Community discussions

 
eternal0
newbie
Topic Author
Posts: 49
Joined: Fri Jun 20, 2014 5:56 pm

IPsec Hardware acceleration on CHR?

Mon Jun 26, 2017 9:03 am

As is well known that only AES-CBC hardware acceleration is supported by specific RouterBoard.
However, I can see the hardware acceleration flag on my CHR host if AES-GCM is used and no hardware acceleration flag if AES-CBC is used.
RouterOS version is 6.39.2
Any idea?
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 5933
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: IPsec Hardware acceleration on CHR?

Mon Jun 26, 2017 12:26 pm

From v6.39 changelog:

*) ipsec - enable aes-ni on i386 and x64 for cbc, ctr and gcm modes;
 
eternal0
newbie
Topic Author
Posts: 49
Joined: Fri Jun 20, 2014 5:56 pm

Re: IPsec Hardware acceleration on CHR?

Tue Jun 27, 2017 5:14 am

From v6.39 changelog:

*) ipsec - enable aes-ni on i386 and x64 for cbc, ctr and gcm modes;
That confused me why AES-CBC cannot get accelerated on my CHR host.

The IPsec connection is from RB850Gx2 to CHR with sha256/AES-256-CBC. The hardware acceleration works fine on my RB850Gx2.
 
User avatar
nz_monkey
Forum Guru
Forum Guru
Posts: 1818
Joined: Mon Jan 14, 2008 1:53 pm
Location: Straya
Contact:

Re: IPsec Hardware acceleration on CHR?

Tue Jun 27, 2017 6:15 am

What Hypervisor are you running CHR on ?
http://thebrotherswisp.com/ | Mikrotik MTCNA, MTCRE, MTCINE | Fortinet FTCNA, FCNSP, FCT | Extreme Networks ENA
 
eternal0
newbie
Topic Author
Posts: 49
Joined: Fri Jun 20, 2014 5:56 pm

Re: IPsec Hardware acceleration on CHR?

Tue Jun 27, 2017 10:59 am

What Hypervisor are you running CHR on ?
Hyperviser is KVM. Hardware acceleration is enabled if we use AES-GCM so that AES-NI is supported by this.
 
ebreyit
Member Candidate
Member Candidate
Posts: 120
Joined: Tue Apr 30, 2013 11:44 am
Location: Shropshire, United Kingdom

Re: IPsec Hardware acceleration on CHR?

Fri Jun 22, 2018 12:28 am

Im seeing this also.

ESXI V6
CHR RouterOS 6.42.4

If I set the proposal to aes-256 gcm I get the hardware flag and CPU stays low

If I set it to aes-256 cbc or ctr then there is no hardware flag and CPU rises.

Has anyone seen aes-265 ctr or cbc work on a CHR...?

I'd like to get it running as I have a CCR at the other end...
 
User avatar
chechito
Forum Guru
Forum Guru
Posts: 1736
Joined: Sun Aug 24, 2014 3:14 am
Location: Bogota Colombia
Contact:

Re: IPsec Hardware acceleration on CHR?

Fri Jun 22, 2018 12:51 am

server CPU supports AES-NI?
 
ebreyit
Member Candidate
Member Candidate
Posts: 120
Joined: Tue Apr 30, 2013 11:44 am
Location: Shropshire, United Kingdom

Re: IPsec Hardware acceleration on CHR?

Fri Jun 22, 2018 11:35 am

server CPU supports AES-NI?
Xeon D-1541 ( https://ark.intel.com/products/91199/In ... e-2_10-GHz )

ESXI extension pass-through is not disabled

Image attached of CPU-Z running on a guest in the same Host showing the AES-NI

Also I'm assuming that if GCM has been hardware accelerated then it must be able to see the AES-NI in the first place.
You do not have the required permissions to view the files attached to this post.
 
oreggin
Frequent Visitor
Frequent Visitor
Posts: 99
Joined: Fri Oct 16, 2009 9:21 pm

Re: IPsec Hardware acceleration on CHR?

Tue Jun 25, 2019 7:40 am

Same here, KVM with host CPU which has AES-NI flag.
Is there any solution?
 
jonmansey
Frequent Visitor
Frequent Visitor
Posts: 69
Joined: Sat Sep 18, 2004 3:43 am

Re: IPsec Hardware acceleration on CHR?

Wed Jul 03, 2019 2:12 am

on the ipSec wiki hardware acceleration page, there is a note by the x86 (AES-NI) entry that states

*** AES-CBC and AES-CTR only encryption is accelerated, hashing done in software

So im guessing that's why there is no H by the entry as its not fully hardware accelerated.

Who is online

Users browsing this forum: Google [Bot] and 98 guests