diff --git a/.gitignore b/.gitignore
index 89fcb341167..f57991284dd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,6 +31,17 @@
 /build/external/deb/debian/files/
 /build/external/deb/debian/.debhelper/
 /build/external/deb/debian/vpp-ext-deps*
+/build/optional/downloads/
+/build/optional/*.tar.gz
+/build/optional/*.tar.xz
+/build/optional/vpp-*
+/build/optional/deb/_build/
+/build/optional/deb/debian/changelog
+/build/optional/deb/debian/debhelper-build-stamp
+/build/optional/deb/debian/tmp/
+/build/optional/deb/debian/files/
+/build/optional/deb/debian/.debhelper/
+/build/optional/deb/debian/vpp-ext-deps*
 /path_setup
 /tools/
 # start autotools ignore
diff --git a/Makefile b/Makefile
index 98866e9be5f..72d2ba5a1bc 100644
--- a/Makefile
+++ b/Makefile
@@ -271,6 +271,7 @@ help:
 	@echo " snap-clean           - clean up snap build environment"
 	@echo " pkg-rpm              - build RPM packages"
 	@echo " install-ext-dep[s]   - install external development dependencies"
+	@echo " install-opt-deps     - install optional dependencies"
 	@echo " ctags                - (re)generate ctags database"
 	@echo " gtags                - (re)generate gtags database"
 	@echo " cscope               - (re)generate cscope database"
@@ -740,6 +741,10 @@ install-ext-deps:
 .PHONY: install-ext-dep
 install-ext-dep: install-ext-deps
 
+.PHONY: install-opt-deps
+install-opt-deps:
+	$(MAKE) -C build/optional install-$(PKG)
+
 .PHONY: json-api-files
 json-api-files:
 	$(WS_ROOT)/src/tools/vppapigen/generate_json.py
diff --git a/build-data/packages/vpp.mk b/build-data/packages/vpp.mk
index 9c8e62dc739..cdd40655dce 100644
--- a/build-data/packages/vpp.mk
+++ b/build-data/packages/vpp.mk
@@ -19,7 +19,7 @@ else
 CMAKE?=cmake
 endif
 
-vpp_cmake_prefix_path  = /opt/vpp/external/$(shell uname -m)
+vpp_cmake_prefix_path  = /opt/vpp/external/$(shell uname -m) /opt/vpp/optional/$(shell uname -m)
 vpp_cmake_prefix_path += $(PACKAGE_INSTALL_DIR)external
 vpp_cmake_prefix_path := $(subst $() $(),;,$(vpp_cmake_prefix_path))
 
diff --git a/build/build_common.mk b/build/build_common.mk
new file mode 100644
index 00000000000..92a7f03e9b8
--- /dev/null
+++ b/build/build_common.mk
@@ -0,0 +1,49 @@
+# Copyright (c) 2024 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Scripts require non-POSIX parts of bash
+SHELL := $(shell which bash)
+
+DL_CACHE_DIR = $(HOME)/Downloads
+MAKE_ARGS ?= -j
+BUILD_DIR        ?= $(CURDIR)/_build
+INSTALL_DIR      ?= $(CURDIR)/_install
+DOWNLOAD_DIR     ?= $(CURDIR)/downloads
+PKG_VERSION ?= $(shell git describe --abbrev=0 --match 'v[0-9]*' | cut -d- -f1 | cut -dv -f2 | cut -d. -f1,2)
+PKG_SUFFIX ?= $(shell git log --oneline v$(PKG_VERSION)-rc0.. . | wc -l)
+SOURCE_DATE_EPOCH ?= $(shell git log -1 --pretty=%ct .)
