Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Bandwidth IPSEC / AES-NI / Bad perf

    IPsec
    3
    9
    535
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Y
      Yazur
      last edited by Yazur

      Hello,

      I'm currently encountering a bandwidth problem in an IPSEC tunnel between 2 pfsense.

      The first pfsense is physical at our company headquarters.
      The second is virtual on a private cloud OVH "ESX vmware".

      From my PC in LAN at our company headquarters, I get 8mo/s download and 3mo/s through the ipsec tunnel.

      By doing a speedtest from the LAN of the head office I get 30 mbps download and 60 mbps upload.

      And by doing a speedtest from OVH I get 30 mbps download and 30 mbps upload.

      The hardware we have supports "AES-NI".

      What we have tried:

      • Change "MTU and MSS".
      • Changing the IPSEC configuration
      • Activation of AES-NI in pfsense --> advanced --> Miscellaneous

      Do you have any other ideas?

      1 Reply Last reply Reply Quote 0
      • Y
        Yazur
        last edited by

        up

        1 Reply Last reply Reply Quote 0
        • Y
          Yazur
          last edited by

          up

          1 Reply Last reply Reply Quote 0
          • RicoR
            Rico LAYER 8 Rebel Alliance
            last edited by

            Which Cipher are you using?
            I'm not an IPsec guy (using OpenVPN all day long...) BUT I think it is the same with IPsec... you need to use AES-GCM to really have AES-NI kick in.

            -Rico

            2x Netgate XG-7100 | 11x Netgate SG-5100 | 6x Netgate SG-3100 | 2x Netgate SG-1100

            N 1 Reply Last reply Reply Quote 1
            • N
              Napsterbater @Rico
              last edited by

              Try these settings for Phase 1 and 2, i'm pretty sure I based them on an official guide or wiki entry but I can not find it right now, but i'm hitting about 315mpbs (maxing out the link) with the weaker side being just a Intel Celeron N3150 @ 1.60GHz 4 CPUs: 1 package(s) x 4 core(s).

              Capture.PNG
              Capture2.PNG

              Y 1 Reply Last reply Reply Quote 0
              • Y
                Yazur @Napsterbater
                last edited by

                @Napsterbater @Rico

                Thank you for your answers, could you tell me if you are on virtual or physical hardware?

                Because on our side we are on virtualization on one side and physical on the other.

                We had also tested in the past to have VIRTUAL hardware on both sides, without having a difference in performance.

                Here are our P1 and P2 configurations:

                text alternatif

                text alternatif

                N 1 Reply Last reply Reply Quote 0
                • N
                  Napsterbater @Yazur
                  last edited by

                  @Yazur said in Bandwidth IPSEC / AES-NI / Bad perf:

                  Because on our side we are on virtualization on one side and physical on the other.

                  Physical, both sides.

                  Make sure

                  System -> Advanced -> Miscellaneous:
                  Cryptographic Hardware: AES-NI CPU-based Acceleration

                  is set.

                  And make sure both systems show:

                  "AES-NI CPU Crypto: Yes (active)"
                  on the dashboard under System Information / CPU Type

                  1 Reply Last reply Reply Quote 0
                  • Y
                    Yazur
                    last edited by

                    I checked and the AES-NI is well activated on both sides.

                    Are our P1 and P2 configurations good?

                    N 1 Reply Last reply Reply Quote 0
                    • N
                      Napsterbater @Yazur
                      last edited by

                      @Yazur said in Bandwidth IPSEC / AES-NI / Bad perf:

                      Are our P1 and P2 configurations good?

                      I can only note they do not match mine exactly, but I do not know if they are wrong and if they should be working or not.

                      I only know that my exact settings works. :-/

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post