OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • English Forums »
  • Hardware and Performance »
  • pfSense will support Intel Quickassist, what about OPNsense?
« previous next »
  • Print
Pages: [1] 2

Author Topic: pfSense will support Intel Quickassist, what about OPNsense?  (Read 6987 times)

cwegh

  • Newbie
  • *
  • Posts: 10
  • Karma: 0
    • View Profile
pfSense will support Intel Quickassist, what about OPNsense?
« on: March 23, 2021, 09:42:38 am »
Hi all

pfSense and OPNsense supports CPUs that have AES-NI as an on-die cryptographic accelerators. On ARM-based systems, the additional load from AES operations will be offloaded to those on-die cryptographic accelerators, such as the one found on our SG-1000. ARM v8 CPUs include instructions like AES-NI that can be used to increase performance of the AES algorithm on these platforms. Information from pfSense: https://www.netgate.com/blog/more-on-aes-ni.html

Besides AES-NI some CPUs, such as the Atom C3xx series, also have Intel QuickAssist as an extra offloading chip for encryption (and compression but not relevant in this context) --> https://www.servethehome.com/intel-quickassist-technology-and-openssl-setup-insights-and-initial-benchmarks/ and https://www.servethehome.com/intel-quickassist-at-40gbe-speeds-ipsec-vpn-testing/


Question: I was wondering if the OPNsense team has any plans that this also will become available in OPNsense? I am unable to find concrete information on this (so not assumptions or rumors).


Somewhere the coming year I will upgrade to 1 gigabit internet. I am also setting up my network with an always-on VPN, routing all internet traffic through an OpenVPN tunnel. I have a firewall appliance with a C3558 board so I can leverage QuickAssist in the future.


Having QuickAssist available to avoid too much load on the CPU will become a requirement at a certain point (AES-NI is sufficient for now). Of course I can still use the CPU but that will stress the hardware and will impact longevity but also more power usage.

More background information:

The QAT driver is available in FreeBSD --> https://www.freebsd.org/cgi/man.cgi?query=qat&apropos=0&sektion=0&manpath=FreeBSD+13.0-current&arch=default&format=html

pfSense Plus also supports this from version 21.02: Support for Intel® QuickAssist Technology, also known as QAT.

  • QAT accelerates cryptographic and hashing operations on supported hardware, and can be used to accelerate IPsec, OpenVPN, and other OpenCrypto Framework-aware software.
  • Supported hardware includes many C3000 and C2000 systems sold by Netgate and some other types of built-in QAT support and add-on cards.
pfSense will also make this available in pfSense CE somewhere this year on 3rd party hardware.





« Last Edit: March 23, 2021, 09:44:09 am by cwegh »
Logged

pmhausen

  • Hero Member
  • *****
  • Posts: 2505
  • Karma: 225
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #1 on: March 23, 2021, 10:47:27 am »
Quote
HISTORY
     The qat driver first appeared in FreeBSD 13.0.

Which implies as soon as OPNsense upgrades to Free/HardenedBSD 13, the support will be there. If not in the UI, you can always set a tunable to load the driver as described in the manpage.
« Last Edit: March 23, 2021, 02:27:30 pm by pmhausen »
Logged
Supermicro A2SDi-4C-HLN4F mainboard and SC101F chassis
16 GB ECC memory
Crucial MX300 275 GB SATA 2.5" plus
Crucial MX300 275 GB SATA M.2 (ZFS mirror)
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

cwegh

  • Newbie
  • *
  • Posts: 10
  • Karma: 0
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #2 on: March 23, 2021, 01:32:11 pm »
Thanks, that is good intel. Looking to the roadmap (https://opnsense.org/about/road-map/), this would be not earlier than the January 2022 release?
Logged

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13624
  • Karma: 1173
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #3 on: March 23, 2021, 08:10:38 pm »
Yes, current plan is 22.1.