+ifeq ($(shell uname), FreeBSD)
+JOBS := $(shell nproc)
+else
+JOBS := $(if $(shell [ -f /proc/cpuinfo ] && head /proc/cpuinfo),\
+	$(shell grep -c ^processor /proc/cpuinfo), 2)
+endif	# FreeBSD
+
+B := $(BUILD_DIR)
+I := $(INSTALL_DIR)
+D := $(DOWNLOAD_DIR)
+ifeq ($(WORKSPACE),)
+L := $(B)
+else
+L := $(WORKSPACE)/archives/vpp-ext-deps
+$(shell rm -rf $(L) && mkdir -p $(L))
+endif
+
+ifneq ($(shell which cmake3),)
+CMAKE?=cmake3
+else
+CMAKE?=cmake
+endif
+
+ARCH_X86_64=$(filter x86_64,$(shell uname -m))
+AARCH64=$(filter aarch64,$(shell uname -m))
diff --git a/build/external/Makefile b/build/external/Makefile
index b4a099c57e1..d70ba7c3f6a 100644
--- a/build/external/Makefile
+++ b/build/external/Makefile
@@ -11,42 +11,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Scripts require non-POSIX parts of bash
-SHELL := $(shell which bash)
+include ../build_common.mk
+include ../packages_common.mk
 
-DL_CACHE_DIR = $(HOME)/Downloads
-MAKE_ARGS ?= -j
-BUILD_DIR        ?= $(CURDIR)/_build
-INSTALL_DIR      ?= $(CURDIR)/_install
-PKG_VERSION ?= $(shell git describe --abbrev=0 --match 'v[0-9]*' | cut -d- -f1 | cut -dv -f2 | cut -d. -f1,2)
-PKG_SUFFIX ?= $(shell git log --oneline v$(PKG_VERSION)-rc0.. . | wc -l)
-SOURCE_DATE_EPOCH ?= $(shell git log -1 --pretty=%ct .)
-ifeq ($(shell uname), FreeBSD)
-JOBS := $(shell nproc)
-else
-JOBS := $(if $(shell [ -f /proc/cpuinfo ] && head /proc/cpuinfo),\
-	$(shell grep -c ^processor /proc/cpuinfo), 2)
-endif	# FreeBSD
-
-B := $(BUILD_DIR)
-I := $(INSTALL_DIR)
-ifeq ($(WORKSPACE),)
-L := $(B)
-else
-L := $(WORKSPACE)/archives/vpp-ext-deps
-$(shell rm -rf $(L) && mkdir -p $(L))
-endif
-
-ifneq ($(shell which cmake3),)
-CMAKE?=cmake3
-else
-CMAKE?=cmake
-endif
-
-ARCH_X86_64=$(filter x86_64,$(shell uname -m))
-AARCH64=$(filter aarch64,$(shell uname -m))
-
-include packages.mk
 include packages/ipsec-mb.mk
 include packages/quicly.mk
 ifneq ($(shell uname), FreeBSD)
diff --git a/build/external/deb/debian/control b/build/external/deb/debian/control
index 80b81b8b375..a4e59f4c577 100644
--- a/build/external/deb/debian/control
+++ b/build/external/deb/debian/control
@@ -9,5 +9,3 @@ Package: vpp-ext-deps
 Architecture: any
 Depends: ${shlibs:Depends}
 Description: VPP developer package containing dependencies
-Replaces: vpp-dpdk-dev
-Conflicts: vpp-dpdk-dev
diff --git a/build/external/deb/debian/rules b/build/external/deb/debian/rules
index 901d4689766..6682952fa0e 100755
--- a/build/external/deb/debian/rules
+++ b/build/external/deb/debian/rules
@@ -30,4 +30,4 @@ override_dh_install:
 	dh_install -p$(PKG) --autodest /opt
 
 override_dh_shlibdeps:
-	dh_shlibdeps -l$(INSTALL_DIR)lib/
+	dh_shlibdeps -l$(INSTALL_DIR)lib/:$(INSTALL_DIR)lib64
diff --git a/build/optional/Makefile b/build/optional/Makefile
new file mode 100644
index 00000000000..012d4c98c58
--- /dev/null
+++ b/build/optional/Makefile
@@ -0,0 +1,156 @@
+# Copyright (c) 2024 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include ../build_common.mk
+include ../packages_common.mk
+
+ifneq ($(shell uname), FreeBSD)
+include packages/openssl.mk
+endif	# ! FreeBSD
+
+.PHONY: clean
+clean:
+	@rm -rf $(B) $(I)
+
+.PHONY: install
+ifeq ($(shell uname), FreeBSD)
