documentation:examples:ipsec_performance_of_a_pc_engines_apu2
no way to compare when less than two revisions
Differences
This shows you the differences between two versions of the page.
Last revision | |||
— | documentation:examples:ipsec_performance_of_a_pc_engines_apu2 [2017/01/22 08:22] – external edit 127.0.0.1 | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ====== IPSec performance lab of a PC Engines APU2 ====== | ||
+ | {{description> | ||
+ | ===== Hardware detail ===== | ||
+ | |||
+ | This lab will test a [[http:// | ||
+ | * Quad core [[https:// | ||
+ | * 3 with Intel i210AT Gigabit | ||
+ | * 4Gb of RAM | ||
+ | ===== Lab set-up ===== | ||
+ | |||
+ | For more information about full setup of this lab: [[documentation: | ||
+ | ==== Diagram ==== | ||
+ | |||
+ | < | ||
+ | +---------------------+ | ||
+ | | R1 | ||
+ | | | ||
+ | | and receiver | ||
+ | | | ||
+ | |igb2: 198.18.0.201/ | ||
+ | | | ||
+ | | 00: | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | |igb3: 198.19.0.201/ | ||
+ | |2001: | ||
+ | | | ||
+ | +---------------------+ | ||
+ | || || | ||
+ | ==================================< | ||
+ | </ | ||
+ | |||
+ | ===== Devices configuration ===== | ||
+ | |||
+ | |||
+ | ==== APU2 (DUT) ==== | ||
+ | |||
+ | Disable fastforwarding (not compliant with IPSec), configure IP address, routes and static IPSec: | ||
+ | |||
+ | / | ||
+ | < | ||
+ | # IPv4 router | ||
+ | gateway_enable=" | ||
+ | ifconfig_igb1=" | ||
+ | ifconfig_igb2=" | ||
+ | static_routes=" | ||
+ | route_generator=" | ||
+ | route_receiver=" | ||
+ | static_arp_pairs=" | ||
+ | static_arp_generator=" | ||
+ | static_arp_receiver=" | ||
+ | |||
+ | # IPv6 router | ||
+ | ipv6_gateway_enable=" | ||
+ | ipv6_activate_all_interfaces=" | ||
+ | ifconfig_igb1_ipv6=" | ||
+ | ifconfig_igb2_ipv6=" | ||
+ | ipv6_static_routes=" | ||
+ | ipv6_route_generator=" | ||
+ | ipv6_route_receiver=" | ||
+ | static_ndp_pairs=" | ||
+ | static_ndp_generator=" | ||
+ | static_ndp_receiver=" | ||
+ | |||
+ | # Enabling IPSec | ||
+ | ipsec_enable=" | ||
+ | |||
+ | # Enabling AES-NI | ||
+ | kld_list=" | ||
+ | </ | ||
+ | |||
+ | / | ||
+ | |||
+ | < | ||
+ | flush; | ||
+ | spdflush; | ||
+ | spdadd 198.18.0.0/ | ||
+ | spdadd 198.19.0.0/ | ||
+ | add 198.18.1.203 198.18.1.205 esp 0x1000 -E aes-gcm-16 " | ||
+ | add 198.18.1.205 198.18.1.203 esp 0x1001 -E aes-gcm-16 " | ||
+ | spdadd 2001:2::/49 2001: | ||
+ | spdadd 2001: | ||
+ | add 2001: | ||
+ | add 2001: | ||
+ | </ | ||
+ | |||
+ | ==== R3 (Reference device) ==== | ||
+ | |||
+ | Disable fastforwarding (not compliant with IPSec), configure IP address, routes and static IPSec: | ||
+ | < | ||
+ | # IPv4 router | ||
+ | gateway_enable=" | ||
+ | ifconfig_igb2=" | ||
+ | ifconfig_igb3=" | ||
+ | |||
+ | static_routes=" | ||
+ | route_generator=" | ||
+ | route_receiver=" | ||
+ | static_arp_pairs=" | ||
+ | static_arp_generator=" | ||
+ | static_arp_receiver=" | ||
+ | |||
+ | # IPv6 router | ||
+ | ipv6_gateway_enable=" | ||
