Merge "Add vIPSEC testcases"

8 files changed, 682 insertions, 7 deletions

diff --git a/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_aesgcm_IMIX_trex.yaml b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_aesgcm_IMIX_trex.yaml
new file mode 100644
index 000000000..a9c0e4860
--- /dev/null
+++ b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_aesgcm_IMIX_trex.yaml
@@ -0,0 +1,95 @@
+# Copyright (c) 2019 Viosoft Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{% set mlr_search = mlr_search or false %}
+{% set vports = vports or 2 %}
+{% set tolerance_low = tolerance_low or 0.0 %}
+{% set tolerance_high = tolerance_high or 0.005 %}
+{% set tunnels = tunnels or 1 %}
+{% set flow_count = flow_count or 1 %}
+{% set worker_threads = worker_threads or [1] %}
+---
+schema: yardstick:task:0.1
+description: >
+    This is the VPP IPSec performance tests based on the Data Plane Development
+    Kit (DPDK) Cryptodev framework. DUT1 and DUT2 are configured with DPDK HW
+    cryptodev devices and {{ tunnels }} IPsec tunnels between them. DUTs get
+    IPv4 traffic from TG with IMIX packet size and number of flows is
+    {{ flow_count }}, encrypt it and send to another DUT, where packets are
+    decrypted and sent back to TG. Measure successful transmit rate, throughput
+    NDR/PDR with MLR search is {{ "enabled" if mlr_search else "disabled" }}, latency.
+
+scenarios:
+{% for worker_thread in worker_threads %}
+-
+  type: NSPerf
+  traffic_profile: ../../traffic_profiles/ipv4_throughput_latency_vpp.yaml
+  extra_args:
+    vports: {{ vports }}
+  topology: vpp-tg-topology-scale-up.yaml
+  nodes:
+    tg__0: trafficgen.yardstick
+    vnf__0: vnf0.yardstick
+    vnf__1: vnf1.yardstick
+  options:
+    traffic_type: 4
+    rfc2544:
+      allowed_drop_rate: {{ tolerance_low }} - {{ tolerance_high }}
+    framesize:
+      uplink: {64B: 28, 570B: 16, 1518B: 4}
+      downlink: {64B: 28, 570B: 16, 1518B: 4}
+    flow:
+      src_ip:
+        - '10.0.0.0-10.0.0.100'
+      dst_ip:
+        - '20.0.0.0-20.0.0.100'
+      count: {{ flow_count }}
+    vnf__0:
+      collectd:
+        interval: 1
+      # Crypto device type. Type: string - *Example:* HW_cryptodev | SW_cryptodev
+      # Number of RX queues, default value: ${None}. Type: integer
+      vnf_config: {crypto_type: 'HW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    vnf__1:
+      collectd:
+        interval: 1
+      vnf_config: {crypto_type: 'HW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    tg__0:
+      collectd:
+        interval: 1
+      queues_per_port: 7
+    vpp_config:
+      # Number of tunnels
+      tunnels: {{ tunnels }}
+      # Encryption algorithms - Integrity algorithm. Type: string
+      # Example: aes-gcm | cbc-sha1
+      crypto_algorithms: 'aes-gcm'
+{% if mlr_search %}
+      # Maximum Frame Rate depend on Ethernet Link Speed and Frame Size
+      # for a 10 Gb/s Ethernet link and IMIX packet size,
+      # maximum rate = 10*10^9/(((28*64+16*570+4*1518)/48+8+12)*8)
+      max_rate: 3351206
+{% endif %}
+  runner:
+    type: Duration
+    duration: 500
+{% endfor %}
+
+context:
+  type: Node
+  name: yardstick
+  nfvi_type: baremetal
+  file: /etc/yardstick/nodes/vpp-baremetal-{{ vports }}.yaml
\ No newline at end of file
diff --git a/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_aesgcm_trex.yaml b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_aesgcm_trex.yaml
new file mode 100644
index 000000000..84a7fe61b
--- /dev/null
+++ b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_aesgcm_trex.yaml
@@ -0,0 +1,96 @@
+# Copyright (c) 2019 Viosoft Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{% set mlr_search = mlr_search or false %}
+{% set vports = vports or 2 %}
+{% set tolerance_low = tolerance_low or 0.0 %}
+{% set tolerance_high = tolerance_high or 0.005 %}
+{% set frame_size = frame_size or 64 %}
+{% set tunnels = tunnels or 1 %}
+{% set flow_count = flow_count or 1 %}
+{% set worker_threads = worker_threads or [1] %}
+---
+schema: yardstick:task:0.1
+description: >
+    This is the VPP IPSec performance tests based on the Data Plane Development
+    Kit (DPDK) Cryptodev framework. DUT1 and DUT2 are configured with DPDK HW
+    cryptodev devices and {{ tunnels }} IPsec tunnels between them. DUTs get
+    IPv4 traffic from TG with {{ frame_size }}B packet size and number of flows
+    is {{ flow_count }}, encrypt it and send to another DUT, where packets are
+    decrypted and sent back to TG. Measure successful transmit rate, throughput
+    NDR/PDR with MLR search is {{ "enabled" if mlr_search else "disabled" }}, latency.
