IPsec can be enabled on a per-vFiler-unit basis, with distinct security policies for each vFiler unit. IPsec configuration is preserved when vFiler units are moved from one hosting storage system to another, unless the vFiler unit's IP address is changed.