SG-1100 Crypto Hardware
-
I do want to share what I think might be useful information, though, so as not to wave off.
Well, you certainly did just that. Thanks for the detailed info.
To anyone that comes here for the topic title:
With specific regard to when crypto offload for the SG-1100 might arrive, I have it from our CTO that we still don’t have an exact date. It’s possible it could be added to an early 2020 release. Two paths have been investigated. The first is a HW crypto function which uses intellectual property licensed from SafeXcel on the Marvell Armada 3720 SoC. The second is based on A53 ARMv8 cores supporting instructions analogous to the “AES-NI” instructions found on Intel and AMD CPUs. Our early efforts were to write a driver for the SafeXcel HW offload. While a Linux driver exists, we can’t use it (due to GPL issues). Further, no similar driver exists for any of FreeBSD, OpenBSD, or NetBSD. We’ve called upon two experienced outside consultants to implement such a driver (and tie it into cryptodev). Yet, it just isn’t ready for production use. So, we’ve turned our focus back to the AES instructions implemented for the ARMv8 instruction set. With luck, that could make it into a release early next year.
-
@dennis_s Its my fault because I assumed any device sold by netgate would support hardware encryption NOW after all the fuss netgate and pfsense made about hardware crypto being a requirement for pfsense devices in the future. Rest assured, its the last piece of pfsense hardware I will buy that isn't supported right away. I can see a possible scenario where netgate doesn't get it working and abandons the platform altogether for future releases of pfsense because its too much work to be bothered with as compared to just starting to sell atom devices the same size. I really do hope it comes out, but I'm not gullible enough to expect it at this point. What I do expect sometime not too far down the line is to read that, for some technical... Long and drawn out reason.... That Pfsense has decided to abandon the device and that I should buy a new device for continued service... At which point netgate will have sold their last device to me or anyone I can influence. So, I hope things go as you say, but I wasn't born yesterday, so I no longer expect it.
-
@kejianshi We learned from the early announcement that 2.5 would require AES-NI. As with everything, plans could change and with regards to the RESTCONF API it was no longer being planned for 2.5, therefore, AES-NI would not need to be required. There are no plans to abandon the SG-1100 and as I stated before, we’ve turned our focus back to the AES instructions implemented for the ARMv8 instruction set for the SG-1100 and hopefully, it makes it into a release early next year.
With that being said, if AES-NI is a requirement for you or your business all of our other appliances do support AES-NI.
-
@dennis_s
Thank you for the candid response. That level of detail was exactly what was needed. As for my feelings, I won't reiterate specifics but I have had a few run-ins with Netgate previously, I have a colleague that had a real big run-in that became quite sour and I have noticed on more than 1 occasion where an answer over pricing was a bit more than just terse and short. This lead me to use some experience driven speculation.But in an environment light on facts, speculations reigns supreme.
The SG1100 doesn't appeal to me because it doesn't do well in 300MB/s pluss environments at least real world performance with my configs. Which is fine, the 3100 works perfectly up to a gig and it is priced low enough for me to purchase in bulk and replace the Watch guards and SonicWalls I used to purchase.
However there are people with lower budgets and higher expectations that would disagree with my statements. I am sure once hardware crypto is enabled a lot will still complain that it's not as big of an improvement as they hoped.
Maybe a 1500 or 1600 version between the 1100 and 3100 would bridge that gap.
Personally I don't care, I just want a wall mount and rack mount for the 3100. Or a wall mount and a rack mount version that is under $600 that can maybe do >150mbps on vpns.
-
@dennis_s
Are there any news on this? -
@maltehillmann
Netgate ended up releasing the SG-2100 which has the same processor and pfSense 2.5 is rounding 3rd base to completion. 2.5 should be out in February (or March), just in time for the SG-2100's to be in-stock and shipping. If 2.5 doesn't include AES-NI for the SG-1100 then I would tell you that chances are it never will.But to be brutally honest, compared to Sonicwall's SOHO-250 at $234, Watchguard T15 (with 1 year support) at $278 and the Sophos XG 86 at $478, the SG-1100 is the cheapest on the block. I have seen Best Buy Linksys pieces of e-waste at higher prices than an SG-1100.
Now, the SG-2100 I haven't personally used. I liked the SG-3100's but I have started buying the SG-5100's because the SG-3100 still doesn't come with a wall mount and it is black metal. The white shows dirty fingerprints. It is annoying.
-
@phlmike I note that the SG-2100 lists higher performance despite same processor. A potential clue that they've added the hardware acceleration?
-
@phlmike AES-NI is an x86 instruction set so you will never see it on ARM product.
-
@ahking19 Netgate claimed when they released the SG-1100 that they would add in the hardware crypto acceleration. The chip they are using has some form of acceleration, but I do not know if it is 100% identical to x86 AES-NI. Clearly not, as it doesn't work out of the box. The issue at hand for most people that purchased the SG-1100 was that it was promised and thus far has been just that. However those references seem to have been removed from the marketing material.
