IPsec Offload Software Installation and Operation
Rev 1.8
37
Mellanox Technologies
5.3
Operating the IPsec Offload
5.3.1 Loading/Unloading the Module
5.3.1.1 Automatic Load
The Mellanox Innova IPsec Ethernet driver, mlx5_core, is loaded automatically by the kernel
when a Mellanox Innova IPsec card is installed.
5.3.1.2 Manual Load/Unload
1. Load/unload mlx5_core using one of the following commands:
Note:
Unloading the IPsec offload module while there are active IPsec offloaded
connections is not supported and the result is undefined. For proper and stable
operation of the HW and SW, the offloaded IPsec connection must be terminated via
the proper utility before module unload. It is recommended to flush the existing IPsec
XFRM states before restarting the mlx5_core module in case there are offloaded
security associations. It can be done by running the following command: ip xfrm state
flush; ip xfrm pol flush.
5.3.2 Setting up an Offloaded IPsec Connection
IPsec secured connection can be opened through the iproute2 utility. For offload support, please
use the iproute2 version that is modified and supplied by Mellanox (see
the Customized iproute2 Utility,” on page 35
).
In order to configure an IPsec secured connection between hosts, it is necessary to:
1. Configure the security association (SA) intended for use, with its relevant parameters (such
as: crypto algorithm, key length, ESP mode, the SA ID, traffic direction of th SA and more).
2. Configure the xfrm policy which defines the type of traffic that will undergo encryption or
decryption. It also sets the tunnel IP addresses which encapsulate the packet when working in
ESP tunnel mode.
The following example shows how to configure a host (one side of an IPsec connection) with an
offloaded IPsec tunnel using the iproute2 utility. In this example, the tunnel is set in IPv4 mode
with AES-GCM128 crypto algorithm. The keys are added manually.
1. Set the egress traffic security parameters:
ip xfrm state add src
1
192.168.7.2 dst
2
192.168.7.9
proto esp spi
3
0x4c250336 reqid
4
0x4c250336 mode tunnel aead 'rfc4106(gcm(aes))'
0x44e6625f4d2fb01b03cc9baefe9b5c8de9d7b9c1
5
128
offload dev ens8
6
dir out
7
insmod mlx5_core
modprobe mlx5_core
rmmod mlx5_core(unload command)
1. The IP addresses of the src host of the egress traffic. Modify it with your own relevant addresses.
2. The IP addresses of the destination host of the egress traffic. Modify it with your own relevant addresses.
