<div>Hello Martin,</div>
<div> </div>
<div>Thanks for your reply. </div>
<div> </div>
<div>Could you please validate the methodology used by me to do the performance characterization for IKEv2 as below. I tried with a sample 500 ipsec tunnels establishment test</div>
<div> </div>
<div>Based on your response, i tried a test method to measure the tunnel establishment rate with IKEv2 using the following scripts and steps below:</div>
<div> </div>
<div>A) The Test setup topology is as below:</div>
<div> </div>
<div><br> pc1--------192.168.1.1[GW1]1.1.1.1===ipsec-tunnel===1.1.1.2[GW2]<a href="http://192.168.2.1/24---pc2">192.168.2.1/24---pc2</a></div>
<div> <a href="http://192.168.1.2/24">192.168.1.2/24</a> <a href="http://192.168.2.2/24">192.168.2.2/24</a><br></div>
<div>B) The Test script to generate the ipsec.conf files for GW1 (ipsecgw1) and GW2 (ipsecgw2) is as below:</div>
<div>---------------------------------------------------------------------------------------------------</div>
<div>#!/bin/sh<br>q=15000<br>x=7<br>echo "#/etc/ipsec.conf - strongSwan IPsec configuration file" >> ipsecgw1<br>echo "" >> ipsecgw1<br>echo "config setup" >> ipsecgw1<br>echo " strictcrlpolicy=no" >> ipsecgw1<br>
echo " crlcheckinterval=180" >> ipsecgw1<br>echo " plutostart=yes" >> ipsecgw1<br>echo " charonstart=yes" >> ipsecgw1<br>echo " nat_traversal=yes" >> ipsecgw1<br>
echo "" >> ipsecgw1<br>echo "conn %default" >> ipsecgw1<br>echo " ikelifetime=24h" >> ipsecgw1<br>echo " keylife=12h" >> ipsecgw1<br>echo " rekeymargin=3m" >> ipsecgw1<br>
echo " keyingtries=1" >> ipsecgw1<br>echo " mobike=no" >> ipsecgw1<br>echo " left=1.1.1.1" >> ipsecgw1<br>echo " leftsubnet=<a href="http://192.168.1.0/24">192.168.1.0/24</a>" >> ipsecgw1<br>
echo " right=1.1.1.2" >> ipsecgw1<br>echo " rightsubnet=<a href="http://192.168.2.0/24">192.168.2.0/24</a>" >> ipsecgw1<br>echo " authby=secret" >> ipsecgw1<br>
echo " type=tunnel" >> ipsecgw1<br>echo " keyexchange=ikev2" >> ipsecgw1<br>echo " ike=3des-sha1-modp1024" >> ipsecgw1<br>echo " esp=3des-sha1" >> ipsecgw1<br>
echo " reauth=no" >> ipsecgw1<br>echo " pfs=no" >> ipsecgw1<br>for ((i=1;i<501;i++))<br>do<br>echo "" >> ipsecgw1<br>echo "conn tunnel$i" >> ipsecgw1<br>
echo " leftprotoport=17/$q" >> ipsecgw1<br>echo " rightprotoport=17/$x" >> ipsecgw1<br>echo " auto=route" >> ipsecgw1<br>q=`expr ${q} + 1`;<br>done<br>##################################################################<br>
echo "#/etc/ipsec.conf - strongSwan IPsec configuration file" >> ipsecgw2<br>echo "" >> ipsecgw2<br>echo "config setup" >> ipsecgw2<br>echo " strictcrlpolicy=no" >> ipsecgw2<br>
echo " crlcheckinterval=180" >> ipsecgw2<br>echo " plutostart=yes" >> ipsecgw2<br>echo " charonstart=yes" >> ipsecgw2<br>echo " nat_traversal=yes" >> ipsecgw2<br>
echo "" >> ipsecgw2<br>echo "conn %default" >> ipsecgw2<br>echo " ikelifetime=24h" >> ipsecgw2<br>echo " keylife=12h" >> ipsecgw2<br>echo " rekeymargin=3m" >> ipsecgw2<br>
echo " keyingtries=1" >> ipsecgw2<br>echo " mobike=no" >> ipsecgw2<br>echo " left=1.1.1.2" >> ipsecgw2<br>echo " leftsubnet=<a href="http://192.168.2.0/24">192.168.2.0/24</a>" >> ipsecgw2<br>
echo " right=1.1.1.1" >> ipsecgw2<br>echo " rightsubnet=<a href="http://192.168.1.0/24">192.168.1.0/24</a>" >> ipsecgw2<br>echo " authby=secret" >> ipsecgw2<br>
echo " type=tunnel" >> ipsecgw2<br>echo " keyexchange=ikev2" >> ipsecgw2<br>echo " ike=3des-sha1-modp1024" >> ipsecgw2<br>echo " esp=3des-sha1" >> ipsecgw2<br>
echo " reauth=no" >> ipsecgw2<br>echo " pfs=no" >> ipsecgw2<br>q=15000<br>for ((j=1;j<501;j++))<br>do<br>echo "" >> ipsecgw2<br>echo "conn tunnel$j" >> ipsecgw2<br>
echo " rightprotoport=17/$q" >> ipsecgw2<br>echo " leftprotoport=17/$x" >> ipsecgw2<br>echo " auto=route" >> ipsecgw2<br>q=`expr ${q} + 1`;<br>done</div>
<div>-------------------------------------------------------------------------------</div>
<div><br>C) The contents of the ipsec.secrets file is as below:</div>
<div> </div>
<div>#/etc/ipsec.secrets - strongSwan IPsec secrets file<br>1.1.1.1 1.1.1.2 : PSK "123456"<br></div>
<div>D) The script to generate the traffic from PC1 to PC2 using "sendip" is as below:</div>
<div> </div>
<div>--------------------------------------------------------------------------------------</div>
<div> </div>
<div>#!/bin/sh<br>echo "starting to send udp traffic.."<br>q=15000<br>x=7<br>echo "sending traffic .."<br>for ((i=1;i<501;i++))<br>do<br>sendip -p ipv4 -p udp -us $q -ud 7 -is 192.168.1.2 192.168.2.2<br>
q=`expr ${q} + 1`;<br>echo "next iteration.."<br>done<br>echo "ending traffic.."<br>#</div>
<div>------------------------------------------------------------------------</div>
