HP-UX IPSec vA.02.00 Performance and Sizing White Paper

ManualsBrandsHP ManualsSoftwareHP-UX IPSec Software

Table Of Contents

HP-UX IPSec vA.02.00 Performance and Sizing

White Paper

Overview............................................................................................................................................ 3

Throughput, CPU Utilization and Service Demand ................................................................................... 3

Test Configuration............................................................................................................................ 4

AES, DES, and 3DES Encryption........................................................................................................ 5

Throughput .................................................................................................................................. 5

CPU Utilization ............................................................................................................................ 6

Service Demand........................................................................................................................... 6

MD5 and HMAC-SHA1 Authentication............................................................................................... 7

Throughput .................................................................................................................................. 7

CPU Utilization ............................................................................................................................ 8

Service Demand........................................................................................................................... 8

Authenticated AES, DES, and 3DES ................................................................................................... 9

Throughput .................................................................................................................................. 9

CPU Utilization .......................................................................................................................... 10

Service Demand......................................................................................................................... 10

Comparative Throughput................................................................................................................. 11

Security Association Measurements...................................................................................................... 12

ISAKMP/MM SA ........................................................................................................................... 12

IPsec/QM SAs............................................................................................................................... 12

Test Configuration.......................................................................................................................... 12

SA Negotiation Times..................................................................................................................... 12

Tuning Performance: Maximum Quick Mode SAs .............................................................................. 13

Mobile IPv6 Measurements ................................................................................................................. 14

Test Configuration.......................................................................................................................... 14

Binding Update and Binding Acknowledgement Messages ................................................................. 14

Forwarded Packets......................................................................................................................... 15

Applying Performance Data ................................................................................................................ 16

Appendix A: Two-Way HP Integrity Server Performance Data ................................................................. 17

Test Configuration.......................................................................................................................... 17

Comparative Results ....................................................................................................................... 18

Encrypted AES, DES, and 3DES....................................................................................................... 19

MD5 and HMAC-SHA1 .................................................................................................................. 20

Summary of content (30 pages)

