Assisted-by: claude-opus-5-5, Claude Code
Signed-off-by: Thilak Raj Surendra Babu <[email protected]>
---
Documentation/faq/configuration.rst | 17 +++++++++++++++--
NEWS | 1 -
2 files changed, 15 insertions(+), 3 deletions(-)
diff --git a/Documentation/faq/configuration.rst
b/Documentation/faq/configuration.rst
index 313099f44..840b65898 100644
--- a/Documentation/faq/configuration.rst
+++ b/Documentation/faq/configuration.rst
@@ -290,9 +290,22 @@ Q: Does the userspace datapath, for example with DPDK,
support IPsec?
plus ``ip xfrm policy`` rules for the traffic to protect. Received
packets have their SPI in ``tun_id``.
- The current implementation has these restrictions:
+ Manually configured keys never change, and a restart of either end breaks
+ the tunnel until it is reconfigured. Instead, an IKE daemon can
+ negotiate and rekey them, for a tunnel with ``options:esp_keying=ike``,
+ through the ``esp/sa-add`` and related commands of ``ovs-vswitchd``. For
+ strongSwan, the ``kernel-ovs`` plugin, which is distributed separately,
+ does this::
+
+ $ ovs-vsctl add-port br0 esp0 -- set int esp0 type=esp \
+ options:remote_ip=172.31.1.1 \
+ options:esp_keying=ike options:esp_if_id=7
+
+ with ``if_id_in = 7`` and ``if_id_out = 7`` in the strongSwan
+ connection. Received packets then have 7 in ``tun_id``, and
+ ``ovs-appctl esp/show`` lists the security associations.
- * Keys are configured manually. Key exchange (IKE) is not supported yet.
+ The current implementation has these restrictions:
* Only tunnel mode. ESP can be carried in UDP for NAT traversal
(``options:esp_udp_encap=true``), but the peer's UDP port is not
diff --git a/NEWS b/NEWS
index 1c6861586..b02185ef9 100644
--- a/NEWS
+++ b/NEWS
@@ -9,7 +9,6 @@ Post-v4.0.0
- Userspace datapath:
* New 'esp' tunnel type, which carries IPv4 and IPv6 packets in IPsec
ESP tunnel mode with AES-GCM, encrypted by the datapath threads.
- The keys are configured manually for now.
* New 'esp/show' unixctl command to display the security associations
of 'esp' tunnels and their statistics.
* 'esp' tunnels support UDP encapsulation for NAT traversal, and TCP
--
2.43.0
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
