crypto engine large-mod-accel

giuseppe parlato — Tue, 12 Mar 2019 04:26:55 GMT

Hello

Cisco advice to enable crypto engine large-mod-accel to switch large modulus operations from software to hardware to improve performance and decrease CPU. Is that true even if on my firewall there are no vpn neither ipsec or ssl ? I can't understand why with the show crypto accelerator statistics I see a large amount of outbound bytes [Global Statistics] and outbound SSL records [SSL statistics] which is not justified by any vpn. That command should have a performance impact on SSL throughput, but it is meant to be only SSL vpn throughput ?

fw-01# sh crypto accelerator statistics

Crypto Accelerator Status
-------------------------
[Capability]
   Supports hardware crypto: True
   Supports modular hardware crypto: False
   Max accelerators: 1
   Max crypto throughput: 425 Mbps
   Max crypto connections: 5000
[Global Statistics]
   Number of active accelerators: 1
   Number of non-operational accelerators: 0
   Input packets: 129907
   Input bytes: 38343325
   Output packets: 928819708
   Output error packets: 0
   Output bytes: 152511327920

[Accelerator 0]
   Status: OK
   Software crypto engine
   Slot: 0
   Active time: 4062458 seconds
   Total crypto transforms: 18085063
   Total dropped packets: 0
   [Input statistics]
      Input packets: 0
      Input bytes: 10492944
      Input hashed packets: 0
      Input hashed bytes: 0
      Decrypted packets: 0
      Decrypted bytes: 10492944
   [Output statistics]
      Output packets: 0
      Output bad packets: 0
      Output bytes: 196506368
      Output hashed packets: 0
      Output hashed bytes: 0
      Encrypted packets: 0
      Encrypted bytes: 196506592
   [Diffie-Hellman statistics]
      Keys generated: 0
      Secret keys derived: 0
   [RSA statistics]
      Keys generated: 4
      Signatures: 5982
      Verifications: 1
      Encrypted packets: 3
      Encrypted bytes: 91
      Decrypted packets: 3
      Decrypted bytes: 768
   [ECDSA statistics]
      Keys generated: 12
      Signatures: 12
      Verifications: 15
   [SSL statistics]
      Outbound records: 0
      Inbound records: 0
   [RNG statistics]
      Random number requests: 84
      Random number request failures: 0
   [HMAC statistics]
      HMAC requests: 4974791

[Accelerator 1]
   Status: OK
   Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x0)
                             Boot microcode        : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2_05
                             IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.08
   Slot: 1
   Active time: 4062462 seconds
   Total crypto transforms: 929724996
   Total dropped packets: 0
   [Input statistics]
      Input packets: 129907
      Input bytes: 55682250
      Input hashed packets: 0
      Input hashed bytes: 0
      Decrypted packets: 129907
      Decrypted bytes: 27850381
   [Output statistics]
      Output packets: 928819708
      Output bad packets: 0
      Output bytes: 304629626512
      Output hashed packets: 0
      Output hashed bytes: 0
      Encrypted packets: 928819708
      Encrypted bytes: 152314822512
   [Diffie-Hellman statistics]
      Keys generated: 6045
      Secret keys derived: 5981
   [RSA statistics]
      Keys generated: 0
      Signatures: 1
      Verifications: 1
      Encrypted packets: 0
      Encrypted bytes: 0
      Decrypted packets: 0
      Decrypted bytes: 0
   [ECDSA statistics]
      Keys generated: 0
      Signatures: 0
      Verifications: 0
   [SSL statistics]
      Outbound records: 928819708
      Inbound records: 129907
   [RNG statistics]
      Random number requests: 760796
      Random number request failures: 0
   [HMAC statistics]
      HMAC requests: 5

topic crypto engine large-mod-accel in Network Security

crypto engine large-mod-accel