On 11/6/10 1:06 PM, Tom Eastep wrote: > On 11/4/10 3:27 AM, Joerg Kurlbaum wrote: >> On Tue, Nov 02, 2010 at 01:00:42PM -0700, Tom Eastep wrote: >>> I see nothing in the dumps that gives a clue as to the problem. If you >>> are still experiencing this issue, I think that the next step is for me >>> to try to reproduce the problem in a controlled environment. >> >> Yes, we still have this problem. (And i think it will not go away by >> itself, even when hoped so). >> >> If you could have a closer look, and try to reproduce the problem, >> that would be really great. >> > > I have seen some decrease in throughput with SNAT but no effect on %SI. > I'll test some more tomorrow.
After careful testing today, I was not able to reproduce your problem.
Configuration:
Shorewall box: Debian Lenny, 3.4mz Pentium IV
Shorewall 4.4.14
Remote Endpoint: Debian Lenny running in a VirtualBox VM under
OS X. This was also where the IPSEC tunnel was
terminated. Hardware is a MacBook Pro with a
2.66 Ghz Intel Core i7.
Local Endpoint: Debian Squeeze running in a VirtualBox VM
under Windows XP. Hardware is a 2.3 Ghz Athlon
Dual Core.
There was a commercial SMC router between the Shorewall box and
the remote endpoint. All interfaces are Gigabit Ethernet.
Both endpoints were configured using setkey and racoon.
I tested using iperf which was run on the
Results are as follows:
No SNAT, No IPSEC
Local Server: 91.6 Mbit/sec
Remote Server: 75.8 Mbit/sec
SNAT, No IPSEC
Local Server: 91.3 Mbit/sec
Remote Server: 75.9 Mbit/sec
No SNAT, IPSEC
Local Server: 89.7 Mbit/sec %si=15%
Remote Server: 73.2 Mbit/sec %si=12%
SNAT, IPSEC
Local Server: 90.0 Mbit/sec %si=15%
Remote Server: 73.1 Mbit/sec %si=12%
As you can see, SNAT had no effect on throughput or on CPU utilization.
Adding IPSEC had an expected effect on CPU utilization (Total CPU busy
was around 20% in all IPSEC test cases and around 5% in the non-IPSEC
tests).
I can only conclude that this issue is something unique to your
configuration. The significant difference in our firewalls' software
configurations is Lenny vs. Squeeze. Your hardware is more powerful than
mine.
One more note -- my IPSEC zone has mss=1380 while yours has mss=1400.
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ The Next 800 Companies to Lead America's Growth: New Video Whitepaper David G. Thomson, author of the best-selling book "Blueprint to a Billion" shares his insights and actions to help propel your business during the next growth cycle. Listen Now! http://p.sf.net/sfu/SAP-dev2dev
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
