OpenForum RSS: Cisco 2951 IPSec over GRE: TCP throughput

Sniffer (QRSa)

Wed, 02 Oct 2013 10:30:43 GMT

> �� 6584 ��, �� 240 - Window is full, ��
> � �� , 4-� �� (��).
> �� 4 �� - �� ~9000 �� ~20 Retransmissions, �
> � �� -�� ,
> �� 36 ��.
> UDP �� 2xx ��.

�� .

("Window is full" ��, �� ACK. 20 Retransmissions �� Early detection retransmits.)

��, �� (� ��-�� ), �� , �� TCP.

�� .

Sniffer (Spider7)

Thu, 26 Sep 2013 08:39:38 GMT

> �� 100% �� cpu �� TCP ��.

�� - 79%, �� 96%. RTT �� 6-40 ms.

�� tcp �� cpu �� 8 �� 16%, RTT 2-30 ms.

> VPN �� ISR G2 �� VPN ISM �� (��
> �� sec bundle) � cpu �� .
> �� sh inv � sh ver.

c2951-1#show inventory
NAME: "CISCO2951/K9", DESCR: "CISCO2951/K9 chassis, Hw Serial#: FCZxxxxxxxx, Hw Revision: 1.1"
PID: CISCO2951/K9 , VID: V05 , SN: FCZxxxxxxxx

NAME: "C2921/C2951 AC Power Supply", DESCR: "C2921/C2951 AC Power Supply"
PID: PWR-2921-51-AC , VID: V03 , SN: DCAxxxxxxxx

c2951-1#show crypto engine configuration

crypto engine name: Virtual Private Network (VPN) Module
crypto engine type: hardware
State: Enabled
Location: onboard 0
Product Name: Onboard-VPN
FW Version: 1
Time running: 490593 second

Sniffer (alecx)

Thu, 26 Sep 2013 08:09:59 GMT

> �� 6584 ��, �� 240 - Window is full, ��
> � �� , 4-� �� (��).
> �� 4 �� - �� ~9000 �� ~20 Retransmissions, �
> � �� -�� ,
> �� 36 ��.
> UDP �� 2xx ��.

�� 100% �� cpu �� TCP ��. VPN �� ISR G2 �� VPN ISM �� (�� sec bundle) � cpu �� . �� sh inv � sh ver. �� cisco �� cpu �� RTT, �� TCP �� . �� , �� , �� , �� cpu?

Sniffer (Spider7)

Thu, 26 Sep 2013 07:21:14 GMT

�� 6584 ��, �� 240 - Window is full, �� , 4-� �� (��).

�� 4 �� - �� ~9000 �� ~20 Retransmissions, � � �� -�� , �� 36 ��.

UDP �� 2xx ��.

Sniffer (Spider7)

Thu, 26 Sep 2013 07:06:03 GMT

> �� encrypt/decrypt ��\�� c �� ?

��.

> � �� ? �� ...
> �� , �� , �� ,
> �.�. � tcp early retransmit �� latency 1ms.
> �� ? �� ?

�� win2003 � freebsd. �� win2003, �� iperf � 1 tcp �� , tcp window size 64k.
10.44.0.2 - iperf client, �� .
10.45.1.1 - iperf server.

No. Time Source Destination Protocol Length Info
1 0.000000000 10.44.0.2 10.45.1.1 TCP 62 wago-io-system > commplex-link [SYN] Seq=0 Win=65535 Len=0 MSS=1436 SACK_PERM=1
2 0.000888000 10.45.1.1 10.44.0.2 TCP 62 commplex-link > wago-io-system [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1360 SACK_PERM=1
3 0.000893000 10.44.0.2

Sniffer (QRSa)

Wed, 25 Sep 2013 18:21:31 GMT

�� .

�� encrypt/decrypt ��\�� c �� ?

� �� ? �� ...
�� , �� , �� , �.�. � tcp early retransmit �� latency 1ms.

�� ? �� ?

Cisco 2951 IPSec over GRE: TCP throughput (Spider7)

Wed, 25 Sep 2013 16:08:09 GMT

> �� . �� GRE.

�� ? �� .

> �� Tunnel type
> ipsec, �� GRE �� crypto profile (��
> � DMVPN). � �� :

[skipped]

� �� Tunnel type ipsec & tunnel protection ipsec profile. �� .

> �� , �� .

�� .

�� : UDP - �� , TCP �� 4-� �� - ��, TCP � �� - 30 � ��-�� . �� 1-2 �� 30. �� , �� - �� . �� :( � �� .

Cisco 2951 IPSec over GRE: TCP throughput (alecx)

Wed, 25 Sep 2013 15:18:44 GMT

>[�� ]
> !
> router eigrp - ��, ��
> !
> ip access-list extended to_branch2
> permit gre host 10.253.45.37 host 10.253.45.38
> �� core switch (3750) � �� vlan, ��
> �� gi0/0, � �� 10.44.18.26.
> �� .
>> � �� TCP �� .
> iperf - �� 64k.

�� . �� GRE. �� Tunnel type ipsec, �� GRE �� crypto profile (�� DMVPN). � �� :

crypto keyring mykeyring
pre-shared-key address 10.253.45.38 key mykey

crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2

crypto isakmp profile ISAKMP-PROFILE
keyring mykeyring
match identity address 10.253.45.38 255.255.255.255

crypto ipsec transform-set AES256-SHA-TRANSPORT esp-aes 256 esp-sha-hmac
mode transport

crypto ipsec pr

Cisco 2951 IPSec over GRE: TCP throughput (Spider7)

Wed, 25 Sep 2013 14:53:35 GMT

> �� .

crypto isakmp policy 2
encr 3des
hash md5
authentication pre-share
group 2
lifetime 7200
crypto isakmp key mykey address 10.253.45.38
!
crypto ipsec transform-set to_branch esp-aes esp-sha-hmac
mode transport
�� mode
!
crypto map branch_map 10 ipsec-isakmp
set peer 10.253.45.38
set transform-set to_branch
match address to_branch2
!
interface Tunnel2
ip address 10.253.45.41 255.255.255.252
ip mtu 1400
ip flow ingress - ��
ip flow egress
ip tcp adjust-mss 1360
load-interval 30
keepalive 5 3
tunnel source 10.253.45.37
tunnel destination 10.253.45.38
tunnel path-mtu-discovery
!
interface GigabitEthernet0/0
description *** To CORE ***
ip address 10.44.18.25 255.255.255.248
duplex auto
speed auto
!
interface GigabitEthernet0/2
description *** To office2 ***
ip address 10.253.45.37 255.255.255.252
load-interval 30
duplex auto
speed auto
crypto map map_b