<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<style type="text/css">.mceResizeHandle {position: absolute;border: 1px solid black;background: #FFF;width: 5px;height: 5px;z-index: 10000}.mceResizeHandle:hover {background: #000}img[data-mce-selected] {outline: 1px solid black}img.mceClonedResizable, table.mceClonedResizable {position: absolute;outline: 1px dashed black;opacity: .5;z-index: 10000}
</style></head><body style=""><div><br>> On May 30, 2015 at 6:01 PM Noel Kuntze <noel@familie-kuntze.de> wrote:<br>> <br>> <br>> <br>> -----BEGIN PGP SIGNED MESSAGE-----<br>> Hash: SHA256<br>> <br>> Hello John,<br>> <br>> It is likely that that is caused by insufficient crypto<br>> processing capabilities on either side, so packets need to be dropped,<br>> as the transmit/receive buffers are full.<br>> A solution to this problem is to distribute the work load<br>> over several kernels using pcrypt[1].<br>> <br>> [1] https://wiki.strongswan.org/projects/strongswan/wiki/Pcrypt<br>> <br>> Mit freundlichen Grüßen/Kind Regards,<br>> Noel Kuntze<br>> <br>> GPG Key ID: 0x63EC6658<br>> Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658</div>
<div> </div>
<div>This looks like exactly what I need and I do see the dropped packets in ip -s link ls. However, I am utterly confused about what to use for the tcrypt options. I am using esp=aes128gcm8-modp1024 which I would think mean using the example given in the article, i.e.,
<pre><code>modprobe tcrypt alg="pcrypt(rfc4106(gcm(aes)))" type=3</code></pre>
</div>
<div>but I see no improvement with that even after re-establishing the tunnel (ipsec down then ipsec up). I'm guessing my way through /proc/crypto but am really only guessing. There doesn't seem to be a lot of information on using this. Any guidance would be appreciated - John<br>> <br>> Am 30.05.2015 um 23:57 schrieb jsullivan@opensourcedevel.com:<br>> > Hello, all. We are attempting to use StrongSWAN on a fast (1 Gbps CIR one side<br>> > and 4x10Gbps on the other) with about 80ms latency so pretty high bandwidth<br>> > delay product. The traffic is GRE/IPSec. Our benchmarks show we can saturate<br>> > the 1 Gbps side with just GRE sustaining high 800 low 900 Mbps. When we<br>> > activate IPSec, we plummet to around 40 Mbps - maybe we'll hit 400 Mbps on<br>> > occasion.<br>> > <br>> > This seems to be a TCP windowing problem provoked by TCP segment<br>> > retransmissions. When we use nstat between runs, GRE shows virtually no segment<br>> > retransmissions where GRE/IPSec shows thousands. GRE tunnel MTU is 1412 so it<br>> > should be fine for both transport and tunnel mode.<br>> > <br>> > sanitized config is:<br>> ><br>> > type=transport<br>> > esp=aes128gcm8-modp1024<br>> ><br>> > leftprotoport=47<br>> > rightprotoport=47<br>> > dpddelay=9<br>> > dpdtimeout=30<br>> > compress=yes<br>> ><br>> > keyingtries=20<br>> > keylife=60m<br>> > rekeymargin=5m<br>> > ikelifetime=3h<br>> > mobike=no<br>> ><br>> > authby=rsasig<br>> > rightrsasigkey=%cert<br>> ><br>> > nat_traversal=yes<br>> > charonstart=yes<br>> > plutostart=yes<br>> ><br>> > <br>> ><br>> > We are using intel cards with igb on one side and ixgbe on the other.<br>> ><br>> > What do we need to do to eliminate the lost packets and where can we see the<br>> > drops? I don't see them on any queues, qdiscs - no stats showing packet drops.<br>> > Thanks - John<br>> > _______________________________________________<br>> > Users mailing list<br>> > Users@lists.strongswan.org<br>> > https://lists.strongswan.org/mailman/listinfo/users<br>> <br>> -----BEGIN PGP SIGNATURE-----<br>> Version: GnuPG v2<br>> <br>> iQIcBAEBCAAGBQJVajNHAAoJEDg5KY9j7GZYv0sQAJB1ZDJvO5JWQ1jaAyexe1fk<br>> YwvugHH7FAY6mQH0glVct2Ro1+/c0hRCHgnjIKF6ICQkz6GxcHxbJzr+fnGON31c<br>> faoIVgCm4gxCjHR6Tcj1DMC8I6vDeUJ7nM7rGqs1XXN/+H3vLD+KRK9p0RC3mn85<br>> jc1HWCdyDjdjiNEO7ENi6SUYFkYnuiBIcmbroTcIP+FVvnWd/DHAUKSCxGedVTeO<br>> 0izwkKwGPw9bYkBk2l1Q9K+jccpFoyBzFeMKHnrTQ+hzC46qCGbXNmJklVg9vlHX<br>> H6BszfBdKAiDQ5SOaMe955f8RVynWpktZ2FpistfBylrnCyVfBVsDQXXF9BT9287<br>> tUsVfGbeA+4rCVrlLb/wiciqFLCP95bxITCaxW+3cYEYxNnr1wn5I2MRFRWeJrQL<br>> /HVrWtPqcWTFC+G7kt0XfmMdhsCtIURRt1q0k0ULTqVpALXRbJ+ksFR+zS7X1Hiy<br>> h9wy9jpa4v13Yg8vdOFofn6pe/Dv9/SNnLwfzJpmdit9U4A4QW2C/hZB31EmkuLK<br>> GSTCAZguAKnu/QOlN2zUqRLsAVpb4QlnqLqLJkvbnvooJu80OI7t95asutf5B+9i<br>> 3JAunbtHSlci//uYl59/6lvgfFFKvXNxVH9YMsbS+G2Cn0RIQzj6e0ZdSNXFwRxy<br>> 877iMnpvaZdPPlNZ0r6g<br>> =vgw7<br>> -----END PGP SIGNATURE-----<br>> <br>> _______________________________________________<br>> Users mailing list<br>> Users@lists.strongswan.org<br>> https://lists.strongswan.org/mailman/listinfo/users</div></body></html>