Max IPSec VPN throughput on C1812 and C2811

[bartholomiew]

Hi Everybody

recently we had some performance issues with C2811 which caused us to do some lab testing. For testing we used also C1812. The results were quite surprising for us, as the C1812 appeared to be more efficient than C2811. Below you can see the lab scenario and results.

I'd appreciate very much an answer or any suggestions for 2 questions:

1. Why C2811 is performing worse than C1812?

2. Is there any official Cisco reference stating what are the max VPN throughputs of certain platforms/models? (we consider migration to C2900 platform and would like to choose the right model)

Only thing we found so far is this discussion:

https://supportforums.cisco.com/thread/257204 (which actually doesn't exactly comply with results of our tests)

and such refference:

http://www.cisco.com/en/US/prod/collateral/routers/ps5855/prod_brochure0900aecd8019dc1f.pdf

LAB SCENARIO

as presented on the small diag:

All routers had enabled onboard hw VPN modules and SEC/K9 IOS ver. Configuration was very simple and beside encryption there were also GRE tunnels configured and EIGRP process for routing between "remote LANs". Part of conf responsible for encryption:

crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
lifetime 3600
crypto isakmp key ......... address ......... no-xauth!
crypto ipsec transform-set SHA-AES256 esp-aes 256 esp-sha-hmac

crypto map VPN 90 ipsec-isakmp
set peer .........
set transform-set SHA-AES256
set pfs group5
match address .........

TEST RESULTS

                                                                                                                                                                                                                          

	Cisco 1812		Cisco   2811
iperf   generated BW [bps]	WAN   if BW (max of 30s avgs) [bps]	CPU   usage (max of 5s avgs)	WAN   if BW (max of 30s avgs) [bps]	CPU   usage (max of 5s avgs)
500k	-	-	540k	5%
1M	1,1M	3%	1,2M	8%
2M	2,1M	4%	2,3M	14%
5M	5,4M	10%	5,7M	34%
10M	10,6M	20%	11,5M	65%
15M	15,8M	28%	17M	96%
16M	-	-	17,2M	99%
25M	27M	48%	-	-
35M	38M	64%	-	-
45M	48,2M	72%	-	-
53M	60,8M	88%	-	-
59M	67M	94%	-	-
61M	72M	97%	-	-

Many thanks

Best Regards!

Bartek

[david.tran]

I have the same setup in my lab environment as you and I have an GRE/IPSec tunnel between 2811 and 1841.  I am not running dynamic routing protocol between the two and I am able to push 50Mbps between the two without any issues.

crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
lifetime 3600
crypto isakmp key ......... address ......... no-xauth!
crypto ipsec transform-set SHA-AES256 esp-aes 256 esp-sha-hmac

crypto map VPN 90 ipsec-isakmp

set peer .........

set transform-set SHA-AES256

set pfs group5

match address ..

I also test with Iperf as well. In my situation, it is the 1841 that is the limitation factor.  On the 2811, I enabled the on-board AIM encryption card.   On the 2811 at 50Mbps, CPU is running around 50% and that I am running version 12.4(T)24 on the 2811

[olpeleri]

Hello David,

An ISR 1841 is supposed to be positioned in  a single E1/T1 bandwitdth scenario [ 2 megs/sec].

Looking at the tests I've found internally

Conditions:

• Single tunnel
• Traffic pattern is a selection of small - medium - large frames [ IMIX ] in order to simulate real life traffic

Platform	Mbps @ 75% CPU utilization
Cisco1841	7 megs/sec
Cisco2811	10 megs/sec

Indeed, the 2811 provides more crypto throughput.

In your case with iperf, you are encrypting large frames which are in fact providing the best perfs [ encryption is a one cycle operation - regardless of the packet size ].

Cheers

Olivier

CCIE#20306

[olpeleri · Accepted solution]

Hello Bartlomiej,

About your 2 questions: [ see inline]

1. Why C2811 is performing worse than C1812?
OP> C2811 is supposed to be deployed in single T1/E1 [ 2megs]  environment while a C1811/12 is meant to be deployed in a single xDSL setup [ 4 megs]. That's why you get a better perf.
2. Is there any official Cisco reference stating what are the max VPN throughputs of certain platforms/models? (we consider migration to C2900 platform and would like to choose the right model)
OP> ISR-G2 CCO numbers can be found here:
OP>http://www.cisco.com/en/US/partner/prod/collateral/routers/ps10536/white_paper_c11_595485.pdf
OP> Theses results are based on 1500 bytes perf tests

I had a look at some internal tests this is what I  can share:

Conditions:

• Single tunnel
• Minimum amount of enabled feature
• IPSECIMIX traffic containing a set of small medium large frames in order to simulate a real traffic pattern
• AES encryption

Platform	Performance @ 75% CPU utilization
C2901	53Mbps
C2911	61Mpbs
C2921	72Mpbs
C2951	103Mbps

Performance may change depending on:

• the features that will be enabled.
• The traffic pattern [ Encryption is done in 1 cycle. Even though the PPS would be more or less the same, the router throughput will be way bigger with 1400 bytes frames than with 64 byte frames]

I hope this answer your questions.

Olivier

CCIE#20306

[bartholomiew]

Thank you Guys for your answers!

I think, this is what I needed.

Many thanks to Olivier for these valuable data and resources. It's a big support for people who need to decide which router to choose. I placed this whitepaper on this thread as it can also help others and normal access to it is restricted.

best regards!

Bartek