// Module included in the following assemblies:
//
// * networking/openshift_network_security/configuring-ipsec-ovn.adoc

:_mod-docs-content-type: CONCEPT
[id="nw-ovn-ipsec-prerequisites_{context}"]
= Prerequisites for IPsec encryption for external traffic

[role="_abstract"]
The following prerequisites are required to add certificates into the host NSS database and to configure IPsec to communicate with external hosts.

* Set `routingViaHost=true` in the `ovnKubernetesConfig.gatewayConfig` specification of the OVN-Kubernetes network plugin.
* Install the NMState Operator. This Operator is required for specifying the IPsec configuration. For more information, see "Kubernetes NMState Operator".
+
[NOTE]
====
The NMState Operator is supported on {gcp-first} only for configuring IPsec.
====