+
+scenarios:
+{% for worker_thread in worker_threads %}
+-
+  type: NSPerf
+  traffic_profile: ../../traffic_profiles/ipv4_throughput_latency_vpp.yaml
+  extra_args:
+    vports: {{ vports }}
+  topology: vpp-tg-topology-scale-up.yaml
+  nodes:
+    tg__0: trafficgen.yardstick
+    vnf__0: vnf0.yardstick
+    vnf__1: vnf1.yardstick
+  options:
+    traffic_type: 4
+    rfc2544:
+      allowed_drop_rate: {{ tolerance_low }} - {{ tolerance_high }}
+    framesize:
+      uplink: {'{{ frame_size }}B': 100}
+      downlink: {'{{ frame_size }}B': 100}
+    flow:
+      src_ip:
+        - '10.0.0.0-10.0.0.100'
+      dst_ip:
+        - '20.0.0.0-20.0.0.100'
+      count: {{ flow_count }}
+    vnf__0:
+      collectd:
+        interval: 1
+      # Crypto device type. Type: string - *Example:* HW_cryptodev | SW_cryptodev
+      # Number of RX queues, default value: ${None}. Type: integer
+      vnf_config: {crypto_type: 'HW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    vnf__1:
+      collectd:
+        interval: 1
+      vnf_config: {crypto_type: 'HW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    tg__0:
+      collectd:
+        interval: 1
+      queues_per_port: 7
+    vpp_config:
+      # Number of tunnels
+      tunnels: {{ tunnels }}
+      # Encryption algorithms - Integrity algorithm. Type: string
+      # Example: aes-gcm | cbc-sha1
+      crypto_algorithms: 'aes-gcm'
+{% if mlr_search %}
+      # Maximum Frame Rate depend on Ethernet Link Speed and Frame Size
+      # for a 10 Gb/s Ethernet link and 64 bytes,
+      # maximum rate = 10*10^9/((64+8+12)*8)
+      max_rate: {{ (10 * 10 ** 9 / ((frame_size + 8 + 12) * 8)) | int }}
+{% endif %}
+  runner:
+    type: Duration
+    duration: 500
+{% endfor %}
+
+context:
+  type: Node
+  name: yardstick
+  nfvi_type: baremetal
+  file: /etc/yardstick/nodes/vpp-baremetal-{{ vports }}.yaml
\ No newline at end of file
diff --git a/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_cbcsha1_IMIX_trex.yaml b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_cbcsha1_IMIX_trex.yaml
new file mode 100644
index 000000000..07afe809e
--- /dev/null
+++ b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_cbcsha1_IMIX_trex.yaml
@@ -0,0 +1,95 @@
+# Copyright (c) 2019 Viosoft Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{% set mlr_search = mlr_search or false %}
+{% set vports = vports or 2 %}
+{% set tolerance_low = tolerance_low or 0.0 %}
+{% set tolerance_high = tolerance_high or 0.005 %}
+{% set tunnels = tunnels or 1 %}
+{% set flow_count = flow_count or 1 %}
+{% set worker_threads = worker_threads or [1] %}
+---
+schema: yardstick:task:0.1
+description: >
+    This is the VPP IPSec performance tests based on the Data Plane Development
+    Kit (DPDK) Cryptodev framework. DUT1 and DUT2 are configured with DPDK HW
+    cryptodev devices and {{ tunnels }} IPsec tunnels between them. DUTs get
+    IPv4 traffic from TG with IMIX packet size and number of flows is
+    {{ flow_count }}, encrypt it and send to another DUT, where packets are
+    decrypted and sent back to TG. Measure successful transmit rate, throughput
+    NDR/PDR with MLR search is {{ "enabled" if mlr_search else "disabled" }}, latency.
