IPsec Offload Software Installation and Operation
Rev 1.8
39
Mellanox Technologies
5.3.3 Destroying IPsec Tunnels
The process of destroying an offloaded IPsec tunnel remains unchanged and is similar to the
destruction of a non-offloaded tunnel using the iproute2 “ip” utility.
It is required to close both the xfrm policies and the xfrm states to completely terminate a
session.
A complete flush of all the policies and states can be done with the following commands:
1. ip xfrm state flush
2. ip xfrm pol flush
To delete a specific xfrm policy use the “ip xfrm policy delete <policy parameters>” command.
To delete a specific xfrm state use the “ip xfrm state delete <state parameters>” command.
When flushing all xfrm states, the flow cache is flushed automatically, so this additional
operation is not required.
5.3.4 IPsec Offload Statistics
The FPGA contains several counters which provide information and statistics on the offload
operation.
These counters are a part of the network interface counters and can be viewed using the ethtool
-S <interface_name> command.
Note:
The mlx5_core module must be loaded for the counters to appear in ethtool.
Table 7 - ethtool IPsec Offload Counters
Name
Description
ipsec_dec_in_packets
Total packets received for decryption by FPGA.
ipsec_dec_out_packets
Number of packets that were received for decryption, decrypted and
successfully authenticated by FPGA.
ipsec_dec_bypass_packets
Number of packets that were bypassed by FPGA in decryption
direction.
ipsec_enc_in_packets
Total packets received for encryption by FPGA.
ipsec_enc_out_packets
Number of packets that were received for encryption, encrypted and
successfully authenticated by FPGA.
ipsec_enc_bypass_packets
Number of packets that were bypassed by FPGA in encryption
direction.
ipsec_dec_drop_packets
Number of packets dropped by decryption engine. This can be as a
result of having inband metadata in packet or corrupted decryption.
ipsec_dec_auth_fail_packets
Number of packets dropped by decryption engine due to
authentication issue.
