Langues

Performance des appliances alix

Environnement de configuration du boîtier Alix 2D13:

OSNet vous propose une série de tests de performance sur des cartes Alix. Ces tests sont orientés vers une analyse approfondie des performances de ce type de carte dans différentes conditions d'utilisation (Firewall, VPN, …). Ces tests ont été réalisés sur des cartes Alix 2D13

 

  • PFSense 1.2.3
  • WAN:1.1.1.2
  • LAN:192.168.0.1
  • Deux ordinateurs connectés : un sur le LAN 192.168.0.199 et un sur le WAN.
  • Forward de port pour le port TCP/UDP 5001 qui sert pour IPERF.
  • PFSense prend en charge le NAT.
  • Tous les liens sont en 100Mbits Full Duplex (auto-negocé).
  • Tous les tests ont été conduits avec IPERF. 

 

Tests Alix sur 2D13 : 

Test:  TCP en bidirectionnel 
-----------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[3912]  0.0-10.0 sec  69.4 MBytes  57.9 Mbits/sec
[3916]  0.0-10.0 sec  68.5 MBytes  57.4 Mbits/sec

=============================================================

Test:  TCP unidirectionnel (Server = WAN)
-----------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[3876]  0.0-10.0 sec   102 MBytes  86.1 Mbits/sec

Test: TCP unidirectionnel (server = LAN)
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[3960]  0.0-10.1 sec  95.1 MBytes  79.2 Mbits/sec

=============================================================

Test: UDP en bidirectionnel (Server = WAN)
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth       Jitter   Lost/Total Datagrams
[3908]  0.0-10.0 sec  51.4 MBytes  42.9 Mbits/sec  0.934 ms 1462/54075 (2.7%)
[3976]  0.0-10.0 sec  56.9 MBytes  47.7 Mbits/sec  2.161 ms 3802/62050 (6.1%)

Test: UDP unidirectionnel (Server = WAN)
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth       Jitter   Lost/Total Datagrams
[3976]  0.0-10.0 sec  56.9 MBytes  47.8 Mbits/sec  0.407 ms 3755/62050 (6.1%)

=============================================================

Test: UDP bidirectionnel (Server = LAN)
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth       Jitter   Lost/Total Datagrams
[3924]  0.0-10.0 sec  65.1 MBytes  54.6 Mbits/sec  1.263 ms 1981/68685 (2.9%)
[3960]  0.0-10.0 sec  51.7 MBytes  43.3 Mbits/sec  0.666 ms 9136/62050 (15%)

Test: UDP unidirectionnel (Server = LAN)
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth       Jitter   Lost/Total Datagrams
[3960]  0.0-10.0 sec  74.9 MBytes  62.7 Mbits/sec  1.892 ms  130/76798 (0.17%)

Test OpenVPN 

OPENVPN (encryption)
Test: TCP unidirectionnel (server = LAN)
Ovpn: LZO compression, TCP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[1912]  0.0-10.4 sec  1.30 MBytes  1.05 Mbits/sec

OPENVPN (encryption)
Test: TCP unidirectionnel (server = LAN)
Ovpn: NO compression, TCP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[1912]  0.0-10.2 sec  12.7 MBytes  10.4 Mbits/sec

OPENVPN (encryption)
Test: TCP bidirectionnel (server = LAN)
Ovpn: NO compression, TCP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[1844]  0.0-10.3 sec  6.15 MBytes  5.01 Mbits/sec
[1876]  0.0-10.5 sec  6.96 MBytes  5.54 Mbits/sec

OPENVPN (encryption)
Test: TCP unidirectionnel (server = WAN)
Ovpn: NO compression, TCP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[1880]  0.0- 9.8 sec  14.6 MBytes  12.6 Mbits/sec

OPENVPN (encryption)
Test: TCP bidirectionnel (server = WAN)
Ovpn: NO compression, TCP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[1824]  0.0-10.3 sec  7.20 MBytes  5.89 Mbits/sec
[1848]  0.0- 9.8 sec  6.30 MBytes  5.37 Mbits/sec

OPENVPN (encryption)
Test: UDP unidirectionnel (server = WAN)
Ovpn: NO compression, TCP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth       Jitter   Lost/Total Datagrams
[3976]  0.0-10.2 sec  19.7 MBytes  16.3 Mbits/sec  1.143 ms 4268/24451 (17%)

OPENVPN (encryption)
Test: UDP unidirectionnel (server = WAN)
Ovpn: LZO compression, TCP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth       Jitter   Lost/Total Datagrams
[3976]  0.0-10.3 sec  40.2 MBytes  32.8 Mbits/sec  11.761 ms 7748/48946 (16%)


OPENVPN (encryption)

Test: TCP unidirectionnel (server = WAN)
Ovpn: NO compression, UDP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[3928]  0.0-10.0 sec  16.7 MBytes  14.0 Mbits/sec


OPENVPN (encryption)
Test: TCP unidirectionnel (server = LAN)
Ovpn: NO compression, UDP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[3960]  0.0-10.2 sec  15.1 MBytes  12.4 Mbits/sec

OPENVPN (encryption)
Test: TCP unidirectionnel (server = WAN)
Ovpn: LZO compression, UDP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[3928]  0.0-10.0 sec  22.7 MBytes  19.1 Mbits/sec

