diff --git a/vnet/vnet/ipsec-gre/interface.c b/vnet/vnet/ipsec-gre/interface.c
index dbf9df5..fae79b9 100644
--- a/vnet/vnet/ipsec-gre/interface.c
+++ b/vnet/vnet/ipsec-gre/interface.c
@@ -163,6 +163,8 @@
       t->local_sa = ipsec_get_sa_index_by_sa_id (a->lsa);
       t->remote_sa = ipsec_get_sa_index_by_sa_id (a->rsa);
 
+      ip4_sw_interface_enable_disable (sw_if_index, 1);
+
       vec_validate_init_empty (igm->tunnel_index_by_sw_if_index,
 			       sw_if_index, ~0);
       igm->tunnel_index_by_sw_if_index[sw_if_index] = t - igm->tunnels;
@@ -199,6 +201,7 @@
       t = pool_elt_at_index (igm->tunnels, p[0]);
 
       sw_if_index = t->sw_if_index;
+      ip4_sw_interface_enable_disable (sw_if_index, 0);
       vnet_sw_interface_set_flags (vnm, sw_if_index, 0 /* down */ );
       /* make sure tunnel is removed from l2 bd or xconnect */
       set_int_l2_mode (igm->vlib_main, vnm, MODE_L3, sw_if_index, 0, 0, 0, 0);
diff --git a/vnet/vnet/ipsec-gre/ipsec_gre.c b/vnet/vnet/ipsec-gre/ipsec_gre.c
index cf0f391..9fd8a30 100644
--- a/vnet/vnet/ipsec-gre/ipsec_gre.c
+++ b/vnet/vnet/ipsec-gre/ipsec_gre.c
@@ -206,6 +206,11 @@
 	  ip0->checksum = ip4_header_checksum (ip0);
 	  ip1->checksum = ip4_header_checksum (ip1);
 
+	  vnet_buffer (b0)->sw_if_index[VLIB_RX] =
+	    vnet_buffer (b0)->sw_if_index[VLIB_TX];
+	  vnet_buffer (b1)->sw_if_index[VLIB_RX] =
+	    vnet_buffer (b1)->sw_if_index[VLIB_TX];
+
 	  vnet_buffer (b0)->output_features.ipsec_sad_index = t->local_sa;
 	  vnet_buffer (b1)->output_features.ipsec_sad_index = t->local_sa;
 
@@ -281,6 +286,8 @@
 	  ip0->dst_address.as_u32 = t->tunnel_dst.as_u32;
 	  ip0->checksum = ip4_header_checksum (ip0);
 
+	  vnet_buffer (b0)->sw_if_index[VLIB_RX] =
+	    vnet_buffer (b0)->sw_if_index[VLIB_TX];
 	  vnet_buffer (b0)->output_features.ipsec_sad_index = t->local_sa;
 	  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;