From mboxrd@z Thu Jan  1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@ipfire.org>
To: development@lists.ipfire.org
Subject: Question regarding IPsec N2N throughput with and without IPS
Date: Wed, 22 Jan 2020 16:24:00 +0000
Message-ID: <c9ef30fe-d3ce-ace5-2cd4-0a4d446c689c@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8080590849530200185=="
List-Id: <development.lists.ipfire.org>

--===============8080590849530200185==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hello Stefan, hello list (CC'ed),

are you aware of any IPS bottlenecks regarding IPsec N2N throughput?

I finally (!) managed to get an IPsec connection between OpenBSD 6.6 (OpenIKE=
D)
and IPFire 2.23 Core Update 139 working. During throughput tests, where
I downloaded a 1 GByte test file from the machine via the IPsec tunnel,
a rather large throughput difference with and without IPS enabled on RED
has come to my attention:

With IPS enabled on RED, the download starts at ~ 2.5 MByte/sec. and
continually decreases to ~ 580 kByte/sec. - 800 kByte/sec., which is
even lower than OpenVPN performance. Without IPS enabled on RED, throughput
is 4.0 MByte/sek. on average - running the IPS on other interfaces does
not change this behaviour, neither does enabling monitoring mode.

This suspiciously sounds like the issue we have had with Suricata last
year - as far as I am concerned that was fully fixed. Are you aware of
any other similar issue that could cause this massive throughput loss?

Anyway, thank you in advance for any help and hints. :-)

Kernel and CPU information of the OpenBSD machine:
> openbsd# uname -a
> OpenBSD openbsd 6.6 GENERIC.MP#4 amd64
> openbsd# sysctl hw.model hw.machine hw.ncpu
> hw.model=3DIntel(R) Xeon(R) CPU E5-2680 v2 @ 2.80GHz
> hw.machine=3Damd64
> hw.ncpu=3D2

Content of /etc/iked.conf on the OpenBSD machine:
> set fragmentation
>=20
> ikev2 "[REDACTED]" active esp \
>    from 10.xxx.xxx.2/24 to 10.xxx.xxx.0/24 \
>    local [REDACTED] peer [REDACTED] \
>    ikesa auth hmac-sha2-512 enc aes-256 prf hmac-sha2-512 group curve25519 \
>    childsa enc aes-256-gcm group curve25519 \
>    srcid [REDACTED] dstid [REDACTED] \
>    ikelifetime 3h \
>    lifetime 1h

Kernel and CPU information of the IPFire machine:
> [root(a)maverick ~]# uname -a
> Linux maverick 4.14.154-ipfire #1 SMP Fri Nov 15 07:27:41 GMT 2019 x86_64 I=
ntel(R) Celeron(R) CPU N3150 @ 1.60GHz GenuineIntel GNU/Linux

Thanks, and best regards,
Peter M=C3=BCller

--===============8080590849530200185==--