IPsec tunnel configuration support limits for IPv4 and IPv6 on ESXi hosts.

Products

• VMware vSphere ESXi

Issue/Introduction

When attempting to establish an IPsec tunnel between an ESXi host and a non-ESXi platform (e.g., Linux-based systems or NetApp storage appliances), configuration errors may occur if the network protocol or key requirements are not met.

• IPsec tunnel fails to establish.
• Errors occur when running esxcli network ip ipsec sa add commands.
• Communication is attempted using IPv4 addresses.
• Configuration is attempted using only a Pre-Shared Key (PSK) without separate encryption and integrity keys.

Environment

• VMware vSphere 7.x
• VMware vSphere 8.x
• VMware Cloud Foundation 9.x

Cause

ESXi hosts currently support IPsec for IPv6 traffic only. IPsec for IPv4 traffic is not supported on the ESXi platform. Additionally, the configuration requires explicit encryption and integrity keys; a single PSK string cannot be used for both fields.

Resolution

To establish a functional IPsec tunnel, ensure the following requirements are met:

• Use IPv6 addressing for both source and destination endpoints. IPv4 is not a viable protocol for IPsec on ESXi.
• Configure IPv6 routing to ensure connectivity between the ESXi host and the peer appliance.
• Obtain and provide unique encryption and integrity keys for the Security Association (SA). A single PSK is insufficient for the esxcli configuration command.

For detailed command examples and sdk documentation, see Setting up IPsec in vSphere.