+
+scenarios:
+{% for worker_thread in worker_threads %}
+-
+  type: NSPerf
+  traffic_profile: ../../traffic_profiles/ipv4_throughput_latency_vpp.yaml
+  extra_args:
+    vports: {{ vports }}
+  topology: vpp-tg-topology-scale-up.yaml
+  nodes:
+    tg__0: trafficgen.yardstick
+    vnf__0: vnf0.yardstick
+    vnf__1: vnf1.yardstick
+  options:
+    traffic_type: 4
+    rfc2544:
+      allowed_drop_rate: {{ tolerance_low }} - {{ tolerance_high }}
+    framesize:
+      uplink: {64B: 28, 570B: 16, 1518B: 4}
+      downlink: {64B: 28, 570B: 16, 1518B: 4}
+    flow:
+      src_ip:
+        - '10.0.0.0-10.0.0.100'
+      dst_ip:
+        - '20.0.0.0-20.0.0.100'
+      count: {{ flow_count }}
+    vnf__0:
+      collectd:
+        interval: 1
+      # Crypto device type. Type: string - *Example:* HW_cryptodev | SW_cryptodev
+      # Number of RX queues, default value: ${None}. Type: integer
+      vnf_config: {crypto_type: 'HW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    vnf__1:
+      collectd:
+        interval: 1
+      vnf_config: {crypto_type: 'HW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    tg__0:
+      collectd:
+        interval: 1
+      queues_per_port: 7
+    vpp_config:
+      # Number of tunnels
+      tunnels: {{ tunnels }}
+      # Encryption algorithms - Integrity algorithm. Type: string
+      # Example: aes-gcm | cbc-sha1
+      crypto_algorithms: 'cbc-sha1'
+{% if mlr_search %}
+      # Maximum Frame Rate depend on Ethernet Link Speed and Frame Size
+      # for a 10 Gb/s Ethernet link and IMIX packet size,
+      # maximum rate = 10*10^9/(((28*64+16*570+4*1518)/48+8+12)*8)
+      max_rate: 3351206
+{% endif %}
+  runner:
+    type: Duration
+    duration: 500
+{% endfor %}
+
+context:
+  type: Node
+  name: yardstick
+  nfvi_type: baremetal
+  file: /etc/yardstick/nodes/vpp-baremetal-{{ vports }}.yaml
\ No newline at end of file
diff --git a/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_cbcsha1_trex.yaml b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_cbcsha1_trex.yaml
new file mode 100644
index 000000000..9e210aeed
--- /dev/null
+++ b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_hw_cbcsha1_trex.yaml
@@ -0,0 +1,96 @@
+# Copyright (c) 2019 Viosoft Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{% set mlr_search = mlr_search or false %}
+{% set vports = vports or 2 %}
+{% set tolerance_low = tolerance_low or 0.0 %}
+{% set tolerance_high = tolerance_high or 0.005 %}
+{% set frame_size = frame_size or 64 %}
+{% set tunnels = tunnels or 1 %}
+{% set flow_count = flow_count or 1 %}
+{% set worker_threads = worker_threads or [1] %}
+---
+schema: yardstick:task:0.1
+description: >
+    This is the VPP IPSec performance tests based on the Data Plane Development
+    Kit (DPDK) Cryptodev framework. DUT1 and DUT2 are configured with DPDK HW
+    cryptodev devices and {{ tunnels }} IPsec tunnels between them. DUTs get
+    IPv4 traffic from TG with {{ frame_size }}B packet size and number of flows
+    is {{ flow_count }}, encrypt it and send to another DUT, where packets are
+    decrypted and sent back to TG. Measure successful transmit rate, throughput
+    NDR/PDR with MLR search is {{ "enabled" if mlr_search else "disabled" }}, latency.
