Encapsulating IPsec ESP in UDP for Load-balancing#

Xiaohu Xu (China Mobile), Shraddha Hegde (HPE), Boris Pismenny (Nvidia), Dacheng Zhang, Liang Xia (Huawei), Mahendra Puttaswamy (HPE)

• Why: ESP has no entropy, so IPsec tunnels hash onto one ECMP path / one LAG member and one CPU core (no RSS spread). For SD-WAN branch interconnects and, increasingly, cloud-provider encryption of DCI WAN traffic (financial/governmental clouds), this strands bandwidth and CPU.
• What: A UDP encapsulation of ESP where the 16-bit UDP source port carries a per-flow entropy value, letting unmodified switches and routers load-balance IPsec traffic across ECMP/LAG, and letting x86 IPsec gateways RSS-distribute across cores. Alternative to running multiple parallel tunnels.
• How: Standard UDP encapsulation with source-port-as-entropy; no changes required in transit switches or core routers. The slides state it is implemented by vendors (Juniper/HPE cited) and the draft (-15) is ready for WG adoption call.
• Where applicable: Broadly applicable — enterprise SD-WAN, cloud DCI encryption, multi-core IPsec gateways. Mature individual draft on the edge of WG adoption; the closest to shipping of the security items here.