documentation:examples:openvpn_performance_lab_of_an_ibm_system_x3550_m3_with_intel_82580
no way to compare when less than two revisions
Differences
This shows you the differences between two versions of the page.
| — | documentation:examples:openvpn_performance_lab_of_an_ibm_system_x3550_m3_with_intel_82580 [2017/01/23 00:10] (current) – created - external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ====== OpenVPN performance lab of an IBM System x3550 M3 with Intel 82580 ====== | ||
| + | {{description> | ||
| + | ===== Hardware detail ===== | ||
| + | |||
| + | This lab will test an [[IBM System x3550 M3]] with **quad** cores (Intel Xeon L5630 2.13GHz, hyper-threading disabled) and a quad NIC 82580 connected to the PCI-Express Bus. | ||
| + | |||
| + | This CPU includes AES-NI: AES-CBC, | ||
| + | ===== Method used ===== | ||
| + | |||
| + | The benchmarking method used here is detailed in [[documentation: | ||
| + | |||
| + | ==== Diagram ==== | ||
| + | |||
| + | < | ||
| + | +---------------------+ | ||
| + | | R1 | ||
| + | | | ||
| + | | and receiver | ||
| + | | | ||
| + | |igb2: 198.18.0.201/ | ||
| + | | | ||
| + | | 00: | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | |igb3: 198.19.0.201/ | ||
| + | |2001: | ||
| + | | | ||
| + | +---------------------+ | ||
| + | || || | ||
| + | ==================================< | ||
| + | </ | ||
| + | |||
| + | ===== Devices configuration ===== | ||
| + | |||
| + | Almost the same as on the forwarding performance lab but with fastforwarding disabled (not compatible with IPsec). | ||
| + | |||
| + | |||
| + | ==== R2 (DUT) ==== | ||
| + | |||
| + | Disable fastforwarding (not compliant with IPSec), configure IP address, routes and static IPSec. | ||
| + | |||
| + | / | ||
| + | < | ||
| + | # IPv4 router | ||
| + | gateway_enable=" | ||
| + | ifconfig_igb2=" | ||
| + | ifconfig_igb3=" | ||
| + | # Route toward receiver will be pushed by OpenVPN client | ||
| + | static_routes=" | ||
| + | route_generator=" | ||
| + | static_arp_pairs=" | ||
| + | static_arp_generator=" | ||
| + | static_arp_receiver=" | ||
| + | |||
| + | # IPv6 router | ||
| + | ipv6_gateway_enable=" | ||
| + | ipv6_activate_all_interfaces=" | ||
| + | ifconfig_igb2_ipv6=" | ||
| + | ifconfig_igb3_ipv6=" | ||
| + | ipv6_static_routes=" | ||
| + | ipv6_route_generator=" | ||
| + | static_ndp_pairs=" | ||
| + | static_ndp_generator=" | ||
| + | static_ndp_receiver=" | ||
| + | |||
| + | # Enabling OpenVPN | ||
| + | openvpn_enable=" | ||
| + | |||
| + | # Enabling AES-NI | ||
| + | kld_list=" | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | |||
| + | < | ||
| + | client | ||
| + | dev tun | ||
| + | remote 198.18.1.203 | ||
| + | ca ca.crt | ||
| + | cert client.crt | ||
| + | key client.key | ||
| + | ncp-disable | ||
| + | cipher AES-128-GCM | ||
| + | engine cryptodev | ||
| + | fast-io | ||
| + | </ | ||
| + | |||
| + | ==== R3 (reference) ==== | ||
| + | |||
| + | Disable fastforwarding (not compliant with IPSec), configure IP address, routes and static IPSec: | ||
| + | < | ||
| + | # IPv4 router | ||
| + | gateway_enable=" | ||
| + | ifconfig_igb2=" | ||
| + | ifconfig_igb3=" | ||
| + | |||
| + | # routes toward generator will be installed by OpenVPN | ||
| + | static_routes=" | ||
| + | route_receiver=" | ||
| + | static_arp_pairs=" | ||
| + | static_arp_generator=" | ||
| + | static_arp_receiver=" | ||
| + | |||
| + | # IPv6 router | ||
