Hi Manoj, We support 2 main modes: - tunnel protection mode: https://wiki.fd.io/view/VPP/IPSec#Protection_Model - policy mode: https://wiki.fd.io/view/VPP/IPSec#Policy_Mode
In tunnel protection mode, the packet classification is done via routing, I suspect this is what you need, eg. - VLANs arrive on different sub-interfaces - each sub-interface is in a different VRF - each VRF has its own tunnel with a default route going through it Of course you can build more complex topologies, eg. having multiple tunnels per VRF with different routes, etc. Best ben > -----Original Message----- > From: [email protected] <[email protected]> On Behalf Of Manoj Kumar > (manojku5) via lists.fd.io > Sent: mercredi 7 avril 2021 19:19 > To: [email protected] > Cc: Dharmarajan Subramanian (dharsubr) <[email protected]>; Srinivas > Davuluri (srinud) <[email protected]>; Prashant Anand (prasanan) > <[email protected]> > Subject: [vpp-dev] IPSec - Clear packet's classification for SA lookup in > VPP > > Hi Team, > > > > We have some basic queries on the IPSEC support in VPP. Could someone > please take a look? > > > > How does the clear packet classification and SA lookup happens in VPP for > the packet? I mean, what all fields of the IP packet are considered for > the SA lookup – can it support some L2/VLAN fields as well for this > lookup? > > * Please share some code pointers towards this if possible. > > > > I came across esp4_encrypt_handoff() in ipsec_handoff.c file but could not > find the caller for the same. Which code leg calls this? > > * This further points to esp4_encrypt_node() and to > esp_encrypt_inline(). > * Inside esp_encrypt_inline(), I can see the code to access the SA for > the packet. But looks like that is pre-populated in the packet/frame. Is > that understanding correct? If yes, can you please point us to the code > pointers where this is set – is it in the previous graph node before > “esp4_encrypt_handoff”? > > 636 if (is_tun) > > 637 { > > 638 /* we are on a ipsec tunnel's feature arc */ > > 639 vnet_buffer (b[0])->ipsec.sad_index = > > 640 sa_index0 = ipsec_tun_protect_get_sa_out > > 641 (vnet_buffer (b[0])->ip.adj_index[VLIB_TX]); > > 642 } > > 643 else > > 644 sa_index0 = vnet_buffer (b[0])->ipsec.sad_index; > > 645 > > > > At a high level, we want to be able to support IPSEC for multiple VRFs and > we would like to use an L2 encapsulation so that we can classify / find > the SA for the clear text packet using the IP Header and the L2 fields. Is > that supported? > > If yes, what is the control plane programming requirements for that and > where is this classification done in the VPP code? > > > > > > Thanks & Regards > > --Manoj > >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#19129): https://lists.fd.io/g/vpp-dev/message/19129 Mute This Topic: https://lists.fd.io/mt/81921820/21656 Group Owner: [email protected] Unsubscribe: https://lists.fd.io/g/vpp-dev/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
