Page 1 of 1

RB3011 IPSEC Hardware Encryption?

Posted: Sun Jan 08, 2017 7:37 pm
by w0lt
Does the RB3011 have hardware encryption ability and is it enabled?

Thanks,

-tp

Re: RB3011 IPSEC Hardware Encryption?

Posted: Mon Jan 09, 2017 1:47 am
by kiler129
It has this in CPU but it's not enabled AFAIK - http://wiki.mikrotik.com/wiki/Manual:IP ... encryption

Re: RB3011 IPSEC Hardware Encryption?

Posted: Mon Jan 09, 2017 7:39 am
by dhoulbrooke
Does the RB3011 have hardware encryption ability and is it enabled?
Not yet unfortunately:

http://forum.mikrotik.com/viewtopic.php?t=83478#p512868
http://forum.mikrotik.com/viewtopic.php ... 02#p542641

Re: RB3011 IPSEC Hardware Encryption?

Posted: Mon Jan 09, 2017 12:28 pm
by josu
Is there any plan to implement it?

It will great to have it in the next release.

Regards.

Re: RB3011 IPSEC Hardware Encryption?

Posted: Mon Jan 09, 2017 12:29 pm
by mrz
As it was mentioned in other topics, there will be no HW acceleration in ROS v6.

Re: RB3011 IPSEC Hardware Encryption?

Posted: Tue Jan 10, 2017 8:19 pm
by Ascendo
How much IPSEC throughput can it do currently (software only)?

Re: RB3011 IPSEC Hardware Encryption?

Posted: Sun Jan 15, 2017 10:10 pm
by efaden
Curious myself....

Re: RB3011 IPSEC Hardware Encryption?

Posted: Wed Jan 18, 2017 8:45 am
by infused
bugger all.

Re: RB3011 IPSEC Hardware Encryption?

Posted: Sat Jun 30, 2018 11:16 am
by chriscolden
I'm seeing about 16Mb over the internet at about 7 or 8% cpu over all. The internet the other end is limited at 20Mb upload so I cannot physically receive any faster anyway.

Re: RB3011 IPSEC Hardware Encryption?

Posted: Tue Sep 18, 2018 12:08 pm
by petrz
What's new in 6.43.1 (2018-Sep-17 06:53):

Changes in this release:
*) rb3011 - added IPsec hardware acceleration support;

Re: RB3011 IPSEC Hardware Encryption?

Posted: Tue Sep 18, 2018 10:48 pm
by zorrua
What's new in 6.43.1 (2018-Sep-17 06:53):

Changes in this release:
*) rb3011 - added IPsec hardware acceleration support;
Great!

Is there any example about how to configure a IPSec tunnel between 2 RB3011 devices?

Kind regards.

Re: RB3011 IPSEC Hardware Encryption?

Posted: Tue Sep 18, 2018 11:06 pm
by honzam
As it was mentioned in other topics, there will be no HW acceleration in ROS v6.
Really? :)

Re: RB3011 IPSEC Hardware Encryption?

Posted: Wed Sep 19, 2018 4:53 pm
by sindy
Is there any example about how to configure a IPSec tunnel between 2 RB3011 devices?
There is nothing specific for the case of two RB3011, simply use the setup for any two Mikrotik devices mentioned in the manual. If hardware support for the authentication and encryption algorithms chosen is available on the device, it is activated automatically - it does not need to be switched on, and it cannot be switched off. Which algorithms enjoy hardware support can be found in this table in the same manual.

Re: RB3011 IPSEC Hardware Encryption?

Posted: Mon Sep 24, 2018 1:53 pm
by gcxo
I've install 6.43.1 on a 3011 but the IPSEC HW accelartion does not seem to work, it works fine on 750r3 an 1100ahx2.

Installed SAs of the 3011
cap3011.PNG
Installed SAs of the 1100
cap1100.PNG
One of the conexion is between the 1100 and 3100. On the 1100 side has EH, but on the 3011 has only E.

Any ideas?

Thanks

Re: RB3011 IPSEC Hardware Encryption?

Posted: Mon Sep 24, 2018 2:12 pm
by bennyh
For first sight might the problem is:
* supported only 128 bit and 256 bit key sizes

On your captured picture is see 192 bit size encription keys.
I've install 6.43.1 on a 3011 but the IPSEC HW accelartion does not seem to work, it works fine on 750r3 an 1100ahx2.

Installed SAs of the 3011

cap3011.PNG

Installed SAs of the 1100

cap1100.PNG

One of the conexion is between the 1100 and 3100. On the 1100 side has EH, but on the 3011 has only E.

Any ideas?

Thanks

Re: RB3011 IPSEC Hardware Encryption?

Posted: Mon Sep 24, 2018 2:14 pm
by sindy
In the table in the manual, there is a * reference in the row for RB3011, which says

* supported only 128 bit and 256 bit key sizes

In your installed-sa list, I can see "192" in "Encryption Key Size" column. So change the aes key size to either 128 or 256 bits and try again.

Re: RB3011 IPSEC Hardware Encryption?

Posted: Tue Sep 25, 2018 11:58 am
by gcxo
Thanks!! Setting the default ipsec proposal only to allow 128 or 256 worked.

Re: RB3011 IPSEC Hardware Encryption?

Posted: Wed Oct 03, 2018 11:08 am
by emils
What's new in 6.44beta14 (2018-Oct-01 12:01):

*) rb3011 - implemented multiple engine IPsec hardware acceleration support;

IPsec throughput table for RB3011UiAS-RM on our products page is updated too.

https://mikrotik.com/product/RB3011UiAS ... estresults

If you experience any stability related issues when running hardware offloaded IPsec on RB3011UiAS-RM, please let us know at support@mikrotik.com