[strongSwan] ksoftirq thread reaching 100%

[Sach K]

Hi,

In our setup we see a problem with ksoftirq thread reaching 100% on CPU 0.
The box is running strongswan 4.6 version and acts as the responder to
IPSEC connections from other firewalls. The number of sites connecting to
this box is around 140. The cipher suite chosen is AES-128. The firewalls
connect using ikev1.

This does not happen always, but when this happens, all ipsec connections
slow down. We have seen often enough for us to be concerned.

I have checked to see that irqbalance is running.

I have seen this on boxes with aes-ni enabled and also disabled. The box
has a gig ethernet card (a Broadcom NetExtreme II), and is handling maybe
around half its capacity.

Has anyone else seen this problem with the ksoftirq thread reaching 100%?
Is there anything that can be done to alleviate this problem?

thanx
skmat.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20140330/b0fa5dec/attachment.html>