Large flow offloads

A large flow offload is a hardware-based traffic processing feature that

  • handles certain fastpathed traffic in the NIC hardware rather than in the Firewall Threat Defense software

  • results in higher throughput and lower latency for data-intensive applications such as large file transfers, and

  • includes both static flow offload (based on prefilter policy configuration) and dynamic flow offload (based on trust and other criteria).

Supported models and offload types

For the following models, certain traffic that you configure to be fastpathed by a prefilter policy is handled by the hardware (specifically, in the NIC), not by the Firewall Threat Defense software:

  • Firepower 4100/9300

  • Secure Firewall 3100 (static only)

  • Secure Firewall 4200 (static only)

  • Secure Firewall 6100

Offloaded flows continue to receive limited stateful inspection, such as basic TCP flag and option checking. The system can selectively escalate packets to the firewall system for further processing if necessary.

Two types of flow offload are available:

  • Static flow offload: Offloads flows based on prefilter policy configuration that applies the Fastpath action.

  • Dynamic flow offload: By default, devices offload flows based on other criteria, including trust.

Applications that can benefit from offloading large flows include:

  • High Performance Computing (HPC) Research sites, where the firewall is deployed between storage and high compute stations. When one research site backs up using FTP file transfer or file sync over NFS, the large amount of data traffic affects all connections. Offloading FTP file transfer and file sync over NFS reduces the impact on other traffic.

  • High Frequency Trading (HFT), where the firewall is deployed between workstations and the Exchange, mainly for compliance purposes. Security is usually not a concern, but latency is a major concern.

Flows that can be offloaded include:

  • (Static flow offload only.) Connections that are fastpathed by the prefilter policy.

  • Standard or 802.1Q tagged Ethernet frames only.

  • Cluster asymmetric flows (Secure Firewall 4200). For asymmetric flows, cluster redirect lets the forwarding node offload flows to hardware. When traffic for an existing flow is sent to a different node, then that traffic is redirected to the owner node over the cluster control link. Because asymmetric flows can create a lot of traffic on the cluster control link, letting the forwarder offload these flows can improve performance.

  • (Dynamic flow offload only):

    • Inspected flows that the inspection engine decides no longer need inspection. These flows include:

      • Flows handled by access control rules that apply the Trust action and are based on security zone, source and destination network and port matching only.

      • TLS/SSL flows that are not selected for decryption using a decryption policy.

      • Flows that are trusted by the Intelligent Application Bypass (IAB) policy either explicitly or due to exceeding flow bypass thresholds.

      • Flows that match file or intrusion policies that result in trusting the flow.

      • Any allowed flow that no longer needs to be inspected.

    • IPS preprocessor inspected flows:

      • SSH and SMTP.

      • FTP preprocessor secondary connections.

      • Session Initiation Protocol (SIP) preprocessor secondary connections.

    • Intrusion rules that use keywords (also referred to as options)

Important

For details, exceptions, and limitations to the above, see Restrictions for flow offload implementation.

Static flow offload configuration

To offload eligible traffic to hardware, create a prefilter policy rule that applies the Fastpath action. Use prefilter rules for TCP/UDP, and tunnel rules for GRE.

(Not recommended.) To disable flow offload, use FlexConfig:

  • Disable static (and thereby dynamic) flow offload: no flow-offload enable

  • Re-enable flow offload: flow-offload enable

  • Disable cluster redirection: no flow-offload cluster-redirect

For more information, see Cisco Secure Firewall ASA Series Command Reference.

Dynamic flow offload configuration

Dynamic flow offload is enabled by default. However, dynamic offload occurs only if static flow offload is enabled, regardless of whether prefiltering is configured.

To disable dynamic flow offload, use the device CLI:

  • Disable dynamic offload: configure flow-offload dynamic whitelist disable

  • Re-enable dynamic offload: configure flow-offload dynamic whitelist enable