documentation:examples:ipsec_performance_of_a_pc_engines_apu
Differences
This shows you the differences between two versions of the page.
| — | documentation:examples:ipsec_performance_of_a_pc_engines_apu [2016/12/01 16:09] (current) – created - external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ====== IPSec performance lab of a PC Engines APU ====== | ||
| + | {{description> | ||
| + | ===== Hardware detail ===== | ||
| + | |||
| + | This lab will test a [[http:// | ||
| + | * Dual core [[http:// | ||
| + | * 3 Realtek RTL8111E Gigabit Ethernet ports | ||
| + | * 2Gb of RAM | ||
| + | |||
| + | [[documentation: | ||
| + | ===== Lab set-up ===== | ||
| + | |||
| + | For more information about full setup of this lab: [[documentation: | ||
| + | |||
| + | A current version of [[https:// | ||
| + | |||
| + | ==== Diagram ==== | ||
| + | |||
| + | < | ||
| + | +---------------------+ | ||
| + | | R1 | ||
| + | | | ||
| + | | and receiver | ||
| + | | | ||
| + | |igb2: 198.18.0.201/ | ||
| + | | | ||
| + | | 00: | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | |igb3: 198.19.0.201/ | ||
| + | |2001: | ||
| + | | | ||
| + | +---------------------+ | ||
| + | || || | ||
| + | ==================================< | ||
| + | </ | ||
| + | |||
| + | ===== Devices configuration ===== | ||
| + | |||
| + | ==== R1 (Packet generator/ | ||
| + | |||
| + | < | ||
| + | ifconfig igb2 up | ||
| + | ifconfig igb3 up | ||
| + | </ | ||
| + | |||
| + | ==== APU (DUT) ==== | ||
| + | |||
| + | Disable fastforwarding (not compliant with IPSec), configure IP address, routes and static IPSec. | ||
| + | |||
| + | / | ||
| + | < | ||
| + | # Hostname | ||
| + | hostname=" | ||
| + | |||
| + | # Disable INTERRUPT and ETHERNET from entropy sources | ||
| + | harvest_mask=" | ||
| + | |||
| + | # IPv4 router | ||
| + | gateway_enable=" | ||
| + | ifconfig_re1=" | ||
| + | ifconfig_re2=" | ||
| + | static_routes=" | ||
| + | route_generator=" | ||
| + | route_receiver=" | ||
| + | static_arp_pairs=" | ||
| + | static_arp_generator=" | ||
| + | static_arp_receiver=" | ||
| + | |||
| + | # IPv6 router | ||
| + | ipv6_gateway_enable=" | ||
| + | ipv6_activate_all_interfaces=" | ||
| + | ipv6_static_routes=" | ||
| + | ipv6_route_generator=" | ||
| + | ipv6_route_receiver=" | ||
| + | ifconfig_re1_ipv6=" | ||
| + | ifconfig_re2_ipv6=" | ||
| + | static_ndp_pairs=" | ||
| + | static_ndp_generator=" | ||
| + | static_ndp_receiver=" | ||
| + | |||
| + | # Enabling IPSec | ||
| + | ipsec_enable=" | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | |||
| + | < | ||
| + | flush; | ||
| + | spdflush; | ||
| + | spdadd 198.18.0.0/ | ||
| + | spdadd 198.19.0.0/ | ||
| + | add 198.18.1.203 198.18.1.207 esp 0x1000 -E rijndael-cbc " | ||
| + | add 198.18.1.207 198.18.1.203 esp 0x1001 -E rijndael-cbc " | ||
| + | spdadd 2001:2::/49 2001: | ||
| + | spdadd 2001: | ||
| + | add 2001: | ||
| + | add 2001: | ||
| + | </ | ||
| + | ==== R3 (Reference device) ==== | ||
| + | |||
| + | Disable fastforwarding (not compliant with IPSec), configure IP address, routes and static IPSec. | ||
| + | |||
| + | / | ||
| + | < | ||
| + | # Hostname | ||
| + | hostname=" | ||
| + | |||
| + | # Disable INTERRUPT and ETHERNET from entropy sources | ||
| + | harvest_mask=" | ||
| + | |||
| + | # IPv4 router | ||
| + | gateway_enable=" | ||
| + | ifconfig_igb2=" | ||
| + | ifconfig_igb3=" | ||
| + | |||
| + | static_routes=" | ||
| + | route_generator=" | ||
| + | route_receiver=" | ||
| + | static_arp_pairs=" | ||
| + | static_arp_generator=" | ||
| + | static_arp_receiver=" | ||
| + | |||
| + | # IPv6 router | ||
| + | ipv6_gateway_enable=" | ||
| + | ipv6_activate_all_interfaces=" | ||
| + | ifconfig_igb2_ipv6=" | ||
| + | ifconfig_igb3_ipv6=" | ||
| + | |||
| + | ipv6_static_routes=" | ||
| + | ipv6_route_generator=" | ||
| + | ipv6_route_receiver=" | ||
| + | static_ndp_pairs=" | ||
| + | static_ndp_generator=" | ||
| + | static_ndp_receiver=" | ||
| + | |||
| + | # Enabling IPSec | ||
| + | kld_list=" | ||
| + | ipsec_enable=" | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | flush; | ||
