struct flow_match_enc_keyid enc_keyid;
        void *misc_c, *misc_v;
 
-       misc_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria, misc_parameters);
-       misc_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, misc_parameters);
-
        if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_KEYID))
                return 0;
 
                err = mlx5e_tc_tun_parse_vxlan_gbp_option(priv, spec, f);
                if (err)
                        return err;
+
+               /* We can't mix custom tunnel headers with symbolic ones and we
+                * don't have a symbolic field name for GBP, so we use custom
+                * tunnel headers in this case. We need hardware support to
+                * match on custom tunnel headers, but we already know it's
+                * supported because the previous call successfully checked for
+                * that.
+                */
+               misc_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
+                                     misc_parameters_5);
+               misc_v = MLX5_ADDR_OF(fte_match_param, spec->match_value,
+                                     misc_parameters_5);
+
+               /* Shift by 8 to account for the reserved bits in the vxlan
+                * header after the VNI.
+                */
+               MLX5_SET(fte_match_set_misc5, misc_c, tunnel_header_1,
+                        be32_to_cpu(enc_keyid.mask->keyid) << 8);
+               MLX5_SET(fte_match_set_misc5, misc_v, tunnel_header_1,
+                        be32_to_cpu(enc_keyid.key->keyid) << 8);
+
+               spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS_5;
+
+               return 0;
        }
 
        /* match on VNI is required */
                return -EOPNOTSUPP;
        }
 
+       misc_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
+                             misc_parameters);
+       misc_v = MLX5_ADDR_OF(fte_match_param, spec->match_value,
+                             misc_parameters);
+
        MLX5_SET(fte_match_set_misc, misc_c, vxlan_vni,
                 be32_to_cpu(enc_keyid.mask->keyid));
        MLX5_SET(fte_match_set_misc, misc_v, vxlan_vni,