<div>Hi Tobias</div>
<div> </div>
<div>Thanks for the reply. </div>
<div> </div>
<div>No, i did not know of the load-tester plugin till you told me about it. I followed your advice and started setting up the load-tester plugin with strongswan-4.5.2 on Linux-Fedora servers</div>
<div> </div>
<div>- As mentioned in one of the mail-list on Load-Tester plugin, I have assgined one linux-box for simulating the road-warrior-clients and the other as the rw-server</div>
<div> </div>
<div>- Now On the rw-client-simulator, i have setup the following:</div>
<div> </div>
<div>strongswan.conf file</div>
<div>------------------------<br>....</div>
<div>....</div>
<div>charon {<br> reuse_ikesa = no<br> threads = 32<br><br> plugins {<br> load-tester {<br> # enable the plugin<br> enable = yes<br> # 1000 connections, ten in parallel<br>
initiators = 10<br> iterations = 100<br> # use a delay of 100ms, overall time is: iterations * delay = 100s<br> delay = 100<br> # address of the gateway<br> remote = 192.168.0.1<br>
# IKE-proposal to use<br> proposal = aes128-sha1-modp1024<br> # use faster PSK authentication instead of 1024bit RSA<br> initiator_auth = psk<br> responder_auth = psk<br>
# request a virtual IP using configuration payloads<br> request_virtual_ip = yes<br> # disable IKE_SA rekeying (default)<br> ike_rekey = 0<br> # enable CHILD_SA every 60s<br>
child_rekey = 60<br> # do not delete the IKE_SA after it has been established (default)<br> delete_after_established = no<br> # do not shut down the daemon if all IKE_SAs established<br>
shutdown_when_complete = no<br> }<br> }<br>}<br>...</div>
<div>...<br></div>
<div>Now,here i request for some help and clarfication as iam unable to understand the exact usage and flow of the load-test scenario:</div>
<div> </div>
<div>-------------------------------------------</div>
<div>on the rw-client-simulator pc</div>
<div>-------------------------------------------</div>
<div> </div>
<div>- What is the meaning of "initiators=10 and iterations=100". i would think that for simulating establishment of 1000 simultaneous tunnels i would want 1000 initiators to be running right? Why only 10 and running them 100 times?</div>
<div> </div>
<div>- Would the initiators change after every 10th tunnel is established?....????? or what???</div>
<div> </div>
<div>- what will be the configuration in "ipsec.conf"? will there be a ipsec.conf file used for this load-test scenario on the rw-client-simulator pc.</div>
<div> </div>
<div>- The wiki page on load-test plugin says</div>
<div>"For PSK authentication, FQDN identities are used. The server uses <em><a href="http://srv.strongswan.org">srv.strongswan.org</a></em>, the client uses an identity in the form <em><a href="http://c1-r1.strongswan.org">c1-r1.strongswan.org</a>"</em></div>
<div><em></em> </div>
<div>- So this means that the "ipsec.secrets" file will be used? right? any sample file for this load-test scenario for say simulating 1000 tunnels/clients?</div>
<div> </div>
<div>- Also iam confused as to what should be the content of the "ipsec.secrets" file on the rw-client-simulator for PSK with FQDN? any example will help because iam thinking for 1000 clients how many PSK statments and what FQDN to use in the ipsec.secrets file</div>
<div> </div>
<div>- Do i just use the command "ipsec start" or is there any other options required to be used?</div>
<div> </div>
<div>----------------------------------------------------------------------</div>
<div>On the RW-Server (RoadWarrior-Server) Machine:</div>
<div>-----------------------------------------------------------------------</div>
<div> </div>
<div>Once again as adviced in one of the mail-list response on load-tester plugin query , On the rw-server-simulator pc, iam using the following:</div>
<div> </div>
<div>- I have NOT configured anything in the strongswan.conf file i.e as adviced i have not enabled the load-tester plugin on the server. Is this correct?</div>
<div> </div>
<div>- Now the configurations:</div>
<div> </div>
<div>ipsec.conf file</div>
<div> </div>
<div># /etc/ipsec.conf - strongSwan IPsec configuration file</div>
<div>config setup<br> crlcheckinterval=180<br> strictcrlpolicy=no<br> plutostart=no<br> charonstart=yes</div>
<div> </div>
<div>conn %default<br> ikelifetime=60m<br> keylife=20m<br> rekeymargin=3m<br> keyingtries=1<br> keyexchange=ikev2<br> mobike=no</div>
<div> </div>
<div>conn rw<br> left=192.168.0.1<br> leftsubnet=<a href="http://10.1.0.0/16">10.1.0.0/16</a><br> right=%any<br> rightsourceip=<a href="http://10.3.0.0/28">10.3.0.0/28</a><br> auto=add</div>
<div> authby=secret</div>
<div> </div>
<div>- I feel that iam still missing some more important configurations in the ipsec.conf file on this server</div>
<div> </div>
<div>- What will be the contents of the ipsec.secrets file on this server m/c? I mean we need to use PSK with FQDN for 1000 clients right? any sample ipsec.secrets file will be a tremendous help</div>
<div> </div>
<div> </div>
<div>I am stuck at this point of setup and i would be greatful for your help and advice</div>
<div> </div>
<div>thanks & regards</div>
<div>rajiv</div>
<div> </div>
<div class="gmail_quote">On Mon, Jul 18, 2011 at 7:44 PM, Tobias Brunner <span dir="ltr"><<a href="mailto:tobias@strongswan.org">tobias@strongswan.org</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">Hi Rajiv,<br>
<div class="im"><br>> - is there a better way and a simple and elegant way to simulate 1000<br>> tunnels (2000 SAs)?<br><br></div>Did you already have a look at the load-tester plugin [1]?<br><br>Regards,<br>Tobias<br>
<br>[1] <a href="http://wiki.strongswan.org/projects/strongswan/wiki/LoadTests" target="_blank">http://wiki.strongswan.org/projects/strongswan/wiki/LoadTests</a><br><br>_______________________________________________<br>Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br><a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br></blockquote>
</div><br>