Flowtable NAT Hardware Offload on ConnectX-5 cards

[wojciech.wrona1]

Hi,
I’m confused. I’ve seen multiple places on the internet that cards starting from ConnectX-4 have hardware flow offload functionality. Especially NAT44 offloading. I have ConnectX-5 MCX516A-CCAT where hardware NAT and offloading is even mentioned in datasheet but have trouble running it with nft flowtables.

Can anyone give me a binding answer if it is supported and worth trying ? I can provide more information about my config but for now i have doubts if it is even supported by this card.

Example link where this functionallity is menntioned:

10/25 Gbps Mellanox NIC with Linux NAT offload support

I’m looking for a 10 or 25 Gbps Mellanox NIC that has NAT44 offload support in Linux. This is for an ISP with a thousand users or so, and we have nftables rules that handle NAT mappings, including a map with ~100 public IPs, for snat and dnat. Peak loads are 5+ Gbps or so, and mean loads more like up to 2 Gbps. We want to add two NAT boxes to move NAT functionality off of our gateway. We actually think that general purpose hardware should be able to handle this load, without hardware accelerati…

Best regards,
Wojciech Wrona

[namrata1]

Hi Wojciech,

Thank you for posting your query on NVIDIA Community.

Hardware Offload is supported on ConnectX-5 HCA. I would like to confirm if you are using MLNX OFED driver. If not, please install the driver by downloading the driver relevant to the OS in use —> Linux InfiniBand Drivers

For Connection Tracking & NAT, you may refer section " Connection Tracking"—> https://docs.nvidia.com/networking/pages/viewpage.action?pageId=111589098#OVSOffloadUsingASAP²Direct-BasicTCRulesConfiguration

If this requires additional debug, a support ticket will be needed. The support ticket can be opened by emailing " Enterprise-support@nvidia.com "

Please note that an active support contract would be required for the same. For contracts information, please feel free to reach out to our contracts team at " Networking-Contracts@nvidia.com "

Thanks,
Namrata.

[wojciech.wrona1]

Hi again,

Can You confirm which model exacly is this ? I dont see any “HCA” in this table:
[https:// docs. nvidia. com /networking/display/ConnectX5EN]
(Spaces added cuz of stupid limit about links)

I have MCX516A-CCAT in our lab now.

I’m using mlnx_en ver 5.8-2.0.3.0, is especially OFED needed for this functionality ?

Yes there is a lot of stuff there but it is only related to TC functions. And i’m talking about NFT FLOWTABLE OFFLOAD functions. As mentioned here:

[netfilter flowtable hardware offload [LWN.net]]

Can You relate to this one ? Is it supported on MCX516A-CCAT card ? If not which model is needed to support it ?

For now it is far from debugging. Now we have to tell that we still don’t know which model supports which functionality and we don’t know which one to buy :)

Best regards,
Wojciech Wrona