IP-Sec offload tunnel mode

Infrastructure & Networking BlueField
1

Hi,

we have crypto enabled Bluefield 2 and Bluefield 3 and are trying to get an offloaded ip sec tunnel working. We got transport mode working following this guide: IPsec Packet Offload | MLNX_OFED Software . We are however getting the following error when trying to switch to tunnel mode:

/opt/mellanox/iproute2/sbin/ip xfrm state add src 10.100.10.135/16 dst 10.100.10.164/16 proto esp spi 0xc35aa26e reqid 0xc35aa26e mode tunnel aead 'rfc4106(gcm(aes))' 0x6cb228189b4c6e82e66e46920a2cde39187de4ba 128 offload packet dev p0 dir in sel src $10.1.0.0/16 dst $10.2.0.0/16 flag esn replay-window 64
Error: mlx5_core: Packet offload tunnel mode is disabled due to encap settings.

Hardware:

lspci -v -v -v |grep Mellanox
00:00.0 PCI bridge: Mellanox Technologies MT42822 BlueField-2 SoC Crypto enabled (rev 01) (prog-if 00 [Normal decode])
01:00.0 PCI bridge: Mellanox Technologies MT42822 Family [BlueField-2 SoC PCIe Bridge] (rev 01) (prog-if 00 [Normal decode])
02:00.0 PCI bridge: Mellanox Technologies MT42822 Family [BlueField-2 SoC PCIe Bridge] (rev 01) (prog-if 00 [Normal decode])
03:00.0 Ethernet controller: Mellanox Technologies MT42822 BlueField-2 integrated ConnectX-6 Dx network controller (rev 01)
	Subsystem: Mellanox Technologies MT42822 BlueField-2 integrated ConnectX-6 Dx network controller
03:00.1 Ethernet controller: Mellanox Technologies MT42822 BlueField-2 integrated ConnectX-6 Dx network controller (rev 01)
	Subsystem: Mellanox Technologies MT42822 BlueField-2 integrated ConnectX-6 Dx network controller

Is tunnel mode possible on the bluefield and does anybody have an idea to solve this error?

2

IPSec Tunnel Mode should be supported even with kernel. Can you please share your full configuration? Also, Which DOCA/FW Version is being used on the BF?

cat /etc/mlnx-release

flint -d 03:00.0 q full

3

Thanks for the quick reply. Here is the output:

root@bf2:~# cat /etc/mlnx-release
bf-bundle-3.3.0-202_26.01_ubuntu-24.04_64k_prod
root@bf2:~# flint -d 03:00.0 q full
Image type:            FS4
FW Version:            24.48.1000
FW Release Date:       11.2.2026
Part Number:           MBF2M516C-CECO_Ax
Description:           BlueField-2 E-Series DPU 100GbE Dual-Port QSFP56; integrated BMC; PCIe Gen4 x16; Secure Boot Enabled; Crypto Enabled; 16GB on-board DDR; 1GbE OOB management; Tall Bracket; FHHL
Product Version:       24.48.1000
Rom Info:              type=UEFI Virtio net version=21.4.13 cpu=AMD64,AARCH64
                       type=UEFI Virtio blk version=22.4.14 cpu=AMD64,AARCH64
                       type=UEFI version=14.41.14 cpu=AMD64,AARCH64
                       type=PXE version=3.9.101 cpu=AMD64
Description:           UID                GuidsNumber
Base GUID:             e8ebd30300e53318        16
Base MAC:              e8ebd3e53318            16
Image VSD:             N/A
Device VSD:            N/A
PSID:                  MT_0000000733
Security Attributes:   secure-fw
Default Update Method: fw_ctrl
Life cycle:            GA SECURED
Secure Boot Capable:   Enabled
EFUSE Security Ver:    0
Image Security Ver:    0
Security Ver Program:  Manually ; Disabled

Do you need any other information?

4

Apologies for the delayed reply. The output looks good (Capabilities, FW Version, etc). Please disable encap mode as below and give it a try:
/opt/mellanox/iproute2/sbin/devlink dev eswitch set pci/0000:03:00.0 mode legacy
/opt/mellanox/iproute2/sbin/devlink dev eswitch set pci/0000:03:00.1 mode legacy
echo none > /sys/class/net/p0/compat/devlink/encap
echo none > /sys/class/net/p1/compat/devlink/encap
/opt/mellanox/iproute2/sbin/devlink dev eswitch set pci/0000:03:00.0 mode switchdev
/opt/mellanox/iproute2/sbin/devlink dev eswitch set pci/0000:03:00.1 mode switchdev