Index: libexec/rc/rc.conf
===================================================================
--- libexec/rc/rc.conf
+++ libexec/rc/rc.conf
@@ -234,7 +234,7 @@
 tcp_keepalive="YES"		# Enable stale TCP connection timeout (or NO).
 tcp_drop_synfin="NO"		# Set to YES to drop TCP packets with SYN+FIN
 				# NOTE: this violates the TCP specification
-icmp_drop_redirect="NO" 	# Set to YES to ignore ICMP REDIRECT packets
+icmp_drop_redirect="auto" 	# Set to YES to ignore ICMP REDIRECT packets
 icmp_log_redirect="NO"		# Set to YES to log ICMP REDIRECT packets
 network_interfaces="auto"	# List of network interfaces (or "auto").
 cloned_interfaces=""		# List of cloned network interfaces to create.
Index: libexec/rc/rc.d/routing
===================================================================
--- libexec/rc/rc.d/routing
+++ libexec/rc/rc.d/routing
@@ -303,7 +303,13 @@
 		${SYSCTL} net.inet.icmp.bmcastecho=0 > /dev/null
 	fi
 
-	if checkyesno icmp_drop_redirect; then
+	_icmp_drop_redirect="${icmp_drop_redirect}"
+	case "${_icmp_drop_redirect}" in
+	[Aa][Uu][Tt][Oo] | "")
+		_icmp_drop_redirect="${routed_enable}"
+		;;
+	esac
+	if checkyesno _icmp_drop_redirect; then
 		ropts_init inet
 		echo -n ' ignore ICMP redirect=YES'
 		${SYSCTL} net.inet.icmp.drop_redirect=1 > /dev/null
Index: share/man/man5/rc.conf.5
===================================================================
--- share/man/man5/rc.conf.5
+++ share/man/man5/rc.conf.5
@@ -1182,11 +1182,17 @@
 .It Va icmp_drop_redirect
 .Pq Vt bool
 Set to
-.Dq Li NO
-by default.
+.Dq Li AUTO
+by default.  This setting will take the value from
+.Va routed_enable 
+instead, because redirect processing may cause perfomance issues
+for large routing tables.
 Setting to
 .Dq Li YES
 will cause the kernel to ignore ICMP REDIRECT packets.
+Setting to
+.Dq Li NO
+will cause the kernel to process ICMP REDIRECT packets.
 Refer to
 .Xr icmp 4
 for more information.