| + | ipv6_gateway_enable=" | ||
| + | ipv6_activate_all_interfaces=" | ||
| + | ifconfig_igb2_ipv6=" | ||
| + | ifconfig_igb3_ipv6=" | ||
| + | |||
| + | ipv6_static_routes=" | ||
| + | ipv6_route_receiver=" | ||
| + | static_ndp_pairs=" | ||
| + | static_ndp_generator=" | ||
| + | static_ndp_receiver=" | ||
| + | |||
| + | # Enabling OpenVPN | ||
| + | kld_list=" | ||
| + | openvpn_enable=" | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | |||
| + | < | ||
| + | dev tun | ||
| + | ca / | ||
| + | cert / | ||
| + | key / | ||
| + | dh / | ||
| + | server 172.16.254.0 255.255.255.0 | ||
| + | server-ipv6 2001: | ||
| + | ncp-disable | ||
| + | cipher AES-128-GCM | ||
| + | engine cryptodev | ||
| + | ifconfig-pool-persist ipp.txt | ||
| + | client-config-dir ccd | ||
| + | push "route 198.19.0.0 255.255.0.0" | ||
| + | push " | ||
| + | route 198.18.0.0 255.255.0.0 | ||
| + | route-ipv6 2001:2::/49 | ||
| + | keepalive 60 720 | ||
| + | fast-io | ||
| + | </ | ||
| + | |||
| + | ===== Equilibrium throughput benchmark methodology ===== | ||
| + | |||
| + | Once done, we start using a fast method for measuring the " | ||
| + | |||
| + | From the packet generator/ | ||
| + | < | ||
| + | [root@R1]/ | ||
| + | Benchmark tool using equilibrium throughput method | ||
| + | - Benchmark mode: Bandwitdh (bps) for VPN gateway | ||
| + | - UDP load = 500B, IPv4 packet size=528B, Ethernet frame size=542B | ||
| + | - Link rate = 1000 Mb/s | ||
| + | - Tolerance = 0.001 | ||
| + | Iteration 1 | ||
| + | - Offering load = 500 Mb/s | ||
| + | - Step = 250 Mb/s | ||
| + | - Measured forwarding rate = 500 Mb/s | ||
| + | Iteration 2 | ||
| + | - Offering load = 750 Mb/s | ||
| + | - Step = 250 Mb/s | ||
| + | - Trend = increasing | ||
| + | - Measured forwarding rate = 539 Mb/s | ||
| + | Iteration 3 | ||
| + | - Offering load = 625 Mb/s | ||
| + | - Step = 125 Mb/s | ||
| + | - Trend = decreasing | ||
| + | - Measured forwarding rate = 543 Mb/s | ||
| + | Iteration 4 | ||
| + | - Offering load = 563 Mb/s | ||
| + | - Step = 62 Mb/s | ||
| + | - Trend = decreasing | ||
| + | - Measured forwarding rate = 545 Mb/s | ||
| + | Iteration 5 | ||
| + | - Offering load = 532 Mb/s | ||
| + | - Step = 31 Mb/s | ||
| + | - Trend = decreasing | ||
| + | - Measured forwarding rate = 532 Mb/s | ||
| + | Iteration 6 | ||
| + | - Offering load = 547 Mb/s | ||
| + | - Step = 15 Mb/s | ||
| + | - Trend = increasing | ||
| + | - Measured forwarding rate = 545 Mb/s | ||
| + | Iteration 7 | ||
| + | - Offering load = 540 Mb/s | ||
| + | - Step = 7 Mb/s | ||
| + | - Trend = decreasing | ||
| + | - Measured forwarding rate = 540 Mb/s | ||
| + | Iteration 8 | ||
| + | - Offering load = 543 Mb/s | ||
| + | - Step = 3 Mb/s | ||
| + | - Trend = increasing | ||
| + | - Measured forwarding rate = 543 Mb/s | ||
| + | Iteration 9 | ||
| + | - Offering load = 544 Mb/s | ||
| + | - Step = 1 Mb/s | ||
| + | - Trend = increasing | ||
| + | - Measured forwarding rate = 543 Mb/s | ||
| + | Estimated Equilibrium Ethernet throughput= 543 Mb/s (maximum value seen: 545 Mb/s) | ||
| + | </ | ||
| + | |||
| + | => OpenVPN (userspace) reach about 454Mb/s which is about half IPSec performance (kernel space) | ||
| + | |||
| + | ==== Encryption algorithms ==== | ||
| + | |||
| + | {{documentation: | ||
documentation/examples/openvpn_performance_lab_of_an_ibm_system_x3550_m3_with_intel_82580.txt · Last modified: 2017/01/23 00:10 by 127.0.0.1