--- distrib/ipsec_updown	2018-12-11 14:32:14.000000000 +0100
+++ modif/ipsec_updown	2019-03-21 14:32:45.273634432 +0100
@@ -403,6 +406,42 @@
 	#Autoriser le FW a acceder au RVP
 	/sbin/iptables -I OUTPUT -m state --state NEW -m policy --pol ipsec --proto esp --dir out -o %%interface_gw -d $PLUTO_PEER_CLIENT -j ACCEPT
 	/sbin/iptables -I OUTPUT -m state --state ESTABLISHED,RELATED -m policy --pol ipsec --proto esp --dir out -o %%interface_gw -d $PLUTO_PEER_CLIENT -j ACCEPT
+    # xfrm policies
+    %set %%reseau = []
+    %for %%int_num in %%range(%%int(%%nombre_interfaces))
+%%reseau.append(%%getVar('adresse_network_eth' + %%str(%%int_num)) + "/" + %%calc_classe(%%getVar('adresse_netmask_eth' + %%str(%%int_num))))%slurp
+      %if %%getVar('alias_eth' + %%str(%%int_num)) == 'oui'
+        %for %%alias in %%getVar('alias_ip_eth' + %%str(%%int_num))
+          %set %%network_key = "alias_network_eth" + %%str(%%int_num)
+          %set %%netmask_key = "alias_netmask_eth" + %%str(%%int_num)
+          %set %%calc_net = %%getattr(alias, %%network_key)+ "/" + %%calc_classe(%%getattr(alias, %%netmask_key))
+%%reseau.append(%%calc_net)%slurp
+        %end for
+      %end if
+      %if %%getVar('vlan_eth' + %%str(%%int_num)) == 'oui'
+        %for %%vlan_id in %%getVar('vlan_id_eth' + %%str(%%int_num))
+          %set %%network_key = "vlan_network_eth" + str(%%int_num)
+          %set %%netmask_key = "vlan_netmask_eth" + str(%%int_num)
+          %set %%calc_net = %%getattr(%%vlan_id, %%network_key)+ "/" + %%calc_classe(%%getattr(vlan_id, %%netmask_key))
+%%reseau.append(%%calc_net)%slurp
+        %end for
+      %end if
+    %end for
+    %if %%activer_route == 'oui'
+      %for %%route in %%route_adresse
+        %if %%route.route_int != '0'
+          %set %%net_route = %%str(%%route) + "/" + %%str(%%calc_classe(%%route.route_netmask))
+%%reseau.append(%%net_route)%slurp
+        %end if
+      %end for
+    %end if
+    %for %%res1 in %%reseau
+      %for %%res2 in %%reseau
+    ip xfrm policy add src %%res1 dst %%res2 dir in
+    ip xfrm policy add src %%res1 dst %%res2 dir out
+    ip xfrm policy add src %%res1 dst %%res2 dir fwd
+      %end for
+    %end for
     %if %%mode_conteneur_actif == "oui"
     # Si mode conteneur, on translate le réseau des conteneurs dans les tunnels du réseau de l'interface 1
     for ip in $(hostname -I)
@@ -441,6 +480,42 @@
 	##
 	/sbin/iptables -D OUTPUT -m state --state NEW -m policy --pol ipsec --proto esp --dir out -o %%interface_gw -d $PLUTO_PEER_CLIENT -j ACCEPT
 	/sbin/iptables -D OUTPUT -m state --state ESTABLISHED,RELATED -m policy --pol ipsec --proto esp --dir out -o %%interface_gw -d $PLUTO_PEER_CLIENT -j ACCEPT
+    # xfrm policies
+    %set %%reseau = []
+    %for %%int_num in %%range(%%int(%%nombre_interfaces))
+%%reseau.append(%%getVar('adresse_network_eth' + %%str(%%int_num)) + "/" + %%calc_classe(%%getVar('adresse_netmask_eth' + %%str(%%int_num))))%slurp
+      %if %%getVar('alias_eth' + %%str(%%int_num)) == 'oui'
+        %for %%alias in %%getVar('alias_ip_eth' + %%str(%%int_num))
+          %set %%network_key = "alias_network_eth" + %%str(%%int_num)
+          %set %%netmask_key = "alias_netmask_eth" + %%str(%%int_num)
+          %set %%calc_net = %%getattr(alias, %%network_key)+ "/" + %%calc_classe(%%getattr(alias, %%netmask_key))
+%%reseau.append(%%calc_net)%slurp
+        %end for
+      %end if
+      %if %%getVar('vlan_eth' + %%str(%%int_num)) == 'oui'
+        %for %%vlan_id in %%getVar('vlan_id_eth' + %%str(%%int_num))
+          %set %%network_key = "vlan_network_eth" + str(%%int_num)
+          %set %%netmask_key = "vlan_netmask_eth" + str(%%int_num)
+          %set %%calc_net = %%getattr(%%vlan_id, %%network_key)+ "/" + %%calc_classe(%%getattr(vlan_id, %%netmask_key))
+%%reseau.append(%%calc_net)%slurp
+        %end for
+      %end if
+    %end for
+    %if %%activer_route == 'oui'
+      %for %%route in %%route_adresse
+        %if %%route.route_int != '0'
+          %set %%net_route = %%str(%%route) + "/" + %%str(%%calc_classe(%%route.route_netmask))
+%%reseau.append(%%net_route)%slurp
+        %end if
+      %end for
+    %end if
+    %for %%res1 in %%reseau
+      %for %%res2 in %%reseau
+    ip xfrm policy del src %%res1 dst %%res2 dir in
+    ip xfrm policy del src %%res1 dst %%res2 dir out
+    ip xfrm policy del src %%res1 dst %%res2 dir fwd
+      %end for
+    %end for
     %if %%mode_conteneur_actif == "oui"
     # Si mode conteneur, on supprime la tranlation du réseau des conteneurs dans les tunnels du réseau ide l'interface 1
     for ip in $(hostname -I)