@scurrier From looking at both products it is not the 100% same CPU. The SG-100 has a Marvell Armada 3720LP and the SG-2100 has the Non-LP variant which I am assuming means Low Power. So educated guess would be higher cooling capacity allows more power and thus performance. The SG-2100 also has NEON SIMD and FPU. More than likely the SG-2100 will support hardware crypto acceleration and use those extra instructions for it.
@maltehillmann I just went through the material again for the SG-1100. All reference to hardware crypto acceleration has been removed from what I can see. I think it proved too hard to do with too many roadblocks for what would be only nominal performance gains on that unit. I think HCA is dead on the SG-1100.
The Abstract on NEON: "NEON is a vector instruction set included in a large fraction of new ARM-based tablets and smartphones. ...NEON supports high-security cryptography at surprisingly high speeds"
My intuition or RPIA (random person on internet's assumption) is that the base Marvell Armada proved to be too much of a challenge to get HCA working so NG created the SG-2100 with the NEON to have it on that platform and abandoning the SG-1100.
-
A lot of the performance improvements for the SG-2100 are due to the fact it has two NICs.
mvneta(4) uses a single queue which means two NICs can use both CPU cores more efficiently.It also has far more RAM which helps a lot, especially if you're running any packages.
An early version of the SafeXcel driver was included in 2.4.5 but mostly just for testing at that point. You can enable it but it only supports AES-128-CBC and doesn't accelerate much.
The current version is much better.Steve
-
I went back and found an email I wrote my team from September and I am pretty sure the two products' pages showed the same CPU. If it's different that is a good thing. Also the 2100 has a separate WAN port whereas the 1100 has all ports on the same switch.
Another thread: https://forum.netgate.com/topic/151296/update-sg-1100-crypto-hardware/8
Also Netgate had said 2.5 would "require" AES-NI, which they backed away from. I'm assuming if they're going to launch the 2100 they won't be making it obsolete and un-upgradeable in the near future.
-
@stephenw10 said in SG-1100 Crypto Hardware:
An early version of the SafeXcel driver was included in 2.4.5 but mostly just for testing at that point. You can enable it but it only supports AES-128-CBC and doesn't accelerate much.
The current version is much better.Will that updated driver be included in pfSense 2.5.0?
The linked FreeBSD manual page says that "the safexcel driver first appeared in FreeBSD 13.0."
-
Since I've had an SG-3100, I've been using HCA in the SG-1100 with AES_CBS128 for about 6 months.
No crash, no problems, just works.
50 Mbit / s corresponds to a CPU utilization of approx. 40%.I think the SG-1100 and SG-2100 deliver roughly the same speed with the HCA on.
-
@rdsmith24 in the latest version of pfSense + 21.02-RELEASE (arm64) going to [System][Advanced][miscellaneous][Cryptographic & Thermal Hardware][Cryptographic Hardware] you can enable "SafeXcel". Your CPU Type at the [Status][Dashboard] will show:
ARM Cortex-A53 r0p42 CPUs:
CPU 0: ARM Cortex-A53 r0p4 affinity: 0
CPU 1: ARM Cortex-A53 r0p4 affinity: 1
Crypto: (SafeXcel active) -
correct, I also ticked that box after upgrading to 21.02 and rebooted.
After that one of my three IPSEC-tunnels did come up but didn't transport data = no ping, nothing, although the IPSEC SA was up etcDisabling that hw crypto (+ reboot) made it work again.
-
@sgw please work with Netgate TAC to resolve your issue or report a bug.
-
So.. what is the performance improvement with SafeXcel active?
Im running 2 OpenVPN tunnels on SG-1100..
Data Ciphers: AES-256-GCM, AES-128-GCM, AES-256-CBC
Digest: SHA1Data Ciphers: AES-128-GCM, AES-256-GCM
Digest: SHA384 -
@taz79 Does it do anything for OpenVPN? Anything I've read has been to do with improved IPsec performance.
-
@taz79 I tend to complain a lot if I PAY for something thats not working right which is why I was disappointed that my hardware crypto was not working on the pfsense when I got it over a year ago. But the latest update to 2.5 enabled crypto. I went into openvpn config and turned it on for 2 tunnels. I also installed wireguard on a couple of phones and routed all network traffic from the phones through the pfsense. It's very nice and persistent and doesn't quit even when the phones reboot. This update was a big improvement. My tunnels are spread across the world all 1000s of miles from each other so it would not be fair for me to talk about speed since my vpn speed is mostly limited by latency... Long fat pipe syndrome. But even at 8000 miles, I get about 50 / 50 up and down through the VPN and thats a pretty good improvement. Wireguard is even faster and more reliable. Finger poking settings into both the pfsense and the phone or computer means that wireguard is still far less convenient than openvpn but I'm hoping there will be a QR code package for pfsense wireguard soon to make it simple.
-
@kejianshi Maybe a good oportunity for me to setup VPN connection for my phone now then.. To try our WireGuard at the same time :)