+install:
+else
+install: openssl-install
+endif	# FreeBSD
+
+.PHONY: config
+ifeq ($(shell uname), FreeBSD)
+config:
+else
+config: openssl-config
+endif	# FreeBSD
+
+##############################################################################
+# .deb packaging
+##############################################################################
+
+DEB_VER := $(PKG_VERSION)
+DEB_ARCH=$(shell dpkg --print-architecture 2> /dev/null)
+DEV_DEB=vpp-opt-deps_$(DEB_VER)-$(PKG_SUFFIX)_$(DEB_ARCH).deb
+INSTALLED_VER=$(shell dpkg-query --showformat='$${Version}' --show vpp-opt-deps 2> /dev/null)
+
+.PHONY: build-deb install-deb check-deb
+
+deb/debian/changelog: Makefile
+	@echo "vpp-opt-deps ($(DEB_VER)-$(PKG_SUFFIX)) unstable; urgency=low" > $@
+	@echo "" >> $@
+	@echo "  * Version $(DEB_VER)" >> $@
+	@echo "" >> $@
+	@echo " -- VPP Dev <vpp-dev@lists.fd.io>  $(shell date -R --date=@${SOURCE_DATE_EPOCH})" >> $@
+
+$(DEV_DEB): deb/debian/changelog
+	@cd deb && dpkg-buildpackage -b -uc -us
+	git clean -fdx deb
+
+build-deb: $(DEV_DEB)
+
+install-deb:
+ifneq ($(INSTALLED_VER),$(DEB_VER)-$(PKG_SUFFIX))
+	@$(MAKE) $(DEV_DEB)
+	@sudo dpkg -i $(DEV_DEB)
+else
+	@echo "=========================================================="
+	@echo " Up-to-date vpp-opt-deps package already installed"
+	@echo "=========================================================="
+endif
+
+check-deb:
+ifneq ($(INSTALLED_VER),$(DEB_VER)-$(PKG_SUFFIX))
+	@echo "=========================================================="
+	@echo " Out of date vpp-opt-deps package installed."
+	@echo " Installed: $(INSTALLED_VER)"
+	@echo " Needed: $(DEB_VER)-$(PKG_SUFFIX)"
+	@echo ""
+	@echo " Please upgrade by invoking 'make install-opt-deps'"
+	@echo " from the top level directory."
+	@echo "=========================================================="
+endif
+
+##############################################################################
+# .rpm packaging
+##############################################################################
+
+RPM_VER := $(PKG_VERSION)
+RPM_ARCH=$(shell rpm --eval "%{_arch}" 2> /dev/null)
+DEV_RPM=vpp-opt-deps-$(RPM_VER)-$(PKG_SUFFIX).$(RPM_ARCH).rpm
+INSTALLED_RPM_VER=$(shell rpm -q --queryformat '%{VERSION}-%{RELEASE}' vpp-opt-deps 2> /dev/null | grep -v "vpp-opt-deps")
+
+.PHONY: build-rpm install-rpm check-rpm
+
+$(DEV_RPM): Makefile rpm/vpp-opt-deps.spec
+	@rpmbuild -bb \
+	  --define "_topdir $(CURDIR)/rpm" \
+	  --define "_version $(RPM_VER)" \
+	  --define "_release $(PKG_SUFFIX)" \
+	  $(CURDIR)/rpm/vpp-opt-deps.spec
+	mv rpm/RPMS/$(RPM_ARCH)/*.rpm .
+	@git clean -fdx rpm
+
+build-rpm: $(DEV_RPM)
+
+install-rpm:
+ifneq ($(INSTALLED_RPM_VER),$(RPM_VER)-$(PKG_SUFFIX))
+	@$(MAKE) $(DEV_RPM)
+	sudo rpm -e vpp-opt-deps || true
+	sudo rpm -Uih --force $(DEV_RPM)
+else
+	@echo "=========================================================="
+	@echo " Up-to-date vpp-opt-deps package already installed"
+	@echo "=========================================================="
+endif
+
+check-rpm:
+ifneq ($(INSTALLED_RPM_VER),$(RPM_VER)-$(PKG_SUFFIX))
+	@echo "=========================================================="
+	@echo " Out of date vpp-opt-deps package installed."