+
+scenarios:
+{% for worker_thread in worker_threads %}
+-
+  type: NSPerf
+  traffic_profile: ../../traffic_profiles/ipv4_throughput_latency_vpp.yaml
+  extra_args:
+    vports: {{ vports }}
+  topology: vpp-tg-topology-scale-up.yaml
+  nodes:
+    tg__0: trafficgen.yardstick
+    vnf__0: vnf0.yardstick
+    vnf__1: vnf1.yardstick
+  options:
+    traffic_type: 4
+    rfc2544:
+      allowed_drop_rate: {{ tolerance_low }} - {{ tolerance_high }}
+    framesize:
+      uplink: {'{{ frame_size }}B': 100}
+      downlink: {'{{ frame_size }}B': 100}
+    flow:
+      src_ip:
+        - '10.0.0.0-10.0.0.100'
+      dst_ip:
+        - '20.0.0.0-20.0.0.100'
+      count: {{ flow_count }}
+    vnf__0:
+      collectd:
+        interval: 1
+      # Crypto device type. Type: string - *Example:* HW_cryptodev | SW_cryptodev
+      # Number of RX queues, default value: ${None}. Type: integer
+      vnf_config: {crypto_type: 'HW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    vnf__1:
+      collectd:
+        interval: 1
+      vnf_config: {crypto_type: 'HW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    tg__0:
+      collectd:
+        interval: 1
+      queues_per_port: 7
+    vpp_config:
+      # Number of tunnels
+      tunnels: {{ tunnels }}
+      # Encryption algorithms - Integrity algorithm. Type: string
+      # Example: aes-gcm | cbc-sha1
+      crypto_algorithms: 'cbc-sha1'
+{% if mlr_search %}
+      # Maximum Frame Rate depend on Ethernet Link Speed and Frame Size
+      # for a 10 Gb/s Ethernet link and 64 bytes,
+      # maximum rate = 10*10^9/((64+8+12)*8)
+      max_rate: {{ (10 * 10 ** 9 / ((frame_size + 8 + 12) * 8)) | int }}
+{% endif %}
+  runner:
+    type: Duration
+    duration: 500
+{% endfor %}
+
+context:
+  type: Node
+  name: yardstick
+  nfvi_type: baremetal
+  file: /etc/yardstick/nodes/vpp-baremetal-{{ vports }}.yaml
\ No newline at end of file
diff --git a/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_aesgcm_IMIX_trex.yaml b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_aesgcm_IMIX_trex.yaml
new file mode 100644
index 000000000..ac7fceef6
--- /dev/null
+++ b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_aesgcm_IMIX_trex.yaml
@@ -0,0 +1,95 @@
+# Copyright (c) 2019 Viosoft Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{% set mlr_search = mlr_search or false %}
+{% set vports = vports or 2 %}
+{% set tolerance_low = tolerance_low or 0.0 %}
+{% set tolerance_high = tolerance_high or 0.005 %}
+{% set tunnels = tunnels or 1 %}
+{% set flow_count = flow_count or 1 %}
+{% set worker_threads = worker_threads or [1] %}
+---
+schema: yardstick:task:0.1
+description: >
+    This is the VPP IPSec performance tests based on the Data Plane Development
+    Kit (DPDK) Cryptodev framework. DUT1 and DUT2 are configured with DPDK SW
+    cryptodev devices and {{ tunnels }} IPsec tunnels between them. DUTs get
+    IPv4 traffic from TG with IMIX packet size and number of flows is
+    {{ flow_count }}, encrypt it and send to another DUT, where packets are
+    decrypted and sent back to TG. Measure successful transmit rate, throughput
+    NDR/PDR with MLR search is {{ "enabled" if mlr_search else "disabled" }}, latency.
