Netgate SG-1000 microFirewall

Author Topic: ipsec not using AES-NI?  (Read 167 times)

0 Members and 1 Guest are viewing this topic.

Offline don.key

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
ipsec not using AES-NI?
« on: January 02, 2018, 06:00:27 pm »
Hi,

I am configuring a new pair of firewalls to provide Site to Site gigabit VPN link. Both machines have i7-4500U AES-NI enabled CPUs and run 2.4.2-RELEASE-p1 (amd64)

Crypto is set to AES-NI and is working
openssl speed -evp aes-256-cbc
Code: [Select]
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-cbc      79567.75k   281417.23k  1357269.13k  3620354.84k 74564763.65k

I see following iperf3 results between two devices (not firewalls themselves) on both ends:

Code: [Select]
No VPN 930 Mbits/sec
OpenVPN 783 Mbits/sec
IPSec 439 Mbits/sec

IPSec ESP is set to 'AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ'

Performance of IPSec seems not to change no matter what I do: disable crypto, set to AES-NI or BSD Cryptodev or both (of course with reboot after each change). openssl speed does see the changes but IPSec does not. Any idea why this can be?

Thanks

Offline don.key

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: ipsec not using AES-NI?
« Reply #1 on: January 02, 2018, 07:07:58 pm »
Fixed that...

Changed encryption to: AES-128-GCM / SHA256 / DH 14 and IPSec performance jumped to 877 Mbit/sec.