PAGE 1
HP-UX IPSec vA.02.00 Performance and Sizing White Paper Overview............................................................................................................................................ 3 Throughput, CPU Utilization and Service Demand ................................................................................... 3 Test Configuration ............................................................................................................................
PAGE 2
Authenticated AES, DES, and 3DES ................................................................................................. 22 Appendix B: HP-UX PA-RISC Server Performance Data ........................................................................... 24 Test Configuration .......................................................................................................................... 24 Encrypted AES, DES, and 3DES............................................................................
PAGE 3
Overview The purpose of this document is to provide basic guidelines for accurately determining HP-UX server system modeling and configuration when using HP-UX IPSec. It is intended to help customers and the HP field force effectively size customer configurations when selling systems, responding to RFPs and deploying systems with HP-UX IPSec. The HP-UX IPSec product operates on HP-UX 11.0 and HP-UX 11i (HP-UX 11i v1 and HP-UX 11i v2 update 2).
PAGE 4
Data encryption with ESP Triple Data Encryption Standard (ESP-3DES). 3DES encrypts the data three times with three 56-bit keys. Data authentication with Authentication Header (AH) using Secure Hash Algorithm 1 (AH-SHA1-). AH provides data integrity and data authentication. AH using Message Digest 5 (AH-MD5). Data encryption with authentication using authenticated ESP with DES, 3DES and AES and HMAC-SHA1 (ESP-DES-HMAC-HMAC-SHA1, ESP-3DES-HMAC-HMACSHA1, and ESP-AES-HMAC-HMAC-SHA1).
PAGE 5
AES, DES, and 3DES Encryption The following charts display throughput, CPU utilization, and service demand data for raw IP data transmission and the following HP-UX IPSec transfer types: • ESP-AES • ESP-DES • ESP-3DES Throughput Figure 1 shows the throughput rates in Megabits per second (Mb/s).The throughput rates for ESP-DES and ESP-AES are close to the throughput for raw IP. Of the three encryption types, ESP-AES provides the strongest encryption with excellent throughput.
PAGE 6
CPU Utilization Figure 2 shows the percentage of the CPU used by the sending system. Of the three HP-UX IPSec transfer types, ESP- AES has the lowest CPU utilization rates, and provides the strongest encryption. CPU utilization for DES and AES decreases as the packet size increases, while CPU utilization for 3DES remains consistently high. Figure 2.
PAGE 7
MD5 and HMAC-SHA1 Authentication The following charts display a comparison of throughput and CPU utilization measured for raw IP data transmission and the following HP-UX IPSec transfer types: • AH-MD5 • AH-SHA1 Throughput Figure 4 shows the throughput rates in Mb/s). The throughput rates for AH-MD5 and AH-SHA1 are nearly identical. Figure 4.
PAGE 8
CPU Utilization Figure 5 shows the percentage of the CPU used by the sending system. The percentage of the CPU used with AH-SHA1 is less than the percentage used with AH-MD5. Figure 5. One-Way Itanium CPU Utilization for Raw IP, AH-MD5, AH-SHA1 Service Demand Figure 6 shows the service demand rates for AH-MD5 and AH-SHA1, which are much higher than those for raw IP at small packet sizes.
PAGE 9
Authenticated AES, DES, and 3DES ESP by itself does not provide data integrity or data authentication. HP recommends that you use authenticated ESP for data privacy, integrity and authentication, such as ESP-AES authenticated with HMAC-SHA1 (ESP-AES-HMAC-SHA1).
PAGE 10
CPU Utilization Figure 8 shows the percentage of the CPU used by the sending system. CPU utilization for ESP-AESHMAC-SHA1 is lower than CPU utilization rates for ESP-DES-HMAC-SHA1 and ESP-3DES-HMACSHA1, even though ESP- AES-HMAC-SHA1 provides the strongest encryption. CPU utilization for ESPDES-HMAC-SHA1 and ESP-AES-HMAC-SHA1 decreases as the packet size increases, while CPU utilization with ESP-3DES-HMAC-SHA1 remains consistently high. Figure 8.
PAGE 11
Comparative Throughput Figure 10 shows the comparative throughput when sending 32768-byte packets for raw IP packets and HP-UX IPSec encryption and authentication methods. ESP-AES and ESP-AES-HMAC-SHA1 provide the strongest encryption, with excellent throughput: 91.95 and 91.22 Mb/s, less than three percent throughput degradation compared to raw IP. Figure 10.
PAGE 12
Security Association Measurements You can use HP-UX IPSec with static, manually configured cryptography keys to encrypt and authenticate data. However, most installations use HP-UX IPSec with the Internet Key Exchange (IKE) protocol, which generates and manages dynamic keys for data encryption and authentication. When using IKE for dynamic keys, HP-UX IPSec must negotiate the following security sessions, or Security Associations (SAs) with the remote system before it can transmit user data: 1.
