Skip to main content

Configure ONTAP TLS hardware offload

Contributors netapp-andreajost netapp-dbagwell
PDFs

Beginning with ONTAP 9.19.1, you can configure TLS offload to improve TLS post-handshake performance by leveraging resources on supported Ethernet cards. This feature offloads encryption and decryption, reducing CPU overhead and improving performance.

About this task

  • TLS offload is disabled by default.

  • Only AES-GCM cipher suites (TLSv1.2/TLSv1.3, 128/256-bit) are offloaded.

  • The TLS handshake phase is not offloaded. Only the post-handshake data phase is offloaded.

  • Network logical interface (LIF) migration to non-offload-capable ports causes an automatic software fallback.

    For TLS-offloaded connections, TLS cryptographic operations typically bypass software and are handled by an offload-capable NIC. If the LIF associated with this connection migrates to a network port without TLS offload capability, cryptographic operations fall back to software and are handled by the system kernel.

  • Management interfaces (HTTPS, REST API) are unaffected by this setting.

  • The TLS hardware offload setting is cluster-wide.

Supported network cards and platforms

TLS hardware offload requires a supported network card. The following table lists supported network cards by platform.

Platform family Platforms Supported network cards

AFF and FAS

AFF A20, AFF A30, AFF A50, AFF C30, AFF C60, FAS50

  • 4-port CX7 10/25 GbE

  • 2-port CX6-DX 40/100 GbE

  • 2-port CX7 40/100 GbE

AFF and FAS

AFF A70, AFF A90, AFF C80, FAS70, FAS90, AFF A1K

  • 2-port CX6-DX 40/100 GbE

  • 2-port CX7 40/100 GbE

  • 2-port CX7 40/100/200/400 GbE

ASA

ASA A20, ASA A30, ASA A50, ASA C30

  • 4-port CX7 10/25 GbE

  • 2-port CX6-DX 40/100 GbE

  • 2-port CX7 40/100 GbE

ASA

ASA A70, ASA A90, ASA A1K

  • 2-port CX6-DX 40/100 GbE

  • 2-port CX7 40/100 GbE

  • 2-port CX7 40/100/200/400 GbE

AFX

AFX 1K

  • 2-port CX6-DX 40/100 GbE

  • 2-port CX7 40/100 GbE

  • 2-port CX7 40/100/200/400 GbE

AFX

AFX 2K

  • 2-port CX7 40/100/200/400 GbE
Supported traffic types

TLS hardware offload supports the following traffic types:

  • NVMe/TCP

  • Cluster peering encryption

  • FabricPool

  • S3

  • NFS

Note On ASA systems, TLS hardware offload applies to NVMe/TCP traffic only. NFS over TLS, FabricPool, and S3 are not supported on ASA platforms.
Note On AFX platforms, TLS hardware offload supports NFS and S3 front-end traffic types. NVMe/TCP is not supported on AFX platforms because AFX does not support SAN/block protocols.
Before you begin

  • You must be an ONTAP administrator at the admin privilege level to perform the following tasks.

  • All nodes must be running ONTAP 9.19.1 or later.

Enable or disable TLS offload

Steps

  1. View the current TLS offload status:

    security config show

    This command displays the cluster-wide TLS offload setting:

    cluster1::*> security config show
Cluster    Supported Offload
FIPS Mode  Protocols Enabled Supported Cipher Suites
---------- --------- ------- --------------------------------------------------
false      TLSv1.3,  false   TLS_RSA_WITH_AES_128_CCM,
           TLSv1.2           TLS_RSA_WITH_AES_128_CCM_8,
                             TLS_RSA_WITH_AES_128_GCM_SHA256,
                             TLS_RSA_WITH_AES_128_CBC_SHA,
                             TLS_RSA_WITH_AES_128_CBC_SHA256,
                             TLS_RSA_WITH_AES_256_CCM,
[...]

  2. Enable or disable TLS offload:

    security config modify * -is-offload-enabled {true|false}

    This command enables or disables hardware offload for the TLS data phase on new connections. Existing connections created prior to enabling the TLS offload feature are not offloaded until those connections are removed and recreated.

Related information