/* ESP packet format (tunnel mode — wraps entire IP packet) */
[Outer IP: src=GW1, dst=GW2, proto=50 (ESP)]
[ESP Header: SPI(4B) + Sequence Number(4B)]
[IV/Nonce: 8-16 bytes (algorithm-dependent)]
[Encrypted Payload:
  [Inner IP: src=10.1.0.5, dst=10.2.0.5]
  [TCP/UDP/ICMP payload]
  [Padding: 0-255 bytes]
  [Pad Length: 1B]
  [Next Header: 4=IPv4, 41=IPv6, 6=TCP, 17=UDP]
]
[Auth Tag / ICV: 12-16 bytes]

/* SPI — Security Parameters Index */
32-bit value that identifies which SA to use for decryption
Receiver uses (SPI, dst_IP, protocol=ESP) to look up the SA
SA contains: decryption key, algorithm, anti-replay window

/* Sequence Number */
32-bit (or 64-bit ESN) counter, starts at 1, never wraps
Anti-replay: receiver maintains a sliding window of acceptable SN
Duplicate or out-of-window SN → packet dropped

/* Modern ESP cipher suites (RFC 8221) */
AES-256-GCM-16:     AES-256 GCM with 16-byte ICV (recommended)
AES-128-GCM-16:     AES-128 GCM with 16-byte ICV
ChaCha20-Poly1305:  For devices without AES-NI

/* Combined mode AEAD (GCM): */
Authenticated:  ESP header + IV (as AAD)
Encrypted:      payload + padding + next_header
ICV:            16-byte authentication tag

/* AH vs ESP */
AH (proto 51):  authenticates IP header + payload (no encryption)
                Problem: AH covers IP header fields that NAT changes → NAT breaks AH
ESP (proto 50): encrypts payload + authenticates ESP header
                Does NOT authenticate outer IP header → NAT compatible
Recommendation: always use ESP with authentication (GCM or AES-CBC + HMAC)

/* Linux IPsec: kernel handles ESP (via xfrm), StrongSwan handles IKEv2 */

/* /etc/swanctl/swanctl.conf — StrongSwan IKEv2 config */
connections {
  site-to-site {
    local_addrs  = 203.0.113.1      # our gateway IP
    remote_addrs = 198.51.100.1     # peer gateway IP

    local {
      auth  = pubkey                # certificate authentication
      certs = gw1-cert.pem
      id    = "gw1.example.com"
    }
    remote {
      auth  = pubkey
      id    = "gw2.example.com"
    }

    children {
      tunnel {
        local_ts   = 10.1.0.0/24   # traffic selectors
        remote_ts  = 10.2.0.0/24
        esp_proposals = aes256gcm128-prfsha384-ecp384  # cipher suite
        mode      = tunnel
        dpd_action = restart       # restart tunnel on DPD failure
      }
    }
    ike_proposals = aes256gcm16-prfsha384-ecp384
    version = 2
    dpd_delay = 30s
  }
}

# Start IKEv2 negotiation
swanctl --load-all
swanctl --initiate --child tunnel

# Monitor
swanctl --list-sas        # show active IKE and Child SAs
ip xfrm state             # kernel ESP SAs (keys, algorithms, byte counts)
ip xfrm policy            # kernel SPD (traffic selectors, actions)
ip xfrm monitor           # real-time SA events

# Check tunnel traffic
tcpdump -i eth0 esp       # ESP packets
tcpdump -i eth0 udp port 500 or udp port 4500  # IKE packets

/* XFRM offload to hardware (Intel QAT, Mellanox IPsec offload) */
# For your Mellanox ConnectX cards:
# ip xfrm state add ... offload dev eth0 dir in
# Pushes ESP encryption/decryption to NIC — reduces CPU overhead significantly