Netdev 0x13 - IPsec encapsulation over TCP
Channel: netdevconf
Date: 2019-06-03

Sabrina Dubroca describes how to get the middle boxes happy with TCP by introducing encapsulation over standard TCP connections based on RFC 8229. She further
describes the implementation approach which utilizes existing kernel infrastructure (TCP upper layer protocol mechanism (ULP) and stream parser), and finaly how it can be used by userspace IKE daemons.

Why TCP?
Many network middleboxes either muck or block all UDP traffic; this includes IKE and IPsec.
They are, however, happy to allow TCP connections through because they appear to be web traffic.

https://netdevconf.org/0x13/session.html?talk-ipsec-encap