An Internet Protocol Security (IPSec) acceleration method, an apparatus, and a system, where the method includes generating, by an Internet Key Exchange (IKE) device, an IKE link establishment session packet according to an IPSec configuration parameter and a security policy in a security policy database (SPD), sending, by the IKE device, the IKE link establishment session packet to a peer device, establishing a security association (SA) with the peer device, and sending, by the IKE module, the SA to a data forwarding device. The IKE device and the data forwarding device are discrete devices. In this way, the IKE device and the data forwarding device can be deployed in different devices in order to increase the IPSec speed.