IPsec flow offload

IPsec flow offload is a performance optimization feature that

  • offloads IPsec connections to field-programmable gate array (FPGA) or specialized hardware components after initial setup

  • improves device performance by handling pre-decryption, decryption, pre-encryption, and encryption processing in hardware, and

  • is enabled by default on supporting device models while allowing system software to handle inner flow security policies.

IPsec flow offload characteristics

After the initial setup of an IPsec site-to-site VPN or remote access VPN security association (SA), IPsec connections are offloaded to the field-programmable gate array (FPGA) in the device. This process improves device performance.In the Secure Firewall 1200 series, IPsec connections are offloaded to the Marvell Cryptographic Accelerator (CPT) to improve device performance.In the Secure Firewall 6100 series, IPsec connections are offloaded to the Kintex 7 (KC400) FPGA. This FPGA contains a built-in crypto engine that is capable of handling AES-GCM-128 and AES-GCM-256 encryption and decryption.

Offloaded operations include pre-decryption and decryption processing on ingress and egress. The system software applies your security policies for traffic within the inner flow.

IPsec flow offload applies to these device types:

  • Secure Firewall 1200

  • Secure Firewall 3100

  • Secure Firewall 4200

  • Secure Firewall 6100

IPsec flow offload is also used when the device's VTI loopback interface is enabled.

For asymmetric flows in cluster distributed site-to-site VPN mode, IPsec flow offload lets the flow owner decrypt IPsec traffic in hardware that was forwarded over the cluster control link. This feature is not configurable and is always available with IPsec flow offload.

By default, the system enables IPsec flow offload on supported device models. To change the configuration, use FlexConfig to implement the flow-offload-ipsec command. For more information, refer to the ASA command reference.