I've set up the gre over ipsec tunnel between SRX650 and MX5 (MS-MIC onboard). While SRX is able to serve ipsec tunnels traffic at about 100-200 Mbit/sec to other SRXes, I can get only about 1.5 Mbit/sec on SRX-MX link. I've played with MTU/MSS settings to ensure the proper fragmentation... but surprisingly this has zero influence on the speed, while I can observe that for instance 4k packets get fragmented properly. I've also tested the speed between same endpoints without ipsec (they have also public IPs, that are routed through the same exit points) - I get FTP transfer speed at about 100 Mbit/sec.
Is there some performance tweak that I'm unaware of ?
Update: revamped the configuration to get rid off the GRE intermediate incapsulation. Unfortunately, ipsec VPN speed still stays around 1.5 MBit/sec.
show chassis hardware:
emz@LDN-MX5> show chassis hardware
Hardware inventory:
Item Version Part number Serial number Description
Chassis XXXXX MX5-T
Midplane REV 10 711-038215 XXXXXXXX MX5-T
PEM 0 Rev 05 740-028288 XI00424 AC Power Entry Module
PEM 1 Rev 05 740-028288 XI00409 AC Power Entry Module
Routing Engine BUILTIN BUILTIN Routing Engine
TFEB 0 BUILTIN BUILTIN Forwarding Engine Processor
QXM 0 REV 06 711-028408 XXXXXXXXX MPC QXM
FPC 0 BUILTIN BUILTIN MPC BUILTIN
MIC 0 BUILTIN BUILTIN 4x 10GE XFP
PIC 0 BUILTIN BUILTIN 4x 10GE XFP
MIC 1 REV 02 750-061622 XXXXXXXX MS-MIC-16G
PIC 2 BUILTIN BUILTIN MS-MIC-16G
FPC 1 BUILTIN BUILTIN MPC BUILTIN
MIC 0 REV 30 750-028392 XXXXXXXX 3D 20x 1GE(LAN) SFP
PIC 0 BUILTIN BUILTIN 10x 1GE(LAN) SFP
Xcvr 0 REV 02 740-013111 B302483 SFP-T
Xcvr 1 REV 02 740-013111 B302729 SFP-T
Xcvr 2 REV 02 740-013111 F172228 SFP-T
PIC 1 BUILTIN BUILTIN 10x 1GE(LAN) SFP
Xcvr 0 REV 02 740-013111 B261212 SFP-T
Xcvr 1 REV 02 740-013111 F380617 SFP-T
Xcvr 2 REV 02 740-013111 F150924 SFP-T
Xcvr 3 REV 02 740-013111 B304909 SFP-T
Fan Tray Fan Tra
configuration, important pieces:
chassis {
fpc 0 {
pic 0 {
tunnel-services {
bandwidth 1g;
}
inline-services {
bandwidth 1g;
}
}
pic 2 {
adaptive-services {
service-package layer-3;
}
}
}
alarm {
management-ethernet {
link-down ignore;
}
}
}
services {
service-set nat-lan {
nat-rules default;
interface-service {
service-interface ms-0/2/0;
}
}
service-set tcp-mss {
tcp-mss 1343;
service-set-options {
enable-asymmetric-traffic-processing;
}
stateful-firewall-rules permit-all;
interface-service {
service-interface ms-0/2/0.3;
}
}
service-set ipsec-srx-perm {
next-hop-service {
inside-service-interface ms-0/2/0.4;
outside-service-interface ms-0/2/0.5;
}
ipsec-vpn-options {
local-gateway 93.179.66.1;
}
ipsec-vpn-rules srx-perm;
}
ipsec-vpn {
rule ipsec {
term 1 {
from {
source-address {
172.16.6.1/32;
}
destination-address {
172.16.6.0/32;
}
}
then {
remote-gateway 91.196.139.1;
dynamic {
ike-policy ike-policy;
ipsec-policy ipsec-policy;
}
initiate-dead-peer-detection;
}
}
match-direction input;
}
rule srx-perm {
term default {
from {
ipsec-inside-interface ms-0/2/0.4;
}
then {
remote-gateway 91.196.139.1;
dynamic {
ike-policy ike-policy;
ipsec-policy ipsec-policy;
}
copy-dont-fragment-bit;
initiate-dead-peer-detection;
dead-peer-detection {
interval 10;
threshold 5;
}
}
}
match-direction input;
}
ipsec {
proposal ipsec-proposal {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm aes-128-cbc;
}
policy ipsec-policy {
perfect-forward-secrecy {
keys group2;
}
proposals ipsec-proposal;
}
}
ike {
proposal ike-proposal {
authentication-method pre-shared-keys;
dh-group group19;
authentication-algorithm sha-256;
encryption-algorithm aes-128-cbc;
lifetime-seconds 14400;
}
policy ike-policy {
proposals ike-proposal;
local-id ipv4_addr 93.179.66.1;
pre-shared-key ascii-text "$9$oQZiqmPQz3/24F/CuIRhSrKX-wsgoJDlKx-VboaGDiHqf0OR"; ## SECRET-DATA
}
}
establish-tunnels immediately;
}
stateful-firewall {
rule permit-all {
match-direction input-output;
term accept {
then {
accept;
}
}
}
}
nat {
pool pool-default {
address 93.179.66.3/32;
port {
automatic;
}
}
rule default {
match-direction input;
term no-nat {
from {
destination-address {
10.0.0.0/8;
192.168.0.0/16;
172.16.0.0/12;
}
}
then {
no-translation;
}
}
term default {
from {
source-address {
10.10.116.0/24;
10.10.102.0/23;
}
}
then {
translated {
source-pool pool-default;
translation-type {
napt-44;
}
}
}
}
}
}
}
interfaces {
ms-0/2/0 {
unit 0 {
family inet;
}
unit 1 {
family inet;
service-domain inside;
}
unit 2 {
family inet;
service-domain outside;
}
unit 3 {
description "TCP MSS Modification";
family inet;
family inet6;
}
unit 4 {
description "SRX, Perm";
family inet {
mtu 1383;
service {
input {
service-set tcp-mss service-filter mss-filter;
}
output {
service-set tcp-mss service-filter mss-filter;
}
}
address 10.200.200.17/32 {
destination 10.200.200.16;
}
}
family inet6;
service-domain inside;
}
unit 5 {
family inet;
family inet6;
service-domain outside;
}
}