PAGE 13
Tuning Performance: Maximum Quick Mode SAs The time required to negotiate the ISAKMP/MM SA is more than 100 times greater than the time required to negotiate one pair of IPsec/QM SAs, so the number of IPsec/QM SA pairs negotiated per ISAKMP/MM SA affects performance. The maximum number of IPsec/QM SA pairs negotiated per ISAKMP/MM SA is configurable. In HP-UX version A.02.00 and later, you configure the maximum Quick Mode SAs per ISAKMP/MM SA using the maxqm option in the ipsec_config add ike command.
PAGE 14
Mobile IPv6 Measurements This section discusses HP-UX IPSec performance when used to secure Mobile IPv6 traffic, and assumes that the reader is familiar with Mobile IPv6 terminology and concepts. If you are not familiar with Mobile IPv6, refer to the HP-UX Mobile IPv6 product documentation, or to the Mobile IPv6 chapter in the HP-UX IPSec version A.02.00 Administrator’s Guide. HP-UX IPSec version A.02.00 and later supports security services for HP-UX Mobile IPv6 Home Agents.
PAGE 15
Forwarded Packets HP measured the number of packets per second a Home Agent forwarded from a Correspondent Node to a Mobile Node. (The data path is Correspondent Node -> Home Agent -> Mobile Node.) The Home Agent and Correspondent Node are attached to the same 100Base-T network, and the Mobile Node is attached to an adjacent 100Base-T network. An HP-UX IPSec tunnel is used to secure the packets as they pass between the Home Agent and Mobile Node.
PAGE 16
Applying Performance Data Use the following steps to create a sizing and performance report for a customer or test system: 1. Locate a server that is running HP-UX IPSec. 2. Assess the current environment, then forecast the potential future environment. Take the following into account: • Customer hardware Processor speed NIC bandwidth • Network bandwidth • Number of connections 3. Obtain current throughput and CPU utilization information for the system(s). 4.
PAGE 17
Appendix A: Two-Way HP Integrity Server Performance Data This appendix shows performance data for two-way HP Integrity (Itanium) servers. The throughput is the total for the two CPUs. The CPU utilization percentage is the average of the utilization rates for each of the two CPUs.
PAGE 18
Comparative Results Figure 11 shows that HP-UX IPSec throughput scales well. When using a 32768-byte send buffer, throughput for a two-way, dual NIC card configuration is approximately double the throughput for a one-way, single NIC card configuration. Figure 11. One-Way and Two-Way, 2 NICs Throughput for ESP-AES Figure 12 shows that HP-UX IPSec service demand (the CPU time required to send one kilobyte of data, in microseconds; lower is better) scales well.
PAGE 19
Figure 12. One-Way and Two-Way, 2 NICs Service Demand for ESP-AES Encrypted AES, DES, and 3DES Figure 13.
PAGE 20
Figure 14. Two-Way, Itanium CPU Utilization for Raw IP, ESP-AES, ESP-DES, ESP-3DES Figure 15. Two-Way, Itanium Service Demand for Raw IP, ESP-AES, ESP-DES, ESP-3DES AES MD5 and HMAC-SHA1 Figure 16.
PAGE 21
Figure 17. Two-Way, Itanium CPU Utilization for Raw IP, AH-MD5, AH-SHA1 Figure 18.
PAGE 22
Authenticated AES, DES, and 3DES Figure 19. Two-Way, Itanium Throughput for Raw IP, ESP-AES-HMAC-SHA1, ESP-DES-HMAC-SHA1, ESP-3DES-HMAC-SHA1 Figure 20.
PAGE 23
Figure 21.
PAGE 24
Appendix B: HP-UX PA-RISC Server Performance Data This appendix shows performance data for HP-UX PA-RISC servers. Data for 2-way HP-UX PA-RISC servers is not shown, but HP measured performance for 2-way PA-RISC systems with 2 100Bast-T cards and the same memory and software configuration. The measurements show that HP-UX IPSec throughput and service demand scale well. Throughput using 2-way PA-RISC systems is approximately double the throughput for 1-way PA-RISC systems.
PAGE 25
Encrypted AES, DES, and 3DES Figure 22. One-Way PA Throughput for Raw IP, ESP-AES, ESP-DES, ESP-3DES Figure 23.
PAGE 26
Figure 24. One-Way, PA Service Demand Rate for Raw IP, ESP-AES, ESP-DES, ESP-3DES MD5 and HMAC-SHA1 Figure 25.
PAGE 27
Figure 26. One-Way CPU Utilization for Raw IP, AH-MD5, AH-SHA1 Figure 27.
PAGE 28
Authenticated AES, DES, and 3DES Figure 28. One-Way PA Throughput for Raw IP, ESP-AES-HMAC-SHA1, ESP-DES-HMAC-SHA1, ESP-3DES-HMAC-SHA1 Figure 29. One-Way PA CPU Utilization for Raw IP, ESP-AES-HMAC-SHA1, ESP-DES-HMAC-SHA1, ESP-3DES-HMAC-SHA1 Figure 30.
PAGE 29
Appendix C: Test Methodology The netperf utility was used to measure HP-UX IPSec performance. The netperf utility can measure the throughput and CPU utilization for one-way and two-way systems. You can then use the data collected to estimate future performance demand and provide a platform that can scale appropriately for the customer's future demand expectations.
PAGE 30
For more information www.docs.hp.com/hpux/internet/index.html#HP-UX%20IPSec HP-UX IPSec version A.02.00 Administrator’s Guide, HP, 2004 Copyright  2005 Hewlett-Packard Development Company L.P. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license.