4

Has anyone achieved line-speed or close to line-speed throughput on a SINGLE IPSec tunnel on a 10Gbps port? If this is not possible, what would be a reasonable throughput (w.r.t interface speed) to expect out of a single IPSec tunnel? I have an assumption that live back haul networks always split the load across multiple IPSec tunnels to achieve better throughput. Is this correct?

EDIT: "back-haul" is wrong. What I meant was access-network-to-core connection. (Ex: radio access network to core in a telco network). Hence, the need for IPSec. Again, I would like to highlight the "single tunnel" term. The server class machines (ex: HP Gen 8/9) running DPDK based routing solution does not seem to handle "single" flows well. The whole RSS (receive side scaling) works only if there are multiple flows. So, when there is only one flow, this becomes a bottleneck. That is, the throughput achieved is what a single core can handle. If there are multiple flows, meaning multiple IPSec tunnels, there is no problem in achieving throughput somewhere close to line speed. So, my question is "does anyone also face this issue with the usage of a single IPSec tunnel and had to use multiple tunnels for better throughput on cisco/juniper?"

Improve this question
3
  • Why would a back-haul network need to use IPsec?
    – Ron Maupin ♦
    Dec 21, 2016 at 5:40
  • 2
    Apart from Ron's valid concerns, the number of tunnels isn't the main performance restriction. The processing load on each participating device is what determines how much IPSec traffic a router can encrypt/decrypt, regardless of hardware assist. Look at manufacturers specs for their hardware for your chosen algorithm. I once got about 40Mbps with small packets out of a cisco 7200 with NPE-G1 and hardware encryption card, nowhere near the platform's line or bus speed of around 1Gbps. I have no idea how fast current hardware is, like I said, check the specs (but don't take them literally).
    – marctxk
    Dec 21, 2016 at 11:58
  • Yes - particularly the newest ASR's (HX) can handle well beyond 10Gbit.
    – rnxrx
    Dec 21, 2016 at 20:22

1 Answer 1

Reset to default
4

Yes. The Cisco ASR 1001-HX is one that is advertised to do it. Just step through 2 clicks of Cisco's router selector and see all the boxes that do 10G+ of IPSec.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.