Using IPsec hardware acceleration

About IPsec hardware acceleration

Security processing, because of the massive and repetitive mathematical operations required, can significantly reduce CPU availability. To address this problem, Network Appliance offers a separately-installable IPsec accelerator adapter, which can be used on some, but not all, NetApp storage appliances and can dramatically improve performance if those storage appliances use IPsec encryption.

The IPsec accelerator is supported on the following platforms:

FAS900 series
F800 series
NearStore series

After you install the IPsec accelerator, the filer uses it automatically for all IPsec computation. Only one accelerator per filer can be used. In the event of IPsec accelerator failure, security processing falls back to IPsec software so that security services are not interrupted.

For information about obtaining an IPsec accelerator adapter for your filer, contact your Network Appliance representative or visit the NetApp On the Web (NOW) site at http://now.netapp.com/.

Monitoring accelerator hardware performance

If you install an IPsec accelerator and it fails, and then security services are taken on by the IPsec software on the filer in order to prevent interruptions to the services, the performance of your filer will decrease.

You can use the ipsec stats command (as described in How to display IPsec statistics) to troubleshoot suspected hardware problems. If the ipsec stats display shows changes in the values for the following items, there might be a problem with the IPsec accelerator adapter:

inbound packets failed on AH replay check (if it has a non-zero value)
inbound packets failed on ESP replay check (if it has a non-zero value)
outbound packets processed successfully (if it has a significantly reduced value)

If there are changes in these values, you can view accelerator hardware statistics by running the ipsec stats command when the privilege level is set to advanced.

Viewing IPsec accelerator statistics

To view IPsec accelerator hardware statistics, complete the following steps.

Step	Action
1	At the filer command line, enter the following command: priv set advanced For more information about advanced privilege level, see the NetApp priv(1) manual page.
2	Enter the following command: `ipsec stats`
3	When you are finished viewing hardware statistics, be sure to return to the normal administrative privilege level by entering the following command: priv set admin

Step

Action

At the filer command line, enter the following command:

priv set advanced

For more information about advanced privilege level, see the NetApp priv(1) manual page.

Enter the following command:

ipsec stats

When you are finished viewing hardware statistics, be sure to return to the normal administrative privilege level by entering the following command:

priv set admin

Example

In the following example, the Hardware Statistics section shows normal activity for the IPsec accelerator adapter.

filer1*> ipsec stats

ipsec:

        49632 inbound packets processed successfully

        0 inbound packets violated process security policy

        0 inbound packets with no SA available

        0 invalid inbound packets

        0 inbound packets failed due to insufficient memory

        0 inbound packets failed getting SPI

        0 inbound packets failed on AH replay check

        0 inbound packets failed on ESP replay check

        49632 inbound packets considered authentic

        0 inbound packets failed on authentication

        ESP input packets

                3des  : 49632

        101572 outbound packets processed successfully

        0 outbound packets violated process security policy

        0 outbound packets with no SP available

        17 outbound packets with no SA available

        0 invalid outbound packets

        0 outbound packets failed due to insufficient memory

        0 outbound packets with no route

        ESP output packets

                3des  : 101572

ike:

        IKE input packets

                Identity Protection          : 3

                Informational                : 1

                Quick                        : 1

        IKE output packets

                Identity Protection          : 3

                Informational                : 1

                Quick                        : 5

Hardware Statistics

        Hardware Acceleration on......

        input Statistics

                49632 Requests  49632 Responses

        Output Statistics

                101572 Requests         101572 Responses

The Hardware Statistics section appears only if the IPsec accelerator is present. Statistics displayed in this section, as well as in the "ipsec" section, should keep increasing if the accelerator is functioning properly. The line "Hardware Acceleration on" indicates that the accelerator is functioning. If the accelerator is not functioning, this line will say "Hardware Acceleration off."

If an accelerator failure is detected, a syslog message will be sent, IPsec will automatically switch to software processing on the storage appliance the accelerator was for, and the report resulting from the ipsec stats command in advanced mode will display the line "Hardware Acceleration off."