diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index 5385a0f..b304458 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -840,8 +840,8 @@
       /* create an ip-ip tunnel, then the two SA, then bind them */
       rv =
 	ipip_add_tunnel (ipv6_set ? IPIP_TRANSPORT_IP6 : IPIP_TRANSPORT_IP4,
-			 instance, &local_ip, &remote_ip, fib_index, 0,
-			 &sw_if_index);
+			 instance, &local_ip, &remote_ip, fib_index,
+			 IPIP_TUNNEL_FLAG_NONE, IP_DSCP_CS0, &sw_if_index);
       rv |=
 	ipsec_sa_add_and_lock (ipsec_tun_mk_local_sa_id (sw_if_index),
 			       local_spi, IPSEC_PROTOCOL_ESP, crypto_alg,