0

I installed strongswan using

pkg install strongswan

But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The strongswan instructions say it's best to do at compile time but since I installed via pkg I'm hoping to avoid that.

New contributor
StackShin is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • It doesn't look like the aesni plugin exists for FreeBSD but I'm hoping i'm wrong... – StackShin Jan 12 at 2:14
  • Can you add a link to sources of this plugin? – arrowd Jan 12 at 7:06
  • 1
    Just a note: The aesni plugin only has an effect on IKE traffic (of which there is usually little). It won't improve the performance of actual IPsec traffic, which is handled by the kernel. – ecdsa Jan 14 at 9:36
  • @ecdsa If that's the case, what are my other options for increasing IPsec performance? I have another thread where the answer was parallelizing IPsec to use multiple cores. I have been unable to fund very much, if any, good documentation on how to do that on FreeBSD. – StackShin Jan 14 at 17:22
  • If you enabled AES-NI support in the kernel(s), you should definitely switch to AES-GCM (esp=aes128gcm16), otherwise the negotiated integrity algorithm will be a bottleneck. But for single connections there might be an upper limit (e.g. single threaded handling to prevent packet reordering). – ecdsa 2 days ago
1

try compiling from /usr/ports/security/strongswan port with copying strongswan to strongswan_my_aesni_edition and editing the code to compile your very own one with additional option. --enable-aesni

Problem is current one has an old version of CONFIGURE_ARGS which overwrites any modifications you add.

New contributor
Andrew is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

StackShin is a new contributor. Be nice, and check out our Code of Conduct.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.