Description

Starting from Junos 19.4R1, fat-tunnel technology is introduced to improve the IPsec tunnel throughput value up to 10 times of current value.

Symptoms

This is an informational Document to enable and verify whether fat-tunnel is enabled or not and also to verify if it is working or not.

Solution

A new CLI command is introduced to enable the fat IPsec tunnel. The fat IPsec tunnel feature is disabled by default. You need to have "Power-mode-ipsec" also enabled on the device for Fat-core to be enabled.

The command to enable fat-core is mentioned below:

#set security distribution-profile fat-core

You can check using the below command to see if Fat-core is enabled or not:

jcluser> show security flow status 
  Flow forwarding mode:
   .................
  Flow packet ordering
    Ordering mode: Hardware
  Flow power mode: Enabled
  Flow power mode IPsec: Enabled   >>>>>> This tells that Power-mode-ipsec is enabled
  Flow power mode IPsec QAT: Disabled
  Fat core group status: on      >>>>>> This tells Fat-core is enabled
  Flow inline fpga crypto: Disabled

Below is the link for configuring Fat-core on SRX devices

https://www.juniper.net/documentation/us/en/software/junos/vpn-ipsec/topics/topic-map/security-powermodeipsec-vpn.html#id_gtn_2ym_drb__d67e950

 

Modification History

 

09/15/23- Updated Internal comments

2025-05-21: Made the PMI doc link into a clickable link.