Forum Discussion

John_Heyer_1508's avatar
John_Heyer_1508
Icon for Cirrostratus rankCirrostratus
Jan 05, 2015

CPU Increase when enabling AES-GCM

Supposedly AES-GCM should be the "best" cipher right now in terms of efficiency, however I noticed when enabling it on the F5, CPU goes up significantly. This is on a Viprion 2100 blade, 11.5.1 HF6. Anyone else seeing this?

 

 

I'm using "MEDIUM:!ADH:!RC4:@SPEED:RSA+3DES" for the cipher string. Adding a "!AES-GCM" to the line causes the CPU to immediately drop.

 

application delivery
deployment
performance
security
TMOS
TMSH
  • Brad_Parker's avatar
    Brad_Parker
    Icon for Cirrus rankCirrus
    Feb 27, 2015

    Adding !SHA256 and !SHA384 will do the trick too. If SHA256 and SHA384 are an issue, that makes AES-GCM ciphers unusable until its fixed.

     

    Nitass, are those published BugIDs? I can't find them on askf5.com.

     

    • nitass's avatar
      nitass
      Icon for Employee rankEmployee
      Mar 22, 2015
      sorry i missed your post. no, it is not published (as of now) but you can open a support case and ask for bug information.
  • Kai_Kataja's avatar
    Kai_Kataja
    Icon for Altostratus rankAltostratus
    Mar 18, 2015

    I could not wait anymore and had to find the TLS/SSL hardware used from article "SOL7778: BIG-IP hardware SSL and compression cards". Then search "Product Brief" for the specific chip to be sure if SHA-2 hardware acceleration is possible. Hopefully we get some answer from F5 to this SHA-2 CPU consumption issue.