+	@echo " Installed: $(INSTALLED_RPM_VER)"
+	@echo " Needed: $(RPM_VER)-$(PKG_SUFFIX)"
+	@echo ""
+	@echo " Please upgrade by invoking 'make install-opt-deps'"
+	@echo " from the top level directory."
+	@echo "=========================================================="
+endif
+
+##############################################################################
+# ebuild support
+##############################################################################
+
+.PHONY: ebuild-build ebuild-install
+
+ebuild-build:
+ifeq ($(INSTALLED_VER)$(INSTALLED_RPM_VER),)
+	@echo "=========================================================="
+	@echo "Building vpp-opt-deps from source. Consider installing"
+	@echo "development package by invoking 'make install-opt-deps'"
+	@echo "from the top level directory"
+	@echo "=========================================================="
+	$(MAKE) config
+else
+ifneq ($(INSTALLED_VER),)
+	$(MAKE) check-deb
+endif
+ifneq ($(INSTALLED_RPM_VER),)
+	$(MAKE) check-rpm
+endif
+endif
+
+ebuild-install:
+ifeq ($(INSTALLED_VER)$(INSTALLED_RPM_VER),)
+	$(MAKE) install
+endif
diff --git a/build/optional/deb/debian/compat b/build/optional/deb/debian/compat
new file mode 100755
index 00000000000..f599e28b8ab
--- /dev/null
+++ b/build/optional/deb/debian/compat
@@ -0,0 +1 @@
+10
diff --git a/build/optional/deb/debian/control b/build/optional/deb/debian/control
new file mode 100644
index 00000000000..d892395ddab
--- /dev/null
+++ b/build/optional/deb/debian/control
@@ -0,0 +1,11 @@
+Source: vpp-opt-deps
+Section: net
+Priority: extra
+Maintainer: vpp-dev@lists.fd.io
+Build-Depends: debhelper (>= 9), dkms
+Standards-Version: 3.9.4
+
+Package: vpp-opt-deps
+Architecture: any
+Depends: ${shlibs:Depends}
+Description: VPP developer package containing optional dependencies
diff --git a/build/optional/deb/debian/rules b/build/optional/deb/debian/rules
new file mode 100755
index 00000000000..2fd8b3d110d
--- /dev/null
+++ b/build/optional/deb/debian/rules
@@ -0,0 +1,33 @@
+#!/usr/bin/make -f
+DH_VERBOSE = 1
+DEB_BUILD_OPTIONS = noddebs
+DEB_CFLAGS_MAINT_STRIP = -flto=auto -ffat-lto-objects -flto=auto -ffat-lto-objects -O2
+DEB_LDFLAGS_MAINT_STRIP = -flto=auto -ffat-lto-objects -flto=auto -ffat-lto-objects
+DEB_CFLAGS_MAINT_APPEND = -O3
+PKG=vpp-opt-deps
+
+VERSION = $(shell dpkg-parsechangelog | sed -nr '/^Version:/s/Version: //p')
+BASE_VER = $(word 1, $(subst -, ,$(VERSION)))
+
+export BUILD_DIR=$(CURDIR)/_build
+export INSTALL_DIR=$(CURDIR)/debian/tmp/opt/vpp/optional/$(shell uname -m)/
+
+MAKE_ARGS=-C ..
