// Module included in the following assemblies:
//
// * networking/network_security/configuring-ipsec-ovn.adoc

:_mod-docs-content-type: CONCEPT
[id="nw-ovn-ipsec-external_{context}"]
= IPsec encryption for external traffic

[role="_abstract"]
{product-title} supports the use of IPsec to encrypt traffic destined for external hosts, ensuring confidentiality and integrity of data in transit. This feature relies on X.509 certificates that you must supply.

[id="supported-platforms_{context}"]
== Supported platforms

This feature is supported on the following platforms:

- Bare metal
- {gcp-first}
- {rh-openstack-first}
- {vmw-full}

[IMPORTANT]
====
If you have {op-system-base-full} compute nodes, these do not support IPsec encryption for external traffic.
====

If your cluster uses {hcp} for Red Hat {product-title}, configuring IPsec for encrypting traffic to external hosts is not supported.

[id="ipsec-external-limitations_{context}"]
== Limitations

Ensure that the following prohibitions are observed:

* IPv6 configuration is not currently supported by the NMState Operator when configuring IPsec for external traffic.
* Certificate common names (CN) in the provided certificate bundle must not begin with the `ovs_` prefix, because this naming can conflict with pod-to-pod IPsec CN names in the Network Security Services (NSS) database of each node.