+
+scenarios:
+{% for worker_thread in worker_threads %}
+-
+  type: NSPerf
+  traffic_profile: ../../traffic_profiles/ipv4_throughput_latency_vpp.yaml
+  extra_args:
+    vports: {{ vports }}
+  topology: vpp-tg-topology-scale-up.yaml
+  nodes:
+    tg__0: trafficgen.yardstick
+    vnf__0: vnf0.yardstick
+    vnf__1: vnf1.yardstick
+  options:
+    traffic_type: 4
+    rfc2544:
+      allowed_drop_rate: {{ tolerance_low }} - {{ tolerance_high }}
+    framesize:
+      uplink: {64B: 28, 570B: 16, 1518B: 4}
+      downlink: {64B: 28, 570B: 16, 1518B: 4}
+    flow:
+      src_ip:
+        - '10.0.0.0-10.0.0.100'
+      dst_ip:
+        - '20.0.0.0-20.0.0.100'
+      count: {{ flow_count }}
+    vnf__0:
+      collectd:
+        interval: 1
+      # Crypto device type. Type: string - *Example:* HW_cryptodev | SW_cryptodev
+      # Number of RX queues, default value: ${None}. Type: integer
+      vnf_config: {crypto_type: 'SW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    vnf__1:
+      collectd:
+        interval: 1
+      vnf_config: {crypto_type: 'SW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    tg__0:
+      collectd:
+        interval: 1
+      queues_per_port: 7
+    vpp_config:
+      # Number of tunnels
+      tunnels: {{ tunnels }}
+      # Encryption algorithms - Integrity algorithm. Type: string
+      # Example: aes-gcm | cbc-sha1
+      crypto_algorithms: 'aes-gcm'
+{% if mlr_search %}
+      # Maximum Frame Rate depend on Ethernet Link Speed and Frame Size
+      # for a 10 Gb/s Ethernet link and IMIX packet size,
+      # maximum rate = 10*10^9/(((28*64+16*570+4*1518)/48+8+12)*8)
+      max_rate: 3351206
+{% endif %}
+  runner:
+    type: Duration
+    duration: 500
+{% endfor %}
+
+context:
+  type: Node
+  name: yardstick
+  nfvi_type: baremetal
+  file: /etc/yardstick/nodes/vpp-baremetal-{{ vports }}.yaml
\ No newline at end of file
diff --git a/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_aesgcm_trex.yaml b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_aesgcm_trex.yaml
index 7d1f866d5..82f27112d 100644
--- a/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_aesgcm_trex.yaml
+++ b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_aesgcm_trex.yaml
@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+{% set mlr_search = mlr_search or false %}
 {% set vports = vports or 2 %}
 {% set tolerance_low = tolerance_low or 0.0 %}
 {% set tolerance_high = tolerance_high or 0.005 %}
@@ -22,13 +23,13 @@
 ---
 schema: yardstick:task:0.1
 description: >
-    This is the VPP IPSec performance tests based on the Data Plane
-    Development Kit (DPDK) Cryptodev framework. DUT1 and DUT2 are configured
-    with DPDK SW cryptodev devices and {{ tunnels }} IPsec tunnels between
-    them. DUTs get IPv4 traffic from TG with {{ frame_size }}B packet size
-    and number of flows is {{ flow_count }}, encrypt it and send to another
-    DUT, where packets are decrypted and sent back to TG. Measure successful
-    transmit rate, throughput, latency.
+    This is the VPP IPSec performance tests based on the Data Plane Development
+    Kit (DPDK) Cryptodev framework. DUT1 and DUT2 are configured with DPDK SW
+    cryptodev devices and {{ tunnels }} IPsec tunnels between them. DUTs get
+    IPv4 traffic from TG with {{ frame_size }}B packet size and number of flows
+    is {{ flow_count }}, encrypt it and send to another DUT, where packets are
+    decrypted and sent back to TG. Measure successful transmit rate, throughput
+    NDR/PDR with MLR search is {{ "enabled" if mlr_search else "disabled" }}, latency.
