fortigate-ipsec-40-mr3

Overview Hardware offloading and acceleration
In Phase II configuration:
encryption algorithm must be DES, 3DES, AES-128, AES-192, AES-256, or null
(for NP1 processor, only 3DES is supported)
authentication must be MD5, SHA1, or null
(for NP1 processor, only MD5 is supported)
if replay detection is enabled, encryption and decryption options must be enabled
in the CLI (see “IPsec encryption offloading”, below)
If the IPsec session meets the above requirements, the FortiGate unit sends the IPsec
security association (SA) and configured processing actions to the network
processors.
Packet offloading requirements
In addition to the session requirements, the packets themselves must meet fast-path
requirements:
Incoming packets must not be fragmented.
Outgoing packets must be 385 bytes or larger after any fragmentation. This means the
configured MTU (Maximum Transmission Unit) for the network processors’ interfaces
must have an MTU of 385 bytes or larger.
If packet offloading requirements are not met, an individual packet will use the FortiGate
unit main processing resources, regardless of whether other packets in the session are
offloaded to the specialized network processors.
IPsec encryption offloading
Network processing unit (NPU) settings configure offloading behavior for IPsec VPNs.
Configured behavior applies to all network processors contained by the FortiGate unit
itself or any installed AMC modules.
If replay detection is not enabled (IPsec Phase 2 settings), encryption is always offloaded.
To enable offloading of encryption even when replay detection is enabled
config system npu
set enc-offload-antireplay enable
end
To enable offloading of decryption even when replay detection is enabled
config system npu
set dec-offload-antireplay enable
end
HMAC check offloading
The Hash-based Message Authentication Code (HMAC) check can also be offloaded to
hardware. SHA-256, SHA-384, or SHA-512 cannot be off-loaded to hardware, and must
be processed using only software resources.
To enable HMAC check offloading
configure system global
set ipsec-hmac-offload (enable|disable)
end
IPsec VPNs for FortiOS 4.0 MR3
230 01-434-112804-20120111
http://docs.fortinet.com/