AES-NI

[Hermano_Pereira]

Hello,

Anyone knows how to check in GAIA if AES-NI is enabled on supported appliances and open-servers?

The flag is not present in cpuinfo...

Thanks!

[Pablo_Barriga]

Hello this could be helpful

Check Point supports AES-NI on the following appliances (only when running Gaia OS with 64-bit kernel):

Appliance	Starting in
3100 / 3200	R77.30 for 3000
5600 / 5800	R77.30 for 5000
12400 / 12600	R76
13500 / 13800	R76
15400 / 15600	R77.30 for 15000
21400 / 21600 / 21700 / 21800	R76
23500 / 23800	R77.30 for 23000
41000 / 61000	R76SP
44000 / 64000	R76SP.50

On these appliances, AES-NI is enabled by default. AES-NI is also supported on Open Servers. Make sure that Gaia OS is running in 64-bit mode.

Official Document 

sk105119

[Hermano_Pereira]

Thank you Pablo!

It´s because of that information that i´m wondering how to check in GAIA if it is really enabled...

In a regular linux, cat /proc/cpuinfo shows if the instruction is present with the flag "aes"...

My gateways are running R80.10 on AES-NI supported appliances and open-servers.

Thanks!

[Matthew_Johnson · Accepted solution]

run dmesg and grep for aes-ni

VPN-1: AES-NI is supported on this hardware

[Hermano_Pereira]

Thank you Matthew!

I get the output in appliances! Not on open-servers... I wonder why!? On the same machines with regular linux the instruction is there.

Regards

[Timothy_Hall]

The dmesg method of detecting AES-NI support stopped working in R80.40, although the firewall code is still actively taking advantage of AES-NI.  See sk170779: AES-NI commands no longer work in R80.40

[Timothy_Hall]

To update this old thread for posterity, the fw ctl get int AESNI_is_supported command can be used in R80.40 Jumbo HFA 100+ and R81 Jumbo HFA 13+ to check for the presence of AES-NI support.  See sk170799 which as been updated recently.