<![CDATA[IPsec-MB use case]]>Im running a SG-6100.

Im confused if this should be enabled at all considering this one-liner in the documentation

Generally speaking, this acceleration is faster than software alone or AES-NI, but slower than QAT.

Because i care about throughput mainly when it comes to my VPN should i enable this? QAT is running on my system by default.

]]>https://forum.netgate.com/topic/180541/ipsec-mb-use-caseRSS for NodeMon, 13 Jul 2026 08:58:40 GMTThu, 01 Jun 2023 17:54:29 GMT60<![CDATA[Reply to IPsec-MB use case on Thu, 08 Jun 2023 13:24:50 GMT]]>@stephenw10 said in IPsec-MB use case:

Currently there is only a user ctl for AES-CBC.

Thanks stephenw10. 👍
Hope they add this option in the future.

]]>https://forum.netgate.com/post/1109555https://forum.netgate.com/post/1109555Thu, 08 Jun 2023 13:24:50 GMT<![CDATA[Reply to IPsec-MB use case on Thu, 08 Jun 2023 13:19:20 GMT]]>Currently there is only a user ctl for AES-CBC.

]]>https://forum.netgate.com/post/1109551https://forum.netgate.com/post/1109551Thu, 08 Jun 2023 13:19:20 GMT<![CDATA[Reply to IPsec-MB use case on Thu, 08 Jun 2023 12:27:02 GMT]]>@stephenw10 said in IPsec-MB use case:

disable to prevent IIMB registering for AES-CBC (kern.crypto.iimb.enable_aescbc)

That would be nice indeed. Do you know if this is possible with AES-GCM too ?

]]>https://forum.netgate.com/post/1109533https://forum.netgate.com/post/1109533Thu, 08 Jun 2023 12:27:02 GMT<![CDATA[Reply to IPsec-MB use case on Thu, 08 Jun 2023 12:20:41 GMT]]>Yes, that is the case currently.
However there is a sysctl you can disable to prevent IIMB registering for AES-CBC (kern.crypto.iimb.enable_aescbc). It would be nice to have other options there. 😉

]]>https://forum.netgate.com/post/1109532https://forum.netgate.com/post/1109532Thu, 08 Jun 2023 12:20:41 GMT<![CDATA[Reply to IPsec-MB use case on Thu, 08 Jun 2023 04:04:34 GMT]]>@cwagz from this page: IPsec-MB

If IPsec-MB and QAT are both enabled, IPsec-MB will take over handling of AES-GCM acceleration. QAT accelerates AES-GCM faster than IPsec-MB, but IPsec-MB can accelerate ChaCha20-Poly1305 which is not supported by QAT. Depending on the required performance of each algorithm it may be better to only enable QAT, or to enable both, but it depends on the environment and workload.

]]>https://forum.netgate.com/post/1109486https://forum.netgate.com/post/1109486Thu, 08 Jun 2023 04:04:34 GMT<![CDATA[Reply to IPsec-MB use case on Sat, 03 Jun 2023 20:10:54 GMT]]>I would disable IIMB to be sure it's using QAT which will be faster for AES-GCM.

I'm unsure exactly what would take priority there. I'll try to find out....

]]>https://forum.netgate.com/post/1108667https://forum.netgate.com/post/1108667Sat, 03 Jun 2023 20:10:54 GMT<![CDATA[Reply to IPsec-MB use case on Sat, 03 Jun 2023 15:29:21 GMT]]>@stephenw10 I have both QAT and IPsec-MB enabled on my 6100. Does the system choose the best one based on other settings or would it be better to just disable IPsec-MB. My VPN is using AES-GCM.

]]>https://forum.netgate.com/post/1108633https://forum.netgate.com/post/1108633Sat, 03 Jun 2023 15:29:21 GMT<![CDATA[Reply to IPsec-MB use case on Thu, 01 Jun 2023 18:27:55 GMT]]>If you're using AES-GCM stick with QAT on the 6100.

Steve

]]>https://forum.netgate.com/post/1108318https://forum.netgate.com/post/1108318Thu, 01 Jun 2023 18:27:55 GMT