diff --git a/roles/network_plugin/calico/defaults/main.yml b/roles/network_plugin/calico/defaults/main.yml
index 3431bb94b..ae564b1f3 100644
--- a/roles/network_plugin/calico/defaults/main.yml
+++ b/roles/network_plugin/calico/defaults/main.yml
@@ -8,7 +8,7 @@ calico_ipv4pool_ipip: "Off"
 
 # Use IP-over-IP encapsulation across hosts
 ipip: true
-ipip_mode: Always  # change to "CrossSubnet" if you only want ipip encapsulation on traffic going across subnets
+ipip_mode: "{{ 'Always' if ipip else 'Never' }}"  # change to "CrossSubnet" if you only want ipip encapsulation on traffic going across subnets
 
 calico_cert_dir: /etc/calico/certs