Skip to content
This repository was archived by the owner on Jan 5, 2026. It is now read-only.

Documentation update for clarity #43

Open
5abeel wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Documentation update for clarity #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ The IPsec recipe is an application that enables strongSwan to use [Infrastructur
The strongSwan plugin available in this repository implements a policy-based IPsec enablement using security policy database (SPD) and security association database (SAD). The P4Runtime client introduces a programmable IPsec flow using P4 language for the SPD and OpenConfig for SAD configurability.

* IPsec recipe is validated only on Intel® IPU E2100 target
* Refer to https://ipdk.io/documentation/Recipes/InlineIPsec/
* Refer to https://ipdk.io/documentation/Recipes/InlineIPsec/ for an overview
* YANG model for IPsec offload: https://github.com/ipdk-io/openconfig-public/blob/master/release/models/ipsec/openconfig-ipsec-offload.yang
* Reference P4 program to enable IPsec on DPDK target: https://github.com/ipdk-io/networking-recipe/tree/main/p4src/Inline_IPsec

Expand All @@ -23,7 +23,7 @@ The strongSwan plugin available in this repository implements a policy-based IPs

### Prerequisites

It is assumed that the ES2K IPU SDE dependencies have been installed on the
It is assumed that the Intel® IPU SDE dependencies have been installed on the
system. The list of dependencies can be found
in `sde/tools/setup/install_dep.py` file.

Expand Down Expand Up @@ -75,7 +75,7 @@ Build strongSwan

After successful build, files will be installed in `./output_strongswan` directory.

Compile IPsec P4 files and generate the P4 artifacts (p4info.txt and ipsec.pb.bin). These will be used to set the P4 pipeline. See the [Compiling P4 Programs guide](https://ipdk.io/p4cp-userguide/guides/es2k/compiling-p4-programs.html) for details. Copy the P4 artifacts (p4info.txt and ipsec.pb.bin) in `/var/tmp/` dir with file name linux_networking.p4info.txt and ipsec_fixed_func.pb.bin.
Compile IPsec P4 files and generate the P4 artifacts (p4info.txt and ipsec.pb.bin). These will be used to set the P4 pipeline. See the [Compiling P4 Programs guide](https://ipdk.io/p4cp-userguide/guides/es2k/compiling-p4-programs.html) for details. Copy the P4 artifacts (p4info.txt and ipsec.pb.bin) to `/var/tmp/` directory with file name linux_networking.p4info.txt and ipsec_fixed_func.pb.bin.

Generate and copy the file /usr/share/stratum/ipsec_role_config.pb.txt using the [link](https://ipdk.io/p4cp-userguide/guides/p4-role-configuration.html)

Expand Down
9 changes: 5 additions & 4 deletions docs/deployment.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,23 +14,24 @@ Modify `load_custom_pkg.sh` with following parameters for linux_networking + ips

```bash
sed -i 's/sem_num_pages = .*;/sem_num_pages = 28;/g' $CP_INIT_CFG
sed -i 's/lem_num_pages = .*;/lem_num_pages = 10;/g' $CP_INIT_CFG
sed -i 's/lem_num_pages = .*;/lem_num_pages = 32;/g' $CP_INIT_CFG
sed -i 's/mod_num_pages = .*;/mod_num_pages = 2;/g' $CP_INIT_CFG
sed -i 's/cxp_num_pages = .*;/cxp_num_pages = 5;/g' $CP_INIT_CFG
sed -i 's/acc_apf = 4;/acc_apf = 16;/g' $CP_INIT_CFG
```

- Download `IPU_Documentation` TAR file compliant with the CI build image and refer to `Getting Started Guide` on how to install compatible `IDPF driver` on host.

- Before configuring and using IPsec-recipe, all networking portion of the setup must be completed. Connectivity between the host, ACC and remote systems must work before attempting any IPsec usage. Refer to the Networking-Recipe (P4 Control Plane) user guide for details on bringing up the networking component: https://ipdk.io/p4cp-userguide/apps/lnw/es2k/es2k-lnw-overlay-vms.html
- Before configuring and using IPDK/ipsec-recipe, all networking portion of the setup must be completed. Connectivity between the host, ACC and remote systems must work before attempting any IPsec usage. Refer to the Networking-Recipe (P4 Control Plane) user guide for details on bringing up the networking component: https://ipdk.io/p4cp-userguide/apps/lnw/es2k/es2k-lnw-overlay-vms.html

## IPsec-Recipe Deployment Location

### strongSwan on ACC

This is a simpler deployment scenario where strongSwan and infrap4d both run on ACC. gRPC communication between strongSwan and infrap4d will occur on `localhost` address without any restrictions.
This is a simpler deployment scenario where strongSwan and infrap4d both run on ACC. gRPC communication between strongSwan and infrap4d can occur on `localhost` address without any restrictions.

### strongSwan on host
In this case, the strongSwan application (with ipsec-recipe plugin) will run on host, and communicate via gRPC to the `infrap4d` process, which runs on the ACC.
In this case, the strongSwan application (with IPDK/ipsec-recipe plugin) will run on host, and communicate via gRPC to the `infrap4d` process, which runs on the ACC.

Following deployment details need to be considered:

Expand Down