1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
|
---
myst:
html_meta:
description: |
Hardware acceleration reduces the CPU workload of the router by
offloading it to a supported cryptographic accelerator. It is
configured under system acceleration, is disabled by default,
and applies system-wide once enabled. Intel QAT is currently the
only supported accelerator.
keywords: cryptographic acceleration, intel qat, pci passthrough
---
(acceleration)=
# Acceleration
Hardware acceleration speeds up the router's own workload. It is
configured under `system acceleration` and is disabled by default. Once
enabled, it applies system-wide, with no per-interface or per-tunnel
control. Acceleration requires a cryptographic accelerator that the router
supports, present on its {abbr}`PCI (Peripheral Component Interconnect)` bus.
When the router runs on a virtual machine, it detects a supported
accelerator only when the hypervisor assigns the accelerator to the
machine directly, a setup known as PCI passthrough.
Currently, only Intel® {abbr}`QAT (QuickAssist Technology)` for
cryptographic acceleration is supported.
## Configuration
### Intel® QAT
```{cfgcmd} set system acceleration qat
**Enable Intel® QAT acceleration.**
If IPsec is configured, the commit stops the IPsec service and starts it
again after the change is applied.
```
```{note}
The system must have a supported Intel® QAT device: C3xx (`8086:19e2`),
C62x (`8086:37c8`), C62xvf (`8086:37c9`), DH895 (`8086:0435`), D15xx
(`8086:6f54`), or 200xx (`8086:18ee`). Otherwise, the commit fails.
```
Example:
```none
set system acceleration qat
```
## Operation
### Intel® QAT
```{opcmd} show system acceleration qat
**List the Intel® QAT devices found in the system.**
If the system has no such device, the command shows
`No QAT device found`.
```
Example:
```none
show system acceleration qat
```
```{note}
The following commands work only after `set system acceleration qat` is
committed. Otherwise, they show
`system acceleration qat is not configured`.
```
```{opcmd} show system acceleration qat status
**Show the status of all Intel® QAT devices.**
The `state` field shows whether a device is up.
```
Example:
```none
show system acceleration qat status
```
```{opcmd} show system acceleration qat device \<device\> config
**Show the configuration of the specified Intel® QAT device.**
```
Example:
```none
show system acceleration qat device <device> config
```
```{opcmd} show system acceleration qat device \<device\> flows
**Show the firmware counters of the specified Intel® QAT device.**
```
Example:
```none
show system acceleration qat device <device> flows
```
```{opcmd} show system acceleration qat interrupts
**Show the Intel® QAT device interrupts.**
The output lists each interrupt with a counter for every CPU core.
```
Example:
```none
show system acceleration qat interrupts
```
## Example
### Intel® QAT
The following example configures an IPsec VPN between two routers with
Intel® QAT devices and compares the bandwidth with and without
acceleration.
Side A:
```none
set interfaces ethernet eth0 address '192.0.2.2/30'
set interfaces vti vti1 address '203.0.113.2/24'
set vpn ipsec authentication psk right id '192.0.2.2'
set vpn ipsec authentication psk right id '192.0.2.1'
set vpn ipsec authentication psk right secret 'REPLACE_WITH_RANDOM_SECRET'
set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes256'
set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha256'
set vpn ipsec ike-group MyIKEGroup dead-peer-detection action 'restart'
set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '14'
set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes256'
set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha256'
set vpn ipsec interface 'eth0'
set vpn ipsec options disable-route-autoinstall
set vpn ipsec site-to-site peer right authentication local-id '192.0.2.2'
set vpn ipsec site-to-site peer right authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer right authentication remote-id '192.0.2.1'
set vpn ipsec site-to-site peer right connection-type 'initiate'
set vpn ipsec site-to-site peer right default-esp-group 'MyESPGroup'
set vpn ipsec site-to-site peer right ike-group 'MyIKEGroup'
set vpn ipsec site-to-site peer right local-address '192.0.2.2'
set vpn ipsec site-to-site peer right remote-address '192.0.2.1'
set vpn ipsec site-to-site peer right vti bind 'vti1'
```
Side B:
```none
set interfaces ethernet eth0 address '192.0.2.1/30'
set interfaces vti vti1 address '203.0.113.1/24'
set vpn ipsec authentication psk left id '192.0.2.2'
set vpn ipsec authentication psk left id '192.0.2.1'
set vpn ipsec authentication psk left secret 'REPLACE_WITH_RANDOM_SECRET'
set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes256'
set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha256'
set vpn ipsec ike-group MyIKEGroupPassive proposal 1 dh-group '14'
set vpn ipsec ike-group MyIKEGroupPassive proposal 1 encryption 'aes256'
set vpn ipsec ike-group MyIKEGroupPassive proposal 1 hash 'sha256'
set vpn ipsec interface 'eth0'
set vpn ipsec options disable-route-autoinstall
set vpn ipsec site-to-site peer left authentication local-id '192.0.2.1'
set vpn ipsec site-to-site peer left authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer left authentication remote-id '192.0.2.2'
set vpn ipsec site-to-site peer left connection-type 'trap'
set vpn ipsec site-to-site peer left default-esp-group 'MyESPGroup'
set vpn ipsec site-to-site peer left ike-group 'MyIKEGroupPassive'
set vpn ipsec site-to-site peer left local-address '192.0.2.1'
set vpn ipsec site-to-site peer left remote-address '192.0.2.2'
set vpn ipsec site-to-site peer left vti bind 'vti1'
```
Router A initiates the tunnel and re-establishes it after the
acceleration commit restarts the IPsec service. Router B uses `trap`,
raising the tunnel on matching traffic. Dead peer detection on Router
A attempts to renegotiate if Router B stops responding. Both routers
disable automatic route installation, because routing is managed
through the `vti1` interface.
