Skip to content

vpp: update ipsec supported encryption algorithms #1755

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dmbaturin merged 1 commit into from
Feb 3, 2026
Merged

vpp: update ipsec supported encryption algorithms #1755

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/vpp/configuration/ipsec.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,10 @@
VPP IPsec Configuration
#######################

VPP Dataplane in VyOS can offload IPSec processing from kernel. This allows to speed-up IPSec traffic handling significantly, when necessary conditions are met.

Check warning on line 11 in docs/vpp/configuration/ipsec.rst

View workflow job for this annotation

GitHub Actions / lint-doc / doc-lint 

Line too long: len=160

.. note::
VPP IPsec implementation is not as feature rich as Linux kernel IPsec. It supports only a subset of algorithms and modes.

Check warning on line 14 in docs/vpp/configuration/ipsec.rst

View workflow job for this annotation

GitHub Actions / lint-doc / doc-lint 

Line too long: len=124

Requirements
============
Expand All @@ -19,18 +19,18 @@
To make IPSec offloading work, following requirements must be met:

* VPP dataplane must be configured.
* VPP :doc:`IPsec settings </vpp/configuration/dataplane/ipsec>` should be configured as needed.

Check warning on line 22 in docs/vpp/configuration/ipsec.rst

View workflow job for this annotation

GitHub Actions / lint-doc / doc-lint 

Line too long: len=96
* IPSec should be configured in the VPN configuration section, see :doc:`/configuration/vpn/ipsec/index`.

Check warning on line 23 in docs/vpp/configuration/ipsec.rst

View workflow job for this annotation

GitHub Actions / lint-doc / doc-lint 

Line too long: len=105
* Both source and destination of the IPSec traffic must be reachable via VPP interfaces, so it can perform both encryption and decryption of the traffic.

Check warning on line 24 in docs/vpp/configuration/ipsec.rst

View workflow job for this annotation

GitHub Actions / lint-doc / doc-lint 

Line too long: len=153

Integration Details
===================

VPP Dataplane offloads IPSec processing from kernel, but does not handle IPSec configuration itself. IPSec configuration management and control-plane operation, like IKE negotiation, is still done by the kernel and other daemons.

Check warning on line 29 in docs/vpp/configuration/ipsec.rst

View workflow job for this annotation

GitHub Actions / lint-doc / doc-lint 

Line too long: len=229

After an IPSec tunnel is configured in the kernel, VPP receives the necessary information via netlink messages and creates a corresponding SAs and policies to be able to offload the traffic.

Check warning on line 31 in docs/vpp/configuration/ipsec.rst

View workflow job for this annotation

GitHub Actions / lint-doc / doc-lint 

Line too long: len=190

When VPP is used for offloading IPsec, it creates a virtual interface of a specific type to connect to a peer. The type of the interface can be configured using the ``interface-type`` parameter in the dataplane settings.

Check warning on line 33 in docs/vpp/configuration/ipsec.rst

View workflow job for this annotation

GitHub Actions / lint-doc / doc-lint 

Line too long: len=220

Supported IPsec Modes
=====================
Expand All @@ -45,18 +45,18 @@

.. warning::

Since VPP dataplane is used only to offload IPsec traffic processing, algorithms mentioned below are applicable to ESP profiles in the IPsec configuration. IKE profiles are not affected by these limitations and can use any algorithms supported by the kernel.

Check warning on line 48 in docs/vpp/configuration/ipsec.rst

View workflow job for this annotation

GitHub Actions / lint-doc / doc-lint 

Line too long: len=262

VPP **supports** only the following **encryption algorithms**:

* AES-CBC
* AES-GCM with ICV

VPP **does not** support the following **encryption algorithms**:

* Null encryption
* AES-CTR
* AES-CCM with ICV
* AES-GCM with ICV
* Null encryption with AES-GMAC
* 3DES-EDE-CBC
* Blowfish-CBC
Expand Down Expand Up @@ -85,7 +85,7 @@
* AES CMAC
* AES-GMAC

If you have configured ESP profiles with algorithms not supported by VPP and the traffic for such peers flows trough VPP interfaces, such traffic will be dropped.

Check warning on line 88 in docs/vpp/configuration/ipsec.rst

View workflow job for this annotation

GitHub Actions / lint-doc / doc-lint 

Line too long: len=162

Configuration Examples
======================
Expand Down
Loading