<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi,<br>
I have a problem with slowing down transfers over IPsec tunnel. I have
two servers with Debian 6 and Openswan 2.6.28+dfsg-5+squeeze1. Normal
transfer speed is sth between 50-70MB/s between them. However when i
use IPsec tunnel it starts with something like 20MB/s and slows down to
sth like 1-1.5MB/s just after a minute or two. Moreover server load
goes really up(not max). I have two quite powerful xeon servers with
aes-ni support and aesni_intel modules loaded. My config is:<br>
<br>
1. First server<i><small><br>
<br>
version 2.0 # conforms to second version of ipsec.conf specification<br>
<br>
# basic configuration<br>
config setup<br>
# Do not set debug options to debug configuration issues!<br>
# plutodebug / klipsdebug = "all", "none" or a combation from
below:<br>
# "raw crypt parsing emitting control klips pfkey natt x509 dpd
private"<br>
# eg:<br>
# plutodebug="control parsing"<br>
#<br>
# enable to get logs per-peer<br>
# plutoopts="--perpeerlog"<br>
#<br>
# Again: only enable plutodebug or klipsdebug when asked by a
developer<br>
#<br>
# NAT-TRAVERSAL support, see README.NAT-Traversal<br>
nat_traversal=yes<br>
# exclude networks used on server side by adding %v4:!a.b.c.0/24<br>
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12<br>
# OE is now off by default. Uncomment and change to on, to
enable.<br>
oe=off<br>
# which IPsec stack to use. auto will try netkey, then klips
then mast<br>
protostack=auto</small></i><br>
<br>
<i><small>conn vm-prod1<br>
auto= start<br>
authby= secret<br>
left= ****************<br>
leftsubnet= 192.168.10.2/32<br>
right= ******************<br>
rightsubnet= 192.168.10.1/32<br>
#Phase 1<br>
keyexchange= ike<br>
rekey= yes<br>
ike= aes256-sha1-modp1024<br>
ikelifetime= 1440m<br>
#Phase 2<br>
type= tunnel<br>
auth= esp<br>
esp= aes256-sha1<br>
pfs= no<br>
compress= no<br>
keylife= 21600s</small><br>
<br>
</i><small><big>2. Second server</big></small><i><small><br>
............................<br>
conn vm-prod2<br>
auto= start<br>
authby= secret<br>
left= ****************<br>
leftsubnet= 192.168.10.1/32<br>
right= ********************<br>
rightsubnet= 192.168.10.2/32<br>
#Phase 1<br>
keyexchange= ike<br>
rekey= yes<br>
ike= aes256-sha1-modp1024<br>
ikelifetime= 1440m<br>
#Phase 2<br>
type= tunnel<br>
auth= esp<br>
esp= aes256-sha1<br>
pfs= no<br>
compress= no<br>
keylife= 21600s</small></i><br>
<br>
What could cause this kind of problem? or maybe this should work that
way ? Normal scp transfer works very good so i dont really know what is
wrong.<br>
<br>
</body>
</html>