I installed strongswan using

pkg install strongswan

But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The strongswan instructions say it's best to do at compile time but since I installed via pkg I'm hoping to avoid that.

  • It doesn't look like the aesni plugin exists for FreeBSD but I'm hoping i'm wrong... – StackShin Jan 12 at 2:14
  • Can you add a link to sources of this plugin? – arrowd Jan 12 at 7:06
  • 1
    Just a note: The aesni plugin only has an effect on IKE traffic (of which there is usually little). It won't improve the performance of actual IPsec traffic, which is handled by the kernel. – ecdsa Jan 14 at 9:36
  • @ecdsa If that's the case, what are my other options for increasing IPsec performance? I have another thread where the answer was parallelizing IPsec to use multiple cores. I have been unable to fund very much, if any, good documentation on how to do that on FreeBSD. – StackShin Jan 14 at 17:22
  • If you enabled AES-NI support in the kernel(s), you should definitely switch to AES-GCM (esp=aes128gcm16), otherwise the negotiated integrity algorithm will be a bottleneck. But for single connections there might be an upper limit (e.g. single threaded handling to prevent packet reordering). – ecdsa Jan 15 at 10:49

try compiling from /usr/ports/security/strongswan port with copying strongswan to strongswan_my_aesni_edition and editing the code to compile your very own one with additional option. --enable-aesni

Problem is current one has an old version of CONFIGURE_ARGS which overwrites any modifications you add.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.