diff --git a/sys/netkey/key.c b/sys/netkey/key.c
index 0ee6b74730fa..e743fabf4541 100644
--- a/sys/netkey/key.c
+++ b/sys/netkey/key.c
@@ -584,11 +584,13 @@ key_gettunnel(osrc, odst, isrc, idst)
 				return NULL;
 			ip4_def_policy.refcnt++;
 			return &ip4_def_policy;
+#ifdef INET6
 		case PF_INET6:
 			if (ip6_def_policy.policy == IPSEC_POLICY_DISCARD)
 				return NULL;
 			ip6_def_policy.refcnt++;
 			return &ip6_def_policy;
+#endif
 		default:
 			printf("invalid protocol family %d\n.",
 			       isrc->sa_family);