+
+include /usr/share/dpkg/default.mk
+
+%:
+	dh $@
+
+override_dh_clean:
+	make $(MAKE_ARGS) clean
+
+override_dh_auto_configure:
+
+override_dh_install:
+	make $(MAKE_ARGS) install
+	@mkdir -p $(INSTALL_DIR)
+	dh_install -p$(PKG) --autodest /opt
+
+override_dh_shlibdeps:
+	dh_shlibdeps -l$(INSTALL_DIR)lib/:$(INSTALL_DIR)lib64
diff --git a/build/optional/packages/openssl.mk b/build/optional/packages/openssl.mk
new file mode 100644
index 00000000000..1c9c45b8cd7
--- /dev/null
+++ b/build/optional/packages/openssl.mk
@@ -0,0 +1,44 @@
+# Copyright (c) 2024 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+openssl_version             := 3.3.2
+openssl_tarball             := openssl-$(openssl_version).tar.gz
+openssl_tarball_md5sum      := 015fca2692596560b6fe8a2d8fecd84b
+
+openssl_tarball_strip_dirs  := 1
+openssl_url                 := https://github.com/openssl/openssl/releases/download/openssl-$(openssl_version)/$(openssl_tarball)
+
+define openssl_config_args
+--prefix=$(openssl_install_dir) \
+--openssldir=$(openssl_build_dir) \
+no-dtls1
+endef
+
+define  openssl_config_cmds
+	@cd $(openssl_src_dir) && \
+		$(openssl_src_dir)/config \
+			$(openssl_config_args) | tee -a $(openssl_config_log)
+endef
+
+define  openssl_build_cmds
+	@cd $(openssl_src_dir) && \
+		$(MAKE) depend build_sw | tee $(openssl_build_log)
+endef
+
+define  openssl_install_cmds
+	@cd $(openssl_src_dir) && \
+		$(MAKE) install_sw | tee $(openssl_install_log)
+endef
+
+$(eval $(call package,openssl))
+
diff --git a/build/external/packages.mk b/build/packages_common.mk
similarity index 96%
rename from build/external/packages.mk
rename to build/packages_common.mk
index e8cbe271d9b..92fa559559a 100644
--- a/build/external/packages.mk
+++ b/build/packages_common.mk
@@ -1,4 +1,4 @@
-# Copyright (c) 2018 Cisco and/or its affiliates.
+# Copyright (c) 2024 Cisco and/or its affiliates.
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at:
@@ -28,8 +28,8 @@ $1_install_log ?= $(L)/$1.install.log
 ##############################################################################
 # Download
 ##############################################################################
-downloads/$($1_tarball):
-	mkdir -p downloads
+$(D)/$($1_tarball):
+	mkdir -p $(D)
 	@if [ -e $(DL_CACHE_DIR)/$($1_tarball) ] ; \
 		then cp $(DL_CACHE_DIR)/$($1_tarball) $$@ ; \
 	else \
@@ -38,7 +38,7 @@ downloads/$($1_tarball):
 	fi
 	@rm -f $(B)/.$1.download.ok
 
-$(B)/.$1.download.ok: downloads/$($1_tarball)
+$(B)/.$1.download.ok: $(D)/$($1_tarball)
 	@mkdir -p $(B)
 	$$(call h1,"validating $1 $($1_version) checksum")
 	@SUM=$$(shell openssl md5 $$< | cut -f 2 -d " " -) ; \
@@ -65,7 +65,7 @@ $(B)/.$1.extract.ok: $(B)/.$1.download.ok
 	  --directory $$($1_src_dir) \
 	  --extract \
 	  --strip-components=$$($1_tarball_strip_dirs) \
-	  --file downloads/$($1_tarball)
+	  --file $(D)/$($1_tarball)
 	@touch $$@
 
 .PHONY: $1-extract
diff --git a/src/pkg/debian/rules.in b/src/pkg/debian/rules.in
index 1958497f5ed..dddba992572 100644
--- a/src/pkg/debian/rules.in
+++ b/src/pkg/debian/rules.in
@@ -12,6 +12,7 @@ export PYBUILD_DIR = @CMAKE_SOURCE_DIR@/vpp-api/python
 export PYBUILD_DESTDIR_python3=debian/python3-vpp-api/
 export PYBUILD_DISABLE_python3=test
 export PYBUILD_SYSTEM=distutils
+export INSTALL_DIR=/opt/vpp/external/$(shell uname -m)/
 DH_WITH = systemd,python3
 
 build3vers := $(shell py3versions -sv)
@@ -41,3 +42,6 @@ override_dh_install:
 	    @CMAKE_SOURCE_DIR@/scripts/remove-rpath debian/$$c ; \
 	  fi ; \
 	done
+
+override_dh_shlibdeps:
+	dh_shlibdeps -l$(INSTALL_DIR)lib/:$(INSTALL_DIR)lib64