Rev 1.8
38
Mellanox Technologies
2. Set the ingress traffic security parameters:
ip xfrm state add src
1
192.168.7.9 dst
2
192.168.7.2
proto esp spi
3
0x0f2e596c reqid 0x0f2e596c mode tunnel aead 'rfc4106(gcm(aes))'
0x44e6625f4d2fb01b03cc9baefe9b5c8de9d7b9c1
4
128
offload dev ens8 dir in
5
Note:
offload dev ens8 dir out
and
offload dev ens8 dir in
are the new flags which instruct the
iproute2 utility to enable HW offload for the specified security policy.
3. Apply the new egress traffic security policy:
ip xfrm policy add src 192.168.7.2 dst
6
192.168.7.9 dir out tmpl
7
src 192.168.7.2 dst
8
192.168.7.9 proto esp reqid 0x4c250336 mode
tunnel
4. Apply the new ingress traffic security policy:
ip xfrm policy add src 192.168.7.9 dst
192.168.7.2 dir in tmpl src 192.168.7.9 dst 192.168.7.2 proto esp reqid 0x0f2e596c mode
tunnel
Note:
The above example shows how to configure a host on one side of the IPsec secured
connection. The peer host must undergo the same flow listed above only with the
traffic directions inverted. That is, the settings of the egress traffic in this example are
the settings of the ingress traffic for the peer host.
Once configured, the existing xfrm states (SAs) and policies can be seen using the following
commands:
1. ip xfrm state - to view all the xfrm states in the kernel.
2. ip xfrm pol - to view all the xfrm policies in the kernel.
When viewing the xfrm states in the system, the flag dir in/dir out (depending on the traffic
direction of the state), under the “crypto offload parameters” section, will indicate that this state
is offloaded by an offload device. If these flags are not present, it indicates that encryption/
decryption is not offloaded for this xfrm state and remains within the kernel scope.
3. SPI value for egress traffic - add your own desired value.
4. SA request id - this ID is used as a reference to the new SA (for modification, destruction, attaching to a policy). Any number can be chosen
here.
5. The 128 bit key concatenated with the constant initialization vector (IV) that are used for the encryption of the egress traffic.
6. The relevant network interface name - replace with your own.
7. out/in - traffic direction of this IPsec tunnel setting.
1. The IP addresses of the src host of the ingress traffic. Modify it with your own relevant addresses.
2. The IP addresses of the destination host of the ingress traffic. Modify it with your own relevant addresses.
3. SPI value for ingress traffic - add your own desired value.
4. The 128 bit key concatenated with the constant initialization vector (IV) that are used for the decryption of the ingress traffic. This traffic key
does not have to be similar to the egress traffic key.
5. out/in - traffic direction of this IPsec tunnel setting.
6. The IP addresses of the inner (original) packet to undergo transformation and tunnel encapsulation.
7. Indicates that we are about to define the template of the outer IP header of our tunnel.
8. The tunnel source and destination IP addresses - can be different than the inner packet IP address.
