Scaling Secure Network Functions: High-Performance IPsec with FD.io VPP for VNFs and CNFs#

Benoît Ganne (Cisco, VPP committer)

• Why: One of the few IPsec talks with real production scale behind it: Cisco runs 50K tunnels, 7 PB/month, 10 trillion packets/month on VPP IPsec. The benchmarks are concrete and actionable.
• What: A deep dive into VPP's IPsec implementation plus 2024–2025 improvements (unified crypto+HMAC single-op-per-packet, template-based ESP, full IPv6 NAT-T, async handoff tuning), with a decision framework for the three tunnel modes.
• How: Key measured results (FD.io CSIT, 10K tunnels, AES-256-GCM, Intel ICX): policy-based IPsec is unusable without the flow cache (which is ~40x faster); with it, 1–4 cores deliver 20–49 Gbps; route-based P2P reaches 78 Gbps on 100G. Async crypto decouples crypto from packet processing, enabling 70 Gbps on a single tunnel (2.5x sync) and preventing noisy-neighbor starvation. For 1000+ VRFs, switching the IPv4 FIB mtrie from 16-8-8 to 8-8-8-8 cuts memory 41x (330 MB → 8 MB) at the cost of one extra lookup step.
• Where applicable: SD-WAN, 5G UPF (N3/N9), edge, and large DC VPN gateways. Kernel-IPsec shops hitting per-tunnel interface or memory ceilings are the natural audience. No kernel modules, so it runs cleanly in containers.