Tunneling technologies performance impact comparison

[Cory Anderson]

Hello all,

I have a network that's primarily carrying video traffic.  It's currently deployed with a hub and spoke topology and a flat address space, using L2TP/IPSec.  I don't particularly like having a flat address space across multiple "branch" offices, for multiple reasons, but I'm also gauging whether it's worth the effort to change over to GRE or IPIP/IPSec.  

Strictly in terms of data forwarding performance, has anyone compared the impact  of those three tunneling protocols? (IPIP, GRE, L2TP)

[Richard Burts]

I will first acknowledge that I do not have any definitive performance comparison of these technologies. So I can only comment on my understanding of how they work and their impact. Assuming that you will be doing IPsec encryption of all of these alternatives I believe that this is your biggest performance impact. It is my impression that GRE would impost the least performance impact, that IPIP would be in the middle, and that L2TP would have the highest performance impact. If anyone else in the forum has more definitive information I would be very interested to know what it is.

HTH

Rick

[Cory Anderson]

Thanks for your reply.  All three tunnel types would be encrypted, and since it's providing real time video, there are a lot of packets per second, so the encapsulation could theoretically have a significant impact.

With no verifiable data on hand, I would guess the best to least performance would be in this order:

IPinIP

GRE

L2TP

[Joseph W. Doherty]

I also haven't done a detailed comparison, but as the overhead of the tunneling protocol increases, forwarding performance will decrease, but this generally isn't the biggest performance impact of tunneling. First, if you're using encryption, the encryption often has a big impact. As an example, if you look at the ISR 4K or ASR 1K performance data sheets, you may note the device often cannot sustain its same maximum rate when doing encryption.

Second, when working with UDP kind of packets, that may be fragmented, and video's often are large enough they might be, L3 fragmentation often slows forwarding performance. The "cure" for this is to insure the source's MTU that may be transmitted across your tunnel will not have the possibility of being fragmented.