From 567064877e8f11ed1151145f4fd8c1dcdaf97f4c Mon Sep 17 00:00:00 2001 From: Sabeel Ansari Date: Wed, 12 Mar 2025 05:47:03 -0700 Subject: [PATCH] Documentation update for clarity Signed-off-by: Sabeel Ansari --- README.md | 6 +++--- docs/deployment.md | 9 +++++---- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 5d3eb0f..b22f9a7 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ The IPsec recipe is an application that enables strongSwan to use [Infrastructur The strongSwan plugin available in this repository implements a policy-based IPsec enablement using security policy database (SPD) and security association database (SAD). The P4Runtime client introduces a programmable IPsec flow using P4 language for the SPD and OpenConfig for SAD configurability. * IPsec recipe is validated only on Intel® IPU E2100 target -* Refer to https://ipdk.io/documentation/Recipes/InlineIPsec/ +* Refer to https://ipdk.io/documentation/Recipes/InlineIPsec/ for an overview * YANG model for IPsec offload: https://github.com/ipdk-io/openconfig-public/blob/master/release/models/ipsec/openconfig-ipsec-offload.yang * Reference P4 program to enable IPsec on DPDK target: https://github.com/ipdk-io/networking-recipe/tree/main/p4src/Inline_IPsec @@ -23,7 +23,7 @@ The strongSwan plugin available in this repository implements a policy-based IPs ### Prerequisites -It is assumed that the ES2K IPU SDE dependencies have been installed on the +It is assumed that the Intel® IPU SDE dependencies have been installed on the system. The list of dependencies can be found in `sde/tools/setup/install_dep.py` file. @@ -75,7 +75,7 @@ Build strongSwan After successful build, files will be installed in `./output_strongswan` directory. -Compile IPsec P4 files and generate the P4 artifacts (p4info.txt and ipsec.pb.bin). These will be used to set the P4 pipeline. See the [Compiling P4 Programs guide](https://ipdk.io/p4cp-userguide/guides/es2k/compiling-p4-programs.html) for details. Copy the P4 artifacts (p4info.txt and ipsec.pb.bin) in `/var/tmp/` dir with file name linux_networking.p4info.txt and ipsec_fixed_func.pb.bin. +Compile IPsec P4 files and generate the P4 artifacts (p4info.txt and ipsec.pb.bin). These will be used to set the P4 pipeline. See the [Compiling P4 Programs guide](https://ipdk.io/p4cp-userguide/guides/es2k/compiling-p4-programs.html) for details. Copy the P4 artifacts (p4info.txt and ipsec.pb.bin) to `/var/tmp/` directory with file name linux_networking.p4info.txt and ipsec_fixed_func.pb.bin. Generate and copy the file /usr/share/stratum/ipsec_role_config.pb.txt using the [link](https://ipdk.io/p4cp-userguide/guides/p4-role-configuration.html) diff --git a/docs/deployment.md b/docs/deployment.md index 7db51a9..5ff93cc 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -14,23 +14,24 @@ Modify `load_custom_pkg.sh` with following parameters for linux_networking + ips ```bash sed -i 's/sem_num_pages = .*;/sem_num_pages = 28;/g' $CP_INIT_CFG - sed -i 's/lem_num_pages = .*;/lem_num_pages = 10;/g' $CP_INIT_CFG + sed -i 's/lem_num_pages = .*;/lem_num_pages = 32;/g' $CP_INIT_CFG sed -i 's/mod_num_pages = .*;/mod_num_pages = 2;/g' $CP_INIT_CFG + sed -i 's/cxp_num_pages = .*;/cxp_num_pages = 5;/g' $CP_INIT_CFG sed -i 's/acc_apf = 4;/acc_apf = 16;/g' $CP_INIT_CFG ``` - Download `IPU_Documentation` TAR file compliant with the CI build image and refer to `Getting Started Guide` on how to install compatible `IDPF driver` on host. -- Before configuring and using IPsec-recipe, all networking portion of the setup must be completed. Connectivity between the host, ACC and remote systems must work before attempting any IPsec usage. Refer to the Networking-Recipe (P4 Control Plane) user guide for details on bringing up the networking component: https://ipdk.io/p4cp-userguide/apps/lnw/es2k/es2k-lnw-overlay-vms.html +- Before configuring and using IPDK/ipsec-recipe, all networking portion of the setup must be completed. Connectivity between the host, ACC and remote systems must work before attempting any IPsec usage. Refer to the Networking-Recipe (P4 Control Plane) user guide for details on bringing up the networking component: https://ipdk.io/p4cp-userguide/apps/lnw/es2k/es2k-lnw-overlay-vms.html ## IPsec-Recipe Deployment Location ### strongSwan on ACC -This is a simpler deployment scenario where strongSwan and infrap4d both run on ACC. gRPC communication between strongSwan and infrap4d will occur on `localhost` address without any restrictions. +This is a simpler deployment scenario where strongSwan and infrap4d both run on ACC. gRPC communication between strongSwan and infrap4d can occur on `localhost` address without any restrictions. ### strongSwan on host -In this case, the strongSwan application (with ipsec-recipe plugin) will run on host, and communicate via gRPC to the `infrap4d` process, which runs on the ACC. +In this case, the strongSwan application (with IPDK/ipsec-recipe plugin) will run on host, and communicate via gRPC to the `infrap4d` process, which runs on the ACC. Following deployment details need to be considered: