<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Your question made me realize that i was using netkey stack. I
downloaded KLIPS module source and compiled it. Now ipsec starts with
it. Tunnel gets established, but i cannot ping anymore. ICMP packets
just try to go normal way. They are not geting encapsulted in ESP
headers and are dropped by default gw. I did not change any
configuration. Should i configure anything else? <br>
<br>
<br>
My other question is how KLIPS is better than NETKEY? <br>
<br>
<br>
W dniu 15.02.2013 18:38, Leto pisze:
<blockquote cite="mid:4C4B99BD-33F4-4EA7-B0F8-9C50FDBAB013@gmail.com"
type="cite">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div>what stack are you using? klips has seen speed gains since that
version</div>
<div><br>
</div>
<div>also check nic cards, disable hw offloading, etc<br>
<br>
On the road...</div>
<div><br>
On 2013-02-15, at 10:01, Piotr Dzionek <<a moz-do-not-send="true"
href="mailto:piotr.dzionek@intercon.pl">piotr.dzionek@intercon.pl</a>>
wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
Hi,<br>
I have a problem with slowing down transfers over IPsec tunnel. I have
two servers with Debian 6 and Openswan 2.6.28+dfsg-5+squeeze1. Normal
transfer speed is sth between 50-70MB/s between them. However when i
use IPsec tunnel it starts with something like 20MB/s and slows down to
sth like 1-1.5MB/s just after a minute or two. Moreover server load
goes really up(not max). I have two quite powerful xeon servers with
aes-ni support and aesni_intel modules loaded. My config is:<br>
<br>
1. First server<i><small><br>
<br>
version 2.0 # conforms to second version of ipsec.conf specification<br>
<br>
# basic configuration<br>
config setup<br>
# Do not set debug options to debug configuration issues!<br>
# plutodebug / klipsdebug = "all", "none" or a combation from
below:<br>
# "raw crypt parsing emitting control klips pfkey natt x509 dpd
private"<br>
# eg:<br>
# plutodebug="control parsing"<br>
#<br>
# enable to get logs per-peer<br>
# plutoopts="--perpeerlog"<br>
#<br>
# Again: only enable plutodebug or klipsdebug when asked by a
developer<br>
#<br>
# NAT-TRAVERSAL support, see README.NAT-Traversal<br>
nat_traversal=yes<br>
# exclude networks used on server side by adding %v4:!a.b.c.0/24<br>
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12<br>
# OE is now off by default. Uncomment and change to on, to
enable.<br>
oe=off<br>
# which IPsec stack to use. auto will try netkey, then klips
then mast<br>
protostack=auto</small></i><br>
<br>
<i><small>conn vm-prod1<br>
auto= start<br>
authby= secret<br>
left= ****************<br>
leftsubnet= 192.168.10.2/32<br>
right= ******************<br>
rightsubnet= 192.168.10.1/32<br>
#Phase 1<br>
keyexchange= ike<br>
rekey= yes<br>
ike= aes256-sha1-modp1024<br>
ikelifetime= 1440m<br>
#Phase 2<br>
type= tunnel<br>
auth= esp<br>
esp= aes256-sha1<br>
pfs= no<br>
compress= no<br>
keylife= 21600s</small><br>
<br>
</i><small><big>2. Second server</big></small><i><small><br>
............................<br>
conn vm-prod2<br>
auto= start<br>
authby= secret<br>
left= ****************<br>
leftsubnet= 192.168.10.1/32<br>
right= ********************<br>
rightsubnet= 192.168.10.2/32<br>
#Phase 1<br>
keyexchange= ike<br>
rekey= yes<br>
ike= aes256-sha1-modp1024<br>
ikelifetime= 1440m<br>
#Phase 2<br>
type= tunnel<br>
auth= esp<br>
esp= aes256-sha1<br>
pfs= no<br>
compress= no<br>
keylife= 21600s</small></i><br>
<br>
What could cause this kind of problem? or maybe this should work that
way ? Normal scp transfer works very good so i dont really know what is
wrong.<br>
<br>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span><a moz-do-not-send="true"
href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a></span><br>
<span><a moz-do-not-send="true"
href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a></span><br>
<span>Micropayments: <a moz-do-not-send="true"
href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a></span><br>
<span>Building and Integrating Virtual Private Networks with
Openswan:</span><br>
<span><a moz-do-not-send="true"
href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></span><br>
</div>
</blockquote>
</blockquote>
<br>
</body>
</html>