docs/content/methodology/internet_protocol_security_ipsec.md

   1 ---
   2 bookToc: false
   3 title: "Internet Protocol Security (IPsec)"
   4 weight: 11
   5 ---
   6
   7 # Internet Protocol Security (IPsec)
   8
   9 VPP IPsec performance tests are executed for the following crypto
  10 plugins:
  11
  12 - `crypto_native`, used for software based crypto leveraging CPU
  13   platform optimizations e.g. Intel's AES-NI instruction set.
  14 - `crypto_ipsecmb`, used for hardware based crypto with Intel QAT PCIe
  15   cards.
  16
  17 ## IPsec with VPP Native SW Crypto
  18
  19 CSIT implements following IPsec test cases relying on VPP native crypto
  20 (`crypto_native` plugin):
  21
  22  **VPP Crypto Engine** | **ESP Encryption** | **ESP Integrity** | **Scale Tested**
  23 ----------------------:|-------------------:|------------------:|-----------------:
  24  crypto_native         | AES[128\|256]-GCM  | GCM               | 1 to 60k tunnels
  25  crypto_native         | AES128-CBC         | SHA[256\|512]     | 1 to 60k tunnels
  26
  27 VPP IPsec with SW crypto are executed in both tunnel and policy modes,
  28 with tests running on 3-node testbeds: 3n-icx, 3n-tsh.
  29
  30 ## IPsec with Intel QAT HW
  31
  32 CSIT implements following IPsec test cases relying on ipsecmb library
  33 (`crypto_ipsecmb` plugin) and Intel QAT 8950 (50G HW crypto card):
  34
  35 dpdk_cryptodev
  36
  37  **VPP Crypto Engine** | **VPP Crypto Workers** | **ESP Encryption** | **ESP Integrity** | **Scale Tested**
  38 ----------------------:|-----------------------:|-------------------:|------------------:|-----------------:
  39  crypto_ipsecmb        | sync/all workers       | AES[128\|256]-GCM  | GCM               | 1, 1k tunnels
  40  crypto_ipsecmb        | sync/all workers       | AES[128]-CBC       | SHA[256\|512]     | 1, 1k tunnels
  41  crypto_ipsecmb        | async/crypto worker    | AES[128\|256]-GCM  | GCM               | 1, 4, 1k tunnels
  42  crypto_ipsecmb        | async/crypto worker    | AES[128]-CBC       | SHA[256\|512]     | 1, 4, 1k tunnels
  43
  44 ## IPsec with Async Crypto Feature Workers
  45
  46 *TODO Description to be added*
  47
  48 ## IPsec Uni-Directional Tests with VPP Native SW Crypto
  49
  50 CSIT implements following IPsec uni-directional test cases relying on VPP native
  51 crypto (`crypto_native` plugin) in tunnel mode:
  52
  53  **VPP Crypto Engine** | **ESP Encryption** | **ESP Integrity** | **Scale Tested**
  54 ----------------------:|-------------------:|------------------:|-------------------:
  55  crypto_native         | AES[128\|256]-GCM  | GCM               | 4, 1k, 10k tunnels
  56  crypto_native         | AES128-CBC         | SHA[512]          | 4, 1k, 10k tunnels
  57
  58 In policy mode:
  59
  60  **VPP Crypto Engine** | **ESP Encryption** | **ESP Integrity** | **Scale Tested**
  61 ----------------------:|-------------------:|------------------:|------------------:
  62  crypto_native         | AES[256]-GCM       | GCM               | 1, 40, 1k tunnels
  63
  64 The tests are running on 2-node testbeds: 2n-tx2. The uni-directional tests
  65 are partially addressing a weakness in 2-node testbed setups with T-Rex as
  66 the traffic generator. With just one DUT node, we can either encrypt or decrypt
  67 traffic in each direction.
  68
  69 The testcases are only doing encryption - packets are encrypted on the DUT and
  70 then arrive at TG where no additional packet processing is needed (just
  71 counting packets).
  72
  73 Decryption would require that the traffic generator generated encrypted packets
  74 which the DUT then would decrypt. However, T-Rex does not have the capability
  75 to encrypt packets.