<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt"><div><span><br></span></div><div style="color: rgb(0, 0, 0); font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px; font-style: normal; background-color: transparent;"><br></div><span><div style="color: rgb(0, 0, 0); font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px; font-style: normal; background-color: transparent;"><font face="Times New Roman">
<br></font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Hi Martin,</font></span></div><div style="color: rgb(0, 0, 0); font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px; font-style: normal; background-color: transparent;"><font face="Times New Roman">
<br></font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Can you
please have a look into the below stated and let me know if it a bug with
strongswan-5.0.4 in high load?</font></span></div><div style="color: rgb(0, 0, 0); font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px; font-style: normal; background-color: transparent;"><font face="Times New Roman">
<br></font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">The
IKE_SA-Manager is responsible for managing all initiated and responded
IKE_SA's. Under high load (i.e. 900-1000 TPS and 250k IPsec tunnels), the IKE
Responder end does not respond to all the IKE_SA_INIT request messages received
from IKE Initiator. <span style="mso-spacerun: yes;"> </span>During debugging I found
that, <span style="mso-spacerun: yes;"> </span><span style="mso-spacerun: yes;"> </span>at IKE responder end, <span style="mso-spacerun: yes;"> </span><span style="mso-spacerun: yes;"> </span>the call
to checkout_by_message () does return the IKE_SA for some of IKE_SA_INIT request
messages (not retransmission message). Surprisingly the check_and_put_init_hash()
function returns ALREADY_DONE saying that, the message with the given hash has
been seen before. I think, if a responder receives an IKE_SA_INIT request, it determines
whether the packet is a retransmission belonging to an existing<span style="mso-spacerun: yes;"> </span>half-open IKE_SA (in which case the responder
retransmits the same<span style="mso-spacerun: yes;"> </span>response), or a new
request (in which case the responder creates a new IKE_SA and sends a fresh
response). But I find Charon daemon (IKE Responder) drops some of the new requests
and all the retransmitted packets. But with reduced setup rate (200+),
everything works as expected. </font></span></div><div style="color: rgb(0, 0, 0); font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px; font-style: normal; background-color: transparent;"><font face="Times New Roman">
<br></font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri"> </font></span></div><div style="color: rgb(0, 0, 0); font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px; font-style: normal; background-color: transparent;"><font face="Times New Roman">
<br></font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Regards,</font></span></div><div style="color: rgb(0, 0, 0); font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px; font-style: normal; background-color: transparent;"><font face="Times New Roman">
<br></font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Chinmaya <span style="mso-spacerun: yes;"> </span><span style="mso-spacerun: yes;"> </span></font></span></div><div style="color: rgb(0, 0, 0); font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px; font-style: normal; background-color: transparent;"><font face="Times New Roman">
<br></font></div></span><div style="color: rgb(0, 0, 0); font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px; font-style: normal; background-color: transparent;"><br></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 12pt;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> On Tuesday, May 27, 2014 7:42 PM, Chinmaya Dwibedy <ckdwibedy@yahoo.com> wrote:<br> </font> </div> <br><br> <div><div id="yiv3559305654"><div><div style="color: rgb(0, 0, 0); font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 12pt; background-color: rgb(255, 255, 255);"><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Hi,</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Using the
load tester plugin of strongswan (5.0.4), could able to achieve the 250k IPsec
tunnels with 1000 tunnels per second. However I found that, some of the tunnels
(approximately 10-20) were not getting up. Upon debugging found that, at IKE
responder end, the checkout_by_message() of ike_sa_manager_t does not return
pointer to ike_sa_t for some of the IKE_SA_INIT request messages (in execute()
routine of job). But if I reduce the setup rate to 200, all the tunnels come
up. Is it an bug with strongswan 5.0.4 in high load? Can anyone please suggest
what might be the issue? Thanks in advance for your support.</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri"> </font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Regards,</font></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style="line-height: 115%; font-size: 12pt;"><font face="Calibri">Chinmaya</font></span></div><div><font face="Times New Roman">
</font><br></div></div></div></div><br><br></div> </div> </div> </div> </div></body></html>