EdgeRouter - Hardware Offloading


Overview


This article explains the function, benefits, and implementation of hardware offloading. As of EdgeOS firmware version v1.9.1, all EdgeRouter models support some type of hardware offloading.

NOTES & REQUIREMENTS: 
Applicable to the latest EdgeOS firmware on all EdgeRouter models. Please see the Related Articles below for more information.

Table of Contents


  1. What is Hardware Offloading?
  2. EdgeRouter Features Eligible for Offloading
  3. IPsec Offloading Support
  4. How to Enable/Disable Offloading
  5. Testing & Verification
  6. Related Articles

What is Hardware Offloading?


Back to Top

Offloading is used to execute functions of the router using the hardware directly, instead of a process of software functions. The benefit of offloading in EdgeOS is increased performance and throughput by not depending on the CPU for forwarding decisions.

There are many processes/features that can take advantage of the offloading engine. One of the most basic examples is IPv4 traffic forwarding. Without offloading enabled, IPv4 traffic will be routed via the CPU and will be limited to around 300Mbps on the EdgeRouter Lite (ERLite-3). With offloading enabled, the throughput will be about 950Mbps.


EdgeRouter Features Eligible for Offloading


Back to Top

Some processes currently cannot take advantage of hardware offloading. This can lead to confusion where it is assumed that offloading is disabled. A more accurate statement is that some features are not eligible to be offloaded and will always depend on the CPU. 

There are two platforms that are used by different EdgeRouter models. Each platform has its own offloading support and unique commands to enable the functionality. The platforms are: 


mediatek.png  


Used by the following EdgeRouter models:

  • ER-X
  • ER-X-SFP
  • EP-R6

cavium.png  


Used by the following EdgeRouter models:

  • ERLite-3
  • ERPoE-5
  • ER-8
  • ERPro-8
  • EP-R8
  • ER-4
  • ER-6P
  • ER-12
  • ER-8-XG

The tables below summarizes the features that can be offloaded on each platform.

MediaTek-Based Devices
Feature Offload Eligible
Command
Bridging  hwnat
DPI  hwnat
NAT  hwnat
VLANs  hwnat
GRE  hwnat
PPPoE  hwnat
IPsec  ipsec
QoS  - 
NetFlow  -
Bonding  -
Cavium-Based Devices
Feature Offload Eligible Command
Bridging  -
DPI  ipv4 forwarding
NAT  ipv4 forwarding
VLANs  ipv4 / ipv6 vlan
GRE  ipv4 gre 
PPPoE  ipv4 / ipv6 pppoe 
IPsec  ipsec 
QoS  -
NetFlow  - 
Bonding*  ipv4 bonding
* Offloading support for Bonding on Cavium devices is available starting from the v2.0.0 EdgeOS firmware release.

IPsec Offloading Support


Back to Top

IPsec offload provides significant IPsec performance improvements, increasing throughput for site-to-site and client-to-site tunnels by offloading the ESP (Encapsulated Security Payload) traffic. Not all available ESP hashing/encryption algorithms are compatible with offloading. IKE traffic is not offloaded but this is only used to establish the tunnel and will not affect the performance.

The tables below summarizes the algorithms that can be offloaded on each platform.

MediaTek-Based Devices
ESP Algorithm Offload Eligible

3DES

AES-128

AES-256

MD5

SHA-1

SHA-256

SHA-384

SHA-512

AES-128-GCM

AES-256-GCM

Cavium-Based Devices
ESP Algorithm Offload Eligible

3DES

AES-128

AES-256

MD5

SHA-1

SHA-256

SHA-384

SHA-512

AES-128-GCM

AES-256-GCM


How to Enable/Disable Offloading


Back to Top

That commands that enable and disable offloading are shown below. You should only need to enable offloading for these features if you are using them in your environment. However, enabling offloading for all features will not cause a negative impact if those features are not being used.

ATTENTION: Offloading needs to be explicitly defined with the set system offload ... and delete system offload ... commands. 

mediatek.png  


Used by the following EdgeRouter models:

  • ER-X
  • ER-X-SFP
  • EP-R6
CLI: Access the EdgeRouter Command Line Interface.

1. Enable hwnat and ipsec offloading.

configure

set system offload hwnat enable
set system offload ipsec enable

commit ; save

2. Disable hwnat and ipsec offloading.

configure

set system offload hwnat disable
set system offload ipsec disable

commit ; save
NOTE: IPsec offloading requires a device reboot to become active/inactive.

cavium.png  


Used by the following EdgeRouter models:

  • ERLite-3
  • ERPoE-5
  • ER-8
  • ERPro-8
  • EP-R8
  • ER-4
  • ER-6P
  • ER-12
  • ER-8-XG
CLI: Access the EdgeRouter Command Line Interface.

1. Enable ipv4/ipv6 and ipsec offloading.

configure

set system offload ipv4 forwarding enable
set system offload ipv4 gre enable
set system offload ipv4 pppoe enable
set system offload ipv4 vlan enable
set system offload ipv4 bonding enable

set system offload ipv6 forwarding enable
set system offload ipv6 pppoe enable
set system offload ipv6 vlan enable

set system offload ipsec enable

commit ; save

2. Disable ipv4/ipv6 and ipsec offloading.

configure

set system offload ipv4 forwarding disable
set system offload ipv4 gre disable
set system offload ipv4 pppoe disable
set system offload ipv4 vlan disable
set system offload ipv4 bonding disable

set system offload ipv6 forwarding disable
set system offload ipv6 pppoe disable
set system offload ipv6 vlan disable

set system offload ipsec disable

commit ; save
NOTE: It is currently not possible to enable IPv6 offloading for PPPoE and VLANs simultaneously. IPsec offloading requires a device reboot to become active/inactive.

Testing & Verification


Back to Top

Verify the offloading state by running the following command in operational mode. Different models will show different outputs, do not be concerned if your output is different than the one shown in the example below.

show ubnt offload  

IP offload module : loaded
IPv4
forwarding: enabled
vlan : enabled
pppoe : enabled
gre : enabled
bonding : enabled
IPv6
forwarding: disabled
vlan : disabled
pppoe : disabled

IPSec offload module: loaded

Traffic Analysis :
export : enabled
dpi : enabled

When high throughput is flowing on the router and the traffic is not offloaded, you will see an increase in CPU usage. When traffic is offloaded the throughput will be higher and CPU usage will remain low.

Using a tool like iPerf / iPerf3 is a common way to generate and test throughput. It is important to not use the EdgeRouter as the server or client for iPerf when running the test, as the routers are designed to route/forward traffic and not to generate it.


Related Articles


Back to Top

EdgeRouter - Which EdgeRouter Should I Use?

EdgeRouter - Beginners Guide to EdgeRouter

Intro to Networking - How to Establish a Connection Using SSH


We're sorry to hear that!