Without acceleration, a bandwidth test between the tunnel addresses
(`203.0.113.1` to `203.0.113.2`) shows the following results:
```none
Connecting to host 203.0.113.2, port 5201
[ 9] local 203.0.113.1 port 51344 connected to 203.0.113.2 port 5201
[ ID] Interval Transfer Bitrate Retr Cwnd
[ 9] 0.00-1.01 sec 32.3 MBytes 268 Mbits/sec 0 196 KBytes
[ 9] 1.01-2.03 sec 32.5 MBytes 268 Mbits/sec 0 208 KBytes
[ 9] 2.03-3.03 sec 32.5 MBytes 271 Mbits/sec 0 208 KBytes
[ 9] 3.03-4.04 sec 32.5 MBytes 272 Mbits/sec 0 208 KBytes
[ 9] 4.04-5.00 sec 31.2 MBytes 272 Mbits/sec 0 208 KBytes
[ 9] 5.00-6.01 sec 32.5 MBytes 272 Mbits/sec 0 234 KBytes
[ 9] 6.01-7.04 sec 32.5 MBytes 265 Mbits/sec 0 234 KBytes
[ 9] 7.04-8.04 sec 32.5 MBytes 272 Mbits/sec 0 234 KBytes
[ 9] 8.04-9.04 sec 32.5 MBytes 273 Mbits/sec 0 336 KBytes
[ 9] 9.04-10.00 sec 31.2 MBytes 272 Mbits/sec 0 336 KBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bitrate Retr
[ 9] 0.00-10.00 sec 322 MBytes 270 Mbits/sec 0 sender
[ 9] 0.00-10.00 sec 322 MBytes 270 Mbits/sec receiver
```
With `set system acceleration qat` committed on both routers, the same
test shows higher bandwidth:
```none
Connecting to host 203.0.113.2, port 5201
[ 9] local 203.0.113.1 port 51340 connected to 203.0.113.2 port 5201
[ ID] Interval Transfer Bitrate Retr Cwnd
[ 9] 0.00-1.00 sec 97.3 MBytes 817 Mbits/sec 0 1000 KBytes
[ 9] 1.00-2.00 sec 92.5 MBytes 776 Mbits/sec 0 1.07 MBytes
[ 9] 2.00-3.00 sec 92.5 MBytes 776 Mbits/sec 0 820 KBytes
[ 9] 3.00-4.00 sec 92.5 MBytes 776 Mbits/sec 0 899 KBytes
[ 9] 4.00-5.00 sec 91.2 MBytes 765 Mbits/sec 0 972 KBytes
[ 9] 5.00-6.00 sec 92.5 MBytes 776 Mbits/sec 0 1.02 MBytes
[ 9] 6.00-7.00 sec 92.5 MBytes 776 Mbits/sec 0 1.08 MBytes
[ 9] 7.00-8.00 sec 92.5 MBytes 776 Mbits/sec 0 1.14 MBytes
[ 9] 8.00-9.00 sec 91.2 MBytes 765 Mbits/sec 0 915 KBytes
[ 9] 9.00-10.00 sec 92.5 MBytes 776 Mbits/sec 0 1000 KBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bitrate Retr
[ 9] 0.00-10.00 sec 927 MBytes 778 Mbits/sec 0 sender
[ 9] 0.00-10.01 sec 925 MBytes 775 Mbits/sec receiver
```
|
