topic Re: IPsec Throughput in Firewall and Security Management

IPsec Throughput

handiansudianto — Thu, 15 Aug 2024 08:04:16 GMT

Hello,

My internet connection speed is 100Mbps, testing by accessing speedtest.net and showing 101.90Mbps for download and 115.14Mbps for upload.

I also have IPsec site to site tunnel to connecting our onprem to azure, and when i do speed test by copy larger file from onprem to the azure i can see the traffic is not fully utilize the available bandwidth.

testing speed only get about 3-4 MB/s or about 30Mbps. Anyone know how to fine tuning my checkpoint to get better utilization for ipsec?

Re: IPsec Throughput

AkosBakos — Thu, 15 Aug 2024 08:28:51 GMT

Hi @handiansudianto

And what about the load of the participating gateways in S2S tunnel? One for eg. SCP connection is handled by one CPU core. Can you check the CPU-s on both side?

Maybe the bottleneck is on the AZURE side? Can you check it somehow without VPN?

Akos

Re: IPsec Throughput

Lesley — Thu, 15 Aug 2024 08:40:52 GMT

Hi,

This depends on a few factors. Most common:

What blades are enabled on the gateways.

What encryption methods are used? (for example 3DES is not only very unsafe but also very intensive for the load)

Re: IPsec Throughput

handiansudianto — Thu, 15 Aug 2024 09:45:37 GMT

How i can check the load?

Re: IPsec Throughput

handiansudianto — Thu, 15 Aug 2024 09:48:16 GMT

Enabled blades is : Firewall, S2S VPN, Mobile Access, App Control, URL Filtering, IPS, Antibot, Antivirus, network policy management & Log.

The encryption i used on VPN community string is AES-256 for phase 1 and 3DES for phase 2

Re: IPsec Throughput

AkosBakos — Thu, 15 Aug 2024 10:43:13 GMT

Hi @handiansudianto

#cpview

#top

#htop

If you are not familiar with the last 2 commands use #cpview CPU tab. You will see the CPU utilization

Akos

Re: IPsec Throughput

handiansudianto — Thu, 15 Aug 2024 10:48:40 GMT

Here result of 3 command, seems the utilization is normal.

Re: IPsec Throughput

Lesley — Thu, 15 Aug 2024 11:03:34 GMT

3des is the worst for performance see:

https://support.checkpoint.com/results/sk/sk73980

https://support.checkpoint.com/results/sk/sk98950

Change asap since it is very weak encryption method

Re: IPsec Throughput

the_rock — Thu, 15 Aug 2024 12:35:22 GMT

I can tell you that literally 99% of the time when I worked with folks on this exact problem, I always found it to be one of the 2 problems.

1) Encryption methods used

2) MTU size

Never a combination of both.

Andy

Re: IPsec Throughput

Timothy_Hall — Thu, 28 Nov 2024 14:14:17 GMT

Site-to-Site VPN performance issues generally come down to some combination of these three things:

1) Path Low MTU Issues - From expert mode on your Check Point firewall run tracepath to your Azure VPN peer, this will report the max MTU for that network path. If it is less than 1500 you may need to allow ICMP Type 3, Code 4 packets into your firewall from anywhere for pmtud to work, or look at TCP MSS Clamping

2) Slow algorithms in use like 3DES (already mentioned in this thread) - remember that the Phase 2/IPSec tunnel transfers the vast majority of data through a VPN so its encryption setting will have a far greater impact than the one for IKE/Phase 1. You may want to look at using the GCM versions of AES which are even more efficient than standard AES and also capable of being fully offloaded into the AES-NI processor extension, if the Azure peer supports GCM

3) Encryption/Decryption operations for a particular VPN tunnel can only happen on one core, or are stuck in the slowpath - If the first two listed are not the issue (check them first), the traffic may be in the F2F/slowpath due to what blades you have enabled or other unusual conditions being present, or it is being bottlenecked by single-core limitations as in the case of an elephant flow

All this is covered quite extensively in my Gateway Performance Optimization Course.

Re: IPsec Throughput

handiansudianto — Fri, 16 Aug 2024 01:32:53 GMT

Hi,

Changed to AES-128 and have better throughput. Thanks

Re: IPsec Throughput

handiansudianto — Fri, 16 Aug 2024 01:36:08 GMT

Hello,

Here result of tracepath, seem 1500 MTU i used. Am i right?

Re: IPsec Throughput

the_rock — Fri, 16 Aug 2024 02:22:08 GMT

You got it.