cj - Levi answered this in one of my therads....
"The fast forwarding engine (FFE) was enabled by default, starting in AOS firmware version R10.4.0. The release notes (attached) for that firmware revision have it listed under the "Features and Enhancements" heading:
Not to resurrect an ancient thread, but it's still somewhat relevant.
I'm upgrading from a NV3430 running R10.9.0.E to a NV3140 running R12.1.0.E
The NV3430 has no ffe mentioned anywhere in the config file, and the VPN section begins with 'ip crypto'
The NV3140 has 'ip crypto ffe', though I haven't copied the crypto section over from the NV3430
Should I use 'ip crypto' on the Ethernet interface(s), the Crypto section, both?