SAI for Tunnel Security with IPsec

Author: Dipankar Acharya, Software Engineer, Arista Networks Collection: 2023 Global Summit - Networking

Summary

Arista Networks presented SAI APIs for enabling hardware-accelerated IPsec tunnel security at line rate on switches where tunnels are terminated. The work addresses the need to secure IP tunnels traversing untrusted networks between data centers, between edge sites and data centers, and between customer sites and data centers. The key enabler is that modern switches now include security engines (originally developed for MACsec) that can perform AES-GCM encryption at line rate, and these engines can be repurposed for IPsec with a different packet format. Hardware support is available from both Credo (external MACsec/IPsec chip) and Broadcom (multiple switches with integrated security engines).

Three IPsec packet formats are defined in the SAI specification: IPINIP_ESP (RFC 4303 tunnel mode, no multipathing but supports anti-replay), IPINIP_UDP_ESP (adds UDP header for source port entropy enabling multipathing, but anti-replay becomes challenging at high speeds), and VXLAN_UDP_ESP (IPsec transport mode protecting VXLAN payload, with UDP entropy header). The switch architecture uses a decoupled model where the packet processor handles tunnel origination/termination while a separate security engine performs cryptographic transformation, linked by an sa_index (security association index) in packet metadata. This decoupling allows one security engine to serve a single high-speed port or multiple lower-speed ports.

The SAI changes include three new tunnel types, three new object types (sai_ipsec for switch-level attributes, sai_ipsec_port for port-level attributes, and sai_ipsec_sa for security associations), and the sa_index binding mechanism. The NOS uses IKEv2 for peer authentication and key exchange, then programs hardware via SAI. Arista is already shipping tunnel security with their proprietary NOS and hardware, and the call to action is to get SAI drivers ready and integrate the feature into open NOS platforms like SONiC.