Login
- Table of Contents
-
- 03-Security Configuration Guide
- 00-Preface
- 01-ARP attack protection configuration
- 02-ASPF configuration
- 03-IP-MAC binding configuration
- 04-Keychain configuration
- 05-ND attack defense configuration
- 06-Password control configuration
- 07-uRPF configuration
- 08-Location identification configuration
- 09-Security zone configuration
- 10-User identification configuration
- 11-MAC learning through a Layer 3 device configuration
- 12-Microsegmentation configuration
- 13-IP-SGT mapping configuration
- 14-SMS configuration
- 15-Trusted access control configuration
- 16-Application account auditing configuration
- 17-Terminal identification configuration
- 18-IPoE configuration
- 19-Flow manager configuration
- 20-Object group configuration
- 21-IP source guard configuration
- 22-Server connection detection configuration
- 23-PKI configuration
- 24-SSL configuration
- 25-Crypto engine configuration
- 26-AAA configuration
- 27-Portal configuration
- 28-IPsec configuration
- 29-Public key management
- 30-Attack detection and prevention configuration
- 31-Security policy configuration
- 32-Session management
- 33-Connection limit configuration
- 34-DDoS protection configuration
- 35-SSH configuration
- 36-SDP zero trust configuration
- 37-APR configuration
- 38-Overbilling prevention configuration
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 25-Crypto engine configuration | 51.07 KB |
Configuring crypto engines
About crypto engines
Crypto engines encrypt and decrypt data for service modules.
Crypto engine types
Crypto engines include the following types:
· Hardware crypto engines—A hardware crypto engine is a coprocessor integrated on a CPU or hardware crypto card. Hardware crypto engines can accelerate encryption/decryption speed, which improves device processing efficiency. You can enable or disable hardware crypto engines globally as needed. By default, hardware crypto engines are enabled.
· Software crypto engines—A software crypto engine is a set of software encryption algorithms. The device uses software crypto engines to encrypt and decrypt data for service modules. They are always enabled. You cannot enable or disable software crypto engines.
Crypto engine processing mechanism
If you disable hardware crypto engines, the device uses only software crypto engines for data encryption/decryption. If you enable hardware crypto engines, the device preferentially uses hardware crypto engines. If the device does not support hardware crypto engines, or if the hardware crypto engines do not support the required encryption algorithm, the device uses software crypto engines for data encryption/decryption.
Crypto engines provide encryption/decryption services for service modules, for example, the IPsec module. When a service module requires data encryption/decryption, it sends the desired data to a crypto engine. After the crypto engine completes data encryption/decryption, it sends the data back to the service module.
Display and maintenance commands for crypto engines
Execute display commands in any view and reset commands in user view.
|
Task |
Command |
|
Display crypto engine information. |
display crypto-engine |
|
Display the enabling status of the GM-capable hardware crypto engine for GM algorithms. |
display crypto-engine accelerator gm-algorithm status |
|
Display crypto engine statistics. |
In standalone mode: display crypto-engine statistics [ engine-id engine-id slot slot-number [ cpu cpu-number ] ] In IRF mode: display crypto-engine statistics [ engine-id engine-id chassis chassis-number slot slot-number [ cpu cpu-number ] ] |
|
Clear crypto engine statistics. |
In standalone mode: reset crypto-engine statistics [ engine-id engine-id slot slot-number [ cpu cpu-number ] ] In IRF mode: reset crypto-engine statistics [ engine-id engine-id chassis chassis-number slot slot-number [ cpu cpu-number ] ] |