diff --git a/MAINTAINERS b/MAINTAINERS
index ed163f5d5..f66772908 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1286,7 +1286,7 @@ M: Jiayu Hu <jiayu.hu@intel.com>
 F: lib/librte_gso/
 F: doc/guides/prog_guide/generic_segmentation_offload_lib.rst
 
-IPsec - EXPERIMENTAL
+IPsec
 M: Konstantin Ananyev <konstantin.ananyev@intel.com>
 T: git://dpdk.org/next/dpdk-next-crypto
 F: lib/librte_ipsec/
diff --git a/doc/guides/rel_notes/release_20_11.rst b/doc/guides/rel_notes/release_20_11.rst
index df227a177..b750fcf65 100644
--- a/doc/guides/rel_notes/release_20_11.rst
+++ b/doc/guides/rel_notes/release_20_11.rst
@@ -100,6 +100,7 @@ ABI Changes
    Also, make sure to start the actual text at the margin.
    =======================================================
 
+* ipsec: ``RTE_SATP_LOG2_NUM`` has been dropped from ``enum``
 
 Known Issues
 ------------
diff --git a/lib/librte_ipsec/rte_ipsec.h b/lib/librte_ipsec/rte_ipsec.h
index de05f4e93..dd60d9591 100644
--- a/lib/librte_ipsec/rte_ipsec.h
+++ b/lib/librte_ipsec/rte_ipsec.h
@@ -10,10 +10,6 @@
  *
  * RTE IPsec support.
  *
- * @warning
- * @b EXPERIMENTAL:
- * All functions in this file may be changed or removed without prior notice.
- *
  * librte_ipsec provides a framework for data-path IPsec protocol
  * processing (ESP/AH).
  */
@@ -94,7 +90,6 @@ struct rte_ipsec_session {
  *   - Zero if operation completed successfully.
  *   - -EINVAL if the parameters are invalid.
  */
-__rte_experimental
 int
 rte_ipsec_session_prepare(struct rte_ipsec_session *ss);
 
@@ -119,7 +114,6 @@ rte_ipsec_session_prepare(struct rte_ipsec_session *ss);
  * @return
  *   Number of successfully processed packets, with error code set in rte_errno.
  */
-__rte_experimental
 static inline uint16_t
 rte_ipsec_pkt_crypto_prepare(const struct rte_ipsec_session *ss,
 	struct rte_mbuf *mb[], struct rte_crypto_op *cop[], uint16_t num)
@@ -127,7 +121,6 @@ rte_ipsec_pkt_crypto_prepare(const struct rte_ipsec_session *ss,
 	return ss->pkt_func.prepare.async(ss, mb, cop, num);
 }
 
-__rte_experimental
 static inline uint16_t
 rte_ipsec_pkt_cpu_prepare(const struct rte_ipsec_session *ss,
 	struct rte_mbuf *mb[], uint16_t num)
@@ -158,7 +151,6 @@ rte_ipsec_pkt_cpu_prepare(const struct rte_ipsec_session *ss,
  * @return
  *   Number of successfully processed packets, with error code set in rte_errno.
  */
-__rte_experimental
 static inline uint16_t
 rte_ipsec_pkt_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[],
 	uint16_t num)
diff --git a/lib/librte_ipsec/rte_ipsec_group.h b/lib/librte_ipsec/rte_ipsec_group.h
index 47b33ca5e..ea3bdfad9 100644
--- a/lib/librte_ipsec/rte_ipsec_group.h
+++ b/lib/librte_ipsec/rte_ipsec_group.h
@@ -7,7 +7,6 @@
 
 /**
  * @file rte_ipsec_group.h
- * @b EXPERIMENTAL: this API may change without prior notice
  *
  * RTE IPsec support.
  * It is not recommended to include this file directly,
@@ -42,7 +41,6 @@ struct rte_ipsec_group {
  * @return
  *   The pointer to the related *rte_ipsec_session* structure.
  */
-__rte_experimental
 static inline struct rte_ipsec_session *
 rte_ipsec_ses_from_crypto(const struct rte_crypto_op *cop)
 {
@@ -79,7 +77,6 @@ rte_ipsec_ses_from_crypto(const struct rte_crypto_op *cop)
  * @return
  *   Number of filled elements in *grp* array.
  */
-__rte_experimental
 static inline uint16_t
 rte_ipsec_pkt_crypto_group(const struct rte_crypto_op *cop[],
 	struct rte_mbuf *mb[], struct rte_ipsec_group grp[], uint16_t num)
diff --git a/lib/librte_ipsec/rte_ipsec_sa.h b/lib/librte_ipsec/rte_ipsec_sa.h
index 1cfde5874..cf51ad833 100644
--- a/lib/librte_ipsec/rte_ipsec_sa.h
+++ b/lib/librte_ipsec/rte_ipsec_sa.h
@@ -7,7 +7,6 @@
 