 
 scenarios:
 {% for worker_thread in worker_threads %}
@@ -77,6 +78,12 @@ scenarios:
       # Encryption algorithms - Integrity algorithm. Type: string
       # Example: aes-gcm | cbc-sha1
       crypto_algorithms: 'aes-gcm'
+{% if mlr_search %}
+      # Maximum Frame Rate depend on Ethernet Link Speed and Frame Size
+      # for a 10 Gb/s Ethernet link and 64 bytes,
+      # maximum rate = 10*10^9/((64+8+12)*8)
+      max_rate: {{ (10 * 10 ** 9 / ((frame_size + 8 + 12) * 8)) | int }}
+{% endif %}
   runner:
     type: Duration
     duration: 500
diff --git a/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_cbcsha1_IMIX_trex.yaml b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_cbcsha1_IMIX_trex.yaml
new file mode 100644
index 000000000..d3bc14a97
--- /dev/null
+++ b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_cbcsha1_IMIX_trex.yaml
@@ -0,0 +1,95 @@
+# Copyright (c) 2019 Viosoft Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{% set mlr_search = mlr_search or false %}
+{% set vports = vports or 2 %}
+{% set tolerance_low = tolerance_low or 0.0 %}
+{% set tolerance_high = tolerance_high or 0.005 %}
+{% set tunnels = tunnels or 1 %}
+{% set flow_count = flow_count or 1 %}
+{% set worker_threads = worker_threads or [1] %}
+---
+schema: yardstick:task:0.1
+description: >
+    This is the VPP IPSec performance tests based on the Data Plane Development
+    Kit (DPDK) Cryptodev framework. DUT1 and DUT2 are configured with DPDK SW
+    cryptodev devices and {{ tunnels }} IPsec tunnels between them. DUTs get
+    IPv4 traffic from TG with IMIX packet size and number of flows is
+    {{ flow_count }}, encrypt it and send to another DUT, where packets are
+    decrypted and sent back to TG. Measure successful transmit rate, throughput
+    NDR/PDR with MLR search is {{ "enabled" if mlr_search else "disabled" }}, latency.
+
+scenarios:
+{% for worker_thread in worker_threads %}
+-
+  type: NSPerf
+  traffic_profile: ../../traffic_profiles/ipv4_throughput_latency_vpp.yaml
+  extra_args:
+    vports: {{ vports }}
+  topology: vpp-tg-topology-scale-up.yaml
+  nodes:
+    tg__0: trafficgen.yardstick
+    vnf__0: vnf0.yardstick
+    vnf__1: vnf1.yardstick
+  options:
+    traffic_type: 4
+    rfc2544:
+      allowed_drop_rate: {{ tolerance_low }} - {{ tolerance_high }}
+    framesize:
+      uplink: {64B: 28, 570B: 16, 1518B: 4}
+      downlink: {64B: 28, 570B: 16, 1518B: 4}
+    flow:
+      src_ip:
+        - '10.0.0.0-10.0.0.100'
+      dst_ip:
+        - '20.0.0.0-20.0.0.100'
+      count: {{ flow_count }}
+    vnf__0:
+      collectd:
+        interval: 1
+      # Crypto device type. Type: string - *Example:* HW_cryptodev | SW_cryptodev
+      # Number of RX queues, default value: ${None}. Type: integer
+      vnf_config: {crypto_type: 'SW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    vnf__1:
+      collectd:
+        interval: 1
+      vnf_config: {crypto_type: 'SW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    tg__0:
+      collectd:
+        interval: 1
+      queues_per_port: 7
+    vpp_config:
+      # Number of tunnels
+      tunnels: {{ tunnels }}
+      # Encryption algorithms - Integrity algorithm. Type: string
+      # Example: aes-gcm | cbc-sha1
+      crypto_algorithms: 'cbc-sha1'
+{% if mlr_search %}
+      # Maximum Frame Rate depend on Ethernet Link Speed and Frame Size
+      # for a 10 Gb/s Ethernet link and IMIX packet size,
+      # maximum rate = 10*10^9/(((28*64+16*570+4*1518)/48+8+12)*8)
+      max_rate: 3351206
+{% endif %}
