C2758 vs C3758 for Gigabit VPN?
-
Haha nice, yea that thing is good to go.
This project is really get out of hand and over budget unfortunately. This all started when both mine and my parents go Gigabit fiber which is allowing me to move my local backup server off-site to their house (Site B) for weekly backups. Buying a new CPU/MoBo combo to replace the current J1900 I have there in Site B and just slapping it into the current NUC sized Mini-ITX case was really the plan. That plans is clearly that's going off the rails now.
Maybe I need to rethink what my actual needs are. As much as I'd like to saturate my gigabit link, if I can even get 50MB/s file transfers that would probably suffice.
-
I get gigabit throughput with about 60% processor using an old celeron. Similar setup to what I just told you about. $75
That board you said you have laying around will do it…. Just strap on a huge heatsink, just to be sure.
-
Yeah - the Intel Xeon D-1518 is only 35w. And has AES-NI support. You have what you need already.
-
I get gigabit throughput with about 60% processor using an old celeron. Similar setup to what I just told you about. $75
That board you said you have laying around will do it…. Just strap on a huge heatsink, just to be sure.
You get gigabit throughput across a Site-to-Site VPN? If so, with what settings?
-
Yeah - the Intel Xeon D-1518 is only 35w. And has AES-NI support. You have what you need already.
I have the Xeon D-1508, not 1518. Half the cores/threads.
-
No Havent not test with ipsec. However, I've seen people test 8 core atom boards with less guts than your board and get gigabit speed.
Its not hard to beat them as long as you have good per core performance, 2 or more cores and compatible gigabit NICs.
It just gets hard and expensive when you try to do it with a fanless computer the size of a couple packs of cigarettes.
-
No Havent not test with ipsec. However, I've seen people test 8 core atom boards with less guts than your board and get gigabit speed.
Its not hard to beat them as long as you have good per core performance, 2 or more cores and compatible gigabit NICs.
It just gets hard and expensive when you try to do it with a fanless computer the size of a couple packs of cigarettes.
Wait, I'm confused. So the C2758 SHOULD do close to 1Gbps IPsec? Because if it does than that solves all my issues.
-
https://store.netgate.com/pfSense/C2758.aspx
160
-
https://store.netgate.com/pfSense/C2758.aspx
160
However, I've seen people test 8 core atom boards with less guts than your board and get gigabit speed.
What 8 core atom board are you referring to then?
-
I thought I was referring to that one!
-
I thought I was referring to that one!
So the reason I'm confused is in one post you say you've seen people with the C2758 (an 8 core atom board) hit gigabit vpn speed but then in the next post you say it only hits 160 as per Netgate.
What am I missing?
-
haha. You are missing me being mistaken about the throughput of that board.
But I went looking again at an intel paper on ipsec and their chips and it does look like the best single core performance wins.
https://www.intel.com/content/dam/www/public/us/en/documents/white-papers/aes-ipsec-performance-linux-paper.pdf
Notice their testing is 1 core and 1 tunnel. Or 6 cores and 6 tunnels. Then 12 cores and 12 tunnels.
I still like the i3 kaby lake.
-
https://store.netgate.com/pfSense/C2758.aspx
160
For some bizarre reason they're quoting speeds without AES-NI there, and no AES-GCM. So, basically irrelevant.
-
haha. You are missing me being mistaken about the throughput of that board.
But I went looking again at an intel paper on ipsec and their chips and it does look like the best single core performance wins.
https://www.intel.com/content/dam/www/public/us/en/documents/white-papers/aes-ipsec-performance-linux-paper.pdf
Notice their testing is 1 core and 1 tunnel. Or 6 cores and 6 tunnels. Then 12 cores and 12 tunnels.
I still like the i3 kaby lake.
I don't entirely understand what you think you're seeing there. It has a single westmere core doing ~2Gbps IPSec 7 years ago on linux 2.6.
-
Haha nice, yea that thing is good to go.
This project is really get out of hand and over budget unfortunately. This all started when both mine and my parents go Gigabit fiber which is allowing me to move my local backup server off-site to their house (Site B) for weekly backups. Buying a new CPU/MoBo combo to replace the current J1900 I have there in Site B and just slapping it into the current NUC sized Mini-ITX case was really the plan. That plans is clearly that's going off the rails now.
Maybe I need to rethink what my actual needs are. As much as I'd like to saturate my gigabit link, if I can even get 50MB/s file transfers that would probably suffice.
How are you planning to do the backups?
-
I think I see a scenario where speed per tunnel is linked to speed per core. So unless you need many tunnels, a few very fast cores is best.
-
I think I see a scenario where speed per tunnel is linked to speed per core. So unless you need many tunnels, a few very fast cores is best.
7 years ago. On linux 2.6.
-
I'm not sure what your point is? Perhaps I'm approaching this the wrong way.
What would be the least expensive option to get 1 gb per sec on ipsec? Today.
-
I'm not sure what your point is? Perhaps I'm approaching this the wrong way.
The point is that quoting a paper that's almost a decade old for an obsolete version of a different operating system is not a useful way to predict performance characteristics.
-
OK - So, what would you suggest? Do you have specs and testing for something that is shown to support wire speed on a gigabit to gigabit connection?
My Feeling is that for a single tunnel the fastest dual core processor with AES-NI and good intel NIC will win. I haven't found anything better.I'm also interested in seeing an actual test of two kaby lake pfsense with IPSEC throughput.