diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/vpp/configuration/dataplane/ipsec.md | 32 | ||||
| -rw-r--r-- | docs/vpp/configuration/ipsec.md | 11 |
2 files changed, 7 insertions, 36 deletions
diff --git a/docs/vpp/configuration/dataplane/ipsec.md b/docs/vpp/configuration/dataplane/ipsec.md index 0a66221f..8135f9aa 100644 --- a/docs/vpp/configuration/dataplane/ipsec.md +++ b/docs/vpp/configuration/dataplane/ipsec.md @@ -34,41 +34,9 @@ IPsec tunnels. Enabling this option allows VPP to handle IPsec traffic more efficiently by offloading processing from the kernel. -### netlink - -VPP uses netlink to receive IPsec event messages from the kernel. Proper -settings of the following parameters are crucial for ensuring that VPP can -process all such messages: - -```{cfgcmd} set vpp settings lcp netlink batch-delay-ms \<milliseconds\> -``` - -This parameter specifies the delay in milliseconds between processing -batch netlink messages. - -```{cfgcmd} set vpp settings lcp netlink batch-size \<number\> -``` - -This parameter specifies the maximum number of netlink messages to -process in a single batch. - -```{cfgcmd} set vpp settings lcp netlink rx-buffer-size \<number\> -``` - -This parameter specifies the size of the receive buffer for netlink -socket. If you expect to offload many IPsec tunnels or get frequent and -intensive rekeying, you may need to increase this value. - -:::{note} -IPsec uses the same netlink parameters as LCP, so tuning them -affects both LCP and IPsec processing. -::: - ## Potential Issues and Troubleshooting Improper IPsec configuration can lead to various issues, including: - Failure to offload IPsec tunnels to VPP -- Lost IPsec event messages due to insufficient netlink buffer size or - batch settings - IPsec states or SAs are not synchronized between kernel and VPP diff --git a/docs/vpp/configuration/ipsec.md b/docs/vpp/configuration/ipsec.md index 6ec442e3..86ad920c 100644 --- a/docs/vpp/configuration/ipsec.md +++ b/docs/vpp/configuration/ipsec.md @@ -166,8 +166,7 @@ set vpn ipsec site-to-site peer peerB vti traffic-selector remote prefix '192.16 set vpp settings interface eth1 set vpp settings interface eth2 -set vpp settings ipsec netlink rx-buffer-size '32000' -set vpp settings lcp ignore-kernel-routes +set vpp settings ignore-kernel-routes ``` Where: @@ -212,7 +211,7 @@ Improper IPsec configuration can lead to various issues, including: interfaces to the IPsec peer, they will conflict with the policy routes created for the IPsec tunnel in VPP. Consider using policy-based IPSec configuration to avoid this or - [disable the kernel routes synchronization](lcp.md#vpp-lcp-configuration). + [disable the kernel routes synchronization]. - **Unsupported algorithms** @@ -233,4 +232,8 @@ Improper IPsec configuration can lead to various issues, including: tunnel: ```{cfgcmd} set vpn ipsec site-to-site peer \<peer-name\> force-udp-encapsulation -```
\ No newline at end of file +``` + +% stop_vyoslinter +[disable the kernel routes synchronization]: dataplane/lcp.md#vpp_config_dataplane_lcp_ignore_kernel_routes +% start_vyoslinter |