Hardware Acceleration for ACL

Introduction

Access Control Lists (ACLs) leverage hardware acceleration to improve performance by optimizing traffic management. ACLs function at the network layer of the OSI model to filter and control network traffic.

With hardware acceleration enabled, the configured ACL Rules are applied efficiently. In BIG-IP Next for Kubernetes, the NVIDIA DPU is utilized to process the first packet of a flow and enforce drop rules when necessary.

This section guides you with the essential information to use hardware acceleration.

About ACL policy

A collection of rules grouped with a specific purpose and applied to a device’s interface, firewall zone, or service to enforce traffic control. The ACL policies are applied based on the context (Gateway API or options at the global level).

About ACL Rules

ACL Rules are individual conditions that match packets based on attributes (IP, port, and protocol) and specify whether to allow (accept) or drop traffic.

The ACL Rules are defined while configuring the Firewall CR. Currently, all the rules are not offloaded, as ‌traffic that matches the rule to offload can also match the accept rule, which has a higher priority and takes precedence.

Enabling hardware acceleration for ACL

Currently, only the NVIDIA Bluefield 3 DPU supports hardware acceleration.

You can use the F5GlobalOptions CRD to enable or disable HW acceleration. See F5GlobalOptions.

Note:

  • The firewall.hardwareOffload parameter in F5GlobalOptions must be added to enable the firewall offload. The previously applied value will be considered if the firewall.hardwareOffload parameter is not added. For example: Previously, if the firewall.hardwareOffload parameter is set to false and when applying GlobalOption CR without the firewall.hardwareOffload parameter, then the default value remains false.

  • Traffic will not be offloaded to hardware when the hardwareOffload parameter is disabled or the hardware is not supported.

How are the packets offloaded

This section gives the outline of the criteria used to offload packets in the ACL.

6-tuple method

The hardware entries are created using all the parameters (source IP, destination IP, source port, destination port, protocol, and VLAN) of the flow.

Removing hardware entries

Hardware entries can be removed in two ways:

  • The idle timeout is specified to remove ‌hardware entries that do not receive any traffic for a specific time. The timeout period is two seconds.

  • When the firewall policy attached to any context (global or gateway) is modified, all the hardware entries are removed.

Sample rule

This is an example to describe how the accept condition takes precedence over the drop rule. Here, ‌rule2 cannot be entirely offloaded because the rule2 also matches rule1, which has a higher priority.

  • rule1 (action: accept, src_ip=1.1.1.0/24, dst_port=80, prio=1)

  • rule2 (action: drop,    src_ip=1.1.1.0/24,                      prio=2)

Instead of offloading the whole configured ACL Rules, the HW entries are filtered using Rule Cache method for specific 6-tuple traffic (src/dst ip/port + protocol + src VLAN).

  • The ACL drop rule (src_ip=1.1.1.0/24 dst_port=80)

  • After dropping N packets (TCP src_ip=1.1.1.1, src_port=1234, dst_ip=2.2.2.2 dst_port=80, vlan1) the hardware creates drop entry with corresponding parameters (TCP src_ip=1.1.1.1, src_port=1234, dst_ip=2.2.2.2 dst_port=80, vlan1).

This creates drop entries for particular 6-tuple packets after initially dropping some packets in the software.

HSL

HSL log messages

The log messages are created only for the first packet dropped in the software. Packets dropped into hardware are not logged in HSL log messages.

Sample log message

Mar 20 23:27:18 11.11.11.201 1 2025-03-20T23:27:18.278437+00:00 f5-tmm-tvbcq tmm 23 23003137 [F5@12276 acl_policy_name="default-policy1-firewallpolicy" acl_policy_type="Enforced" acl_rule_name="rule-tcp-accept-firewallpolicyrule" acl_rule_uuid="" action="Accept" hostname="f5-tmm-tvbcq" bigip_mgmt_ip="10.244.99.83" context_name="global-context" context_type="Global" date_time="Mar 20 2025 23:27:17" dest_fqdn="unknown" dest_ip="44.44.44.1" dst_geo="No-lookup" dest_port="8050" device_product="Advanced Firewall Module" device_vendor="F5" device_version="10.14.0+0.1.5" drop_reason="" errdefs_msgno="23003137" errdefs_msg_name="Network Event" flow_id="0000000000000000" ip_protocol="TCP" severity="8" partition_name="" route_domain="0" sa_translation_pool="" sa_translation_type="" source_fqdn="unknown" source_ip="11.11.11.1" src_geo="No-lookup" source_port="5000" source_user="unknown" source_user_group="unknown" translated_dest_ip="" translated_dest_port="" translated_ip_protocol="" translated_route_domain="" translated_source_ip="" translated_source_port="" translated_vlan="" vlan="client-1001" send_to_vs="" src_zone="" dest_zone="" dest_vlan="eth0" source_ipint_categories="No-lookup" dest_ipint_categories="No-lookup"] "10.244.99.83","f5-tmm-tvbcq","Global","global-context","No-lookup","11.11.11.1","No-lookup","44.44.44.1","5000","8050","client-1001","TCP","0","","","","","","","","Enforced","default-policy1-firewallpolicy","rule-tcp-accept-firewallpolicyrule","","Accept","","","","0000000000000000","unknown","unknown","unknown","unknown","","","","eth0","No-lookup","No-lookup"

Note: For more details on firewall rules, see F5BigFwRuleList.