+  runner:
+    type: Duration
+    duration: 500
+{% endfor %}
+
+context:
+  type: Node
+  name: yardstick
+  nfvi_type: baremetal
+  file: /etc/yardstick/nodes/vpp-baremetal-{{ vports }}.yaml
\ No newline at end of file
diff --git a/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_cbcsha1_trex.yaml b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_cbcsha1_trex.yaml
new file mode 100644
index 000000000..a70aa49f7
--- /dev/null
+++ b/samples/vnf_samples/nsut/ipsec/tc_baremetal_rfc2544_ipv4_sw_cbcsha1_trex.yaml
@@ -0,0 +1,96 @@
+# Copyright (c) 2019 Viosoft Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{% set mlr_search = mlr_search or false %}
+{% set vports = vports or 2 %}
+{% set tolerance_low = tolerance_low or 0.0 %}
+{% set tolerance_high = tolerance_high or 0.005 %}
+{% set frame_size = frame_size or 64 %}
+{% set tunnels = tunnels or 1 %}
+{% set flow_count = flow_count or 1 %}
+{% set worker_threads = worker_threads or [1] %}
+---
+schema: yardstick:task:0.1
+description: >
+    This is the VPP IPSec performance tests based on the Data Plane Development
+    Kit (DPDK) Cryptodev framework. DUT1 and DUT2 are configured with DPDK SW
+    cryptodev devices and {{ tunnels }} IPsec tunnels between them. DUTs get
+    IPv4 traffic from TG with {{ frame_size }}B packet size and number of flows
+    is {{ flow_count }}, encrypt it and send to another DUT, where packets are
+    decrypted and sent back to TG. Measure successful transmit rate, throughput
+    NDR/PDR with MLR search is {{ "enabled" if mlr_search else "disabled" }}, latency.
+
+scenarios:
+{% for worker_thread in worker_threads %}
+-
+  type: NSPerf
+  traffic_profile: ../../traffic_profiles/ipv4_throughput_latency_vpp.yaml
+  extra_args:
+    vports: {{ vports }}
+  topology: vpp-tg-topology-scale-up.yaml
+  nodes:
+    tg__0: trafficgen.yardstick
+    vnf__0: vnf0.yardstick
+    vnf__1: vnf1.yardstick
+  options:
+    traffic_type: 4
+    rfc2544:
+      allowed_drop_rate: {{ tolerance_low }} - {{ tolerance_high }}
+    framesize:
+      uplink: {'{{ frame_size }}B': 100}
+      downlink: {'{{ frame_size }}B': 100}
+    flow:
+      src_ip:
+        - '10.0.0.0-10.0.0.100'
+      dst_ip:
+        - '20.0.0.0-20.0.0.100'
+      count: {{ flow_count }}
+    vnf__0:
+      collectd:
+        interval: 1
+      # Crypto device type. Type: string - *Example:* HW_cryptodev | SW_cryptodev
+      # Number of RX queues, default value: ${None}. Type: integer
+      vnf_config: {crypto_type: 'SW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    vnf__1:
+      collectd:
+        interval: 1
+      vnf_config: {crypto_type: 'SW_cryptodev', rxq: 1, worker_config: '1C/1T',
+                   worker_threads: {{ worker_thread }}}
+    tg__0:
+      collectd:
+        interval: 1
+      queues_per_port: 7
+    vpp_config:
+      # Number of tunnels
+      tunnels: {{ tunnels }}
+      # Encryption algorithms - Integrity algorithm. Type: string
+      # Example: aes-gcm | cbc-sha1
+      crypto_algorithms: 'cbc-sha1'
+{% if mlr_search %}
+      # Maximum Frame Rate depend on Ethernet Link Speed and Frame Size
+      # for a 10 Gb/s Ethernet link and 64 bytes,
+      # maximum rate = 10*10^9/((64+8+12)*8)
+      max_rate: {{ (10 * 10 ** 9 / ((frame_size + 8 + 12) * 8)) | int }}
+{% endif %}
+  runner:
+    type: Duration
+    duration: 500
+{% endfor %}
+
+context:
+  type: Node
+  name: yardstick
+  nfvi_type: baremetal
+  file: /etc/yardstick/nodes/vpp-baremetal-{{ vports }}.yaml
\ No newline at end of file