IPSec tunnel performance issue

General questions
, , ,
1

I have an IPSec site-to-site vpn connection setup where both the VPN gws are VyOS
VyOS-1 <-----> VyOS-2
| – ---- – - - ---- |
sw1 – – - – - - - sw2
| – - — ---- - ---- |
sevr1 ----- server2

When testing iperf on my servers passing by IPsec tunnel, I get bandwidth up to 1 Gbps.
What is the maximum performance that is supported by ipsec site to site tunnel in vyos?

2

Try QAT if your devices support it

3

erro: system acceleration qat is not configured

Is vyos by default cannot go up to 1gpps with IPsec tunnel ? Because I saw already in the vyos forum that there are a lot of cases like mine, so I wonder if the max performance of ipsec is 1gps

4

VyOS does not implement any restrictions.
Are all interfaces involved more than giabitEthernet?

6

yes, it’s 10gb peer interface

7

Try different encryption|hash parameters
for example

set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128
set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1

Also check CPU utilization during the test
"sudo top" and press "1"

8

facing similar issue , any work around for this ?
do anyone able to achieve the bandwidth over 1gbps through ipsec ?

9

IPsec will unfortunately perform only to the level of your CPU’s single core performance. If you need more throughput with IPsec, you need a better performing CPU, or acceleration like Viacheslav mentioned previously in this thread.

You can solve it by looking towards alternatives for encryption like WireGuard. WireGuard uses all cores in a system so it is much more effecient. Here’s an example on a cheap $100USDmini-pc with a quad-core Celeron (2.7Ghz max clock):

IPsec:
[ ID] Interval Transfer Bitrate Retr
[ 5] 0.00-10.00 sec 1.51 GBytes 1.30 Gbits/sec 53 sender
[ 5] 0.00-10.00 sec 1.51 GBytes 1.30 Gbits/sec receiver

Wireguard:
[ ID] Interval Transfer Bitrate Retr
[ 5] 0.00-10.00 sec 2.26 GBytes 1.94 Gbits/sec 3366 sender
[ 5] 0.00-10.00 sec 2.26 GBytes 1.94 Gbits/sec receiver

Here’s a look at the CPU utilization during those tests:

IPsec:

image
image783×121 4.24 KB

WireGuard:

image
image781×117 4.13 KB

Almost 2Gbps in a $100USD mini-PC isn’t bad. You can of course get much more performance with a more capable box.

1 Like