diff options
| author | Nataliia S. <81954790+natali-rs1985@users.noreply.github.com> | 2026-02-17 16:38:29 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-02-17 14:38:29 +0000 |
| commit | 72f81aca901d40ddaee862efd20c4f05d753eb74 (patch) | |
| tree | abdb47b98c2dbce601c5518e2fd5c62f401a4ab6 /docs/vpp/configuration/dataplane | |
| parent | 3f9df96e6b5125a4bfb488aa619aa1748687e45d (diff) | |
| download | vyos-documentation-72f81aca901d40ddaee862efd20c4f05d753eb74.tar.gz vyos-documentation-72f81aca901d40ddaee862efd20c4f05d753eb74.zip | |
vpp: T8262: Refactor IPsec settings to use only 'ipsec-acceleration' flag (#1768)
Diffstat (limited to 'docs/vpp/configuration/dataplane')
| -rw-r--r-- | docs/vpp/configuration/dataplane/ipsec.rst | 25 |
1 files changed, 12 insertions, 13 deletions
diff --git a/docs/vpp/configuration/dataplane/ipsec.rst b/docs/vpp/configuration/dataplane/ipsec.rst index b93b1d3d..eab799db 100644 --- a/docs/vpp/configuration/dataplane/ipsec.rst +++ b/docs/vpp/configuration/dataplane/ipsec.rst @@ -15,37 +15,36 @@ IPSec does not require any specific configuration on VPP side. If both source an IPSec Configuration Parameters ============================== -interface-type -^^^^^^^^^^^^^^ +enable IPsec acceleration +^^^^^^^^^^^^^^^^^^^^^^^^^ -When VPP is used for offloading IPsec, it creates a virtual interface of a specific type to connect to a peer. The type of the interface can be configured using the following command: +When VPP is used for offloading IPsec, it creates a virtual interface to connect to peers. The interface type is always 'ipsec', which is used for IPsec tunnels. -.. cfgcmd:: set vpp settings ipsec interface-type <interface-type> +.. cfgcmd:: set vpp settings ipsec-acceleration -The available interface types are: - -- ``ipsec``: This is the default interface type used for IPsec tunnels. -- ``ipip``: This interface type encapsulates IPsec traffic within IP-in-IP packets. - -Select the interface type based on peers settings. In most cases, you need to use the ``ipsec`` type. +Enabling this option allows VPP to handle IPsec traffic more efficiently by offloading processing from the kernel. netlink ^^^^^^^ VPP uses netlink to receive IPSec event messages from the kernel. Proper settings of the following parameters are crucial for ensuring that VPP can process all such messages: -.. cfgcmd:: set vpp settings ipsec netlink batch-delay-ms <milliseconds> +.. cfgcmd:: set vpp settings lcp netlink batch-delay-ms <milliseconds> This parameter specifies the delay in milliseconds between processing batch netlink messages. -.. cfgcmd:: set vpp settings ipsec netlink batch-size <number> +.. cfgcmd:: set vpp settings lcp netlink batch-size <number> This parameter specifies the maximum number of netlink messages to process in a single batch. -.. cfgcmd:: set vpp settings ipsec netlink rx-buffer-size <number> +.. cfgcmd:: set vpp settings lcp netlink rx-buffer-size <number> This parameter specifies the size of the receive buffer for netlink socket. If you expect to offload a lot of IPsec tunnels or get frequent and intensive rekeying, you may need to increase this value. +.. note:: + + IPsec uses the same netlink parameters as LCP, so tuning them affects both LCP and IPsec processing. + Potential Issues and Troubleshooting ==================================== |