Batfish: only disable non-physical vpn interfaces
@@ -1306,14 +1306,23 @@ public class Batfish extends PluginConsumer implements IBatfish {
CommonUtil.initRemoteIpsecVpns(configurations);
for (Configuration c : configurations.values()) {
for (IpsecVpn vpn : c.getIpsecVpns().values()) {
+ Interface bindInterface = vpn.getBindInterface();
+ if (bindInterface == null) {
+ // Nothing to disable.
+ continue;
+ }
+
+ if (bindInterface.getInterfaceType() == InterfaceType.PHYSICAL) {
+ // Skip tunnels bound to physical interfaces (aka, Cisco interface crypto-map).
+ continue;
+ }
+
IpsecVpn remoteVpn = vpn.getRemoteIpsecVpn();
if (remoteVpn == null
|| !vpn.compatibleIkeProposals(remoteVpn)
|| !vpn.compatibleIpsecProposals(remoteVpn)
|| !vpn.compatiblePreSharedKey(remoteVpn)) {
String hostname = c.getHostname();
- Interface bindInterface = vpn.getBindInterface();
- if (bindInterface != null) {
bindInterface.setActive(false);
bindInterface.setBlacklisted(true);
String bindInterfaceName = bindInterface.getName();
@@ -1325,7 +1334,6 @@ public class Batfish extends PluginConsumer implements IBatfish {
}
}
}
- }
private boolean environmentBgpTablesExist(EnvironmentSettings envSettings) {
Path answerPath = envSettings.getParseEnvironmentBgpTablesAnswerPath();
