topic Re: AES-NI in Firewall and Security Management

AES-NI

Hermano_Pereira — Sun, 14 Jan 2018 19:12:57 GMT

Hello,

Anyone knows how to check in GAIA if AES-NI is enabled on supported appliances and open-servers?

The flag is not present in cpuinfo...

Thanks!

Re: AES-NI

Pablo_Barriga — Mon, 15 Jan 2018 01:28:51 GMT

Hello this could be helpful

Check Point supports AES-NI on the following appliances (only when running Gaia OS with 64-bit kernel):

Appliance	Starting in
3100 / 3200	R77.30 for 3000
5600 / 5800	R77.30 for 5000
12400 / 12600	R76
13500 / 13800	R76
15400 / 15600	R77.30 for 15000
21400 / 21600 / 21700 / 21800	R76
23500 / 23800	R77.30 for 23000
41000 / 61000	R76SP
44000 / 64000	R76SP.50

On these appliances, AES-NI is enabled by default. AES-NI is also supported on Open Servers. Make sure that Gaia OS is running in 64-bit mode.

Official Document

sk105119

Re: AES-NI

Hermano_Pereira — Mon, 15 Jan 2018 10:25:53 GMT

Thank you Pablo!

It´s because of that information that i´m wondering how to check in GAIA if it is really enabled...

In a regular linux, cat /proc/cpuinfo shows if the instruction is present with the flag "aes"...

My gateways are running R80.10 on AES-NI supported appliances and open-servers.

Thanks!

Re: AES-NI

Matthew_Johnson — Thu, 21 Feb 2019 12:37:44 GMT

run dmesg and grep for aes-ni

VPN-1: AES-NI is supported on this hardware

Re: AES-NI

Hermano_Pereira — Fri, 22 Feb 2019 18:41:56 GMT

Thank you Matthew!

I get the output in appliances! Not on open-servers... I wonder why!? On the same machines with regular linux the instruction is there.

Regards

Re: AES-NI

Timothy_Hall — Fri, 12 Feb 2021 13:44:40 GMT

The dmesg method of detecting AES-NI support stopped working in R80.40, although the firewall code is still actively taking advantage of AES-NI. See sk170779: AES-NI commands no longer work in R80.40

Re: AES-NI

Timothy_Hall — Fri, 11 Jun 2021 14:41:02 GMT

To update this old thread for posterity, the fw ctl get int AESNI_is_supported command can be used in R80.40 Jumbo HFA 100+ and R81 Jumbo HFA 13+ to check for the presence of AES-NI support. See sk170799 which as been updated recently.