Skip to main content

Configure ONTAP TLS hardware offload

Contributors netapp-andreajost netapp-dbagwell
PDFs

Beginning with ONTAP 9.19.1, you can configure TLS offload to improve TLS post-handshake performance by using resources on supported Ethernet cards. This feature offloads encryption and decryption, reducing CPU overhead and improving performance.

You can enable TLS offload only for traffic that uses KTLS. This setting does not apply to all TLS-enabled traffic. Management traffic such as HTTPS and REST API traffic is unaffected by this setting. HA traffic is not supported.

About this task

  • TLS offload is disabled by default.

  • Only AES-GCM cipher suites (TLSv1.2/TLSv1.3, 128/256-bit) are offloaded.

  • The TLS handshake phase is not offloaded. Only the post-handshake data phase is offloaded.

  • Network logical interface (LIF) migration to non-offload-capable ports causes an automatic software fallback.

    For TLS-offloaded connections, TLS cryptographic operations typically bypass software and are handled by an offload-capable NIC. If the LIF associated with this connection migrates to a network port without TLS offload capability, cryptographic operations fall back to software and are handled by the system kernel.

  • Management interfaces (HTTPS, REST API) are unaffected by this setting.

  • TLS hardware offload is a cluster-wide setting.

  • HA traffic is not supported for TLS hardware offload.

Supported network cards and platforms

TLS hardware offload requires a supported network card. The following table lists supported network cards by platform.

Platform family Platforms Supported network cards

AFF and FAS

AFF A20, AFF A30, AFF A50, AFF C30, AFF C60, FAS50

  • 4-port CX7 10/25 GbE

  • 2-port CX6-DX 40/100 GbE

  • 2-port CX7 40/100 GbE

AFF and FAS

AFF A70, AFF A90, AFF C80, FAS70, FAS90, AFF A1K

  • 2-port CX6-DX 40/100 GbE

  • 2-port CX7 40/100 GbE

  • 2-port CX7 40/100/200/400 GbE

ASA

ASA A20, ASA A30, ASA A50, ASA C30

  • 4-port CX7 10/25 GbE

  • 2-port CX6-DX 40/100 GbE

  • 2-port CX7 40/100 GbE

ASA

ASA A70, ASA A90, ASA A1K

  • 2-port CX6-DX 40/100 GbE

  • 2-port CX7 40/100 GbE

  • 2-port CX7 40/100/200/400 GbE

AFX

AFX 1K

  • 2-port CX6-DX 40/100 GbE

  • 2-port CX7 40/100 GbE

  • 2-port CX7 40/100/200/400 GbE

AFX

AFX 2K

  • 2-port CX7 40/100/200/400 GbE
Supported traffic types

The following table shows whether TLS hardware offload is supported for each traffic type.

Traffic type Supported Notes

NVMe/TCP

Yes

Supported on platforms and network cards that support TLS offload.

Cluster peering encryption

Yes

Supported for cluster network traffic. This does not include HA traffic.

FabricPool

Yes

Supported on platforms and network cards that support TLS offload.

S3

Yes

Supported on platforms and network cards that support TLS offload.

NFS over TLS

Yes, starting with ONTAP 9.19.1

Supported for ONTAP NFS over TLS traffic where KTLS is used.

KMIP

No

Not supported.

System Manager

No

Management interfaces are unaffected by this setting.

REST API

No

Management interfaces are unaffected by this setting.

HA traffic

No

TLS hardware offload does not apply to HA traffic.
Note On ASA systems, TLS hardware offload applies to NVMe/TCP traffic only. NFS over TLS, FabricPool, and S3 are not supported on ASA platforms.
Note On AFX platforms, TLS hardware offload supports NFS over TLS and S3 front-end traffic types. NVMe/TCP is not supported on AFX platforms because AFX does not support SAN/block protocols.
Before you begin

  • You must be an ONTAP administrator at the admin privilege level to perform the following tasks.

  • All nodes must be running ONTAP 9.19.1 or later.

Enable or disable TLS offload

Steps

  1. View the current TLS offload status:

    security config show

    This command displays the cluster-wide TLS offload setting:

    cluster1::*> security config show
Cluster    Supported Offload
FIPS Mode  Protocols Enabled Supported Cipher Suites
---------- --------- ------- --------------------------------------------------
false      TLSv1.3,  false   TLS_RSA_WITH_AES_128_CCM,
           TLSv1.2           TLS_RSA_WITH_AES_128_CCM_8,
                             TLS_RSA_WITH_AES_128_GCM_SHA256,
                             TLS_RSA_WITH_AES_128_CBC_SHA,
                             TLS_RSA_WITH_AES_128_CBC_SHA256,
                             TLS_RSA_WITH_AES_256_CCM,
[...]

  2. Enable or disable TLS offload:

    security config modify * -is-offload-enabled {true|false}

    This command enables or disables hardware offload for the TLS data phase on new connections. Existing connections created prior to enabling the TLS offload feature are not offloaded until those connections are removed and recreated.

Related information