How to reproduce
- Configure VPP + IPsec, but do not enable VPP acceleration for it (vpp settings ipsec-acceleration). This config should prevent installing any SA or policy from the kernel into VPP.
- Confirm that there are no xfrm settings in the VPP config file: grep linux-xfrm-nl /run/vpp/vpp.conf
- Wait for IPsec connections to be established.
- Check VPP IPsec:
vyos@router-initiator-001# sudo vppctl show ipsec all
spd 3359410964
ip4-outbound:
[1] priority 0 action bypass type ip4-outbound protocol any
local addr range 0.0.0.0 - 255.255.255.255 port range 0 - 65535
remote addr range 0.0.0.0 - 255.255.255.255 port range 0 - 65535
packets 119 bytes 20240
ip6-outbound:
ip4-inbound-protect:
ip6-inbound-protect:
ip4-inbound-bypass:
[0] priority 0 action bypass type ip4-inbound-bypass protocol any
local addr range 0.0.0.0 - 255.255.255.255 port range 0 - 65535
remote addr range 0.0.0.0 - 255.255.255.255 port range 0 - 65535
packets 116 bytes 17216
ip6-inbound-bypass:
ip4-inbound-discard:
ip6-inbound-discard:
SPD Bindings:
-935556332 -> eth1
IPSec async mode: off