<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">All,<div class=""><br class=""></div><div class="">I’m working with Strongswan 5.3.2 on Centos 7.1 (also 6.6).</div><div class=""><br class=""></div><div class="">This is a totally greenfield implementation so I have some latitude as we control both ends of the link (and both will be running Strongswan).</div><div class=""><br class=""></div><div class="">I’m working with pcrypt and have successfully implemented it.</div><div class=""><br class=""></div><div class="">As the instances are running in Amazon AWS, we’ll need to run NAT-T.</div><div class=""><br class=""></div><div class="">I’m looking for others experiences in tuning /etc/sysctl.conf for a high-volume S2S router over NAT-T. Bandwidth between sites is effectively unlimited but ~ 1-2Gbps based on instance type we’re running.</div><div class=""><br class=""></div><div class="">I’m doing some tweaking of UDP parameters and gaining some ground. I wondered others thoughts on whether any of the TCP parameters need tuned on the routers? Traffic will be predominantly TCP but there will be some UDP mixed in there too. Lots of file transfer traffic via SMB and FTP.</div><div class=""><br class=""></div><div class="">Looking at AES-GCM for efficiency and AES-NI is supported by their processors. Right now we’re seeing about 350-400Mbps throughput on instances with 4 cores and 8GB of RAM (iperf3)</div><div class=""><br class=""></div><div class="">/etc/sysctl.conf so far has UDP at</div><div class=""><br class=""></div><div class=""><div class=""><font face="Courier" class="">net.ipv4.udp_mem = 262144 873800 16777216</font></div><div class=""><font face="Courier" class="">net.ipv4.udp_rmem_min = 262144</font></div><div class=""><font face="Courier" class="">net.ipv4.udp_wmem_min = 262144</font></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Traffic seems to be bursty. We’ll see high throughput, then fall off, then recover. </div><div class=""><br class=""></div><div class="">Thoughts appreciated on parameters or where to look for any issues and thanks in advance</div><div class=""><br class=""></div><div class="">EKG</div><div class=""><br class=""></div></body></html>