2 .\" Sam Leffler <sam@errno.com>. All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
13 .\" THIS SOFTWARE IS PROVIDED BY Sam Leffler AND CONTRIBUTORS ``AS IS'' AND
14 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16 .\" ARE DISCLAIMED. IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
17 .\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
18 .\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
19 .\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
20 .\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
21 .\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
22 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
23 .\" THE POSSIBILITY OF SUCH DAMAGE.
32 .Nd hardware-accelerated IP Security Protocols
34 .Cd "options FAST_IPSEC"
35 .Cd "options IPSEC_FILTERGIF"
40 .Va net.inet.esp.enable
42 .Va net.inet.ah.enable
44 .Va net.inet.ipcomp.enable
48 is a set of protocols,
50 (for Encapsulating Security Payload)
52 (for Authentication Header),
55 (for IP Payload Compression Protocol)
56 that provide security services for IP datagrams.
58 is an experimental implementation of these protocols that uses the
60 subsystem to carry out cryptographic operations.
61 This means, in particular, that cryptographic hardware devices are
62 employed whenever possible to optimize the performance of these protocols.
66 implementation is intended to be compatible with the
69 This documentation concentrates on differences from that software.
70 The user should refer to
72 for basic information on setting up and using these protocols.
73 Note that it is not currently possible to use
75 in conjuction with the
79 System configuration requires the
84 protocols are configured for use, all protocols are included in the system.
85 To selectively enable/disable protocols, use
88 The packets can be passed to a virtual interface,
90 to perform packet filtering before outbound encryption and after decapsulation
95 tunnels with firewalls, add
96 .Cd "options IPSEC_FILTERGIF"
97 to the kernel configuration file.
107 The protocols draw heavily on the
109 implementation of the
112 The policy management code is derived from the
120 protocols first appeared in
123 There is presently no support for IPv6.
127 protocol support does not work.
129 Certain legacy authentication algorithms are not supported because of
134 This documentation is incomplete.