EdgeRouter - Hardware Offloading Explained

 Overview


This article explains the function, benefits, and implementation of hardware offloading.

info_i_25x25.png Note: As of version 1.9.1, all EdgeRouters support some type of hardware offloading 

Table of Contents


  1. Offloading Explained
  2. Offload Configurations Commands
  3. Troubleshooting
  4. Related Articles

Offloading Explained


Back to Top

Offloading is used to execute functions of the router using the hardware directly, rather than a process of software functions to greatly increase performance. The benefit of enabling offload in EdgeOS is increased performance and throughput by not limiting the performance to the CPU.

One example exhibiting the benefit of offload is a scenario with an ER-Lite and a 1GB ISP connection. When NAT occurs, by default, all traffic will be handled by the CPU and throughput may be limited to 300Mbps. After enabling IPv4 Forwarding which allows for the NAT process to be offloaded, throughput will then be about 950Mbps.

info_i_25x25.png Note: In order to prevent firmware upgrades to change the EdgeOS configuration itself, all routers are shipped with offloading disabled. Therefore, it will need to be enabled manually to allow for best performance.

Some processes currently can not take advantage of hardware offloading. Traffic on a bridged interface, for example, can not be offloaded on the ER-Lite, ER-PoE, ER-8, ER-PRO, and EP-R8. However bridged traffic can be offloaded on the ER-X, ER-X-SFP, and EP-R6, although these units include a hardware switch chip so bridging offload is not as common. Also, when netflow or traffic shaping (Smart Queue, Basic Queue, and Advanced Queue) is enabled, offloading will not be used.

This table shows a summary of what is and is not supported by offload by each platform.

  DEVICES
  ER-Lite, ER-PoE, ER-8, ER-Pro, EP-R8, ER-Infinity ER-X, ER-X-SFP, EP-R6
Features Supported with Offload DPI, NAT, VLAN, GRE, PPPOE Bridge Interfaces, DPI, NAT, VLAN, GRE, PPPOE
Features Not Supported with Offload Bridge Interfaces, Traffic Shaping (QoS), Netflow Traffic Shaping (QoS), Netflow

IPsec Offloading

IPsec offload provides significant IPsec performance improvements, increasing throughput for IPsec Tunnels by offloading ESP traffic. The ESP traffic is the actual data and the offload feature does not offload IKE traffic. Not all algorithms are compatible with IPsec offload. This is different by platform as well, and the differences are outlined below.

For the ER-X, ER-X-SFP, and EP-R6 platform:

checkmark_25x25.png ESP encryption algorithms that can be "offloaded": 3des, aes128, aes256
checkmark_25x25.png ESP hash algorithms that can be "offloaded": md5, sha1, sha256
X_25x25.png ESP encryption algorithms incompatible with "offload": aes128gcm128, aes256gcm128
X_25x25.png ESP hash algorithms incompatible with "offload": sha384, sha512
X_25x25.png

IKE encryption algorithms that are not supported: aes128gcm128, aes256gcm128. (More specifically, these are not supported for IKE on the ER-X platform.)

checkmark_25x25.png  All config options for IKE hash algorithms are supported.

For ER-Lite, ER-PoE, ER-8 ER-Pro, EP-R8, and ER-Infinity:

checkmark_25x25.png ESP encryption algorithms that can be "offloaded": 3des, aes128, aes256
checkmark_25x25.png ESP hash algorithms that can be "offloaded": md5, sha1
X_25x25.png ESP encryption algorithms incompatible with "offload": aes128gcm128, aes256gcm128. (More specifically, unlike on the ER-X platform, these can be configured with IPsec offload enabled but just won't be offloaded.)
X_25x25.png ESP hash algorithms incompatible with "offload": sha256, sha384, sha512. (More specifically, unlike on the ER-X platform, these can be configured with IPsec offload enabled but just won't be offloaded.)
checkmark_25x25.png All config options for IKE encryption and hash algorithms are supported.

 


Offload Configurations Commands


Back to Top

Below, you will find commands for enabling offload for each platform. Enabling forwarding for IPv4 (or hwnat on ER-X platform) is the most commonly used feature as it offloads NAT functionality.

The other commands for GRE, PPPOE, or VLAN are only necessary if you are using specific features, however enabling these will not cause a negative impact if those features are not being used.

The commands below will be made in configuration mode of the CLI, remember to also use “commit” and “save” to make the changes active and persistent on reboot.

For ER-Lite, ER-PoE, ER-8, ER-Pro, EP-R8, and ER-Infinity

IPv4:

set system offload ipv4 forwarding enable
set system offload ipv4 gre enable
set system offload ipv4 pppoe enable
set system offload ipv4 vlan enable

IPv6:

set system offload ipv6 forwarding enable
set system offload ipv6 pppoe enable
set system offload ipv6 vlan enable
info_i_25x25.png Note: It is currently not possible to enable IPv6 offloading for PPPoE and VLANs simultaneously.  

 

IPsec:

set system offload ipsec enable (this requires a reboot to become active)

For ER-X, ER-X-SFP, and EP-R6

hwnat:

set system offload hwnat enable

IPsec:

set system offload ipsec enable (this requires a reboot to become active)

Troubleshooting


Back to Top

You may check to see if offloading is actively working by using this command in operational mode of the CLI.

admin@ubnt:~$ show ubnt offload  

IP offload module   : loaded
IPv4
 forwarding: enabled
 vlan      : enabled
 pppoe     : disabled
 gre       : disabled
IPv6
 forwarding: enabled
 vlan      : enabled
 pppoe     : disabled

IPSec offload module: loaded

Traffic Analysis    :
 export    : enabled
 dpi       : enabled

This command in configuration mode will show the applied configuration settings for offload:

admin@ubnt# show system offload 
hwnat disable
ipv4 {
    forwarding enable
    vlan enable
}

When high throughput is flowing on the router and the traffic is not offloaded, you will see an increase in CPU usage, when traffic is offloaded the throughput will be higher and CPU usage will remain low.

Using a tool like iPerf is a common way to generate and test throughput. It is important to not use EdgeRouter devices as the server or client for iPerf in this case, as they are designed to route traffic, not generate traffic. For best performance testing use another device like a PC that is capable of generating the traffic.


Related Articles


Back to Top

EdgeRouter - Which EdgeRouter Should I Use?

EdgeRouter - Beginners Guide to EdgeRouter