+ | ipv6_activate_all_interfaces=" | ||
+ | ifconfig_igb2_ipv6=" | ||
+ | ifconfig_igb3_ipv6=" | ||
+ | |||
+ | ipv6_static_routes=" | ||
+ | ipv6_route_generator=" | ||
+ | ipv6_route_receiver=" | ||
+ | static_ndp_pairs=" | ||
+ | static_ndp_generator=" | ||
+ | static_ndp_receiver=" | ||
+ | |||
+ | # Enabling IPSec | ||
+ | kld_list=" | ||
+ | ipsec_enable=" | ||
+ | </ | ||
+ | |||
+ | / | ||
+ | |||
+ | < | ||
+ | flush; | ||
+ | spdflush; | ||
+ | spdadd 198.18.0.0/ | ||
+ | spdadd 198.19.0.0/ | ||
+ | add 198.18.1.203 198.18.1.205 esp 0x1000 -E aes-gcm-16 " | ||
+ | add 198.18.1.205 198.18.1.203 esp 0x1001 -E aes-gcm-16 " | ||
+ | spdadd 2001:2::/49 2001: | ||
+ | spdadd 2001: | ||
+ | add 2001: | ||
+ | add 2001: | ||
+ | </ | ||
+ | |||
+ | |||
+ | ===== Using IPSec bench " | ||
+ | |||
+ | Once done, we start using a fast method for measuring the "IPsec equilibrium throughput" | ||
+ | |||
+ | Notice that the reference device (IBM x3550-M3) used in front of the PC Engines APU2 has a [[IPSec performance lab of an IBM System x3550 M3 with Intel 82580|equilibrium throughput of 843Mb/s]]. Then if the value measured during this bench is close to 843Mb/s we had to found a more powerful reference device. | ||
+ | |||
+ | < | ||
+ | root@pkt-gen # equilibrium -4 -u -d 00: | ||
+ | Benchmark tool using equilibrium throughput method | ||
+ | - Benchmark mode: Bandwitdh (bps) for VPN gateway | ||
+ | - UDP load = 500B, IPv4 packet size=528B, Ethernet frame size=542B | ||
+ | - Link rate = 1000 Mb/s | ||
+ | - Tolerance = 0.01 | ||
+ | Iteration 1 | ||
+ | - Offering load = 500 Mb/s | ||
+ | - Step = 250 Mb/s | ||
+ | - Measured forwarding rate = 359 Mb/s | ||
+ | Iteration 2 | ||
+ | - Offering load = 250 Mb/s | ||
+ | - Step = 250 Mb/s | ||
+ | - Trend = decreasing | ||
+ | - Measured forwarding rate = 250 Mb/s | ||
+ | Iteration 3 | ||
+ | - Offering load = 375 Mb/s | ||
+ | - Step = 125 Mb/s | ||
+ | - Trend = increasing | ||
+ | - Measured forwarding rate = 356 Mb/s | ||
+ | Iteration 4 | ||
+ | - Offering load = 313 Mb/s | ||
+ | - Step = 62 Mb/s | ||
+ | - Trend = decreasing | ||
+ | - Measured forwarding rate = 313 Mb/s | ||
+ | Iteration 5 | ||
+ | - Offering load = 344 Mb/s | ||
+ | - Step = 31 Mb/s | ||
+ | - Trend = increasing | ||
+ | - Measured forwarding rate = 344 Mb/s | ||
+ | Iteration 6 | ||
+ | - Offering load = 359 Mb/s | ||
+ | - Step = 15 Mb/s | ||
+ | - Trend = increasing | ||
+ | - Measured forwarding rate = 351 Mb/s | ||
+ | Iteration 7 | ||
+ | - Offering load = 352 Mb/s | ||
+ | - Step = 7 Mb/s | ||
+ | - Trend = decreasing | ||
+ | - Measured forwarding rate = 350 Mb/s | ||
+ | Estimated Equilibrium Ethernet throughput= 350 Mb/s (maximum value seen: 359 Mb/s) | ||
+ | </ | ||
+ | |||
+ | And it reach a maximum of 359Mb/s. | ||
+ | |||
+ | ==== Graph ==== | ||
+ | |||
+ | {{bench.ipsec.on.pc.engines.apu2.png|IPSec | ||
documentation/examples/ipsec_performance_of_a_pc_engines_apu2.txt · Last modified: 2020/09/24 09:18 by olivier