diff --git a/sys/dev/cxgbe/common/common.h b/sys/dev/cxgbe/common/common.h
index 2033967ffb9..fcc728a8bf3 100644
--- a/sys/dev/cxgbe/common/common.h
+++ b/sys/dev/cxgbe/common/common.h
@@ -457,6 +457,10 @@ struct adapter_params {
 	unsigned int max_ordird_qp;	  /* Max read depth per RDMA QP */
 	unsigned int max_ird_adapter;	  /* Max read depth per adapter */
 
+	unsigned int nipsec_tunnel;
+	unsigned int nipsec_transport;
+	unsigned int nofld_ipsec_tunnel;
+
 	/* These values are for all ports (8b/port, upto 4 ports) */
 	uint32_t mps_bg_map;	/* MPS rx buffer group map */
 	uint32_t tp_ch_map;	/* TPCHMAP from firmware */
diff --git a/sys/dev/cxgbe/t4_main.c b/sys/dev/cxgbe/t4_main.c
index d73204eb808..07906dac00a 100644
--- a/sys/dev/cxgbe/t4_main.c
+++ b/sys/dev/cxgbe/t4_main.c
@@ -5998,7 +5998,29 @@ get_params__post_init(struct adapter *sc)
 		sc->vres.key.start = val[0];
 		sc->vres.key.size = val[1] - val[0] + 1;
 	}
-
+	if (sc->cryptocaps & FW_CAPS_CONFIG_IPSEC_INLINE) {
+		param[0] = FW_PARAM_PFVF(NIPSEC_TUNNEL);
+		param[1] = FW_PARAM_PFVF(NIPSEC_TRANSPORT);
+		rc = -t4_query_params(sc, sc->mbox, sc->pf, 0, 2, param, val);
+		if (rc == 0) {
+			sc->params.nipsec_tunnel = val[0];
+			sc->params.nipsec_transport = val[1];
+		} else {
+			CH_ERR(sc, "failed to query IPsec params: %d.\n", rc);
+			MPASS(sc->params.nipsec_tunnel == 0);
+			MPASS(sc->params.nipsec_transport == 0);
+		}
+	}
+	if (sc->cryptocaps & FW_CAPS_CONFIG_OFLD_OVER_IPSEC_INLINE) {
+		param[0] = FW_PARAM_PFVF(OFLD_NIPSEC_TUNNEL);
+		rc = -t4_query_params(sc, sc->mbox, sc->pf, 0, 1, param, val);
+		if (rc == 0) {
+			sc->params.nofld_ipsec_tunnel = val[0];
+		} else {
+			CH_ERR(sc, "failed to query TOE IPsec params: %d.\n", rc);
+			MPASS(sc->params.nofld_ipsec_tunnel == 0);
+		}
+	}
 	/*
 	 * We've got the params we wanted to query directly from the firmware.
 	 * Grab some others via other means.
@@ -7987,6 +8009,15 @@ t4_sysctls(struct adapter *sc)
 	SYSCTL_ADD_INT(ctx, children, OID_AUTO, "nfilters", CTLFLAG_RD,
 	    NULL, sc->tids.nftids, "number of filters");
 
+	SYSCTL_ADD_UINT(ctx, children, OID_AUTO, "nipsec_tunnel", CTLFLAG_RD,
+	    NULL, sc->params.nipsec_tunnel, "max hw IPsec tunnels");
+
+	SYSCTL_ADD_UINT(ctx, children, OID_AUTO, "nipsec_transport", CTLFLAG_RD,
+	    NULL, sc->params.nipsec_transport, "max hw IPsec transport pairs");
+
+	SYSCTL_ADD_UINT(ctx, children, OID_AUTO, "nofld_ipsec_tunnel", CTLFLAG_RD,
+	    NULL, sc->params.nofld_ipsec_tunnel, "max hw IPsec tunnels (TOE)");
+
 	SYSCTL_ADD_PROC(ctx, children, OID_AUTO, "temperature",
 	    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, sc, 0,
 	    sysctl_temperature, "I", "chip temperature (in Celsius)");