diff --git a/RHEL-17403-ipsec-Fix-error-when-ipsec-interface-set-to-yes-or-a.patch b/RHEL-17403-ipsec-Fix-error-when-ipsec-interface-set-to-yes-or-a.patch
new file mode 100644
index 0000000..8533662
--- /dev/null
+++ b/RHEL-17403-ipsec-Fix-error-when-ipsec-interface-set-to-yes-or-a.patch
@@ -0,0 +1,39 @@
+From 9203d781cbb12fab9f5a6fd7d4ac108c263b4254 Mon Sep 17 00:00:00 2001
+From: Gris Ge <fge@redhat.com>
+Date: Fri, 15 Dec 2023 20:45:11 +0800
+Subject: [PATCH] ipsec: Fix error when `ipsec-interface` set to yes or a
+ number
+
+The new nispor 1.2.15 is showing xfrm interface type as `Other("Xfrm")`
+as its dependent netlink-packet-route is not placing it into Other.
+
+To fix that, we just compare the interface type after
+`str::to_lowercase()`.
+
+No test code needed, existing
+`test_ipsec_ipv4_libreswan_psk_auth_with_ipsec_iface` can reproduce this
+problem.
+
+Signed-off-by: Gris Ge <fge@redhat.com>
+---
+ rust/src/lib/nispor/base_iface.rs | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/rust/src/lib/nispor/base_iface.rs b/rust/src/lib/nispor/base_iface.rs
+index 415769d3..011182e6 100644
+--- a/rust/src/lib/nispor/base_iface.rs
++++ b/rust/src/lib/nispor/base_iface.rs
+@@ -26,7 +26,9 @@ fn np_iface_type_to_nmstate(
+         nispor::IfaceType::Vxlan => InterfaceType::Vxlan,
+         nispor::IfaceType::Ipoib => InterfaceType::InfiniBand,
+         nispor::IfaceType::Tun => InterfaceType::Tun,
+-        nispor::IfaceType::Other(v) if v == "xfrm" => InterfaceType::Xfrm,
++        nispor::IfaceType::Other(v) if v.to_lowercase() == "xfrm" => {
++            InterfaceType::Xfrm
++        }
+         _ => InterfaceType::Other(format!("{np_iface_type:?}")),
+     }
+ }
+-- 
+2.43.0
+
diff --git a/nmstate.spec b/nmstate.spec
index 1411689..67d3240 100644
--- a/nmstate.spec
+++ b/nmstate.spec
@@ -4,7 +4,7 @@
 
 Name:           nmstate
 Version:        2.2.21
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Declarative network manager API
 License:        LGPLv2+
 URL:            https://github.com/%{srcname}/%{srcname}
@@ -12,6 +12,7 @@ Source0:        https://github.com/nmstate/nmstate/releases/download/v%{version}
 Source1:        https://github.com/nmstate/nmstate/releases/download/v%{version}/nmstate-%{version}.tar.gz.asc
 Source2:        https://nmstate.io/nmstate.gpg
 Source3:        https://github.com/nmstate/nmstate/releases/download/v%{version}/nmstate-vendor-%{version}.tar.xz
+Patch1:         RHEL-17403-ipsec-Fix-error-when-ipsec-interface-set-to-yes-or-a.patch
 BuildRequires:  python3-devel
 BuildRequires:  python3-setuptools
 BuildRequires:  gnupg2
@@ -150,6 +151,9 @@ popd
 /sbin/ldconfig
 
 %changelog
+* Tue Dec 19 2023 Gris Ge <fge@redhat.com> - 2.2.21-2
+- Fix `ipsec-interface` option. RHEL-17403
+
 * Fri Dec 15 2023 Íñigo Huguet <ihuguet@redhat.com> - 2.2.21-1
 - Upgrade to 2.2.21.