConfig rejects this combination at startup rather than allowing a silently weaker policy.

Source

Thrown at daemon/cmd/daemon.go:42

	// WireGuard and IPSec are mutually exclusive.
	if params.IPSecConfig.Enabled() && params.WireguardConfig.Enabled() {
		return fmt.Errorf("WireGuard (--%s) cannot be used with IPsec (--%s)", wgTypes.EnableWireguard, option.EnableIPSec)
	}

	if !params.IPSecConfig.DNSProxyInsecureSkipTransparentModeCheckEnabled() {
		if params.IPSecConfig.Enabled() && params.DaemonConfig.EnableL7Proxy && !params.DaemonConfig.DNSProxyEnableTransparentMode {
			return fmt.Errorf("IPSec requires DNS proxy transparent mode to be enabled (--dnsproxy-enable-transparent-mode=\"true\")")
		}
	}

	if params.IPSecConfig.Enabled() && params.DaemonConfig.TunnelingEnabled() {
		if err := ipsec.ProbeXfrmStateOutputMask(); err != nil {
			return fmt.Errorf("IPSec with tunneling requires support for xfrm state output masks (Linux 4.19 or later): %w", err)
		}
	}

	if params.IPSecConfig.Enabled() && params.DaemonConfig.EnableEncryptionStrictModeIngress {
		return fmt.Errorf("IPSec doesnt support strict ingress encryption.")
	}

	if params.DaemonConfig.EnableHostFirewall {
		if params.IPSecConfig.Enabled() {
			return fmt.Errorf("IPSec cannot be used with the host firewall.")
		}
	}

	if params.DaemonConfig.LocalRouterIPv4 != "" || params.DaemonConfig.LocalRouterIPv6 != "" {
		if params.IPSecConfig.Enabled() {
			return fmt.Errorf("Cannot specify %s or %s with %s.", option.LocalRouterIPv4, option.LocalRouterIPv6, option.EnableIPSec)
		}
	}

	if params.IPSecConfig.Enabled() || params.WireguardConfig.Enabled() {
		if !params.DaemonConfig.EnableCiliumNodeCRD {
			return fmt.Errorf("CiliumNode CRD cannot be disabled when encryption is enabled with WireGuard (--%s) or IPsec (--%s)", wgTypes.EnableWireguard, option.EnableIPSec)
		}

View on GitHub (pinned to ac7b90affa)

Solutions

Disable strict ingress encryption (remove --enable-encryption-strict-mode-ingress / set encryption.strictMode.ingress.enabled=false)
Switch encryption from IPSec to WireGuard (--enable-wireguard), which supports strict ingress mode
Upgrade to a Cilium version that supports strict mode with the chosen datapath, if available

Example fix

// before
helm upgrade cilium cilium/cilium --set encryption.enabled=true --set encryption.ipsec.enabled=true --set encryption.strictMode.ingress.enabled=true
// after
helm upgrade cilium cilium/cilium --set encryption.enabled=true --set encryption.ipsec.enabled=true --set encryption.strictMode.ingress.enabled=false

Defensive patterns

Strategy: validation

Validate before calling

if ipsecEnabled && strictModeIngressEnabled {
    return fmt.Errorf("IPSec does not support strict ingress encryption; disable one of them before starting the agent")
}

Try / catch

if err := initAndValidateDaemonConfig(params); err != nil {
    if strings.Contains(err.Error(), "strict ingress encryption") {
        // disable strict mode or switch to WireGuard
    }
    log.Fatal(err)
}

Prevention

In Helm values, never set encryption.ipsec.enabled with encryption.strictMode.ingress.enabled simultaneously
Use strict ingress mode only with WireGuard encryption
Validate the rendered Cilium ConfigMap against option-compatibility rules in CI

When it happens

Trigger: Running the cilium-agent with --enable-ipsec (IPSecConfig.Enabled()) while --enable-encryption-strict-mode-ingress is also set, during initAndValidateDaemonConfig in daemon/cmd/daemon.go.

Common situations: Operators migrating from WireGuard (which supports strict mode) to IPSec while keeping the strict-ingress flag; Helm values where encryption mode changed but encryptionStrictModeIngress stayed enabled; copying config from a WireGuard deployment to an IPSec one.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/144d0c38e18899ea. Report an issue: GitHub.