Cheers,
Franco
Logged

jbattermann

  • Newbie
  • *
  • Posts: 18
  • Karma: 2
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #4 on: August 20, 2021, 03:28:10 pm »
Raising my hand here as well - QAT support in OPNSense would be very nice indeed. No pressure or anything, but just to indicate that there's at least one additional user that might appreciate it once >= 22.1 comes around.
Logged

skyjam

  • Newbie
  • *
  • Posts: 23
  • Karma: 0
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #5 on: February 21, 2022, 11:46:34 pm »
Quote from: franco on March 23, 2021, 08:10:38 pm
Yes, current plan is 22.1.
@franco: any update, now that 22.1 is out?
Logged

skyjam

  • Newbie
  • *
  • Posts: 23
  • Karma: 0
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #6 on: February 22, 2022, 12:15:12 am »
OPNsense 22.1.1_3-amd64

According to https://www.freebsd.org/cgi/man.cgi?query=qat I added the loader.conf data to tunables.

I have a Sophos SG 125 Rev.3, powered by Intel Atom C3508.
So I added
  • qat_load => YES
  • qat_c3xxxfw_load => YES

After a reboot, dmesg gives me:
Code: [Select]
qat0: <Intel C3000 QuickAssist PF> mem 0xdd240000-0xdd27ffff,0xdd200000-0xdd23ffff irq 18 at device 0.0 on pci1
Does it work? No Idea... I can tell my IPSEC tunnel is working...
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6289
  • Karma: 432
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #7 on: February 22, 2022, 06:46:47 am »
There is some work to be done

https://github.com/opnsense/core/issues/5559
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13624
  • Karma: 1173
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #8 on: February 22, 2022, 07:53:57 am »
It's really just "kldload" and that's it. As for:

> Does it work? No Idea... I can tell my IPSEC tunnel is working...

It's AESNI all over again. ;)


Cheers,
Franco
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6289
  • Karma: 432
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #9 on: February 22, 2022, 08:27:30 am »
Oh cool, so the issue is just for labeling and boot loading? :)
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13624
  • Karma: 1173
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #10 on: February 22, 2022, 09:18:59 am »
It's done.

https://github.com/opnsense/core/commit/db686a85
https://github.com/opnsense/core/commit/dd4512aa


Cheers,
Franco
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6289
  • Karma: 432
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #11 on: February 22, 2022, 05:46:52 pm »
Thx! And you removed AES-NI because systems with AES-NI-only without QAT will use it anyway?
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13624
  • Karma: 1173
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #12 on: February 22, 2022, 08:39:50 pm »
AESNI is now part of the FreeBSD GENERIC kernel. No use to load the module, see

https://cgit.freebsd.org/src/commit/?id=074a91f746bd


Cheers,
Franco
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6289
  • Karma: 432
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #13 on: February 23, 2022, 07:06:30 am »
I thought I follow the development close enough :) Thx
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

zz00mm

  • Newbie
  • *
  • Posts: 24
  • Karma: 2
    • View Profile
Re: pfSense will support Intel Quickassist, what about OPNsense?
« Reply #14 on: March 02, 2022, 02:23:45 am »
Atom C3758 QAT support
OPNsense 2.1.2 shows the following:

kldstat -v | grep qat
20    1 0xffffffff82904000    16308 qat.ko (/boot/kernel/qat.ko)
                541 pci/qat
21    1 0xffffffff8291b000    a13f8 qat_c3xxxfw.ko (/boot/kernel/qat_c3xxxfw.ko)
                542 qat_c3xxxfw_fw

dmesg | grep qat
qat0: <Intel C3000 QuickAssist PF> mem 0xdf340000-0xdf37ffff,0xdf300000-0xdf33ffff at device 0.0 on pci1


So it see's it, it has been selected under System -> Settings -> Misc -> Hardware acceleration.

As Franco said earlier, Does it work? No Idea... I can tell my IPSEC tunnel is working...


 the openVPN client connections to ProtonVPN are up and working.
Logged

  • Print
Pages: [1] 2
« previous next »
  • OPNsense Forum »
  • English Forums »
  • Hardware and Performance »
  • pfSense will support Intel Quickassist, what about OPNsense?
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2