Do I have to activate AES-NI manually in my pfsense firewall?

Elrick75

Good morning, everyone,

I use OpenVPN on pfSense and it works properly.
I just found out that it was possible to set up hardware support for Cryptography.

Currently is set at None, I thought the default setting was on the most optimized value by default to exploit my hardware but that doesn't seem to be the case.

I think I need to change it manually given my hardware configuration?

Should I choose AES-NI Cpu-based acceleration or AES-NI and BSD Crypto Device?

Thank you for your valuable advice.

provels

@Elrick75 Yes.

Elrick75

Yes, but what choice? AES-NI Cpu-based acceleration or AES-NI and BSD Crypto Device?

bcruze

For that intel processor aes-ni

Elrick75

@Elrick75 said in Do I have to activate AES-NI manually in my pfsense firewall?:

AES-NI Cpu-based acceleration

Just to be clear, only AES-NI Cpu-based acceleration, right ?

Elrick75

Thanks.

nirmalts

The documentation seems to be pointing out that it doesnt really matter if it is chosen or not openVPN will automatically detect AES-NI and use it, if available, right?

Nothing needs selected for OpenVPN to utilize AES-NI. The OpenSSL engine has its own code for handling AES-NI that works well without using the BSD Cryptodev Engine.

https://docs.netgate.com/pfsense/en/latest/hardware/cryptographic-accelerator-support.html