Index: head/sys/conf/config.mk
===================================================================
--- head/sys/conf/config.mk
+++ head/sys/conf/config.mk
@@ -30,6 +30,8 @@
 opt_inet6.h:
 	@echo "#define INET6 1" > ${.TARGET}
 .endif
+opt_ipsec.h:
+	@echo "#define IPSEC_SUPPORT 1" > ${.TARGET}
 .if ${MK_RATELIMIT} != "no"
 opt_ratelimit.h:
 	@echo "#define RATELIMIT 1" > ${.TARGET}
Index: head/sys/modules/ipsec/Makefile
===================================================================
--- head/sys/modules/ipsec/Makefile
+++ head/sys/modules/ipsec/Makefile
@@ -8,7 +8,4 @@
 	opt_inet.h opt_inet6.h opt_ipsec.h opt_sctp.h 
 SRCS.INET=	udpencap.c
 
-opt_ipsec.h:
-	@echo "#define IPSEC_SUPPORT 1" > ${.TARGET}
-
 .include <bsd.kmod.mk>
Index: head/sys/modules/tcp/tcpmd5/Makefile
===================================================================
--- head/sys/modules/tcp/tcpmd5/Makefile
+++ head/sys/modules/tcp/tcpmd5/Makefile
@@ -5,7 +5,4 @@
 KMOD=   tcpmd5
 SRCS=   xform_tcp.c opt_inet.h opt_inet6.h opt_ipsec.h
 
-opt_ipsec.h:
-	@echo "#define IPSEC_SUPPORT 1" > ${.TARGET}
-
 .include <bsd.kmod.mk>