<div> </div>
<div>E) Now the steps for running this test is as below:</div>
<div> </div>
<div>note: PC1 and PC2 are linux PCs</div>
<div>-----------------------------------------------------------------------------</div>
<div><br>*************<br>ON PC1<br>************</div>
<div>1. Save the traffic-gen script to a file "sendip-ipsec500.conf" on PC1</div>
<div>2. stop/disable any iptables or firewall services</div>
<div>3. Ensure that you have installed sendip package/app on this PC<br>**********<br>ON PC2<br>**********</div>
<div>1. Very Importantly, make sure you have enabled and started the echo-dgram (udp port 7) service on this PC. </div>
<div>2. Its in /etc/xinetd.d/</div>
<div>3. stop/disable any iptables or firewall services</div>
<div><br>***********<br>GW1 config<br>***********</div>
<div>* Make sure you disable IPTables</div>
<div># iptables -F<br># iptables -F -t nat</div>
<div>then do the steps below:</div>
<div>1. Execute the script "testipsec1.conf"</div>
<div>2. copy the file "ipsecgw1" to the ipsec.conf file (wherever it is located) on GW1</div>
<div>3. copy the "ipsec.secrets" (with PSK auth entry) file to the location where it should be on GW1 </div>
<div>4. start ipsec by executing the command "ipsec start"</div>
<div>***********<br>GW2 config<br>***********</div>
<div>* Make sure you disable IPTables</div>
<div># iptables -F<br># iptables -F -t nat</div>
<div>then do the steps below:</div>
<div>1. Execute the script "testipsec1.conf"</div>
<div>2. copy the file "ipsecgw2" to the ipsec.conf file (wherever it is located) on GW1</div>
<div>3. copy the "ipsec.secrets" (with PSK auth entry) file to the location where it should be on GW1 </div>
<div>4. start ipsec by executing the command "ipsec start"</div>
<div>------------------------------------------------------------------</div>
<div>General Steps to start measuring the tunnel rate<br>***********************************************</div>
<div>1. On GW1, execute the following on the console/cli prompt, before you start sending traffic from PC1</div>
<div>while :<br>>do<br>>ipsec status | grep INSTALLED | wc<br>>sleep 5<br>>done</div>
<div><br>2. On PC1, start sending the traffic by executing the script as below:</div>
<div>while :<br>>do<br>>./sendip_ipsec500.conf<br>>done</div>
<div>The traffic will be sent continuously now</div>
<div><br>3. Meanwhile start observinng on GW1, the num of tunnels created every 5 seconds. The "INSTALLED" keyword/pattern occurs in the "ipsec status" for every ipsec/esp tunnel created, so you should have 500 for 500 tunnels</div>
<div>4. Observe on GW1 and calculate the difference between the number of tunnels for every 5 second iteration and divide by 5 to get per second tunnel establishment rate</div>
<div> </div>
<div>NOTE: </div>
<div>1. We can edit the testipsec1.conf file for any number of tunnels and generate the conf files for GW1 and GW2.<br>2. ONLY MAKE SURE THAT YOU HAVE DELETED ANY EXISTING ipsecgw1 AND ipsecgw2 FILES BEFORE GENERATING NEW FILES BY EXECUTING THE SCRIPT</div>
<div>------------------------------------------------------------------------------------------------------------------------------------------</div>
<div> </div>
<div>F) Just FYI, my tests on OpenWRT GWs using strongswan-4.3.6 is resulting in an average of 10-11 tunnels per second, if the above method and calculations are correct</div>
<div> </div>
<div> </div>
<div>So awaiting your reply on the correctness of the methodology followed above</div>
<div> </div>
<div>thanks & regards</div>
<div>rajiv</div>
<div><br> </div>
<div> </div>
<div> </div>
<div><br> </div>
<div class="gmail_quote">On Mon, Jun 18, 2012 at 12:16 PM, Martin Willi <span dir="ltr"><<a href="mailto:martin@strongswan.org" target="_blank">martin@strongswan.org</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">Hi,<br>
<div class="im"><br>> I need to run a performance test for finding out IKEv2 Tunnel<br>> Establishment Rate (no of tunnels per second), i have a DUT running<br>> strongswan-4.3.6 on OpenWRT.<br>><br>> How to do this? I have tried with Load-Tester Plugin setup, but that's<br>
> just load. How to find out the rate of tunnels established?<br><br></div>We currently don't have a functionality to automatically measure the<br>tunnel setup rate.<br><br>The load-tester plugin establishes IKE_SAs with a configured rate. If<br>
you increase this rate between different tests and monitor the<br>responder, you should see when packets get dropped because it is<br>overloaded.<br><br>Regards<br><span class="HOEnZb"><font color="#888888">Martin<br><br>
<br></font></span></blockquote></div><br>