What are the performance advantages of the ESP-NULL transform-set in IPSec

[SecureFirewall SecureFirewall]

What are the advantages of using a ESP-NULL transform-set in the Cisco ASA. From my understanding the transform-set parameters are only used during phase1 negotiation. The packets are still encrypted according to the phase2 SA (crypto isakmp policy XXX) and thus you still incur a lot of the overhead when actually transfering data. The only thing I can see ESP-NULL speeding up is the phase1 negotiation but not actually throughput in terms of Mbps.

Am i correct or am I misunderstanding transform-set vs isakmp policy

[Karsten Iwen]

Just look at what the RFC says about it:

NULL is a block cipher the origins of which appear to be lost in
   antiquity.  Despite rumors that the National Security Agency
   suppressed publication of this algorithm, there is no evidence of
   such action on their part. Rather, recent archaeological evidence
   suggests that the NULL algorithm was developed in Roman times, as an
   exportable alternative to Ceaser ciphers. However, because Roman
   numerals lack a symbol for zero, written records of the algorithm's
   development were lost to historians for over two millennia.

Ooops, wrong paragraph, this is the relevant part:

The NULL encryption algorithm is a convenient way to represent the option of
   not applying encryption.

Today, where VPNs are always encrypted regardless of the data, NULL has only a meaning for learning IPsec which gives you the option to look at the data in Wireshark.

BTW: You are mixing up the phases of IPsec. "crypto isakmp ..." defines the parameters for Phase 1, Transform-sets what should be used in Phase 2 to setup the Ipsec SAs.

[SecureFirewall SecureFirewall]

Haha thanks for the RFC.  Also thanks for clearing up phase1 vs phase2.

With that being said, is NULL an option if I do not want encryption but simply tunneling?  For example it is the same traffic I would be comfortable sending over GRE but prefer or am forced to use IPSec.  I assume NULL will drastically speed things up.

[Karsten Iwen]

All ASAs have hardware-acceleration for VPNs. I wouldn't expect too much performance-gain but never measured it. And yes, if you just need tunneling without encryption, ESP-NULL is an option.