Network & Infrastructure / Segmentation, TLS & Secure Connectivity
IPsec traffic-selector overlap and the wrong tunnel choice
A new site tunnel breaks an existing private route because the two connections cover overlapping source and destination ranges. Tunnel status remains up while packets select an unintended policy.
Environment and inputs: Stateful network boundaries, TLS endpoints and IPsec gateways; use the deployed security policy and implementation manual. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Compare negotiated traffic selectors, local security policy, route lookup and actual encrypted counters for each tunnel. Include NAT and overlapping remote subnets in the path model.
Explain the result
An established security association protects only its negotiated traffic context. Overlapping policy entries or route precedence can steer packets into a different association than the operator expects.
Plan the fix
Resolve address and policy ownership explicitly, using a supported route-based or policy-based design. Avoid widening every selector to all addresses as a way to hide ambiguous matching.
Check the result and rollback
Test each intended subnet pair and a forbidden pair while checking the selected tunnel. Restore the previous selector set if another site loses connectivity or isolation boundaries become unclear.