When testing strongswan performance, we saw that the performance differed by a lot between an ubuntu server and a centos server, with everything else being the same. We noticed that the CONFIG_XFRM_SUB_POLICY settings on the two kernels were different. Ubuntu had it disabled and centos had it enabled. We disabled this on the kernel we built and got the same performance as ubuntu server. Does anyone know when this config is required? Why would one distro have it enabled while the other doesn't?
XFRM_SUB_POLICY config in kerne
linux kernel;ipsec