 /**
  * @file rte_ipsec_sa.h
- * @b EXPERIMENTAL: this API may change without prior notice
  *
  * Defines API to manage IPsec Security Association (SA) objects.
  */
@@ -90,8 +89,7 @@ enum {
 	RTE_SATP_LOG2_SQN = RTE_SATP_LOG2_MODE + 2,
 	RTE_SATP_LOG2_ESN,
 	RTE_SATP_LOG2_ECN,
-	RTE_SATP_LOG2_DSCP,
-	RTE_SATP_LOG2_NUM
+	RTE_SATP_LOG2_DSCP
 };
 
 #define RTE_IPSEC_SATP_IPV_MASK		(1ULL << RTE_SATP_LOG2_IPV)
@@ -132,7 +130,6 @@ enum {
  * @return
  *   SA type value.
  */
-__rte_experimental
 uint64_t
 rte_ipsec_sa_type(const struct rte_ipsec_sa *sa);
 
@@ -144,7 +141,6 @@ rte_ipsec_sa_type(const struct rte_ipsec_sa *sa);
  *   - Actual size required for SA with given parameters.
  *   - -EINVAL if the parameters are invalid.
  */
-__rte_experimental
 int
 rte_ipsec_sa_size(const struct rte_ipsec_sa_prm *prm);
 
@@ -161,7 +157,6 @@ rte_ipsec_sa_size(const struct rte_ipsec_sa_prm *prm);
  *   - -EINVAL if the parameters are invalid.
  *   - -ENOSPC if the size of the provided buffer is not big enough.
  */
-__rte_experimental
 int
 rte_ipsec_sa_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm,
 	uint32_t size);
@@ -171,7 +166,6 @@ rte_ipsec_sa_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm,
  * @param sa
  *   Pointer to SA object to de-initialize.
  */
-__rte_experimental
 void
 rte_ipsec_sa_fini(struct rte_ipsec_sa *sa);
 
diff --git a/lib/librte_ipsec/rte_ipsec_sad.h b/lib/librte_ipsec/rte_ipsec_sad.h
index dcc82249e..3e67ab1e4 100644
--- a/lib/librte_ipsec/rte_ipsec_sad.h
+++ b/lib/librte_ipsec/rte_ipsec_sad.h
@@ -10,7 +10,6 @@
 
 /**
  * @file rte_ipsec_sad.h
- * @b EXPERIMENTAL: this API may change without prior notice
  *
  * RTE IPsec security association database (SAD) support.
  * Contains helper functions to lookup and maintain SAD
@@ -82,7 +81,6 @@ struct rte_ipsec_sad_conf {
  * @return
  *   0 on success, negative value otherwise
  */
-__rte_experimental
 int
 rte_ipsec_sad_add(struct rte_ipsec_sad *sad,
 	const union rte_ipsec_sad_key *key,
@@ -103,7 +101,6 @@ rte_ipsec_sad_add(struct rte_ipsec_sad *sad,
  * @return
  *   0 on success, negative value otherwise
  */
-__rte_experimental
 int
 rte_ipsec_sad_del(struct rte_ipsec_sad *sad,
 	const union rte_ipsec_sad_key *key,
@@ -119,7 +116,6 @@ rte_ipsec_sad_del(struct rte_ipsec_sad *sad,
  *  Handle to SAD object on success
  *  NULL otherwise with rte_errno set to an appropriate values.
  */
-__rte_experimental
 struct rte_ipsec_sad *
 rte_ipsec_sad_create(const char *name, const struct rte_ipsec_sad_conf *conf);
 
@@ -133,7 +129,6 @@ rte_ipsec_sad_create(const char *name, const struct rte_ipsec_sad_conf *conf);
  *  set appropriately. Possible rte_errno values include:
  *   - ENOENT - required entry not available to return.
  */
-__rte_experimental
 struct rte_ipsec_sad *
 rte_ipsec_sad_find_existing(const char *name);
 
@@ -145,7 +140,6 @@ rte_ipsec_sad_find_existing(const char *name);
  * @return
  *   None
  */
-__rte_experimental
 void
 rte_ipsec_sad_destroy(struct rte_ipsec_sad *sad);
 
@@ -165,7 +159,6 @@ rte_ipsec_sad_destroy(struct rte_ipsec_sad *sad);
  *  @return
  *   -EINVAL for incorrect arguments, otherwise number of successful lookups.
  */
-__rte_experimental
 int
 rte_ipsec_sad_lookup(const struct rte_ipsec_sad *sad,
 	const union rte_ipsec_sad_key *keys[],
diff --git a/lib/librte_ipsec/rte_ipsec_version.map b/lib/librte_ipsec/rte_ipsec_version.map
index f37c867bf..ad3e38b7c 100644
--- a/lib/librte_ipsec/rte_ipsec_version.map
+++ b/lib/librte_ipsec/rte_ipsec_version.map
@@ -1,4 +1,4 @@
-EXPERIMENTAL {
+DPDK_21 {
 	global:
 
 	rte_ipsec_pkt_crypto_group;
