Using NAT-T in ASA 5505 will cost you 5% performance hit? Why?

[bbiandov]

So I know this box is antient hence I had a pile of them and wanted to play with some performance testing one day in a lab. I was astonished to find out that on a site-to-site VPN configuration enabling NAT-T in ASA 5505 will cost you 5% performance hit? I mean what?

NAT-T is not necessary in most cases since the ASA would likely never sit behind another NAT device - in other words the outside interface in most sane deployments will be facing the public IP world but just for kicks I did many long iperf3 sessions (like hours on end) with and without Nat-T enabled and my conclusion is that I take 5.5% hit on performance across the VPN tunnel when it is enabled.

Interestingly the CPU usage is absolutely the same so there must be another explanation to this? Anyone out there with similar experience? What's your theory on causality? 

Thanks guys

~B

[erwindebrouwer]

Hi bbiadov,

Interesting. First question that comes to mind is;

In your tests with NAT-T enabled, was the VPN tunnel actually using NAT-T? So in other words was ESP or UDP/4500 traffic seen over the wire?

When you were actually using NAT-T for the VPN at that time, we can expect less data to be transferred as headers are larger with NAT-T and with that may come fragmenting inefficiencies.

Please let me know your findings and what you think.

[bbiandov]

Very good question and the answer is NO, NAT-T was actually not being used even though it was enabled. It was always NOT using it whether enabled or disabled. Ok now that's weird, then what would account for the performance hit? I can replicate it at will every time...

IKEv1 AES-256 Tunnel ID: 50.1
Authentication Mode: preSharedKeys
UDP Source Port 500
UDP Destination Port 500
Authentication Mode: preSharedKeys
UDP Source Port 500
UDP Destination Port 500
IKE Negotiation Mode: Main
Hashing: SHA1
Authentication Mode: preSharedKeys
UDP Source Port 500
UDP Destination Port 500
IKE Negotiation Mode: Main
Hashing: SHA1
Diffie-Hellman Group: 2
Rekey Time Interval: 86400 Seconds
Rekey Left(T): 27627 Seconds