Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPsec performance

    Scheduled Pinned Locked Moved IPsec
    3 Posts 1 Posters 660 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mgaudette
      last edited by

      Hi,

      I have two HP computers, one a DL360G7 (with AES-NI enabled) and one run-of-the-mill HP PC configured as pfSense 2.4.2 routers (also with AES-NI). One has 8GB of RAM, the other has 48GB of RAM.

      Here are dashboard snippets of CPUs.

      Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz
      4 CPUs: 1 package(s) x 4 core(s)
      AES-NI CPU Crypto: Yes (active)
      
      Intel(R) Xeon(R) CPU E5606 @ 2.13GHz
      4 CPUs: 1 package(s) x 4 core(s)
      AES-NI CPU Crypto: Yes (active)
      

      I'm connecting those two networks through IPsec over as 100Mbit/s+ connection (tested at 115Mbit/s just now), and I am seeing a throughput of only 30Mbit/s with iperf3.  Both CPU's are hovering in the single digits, and there is basically nothing else going on this link.

      My IPsec is configured with AES-GCM128 SHA512.

      AES_GCM_16
      
      PRF_HMAC_SHA2_512
      MODP_1024
      

      I believe the performance is not what you'd expect with such relatively beefy machines.

      What can  influence/improve IPsec performance? It actually seems to have decrease when I put the server in, as opposed to the old Lanner 7535 I had before (with no AES-NI)

      1 Reply Last reply Reply Quote 0
      • M
        mgaudette
        last edited by

        …I ran iperf3 in reverse (i5 CPU decrypting instead of encrypting) - making the decrypting CPU the most powerful one. I can now reach 80Mbit/s.

        Still, I don't understand how this doesn't go any fast than my old Lanner (DL3650G7 vs Lanner FW-7535? Come on...). I thought I'd be able to saturate a 100Mbit/s link at least.

        1 Reply Last reply Reply Quote 0
        • M
          mgaudette
          last edited by

          Sometimes you have good days, and sometimes bad ones.

          This is a bad day; I have been toying around too much around data centers and totally forgot my home internet wasn't quite as symetrically performant (faster download of course)

          I'll show myself out (and lock this thread)

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.