Re: [vpp-dev] Query for IPSec support on VPP

[Mukesh Yadav (mukyadav)]

Thanks Sergio.

I tried below combinations of dpdk config.

dpdk {
        socket-mem 1024,1024
        num-mbufs 131072
        dev 0000:00:08.0
#        enable-cryptodev
#        vdev cryptodev_aesni_mb_pmd,socket_id=1
#        vdev cryptodev_aesni_mb_pmd,socket_id=1
}

I get below error:
/usr/bin/vpp[3844]: dpdk_ipsec_process:239: not enough Cryptodevs, default to 
OpenSSL IPsec


dpdk {
        socket-mem 1024,1024
        num-mbufs 131072
        dev 0000:00:08.0
#        enable-cryptodev
        vdev cryptodev_aesni_mb_pmd,socket_id=1
        vdev cryptodev_aesni_mb_pmd,socket_id=1
}

CRYPTODEV: [crypto_aesni_mb] cryptodev_aesni_mb_create() line 704: failed to 
create cryptodev vdev
CRYPTODEV: [crypto_aesni_mb] cryptodev_aesni_mb_create() line 746: driver 
cryptodev_aesni_mb_pmd: cryptodev_aesni_create failed
EAL: failed to initialize cryptodev_aesni_mb_pmd device

Seems still config is missing something.
Can you point me out any working wiki or document for making IPSec work along 
DPDK in VPP.

Thanks
Mukesh

From: Sergio Gonzalez Monroy <sergio.gonzalez.mon...@intel.com>
Date: Wednesday, 30 August 2017 at 2:06 PM
To: Mukesh Yadav <mukya...@cisco.com>, "vpp-dev@lists.fd.io" 
<vpp-dev@lists.fd.io>
Subject: Re: [vpp-dev] Query for IPSec support on VPP

Just for reference and clarity, there is no wiki entry for the DPDK crypto, 
only documentation page.
The wiki page is for general VPP/IPSec/IKEv2.

Thanks,
Sergio

On 30/08/2017 09:19, Sergio Gonzalez Monroy wrote:
On 29/08/2017 18:25, Mukesh Yadav (mukyadav) wrote:
Thanks Sergio for quick help. Pointers cleared few of basic doubts.

You are flushing out few left overs from previous releases, so thank you.



I will use below wiki to proceed.
https://docs.fd.io/vpp/17.10/dpdk_crypto_ipsec_doc.html
Since vpp version is 17.10


I added below in /vpp/src/vpp/conf/startup.conf

dpdk {
        socket-mem 1024,1024
        num-mbufs 131072
        dev 0000:00:08.0
        enable-cryptodev
        vdev cryptodev_aesni_mb_pmd,socket_id=1
        vdev cryptodev_aesni_mb_pmd,socket_id=1
}





And did a restart of vpp service using “sudo service vpp restart”. It didn’t 
restarted service.
Till now I was using vanilla config which came with Source where dpdk config 
section was commented.


Next I tried below.
/usr/bin/vpp -c /etc/vpp/startup.conf



I can see logs on command terminal where above command is ran:
load_one_plugin:63: Loaded plugin: 
/usr/lib/vpp_api_test_plugins/ioam_pot_test_plugin.so
dpdk_config: unknown input `enable-cryptodev vdev cryptode...'

That is my bad. The option is not supported anymore, the doc is incorrect.





In wiki it is mentioned to have config like below:
dpdk {
    2     socket-mem 1024,1024
    3     num-mbufs 131072
    4     dev 0000:81:00.0
    5     dev 0000:81:00.1
    6     enable-cryptodev
    7     dev 0000:85:01.0
    8     dev 0000:85:01.1
    9     vdev cryptodev_aesni_mb_pmd,socket_id=1
   10     vdev cryptodev_aesni_mb_pmd,socket_id=1
   11 }



I see the wiki needs update too, at least for the latest VPP release.





It is mandatory to have 4 dev config, or It can work with single dev config as 
I mentioned in my sample config.

I reckon it should work with a single port, should entirely depend on your 
config (fib, ipsec-tunnels, etc).
The example in the wiki was just trying to cover the different options with a 
single configuration.

Thanks,
Sergio







Thanks

Mukesh








_______________________________________________

vpp-dev mailing list

vpp-dev@lists.fd.io<mailto:vpp-dev@lists.fd.io>

https://lists.fd.io/mailman/listinfo/vpp-dev



_______________________________________________
vpp-dev mailing list
vpp-dev@lists.fd.io
https://lists.fd.io/mailman/listinfo/vpp-dev