Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    IPsec performance

    IPsec
    1
    3
    348
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mgaudette last edited by

      Hi,

      I have two HP computers, one a DL360G7 (with AES-NI enabled) and one run-of-the-mill HP PC configured as pfSense 2.4.2 routers (also with AES-NI). One has 8GB of RAM, the other has 48GB of RAM.

      Here are dashboard snippets of CPUs.

      Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz
      4 CPUs: 1 package(s) x 4 core(s)
      AES-NI CPU Crypto: Yes (active)
      
      Intel(R) Xeon(R) CPU E5606 @ 2.13GHz
      4 CPUs: 1 package(s) x 4 core(s)
      AES-NI CPU Crypto: Yes (active)
      

      I'm connecting those two networks through IPsec over as 100Mbit/s+ connection (tested at 115Mbit/s just now), and I am seeing a throughput of only 30Mbit/s with iperf3.  Both CPU's are hovering in the single digits, and there is basically nothing else going on this link.

      My IPsec is configured with AES-GCM128 SHA512.

      AES_GCM_16
      
      PRF_HMAC_SHA2_512
      MODP_1024
      

      I believe the performance is not what you'd expect with such relatively beefy machines.

      What can  influence/improve IPsec performance? It actually seems to have decrease when I put the server in, as opposed to the old Lanner 7535 I had before (with no AES-NI)

      1 Reply Last reply Reply Quote 0
      • M
        mgaudette last edited by

        …I ran iperf3 in reverse (i5 CPU decrypting instead of encrypting) - making the decrypting CPU the most powerful one. I can now reach 80Mbit/s.

        Still, I don't understand how this doesn't go any fast than my old Lanner (DL3650G7 vs Lanner FW-7535? Come on...). I thought I'd be able to saturate a 100Mbit/s link at least.

        1 Reply Last reply Reply Quote 0
        • M
          mgaudette last edited by

          Sometimes you have good days, and sometimes bad ones.

          This is a bad day; I have been toying around too much around data centers and totally forgot my home internet wasn't quite as symetrically performant (faster download of course)

          I'll show myself out (and lock this thread)

          1 Reply Last reply Reply Quote 0
          • First post
            Last post