| + | spdflush; | ||
| + | spdadd 198.18.0.0/ | ||
| + | spdadd 198.19.0.0/ | ||
| + | add 198.18.1.203 198.18.1.207 esp 0x1000 -E rijndael-cbc " | ||
| + | add 198.18.1.207 198.18.1.203 esp 0x1001 -E rijndael-cbc " | ||
| + | spdadd 2001:2::/49 2001: | ||
| + | spdadd 2001: | ||
| + | add 2001: | ||
| + | add 2001: | ||
| + | </ | ||
| + | |||
| + | ===== Using IPSec bench " | ||
| + | |||
| + | Once done, we start using a fast method for measuring the "IPsec equilibrium throughput" | ||
| + | |||
| + | Notice that the reference device (IBM x3550-M3) used in front of the PC Engines APU1 has a [[IPSec performance lab of an IBM System x3550 M3 with Intel 82580|equilibrium throughput of 843Mb/s]]. Then if the value measured during this bench is close to 843Mb/s we had to found a more powerful reference device. | ||
| + | |||
| + | From the packet generator/ | ||
| + | < | ||
| + | [root@R1]# equilibrium -l 100 -d 00: | ||
| + | Benchmark tool using equilibrium throughput method | ||
| + | - Benchmark mode: Bandwitdh (bps) for VPN gateway | ||
| + | - UDP load = 500B, IPv4 packet size=528B, Ethernet frame size=542B | ||
| + | - Link rate = 100 Mb/s | ||
| + | - TOLERANCE = 0.01 | ||
| + | Iteration 1 | ||
| + | - offering load = 50 Mb/s | ||
| + | - STEP = 25 Mb/s | ||
| + | - Measured forwarding rate = 50 Mb/s | ||
| + | Iteration 2 | ||
| + | - offering load = 75 Mb/s | ||
| + | - STEP = 25 Mb/s | ||
| + | - TREND = increasing | ||
| + | - Measured forwarding rate = 72 Mb/s | ||
| + | Iteration 3 | ||
| + | - offering load = 63 Mb/s | ||
| + | - STEP = 12 Mb/s | ||
| + | - TREND = decreasing | ||
| + | - Measured forwarding rate = 63 Mb/s | ||
| + | Iteration 4 | ||
| + | - offering load = 69 Mb/s | ||
| + | - STEP = 6 Mb/s | ||
| + | - TREND = increasing | ||
| + | - Measured forwarding rate = 68 Mb/s | ||
| + | Iteration 5 | ||
| + | - offering load = 66 Mb/s | ||
| + | - STEP = 3 Mb/s | ||
| + | - TREND = decreasing | ||
| + | - Measured forwarding rate = 65 Mb/s | ||
| + | Estimated Equilibrium Ethernet throughput= 65 Mb/s (maximum value seen: 72 Mb/s) | ||
| + | </ | ||
| + | |||
| + | Here is the ministat distribution: | ||
| + | < | ||
| + | root@R1:~ # ministat -s -w 74 apu-ipsec | ||
| + | x Equilibrium throughput with rijndael-cbc | ||
| + | +--------------------------------------------------------------------------+ | ||
| + | | | ||
| + | |x | ||
| + | | |___________________________A__________M_______________| | ||
| + | +--------------------------------------------------------------------------+ | ||
| + | N | ||
| + | x | ||
| + | |||
| + | </ | ||
| + | Using AES-CBC (rijndael-cbc) with a 128 bits key, we can estimate an IPSec Equilibrium throughput of 64Mb/s. | ||
| + | |||
| + | And same performance for IPv6: | ||
| + | < | ||
| + | [root@R1]# equilibrium -l 100 -d 00: | ||
| + | Benchmark tool using equilibrium throughput method | ||
| + | - Benchmark mode: Bandwitdh (bps) for VPN gateway | ||
| + | - UDP load = 500B, IPv6 packet size=548B, Ethernet frame size=562B | ||
| + | - Link rate = 100 Mb/s | ||
| + | - TOLERANCE = 0.01 | ||
| + | Iteration 1 | ||
| + | - offering load = 50 Mb/s | ||
| + | - STEP = 25 Mb/s | ||
| + | - Measured forwarding rate = 50 Mb/s | ||
| + | Iteration 2 | ||
| + | - offering load = 75 Mb/s | ||
| + | - STEP = 25 Mb/s | ||
| + | - TREND = increasing | ||
| + | - Measured forwarding rate = 72 Mb/s | ||
| + | Iteration 3 | ||
| + | - offering load = 63 Mb/s | ||
| + | - STEP = 12 Mb/s | ||
| + | - TREND = decreasing | ||
| + | - Measured forwarding rate = 63 Mb/s | ||
| + | Iteration 4 | ||
| + | - offering load = 69 Mb/s | ||
| + | - STEP = 6 Mb/s | ||
| + | - TREND = increasing | ||
| + | - Measured forwarding rate = 68 Mb/s | ||
| + | Iteration 5 | ||
| + | - offering load = 66 Mb/s | ||
| + | - STEP = 3 Mb/s | ||
| + | - TREND = decreasing | ||
| + | - Measured forwarding rate = 66 Mb/s | ||
| + | Estimated Equilibrium Ethernet throughput= 66 Mb/s (maximum value seen: 72 Mb/s) | ||
| + | </ | ||
| + | |||
| + | ==== Graphs ==== | ||
| + | |||
| + | {{: | ||