Architecture for offloading

After a TCP handshake is complete or one packet from each direction passes through Sophos Firewall, SlowPath fully classifies the flow and programs a connection cache in FastPath. It offloads kernel processing for subsequent packets in the same connection to FastPath.

DPI engine: The DPI engine inspects traffic from layer 4 and higher through stream processing. It applies SSL/TLS decryption and inspection, IPS policies, application identification and control, web policies (including proxy-less web filtering), and antivirus scanning in a single engine. Antivirus scanning includes Zero-day protection and file reputation analysis.

Offloading decisions are taken at each stage of security processing.

FastPath offloading: SlowPath delivers packets to the DPI engine through the kernel. Packets are sent through the Data Acquisition (DAQ) layer for security decisions if security policies apply. FastPath delivers the offloaded packets directly to the DPI engine through the DAQ layer, eliminating the need to retain copies in kernel memory.

If the DPI engine determines that the traffic can be offloaded, it instructs FastPath to cut off the flow from SlowPath and the DPI engine. The ability to offload some or all processing minimizes the load on the CPU.

Turning firewall acceleration on or off: When you turn off firewall acceleration on the CLI console, or when FastPath doesn’t load, Sophos Firewall continues to function fully but without the performance enhancements of FastPath.

To turn firewall acceleration on or off and see the status, see CLI commands for firewall acceleration.

Restrictions

The following restrictions apply to firewall acceleration:

• Doesn't support offloading for SSL VPN, QoS, DoS, RED, LAG, and PPPoE traffic.
• Supports offloading only for some types of bridge deployments.
• Doesn't support firewall acceleration for Active-active HA. Supports firewall acceleration for Active-passive HA on the primary node.
• Optionally, offloading can remain on when tcpdump is run. You can configure FastPath traffic to be sent to tcpdump.

The firewall re-signs X.509 server certificates for inspected TLS flows before sending it to the TLS client.

The DPI engine offloads PKI processing for X.509 certificate re-signing to the crypto hardware on the Xstream Flow Processor when TLS flows meet all the following conditions:

• TLS 1.2 and 1.3 flows.
• TLS flows inspected by the DPI engine.
• Flows that use RSA authentication with key sizes up to 4096 bits.

Restrictions

SFOS doesn't support the following:

• Offloading of symmetric crypto operations for inspected SSL/TLS flows.
• PKI acceleration for SSL/TLS flows in web proxy mode.
• PKI acceleration for SSL VPN connections that terminate on the appliance.

PKI acceleration is turned on by default on supported firewall appliances. See the following links:

• CLI commands for PKI acceleration.
• Show the CLI settings.

The XFRM stack offloads ESP encapsulation, encryption, decapsulation, and decryption for policy-based and route-based IPsec VPNs. IPsec acceleration improves the throughput for IPsec VPN tunnels.

The XFRM stack offloads these processes to the crypto hardware on the NPU based on the phase 2 Security Associations (SA). It offloads SAs for all the encryption and authentication combinations available on SFOS except the following:

• 3DES
• BlowFish
• MD5

IPsec VPN traffic can qualify for one of the following offloading processes:

Full offload: For offloaded SAs, the NPU's crypto hardware encapsulates, encrypts, decapsulates, and decrypts the corresponding packets. If the inner traffic qualifies, SlowPath processing is offloaded to FastPath, delivering full offload.

FastPath and SlowPath: For offloaded SAs, the crypto hardware decrypts or encrypts the packets. If the inner traffic doesn’t qualify for FastPath offloading, SlowPath processes the traffic, including encapsulation and decapsulation. FastPath finalizes the encapsulation after encrypting the packet.

Full SlowPath: For SAs that aren't offloaded, SlowPath performs the entire processing.

Restrictions

SFOS supports IPsec acceleration for Active-active and Active-passive HA on the primary node.

It doesn't offload SAs for the following:

• SAs that use unsupported cipher suites.
• SAs on virtual interfaces, such as VLANs.
• Source and destination IP addresses don't match those expected for the SA.
• IPsec traffic over VLAN and wireless interfaces.

Turning IPsec acceleration on or off restarts all IPsec tunnels and requires downtime. To turn it on or off and see the status, see CLI commands for IPsec acceleration.

Examples are as follows:

• A firewall rule without IPS, web filtering, antivirus, or application control. Traffic is offloaded to FastPath after a handshake is complete or the initial packet passes through Sophos Firewall on either side of the connection.
• A firewall rule with an application control policy. Traffic is offloaded to FastPath after about eight packets.
• A firewall rule with IPS policy set to the rule action Bypass session. Traffic that matches IPS policy rules with this action is offloaded to FastPath.

• A firewall rule with the following policies:

  • An IPS policy containing intelligent offload signatures from SophosLabs.
  • Web filtering without malware and content scanning or DPI engine settings. For firewall rules with malware and content scanning and DPI engine settings, FastPath delivers traffic to the DPI engine directly, bypassing the firewall stack.

• No SSL/TLS inspection rules. For rules with the action set to Decrypt, FastPath delivers traffic to the DPI engine directly, bypassing the firewall stack.

• SSL/TLS inspection rules with the action set to Don't decrypt. For STARTTLS connections, traffic is offloaded to FastPath after 15 packets.

Make sure of the following:

• On the CLI, firewall acceleration must be turned on. It is on by default on supported firewall appliances.
• Go to Rules and policies > Firewall rules. Under Web filtering, make sure you don't select the option for using web proxy instead of the DPI engine.
• Go to Rules and policies > SSL/TLS inspection rules > SSL/TLS settings. Under Re-sign RSA with and Re-sign EC with, make sure you select an RSA certificate with a key size of 4096 bits or lower.

• If you want to use CAs other than the ones used in SSL/TLS inspection settings for specific traffic, go to Profiles > Decryption profiles. Under Re-sign RSA with and Re-sign EC with, make sure you select an RSA certificate with a key size of 4096 bits or lower. Select this decryption profile in the SSL/TLS inspection rules.

  The default re-signing CAs on the firewall use RSA.

Go to Profiles > IPsec profiles. Under Encryption and Authentication for phase 2 tunnels, make sure you don't select the following:

• 3DES
• BlowFish
• MD5