OPENVPN (encryption)
Test: TCP unidirectionnel (server = WAN)
Ovpn: NO compression, UDP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[3872]  0.0-10.1 sec  8.00 MBytes  6.62 Mbits/sec
[3896]  0.0-10.0 sec  6.95 MBytes  5.83 Mbits/sec

OPENVPN (encryption)
Test: TCP bidirectionnel (server = WAN)
Ovpn: LZO compression, UDP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[3916]  0.0-10.0 sec  10.8 MBytes  9.08 Mbits/sec
[3872]  0.0-10.2 sec  11.0 MBytes  9.10 Mbits/sec


OPENVPN (encryption)
Test: TCP bidirectionnel (server = LAN)
Ovpn: NO compression, UDP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth
[3892]  0.0-10.0 sec  4.09 MBytes  3.43 Mbits/sec
[3924]  0.0-10.2 sec  9.00 MBytes  7.39 Mbits/sec


OPENVPN (encryption)
Test: UDP unidirectionnel (server = WAN)
Ovpn: NO compression, UDP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth       Jitter   Lost/Total Datagrams
[3976]  0.0-10.0 sec  19.6 MBytes  16.5 Mbits/sec  1.100 ms 4369/24451 (18%)

OPENVPN (encryption)
Test: UDP unidirectionnel (server = WAN)
Ovpn: LZO compression, UDP
------------------------------------------------------------
[ ID] Interval       Transfer     Bandwidth       Jitter   Lost/Total Datagrams
[3976]  0.0-10.1 sec  27.2 MBytes  22.7 Mbits/sec  2.931 ms 8729/36575 (24%)

Lien vers le firewall Alix 2D13  

Lien vers le firewall Alix 2D2

J'ai réalisé les mêmes tests avec iperf sur mon routeur pfSense sur carte ALIX 2D13. En OpenVPN AES-128-CBC, j'obtiens les mêmes débits avec ou sans l'accélération matériel (engine cryptodev). Qu'en est-il dans vos benchmarks?

Je n'ai pas encore testé les cartes, mais Chris Buechler m'a confirmé que l'on obtenait des performances de x2 avec les cartes en type Hifn (actuellement en vente sur mon site). 

Afin de tirer profit de l'accélération cryptographique, les deux bouts de votre tunnel doivent être configuré avec le même algo (dans votre cas aes-128-cbc). Avez vous bien ajouté l'option suivante dans les option de votre config OpenVPN : 

engine cryptodev

 

Oui les 2 extrémités du tunnel sont bien configurés avec le cypher aes-128-cbc ainsi que l'option "engine cryptodev" sur le serveur openvpn. ci-joint l'url de mon article sur les débits vpn.

Bonjour,
je viens de faire le test sur alix 2D13 et je ne constate pas non plus de différence.
le materiel VPN 1411 est bien détecté :
dmesg | grep glx
glxsb0: mem 0xefff4000-0xefff7fff irq 9 at device 1.2 on pci0
Pour autant le résultat semble identique avec ou sans !
AVEC :
openssl speed -evp AES-128-CBC -engine cryptodev
engine "cryptodev" set.
To get the most accurate results, try to run this
program when this computer is idle.
Doing aes-128-cbc for 3s on 16 size blocks: 46314 aes-128-cbc's in 0.10s
Doing aes-128-cbc for 3s on 64 size blocks: 43221 aes-128-cbc's in 0.09s
Doing aes-128-cbc for 3s on 256 size blocks: 38636 aes-128-cbc's in 0.08s
Doing aes-128-cbc for 3s on 1024 size blocks: 26304 aes-128-cbc's in 0.01s
Doing aes-128-cbc for 3s on 8192 size blocks: 5428 aes-128-cbc's in 0.00s
OpenSSL 0.9.8y 5 Feb 2013
built on: date not available
options:bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) aes(partial) blowfish(idx)
compiler: cc
available timing options: USE_TOD HZ=128 [sysconf value]
timing function used: getrusage
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128-cbc 7750.97k 30689.92k 125285.84k 1862745.23k 28855402.99k

Sans :
openssl speed -evp AES-128-CBC
To get the most accurate results, try to run this
program when this computer is idle.
Doing aes-128-cbc for 3s on 16 size blocks: 46829 aes-128-cbc's in 0.06s
Doing aes-128-cbc for 3s on 64 size blocks: 43227 aes-128-cbc's in 0.05s
Doing aes-128-cbc for 3s on 256 size blocks: 38619 aes-128-cbc's in 0.03s
Doing aes-128-cbc for 3s on 1024 size blocks: 24998 aes-128-cbc's in 0.02s
Doing aes-128-cbc for 3s on 8192 size blocks: 5158 aes-128-cbc's in 0.00s
OpenSSL 0.9.8y 5 Feb 2013
built on: date not available
options:bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) aes(partial) blowfish(idx)
compiler: cc
available timing options: USE_TOD HZ=128 [sysconf value]
timing function used: getrusage
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128-cbc 12525.52k 52398.35k 369559.81k 1163331.76k 42254336.00k

Il n'y a pas d'accélération à proprement parlé, mais simplement un "déchargement" du processeur, ce dernier n'étant plus en charge des opérations d'encryption / décryption.