2

In our environment we are noticing packet drops (with reason "No SA Found") during the SA re-keying. The traffic rate is about 1.2Gbps (pkt size: 800 bytes) and the packet drops are about 200-300 packets in one hour happening during re-keying. Is this normal? The RFC seems to acknowledge that this drop CAN happen and implementations MAY provide a solution for this. (https://wiki.strongswan.org/issues/1291) Strongswan seems to have decided not to fix this. Our IP stack is proprietary, however I would like to know if these drops are seen on other implementations like cisco or juniper and so on. Also, what is normally the lifetime configured for an SA? We are using 1 hour, but what is normally used in real production networks?

2

Yes, this is quite common and I've seen it first hand for many years on both Cisco (ASA) and Juniper (SSG/SRX).

As for the amount being dropped, it will depend on your PPS and your SA timer, but I generally see 1-2 seconds of loss during a re-key.

1
  • <Updated the query a bit and repeating it here just in case>what is normally the lifetime configured for an SA? We are using 1 hour, but what is normally used in real production networks? Feb 17 '17 at 6:32
2

1.2 Gigabits per second / 8 bytes per bit = .15 Gigabytes = 150 Megabytes = 157,286,400 bytes = 196,608 * 800 byte packets per second.

Losing 200-300 packets is about a 1.2 millisecond interruption (assuming constant rate). If this is the hit you take for an hourly re-key I think you're doing pretty well! To put it in context it shouldn't be enough to even cause a noticeable pop - much less a disconnect - on a VOIP call.

I haven't run any IPSec tunnels at that kind of rate but can say that I didn't generally experience anything regularly noticeable connectivity issues with router-to-router IOS-based VPN's with tens of megabits flowing. That said, though, a millisecond or so of traffic loss would have been within the range of line noise on most Internet connections.

1

I have seen it happening in Linux ipsec-tools (KAME stack/racoon IKE daemon), the loss is about 1-2 seconds during re-key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.