SSL Module Throughput issue

bustaj691 — Mon, 19 Sep 2005 17:32:18 GMT

We have a network segment that has a perimeter pix 535 and behind it two 6500 switches, each has a CSM and a SSL module. We can only hit a max throughput of about 42Mbps when we run a loadrunner test going to one ssl module on https traffic. We add a second SSL module to the CSM loadbalancing and we were able to increase to another 41 Mbps totalling our throughput to about 82 Mbps overall.

We are running software version 2.1(4) on the SSL modules. I noticed the following in the ssl modules while the modules were taking in at about 22 Mbps:

dmzssl1.frsat#sh ssl-proxy status tcp

TCP cpu is alive!

TCP cpu utilization:

% process util : 7 % interrupt util : 0

proc cycles : 0xA93422B253E int cycles : 0xD916CBD43A

total cycles: 0x96016CBCDE38

% process util (5 sec) : 60 % interrupt util (5 sec) : 2

% process util (1 min) : 51 % interrupt util (1 min): 1

% process util (5 min) : 51 % interrupt util (5 min) : 1

dmzssl1.frsat#sh ssl-proxy status ssl

SSL cpu is alive!

SSL cpu utilization:

% process util : 0 % interrupt util : 0

proc cycles : 0xAA820CE45C int cycles : 0x278569E70

total cycles: 0x9602074A99C8

% process util (5 sec) : 3 % interrupt util (5 sec) : 0

% process util (1 min) : 3 % interrupt util (1 min): 0

% process util (5 min) : 3 % interrupt util (5 min) : 0

Not sure on how to read these, but does this mean that the tcp process is kind of struggling compared to the ssl process?

We are expecting the ssl modules to be able to handle more traffic than just 41 Mbps. It's not really close to what Cisco claims in their data sheets.

Is there something else I need to look at or some performance tuning I can do in the ssl module to support more bandwidth? Please help. thanks

Re: SSL Module Throughput issue

pradeepde — Fri, 23 Sep 2005 13:39:16 GMT

Check for close queueing traffic models, if it is enabled try disabling it.

Also try disabling both the & with

This will improve the throughput

Re: SSL Module Throughput issue

bustaj691 — Mon, 26 Sep 2005 16:24:53 GMT

disable the following where? On the CSM or the ssl module? thanks

topic Re: SSL Module Throughput issue in Application Networking

SSL Module Throughput issue

Re: SSL Module Throughput issue

Re: SSL Module Throughput issue