RUT241 IPsec performance (IPsec software flow offload enabled)

NETWORKING SOLUTIONS
1

With an IPsec connection with a FortiGate and RUT241 using AES-256P1 and AES-128P2, I’m not seeing any performance improvement by enabling IPsec software flow offload (new feature).

Is there a setting that I might have missed?

Running RUT2M_R_00.07.11.3 firmware.

Seeing around 10-11Mbps in both directions and the CPU is at 100% during the test.
Tested using iperf3 from the units CLI.

If I use iperf3 without going over the VPN I see around 30-40Mbps, so looks like the encryption overhead is dragging the performance down.

Thanks

2

Hi…

I don’t have RUT241, but I did some tests with RUT200… and got more or less, same kind of result… low throughput and high cpu usage.

So… I believe that is result to do the math of the cryptography in the main cpu. Maybe I am wrong.

RUT200 CPU: Mediatek, MT7628, 580 MHz
RUT241 CPU: Mediatek MIPS 24Kc 580 MHz

Can be the mtu size of packet? I don’t try to change it.

3

@stephenevans If you do not need the tunnel itself to provide encryption (e.g. if data is sufficiently secure by the time it hits the wire, for example TLS) then you might consider trying a GRE tunnel. That should be a lot lighter on the CPU.

2 Likes
4

Hi, @stephenevans

A sample of GRE Tunnel.
https://wiki.teltonika-networks.com/view/GRE_Tunnel_configuration_examples

Comment: Both routers must have a Public Static or Public Dynamic IP addresses.

5

Thanks @Marcelo.Barros for giving it a test on a different unit. Appreciate it.
Unfortunately, I need tunnel encryption and one side is dynamic.

Does anyone know if any of the models support hardware acceleration?

I can see the RUTM and RUTX have more modern CPUs, just not sure if it’s been implemented.