# Ipsec offload with sriov

**URL:** <https://forums.developer.nvidia.com/t/ipsec-offload-with-sriov/370345>\
**Category:** Enterprise Networking\
**Created:** [May 16, 2026, 12:22pm UTC](https://forums.developer.nvidia.com/t/ipsec-offload-with-sriov/370345 "2026-05-16T12:22:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![user133664](https://developer.download.nvidia.com/images/forums/profile-default-devtalk-84.png) [@user133664](https://forums.developer.nvidia.com/u/user133664)\
**Post date:** [May 16, 2026, 12:22pm UTC](https://forums.developer.nvidia.com/t/ipsec-offload-with-sriov/370345/1 "2026-05-16T12:22:11Z")

</div>

I have a connectx6 dx with crypto. ethtool shows esp-hw-offload: on. I create some virtual functions, pass one to a virtual machine and the vm works, i.e. has functional networking but ethtool in the vm shows esp\_hw\_offload: off. I am certain this is a proper crypto enabled card, MCX623435AC-CDA\_Ax. CRYPTO\_POLICY is set to 2 (tried 1 earlier), mstconfig doesnt show any other crypto or ipsec parameters. I’ve tried switchdev and legacy modes. Is this supposed to work?