Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN and SG-3100 crypto support

    Scheduled Pinned Locked Moved Official Netgate® Hardware
    11 Posts 3 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      NokkieF @NokkieF
      last edited by NokkieF

      https://forum.netgate.com/topic/152195/sg-3100-crypto-config?_=1648899454000 answers the question of it missing on the page, but I am still looking for an answer if it is even working. Because it does not seem to be.

      btw, I based my queries on this document
      https://docs.netgate.com/pfsense/en/latest/hardware/cryptographic-accelerators.html

      1 Reply Last reply Reply Quote 0
      • B
        bigsy @NokkieF
        last edited by bigsy

        @nokkief said in OpenVPN and SG-3100 crypto support:

        I am using AES-256-GCM and SHA512

        Does the CESA crypto support AES-GCM? I thought it was just CBC.

        N 2 Replies Last reply Reply Quote 0
        • N
          NokkieF @bigsy
          last edited by NokkieF

          @bigsy This is very true, I amended this (I had been playing with the cipher suite). Alas the results are still the same for me.

          using:
          Mode: Peer to Peer ( SSL/TLS )
          Data Ciphers: AES-256-CBC
          Digest: SHA512

          1 Reply Last reply Reply Quote 0
          • N
            NokkieF @bigsy
            last edited by NokkieF

            @bigsy Based on the post you referenced, it does not support sha512. Which is sad, because I can not control that part. Guess I am out of luck on this then.

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Yes it only supports AES-CBC and only up to 256bit SHA2. But it can be used for one or both of those.
              However since pfSense 2.5 (21.02+) it only accelerates IPSec. That's because OpenSSL no longer supports the cryptodev engine which is required to use the BSD crypto framework:
              https://www.mail-archive.com/freebsd-stable@freebsd.org/msg136970.html

              N 1 Reply Last reply Reply Quote 0
              • N
                NokkieF @stephenw10
                last edited by

                @stephenw10 Kind of negates the use of the crypto capabilities though, as ipsec only support aes-gcm and not aes-cbc when I try to set it up through the front end. But I guess I should be looking for some newer hardware if I want better openvpn crypto support. Sad, because I like this little machine on it self.

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  IPSec supports AES-CBC. I use that on a 3100 here:

                  Apr 6 19:41:25 	charon 	5290 	12[CFG] <con1|2> selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ
                  Apr 6 19:41:25 	charon 	5290 	12[IKE] <con1|2> CHILD_SA con1{2} established with SPIs c02b6914_i ca2dbfab_o and TS 172.21.16.0/24|/0 === 172.27.0.0/18|/0 172.30.0.0/21|/0 
                  
                  N 1 Reply Last reply Reply Quote 0
                  • N
                    NokkieF @stephenw10
                    last edited by

                    @stephenw10 I only have these options? I must admit I have not used IPSec before though.

                    e79b27f0-f763-4e02-b0ff-e7dc0ad5f6cf-image.png

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by stephenw10

                      'AES' there is aes-cbc.

                      Screenshot from 2022-04-06 19-50-23.png

                      Also the Phase2 is where is counts for speed.

                      N 1 Reply Last reply Reply Quote 1
                      • N
                        NokkieF @stephenw10
                        last edited by

                        @stephenw10 Thanks! I will give it a try then :)

                        1 Reply Last reply Reply Quote 1
                        • M mcury referenced this topic on
                        • M mcury referenced this topic on
                        • M mcury referenced this topic on
                        • M mcury referenced this topic on
                        • M mcury referenced this topic on
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.