IPsec Scalability Limits

The ICX 7450 supports encryption and decryption on the ICX7400-SERVICE-MOD module. Encryption and decryption are hardware-based and are not performed by the software.

One ICX7400-SERVICE-MOD module can be installed per device or per stack. The ICX7400-SERVICE-MOD module supports a maximum of 100 IPsec tunnels. If you try to configure more than 100 tunnels, an error message is displayed. To configure a new IPsec tunnel when the maximum number allowed is already configured, you must remove an existing tunnel. Limits also apply to the elements that are used to configure IPsec tunnels. The element thresholds are set out in the following table.

IPsec Tunnel Element Thresholds

Tunnel Element

Threshold

IKEv2 Proposal

128

IKEv2 Auth Proposal

128

IKEv2 Policy

128

IKEv2 Profile

128

IPsec Proposal

128

IPsec Profile

128

IPsec Tunnels

100 (either IPv4 or IPv6 or together)