HP-UX IPSec vA.03.00 Performance and Sizing White Paper

ManualsBrandsHP ManualsSoftwareHP-UX IPSec Software

HP-UX IPSec vA.03.00 Performance and Sizing

White Paper

Overview............................................................................................................................................ 2

Throughput, CPU utilization, and service demand.................................................................................... 2

Test system configuration .................................................................................................................. 3

MD5 and HMAC-SHA1 authentication ............................................................................................... 4

Throughput .................................................................................................................................. 4

CPU utilization ............................................................................................................................. 5

Service demand ........................................................................................................................... 5

Authenticated AES and 3DES ............................................................................................................ 6

Throughput .................................................................................................................................. 6

CPU utilization ............................................................................................................................. 7

Service demand ........................................................................................................................... 7

Security Association Measurements........................................................................................................ 7

IKE SAs........................................................................................................................................... 8

IPsec SAs ........................................................................................................................................ 8

Comparison of SA Negotiation Time of IKEv1 and IKEv2...................................................................... 8

Test System Configuration ................................................................................................................. 9

Appendix A: Double dual-core (4-way) HP Integrity Server performance data .......................................... 10

Test configuration........................................................................................................................... 10

Comparative scaling ...................................................................................................................... 10

MD5 and HMAC-SHA1 authentication ............................................................................................. 11

Authenticated AES and 3DES .......................................................................................................... 13

Appendix B: Test methodology............................................................................................................ 15

Methods of measurement ................................................................................................................ 15

Summary of content (15 pages)

PAGE 1
HP-UX IPSec vA.03.00 Performance and Sizing White Paper Overview............................................................................................................................................ 2 Throughput, CPU utilization, and service demand.................................................................................... 2 Test system configuration ..................................................................................................................
PAGE 2
Overview The purpose of this document is to provide basic guidelines for accurately determining HP-UX server system modeling and configuration when using HP-UX IPSec. It is intended to help customers and the HP field force effectively size customer configurations when selling systems, responding to RFPs, and deploying systems with HP-UX IPSec. The HP-UX IPSec product version A.03.00 operates on HP-UX 11i (v2 and v3).
PAGE 3
SHA1, and ESP-AES-HMAC-SHA1) with 128 to 32768-byte TCP send buffers. In addition, CPU utilization for raw IP data transmission (data transmission without HP-UX IPSec enabled) is measured as a baseline. • Service demand Service Demand is the measure of how much of the CPU is used to transfer a unit of data, measured in microseconds of CPU required to transmit one kilobyte (KB) of data. The smaller the measured service demand, the more efficiently the system is operating.
PAGE 4
MD5 and HMAC-SHA1 authentication The following charts display a comparison of throughput and CPU utilization measured for raw IP data transmission and the following HP-UX IPSec transfer types: • AH-MD5 • AH-SHA1 Throughput Figure 1 shows the throughput rates in megabits per second (Mb/s). The throughput rates for AHSHA1 are higher than the rates for AH-MD5. With message sizes greater than 1024 bytes, the AHSHA1 produces almost 50% better throughput rate than AH-MD5. Figure 1.
PAGE 5
CPU utilization Figure 2 shows the percentage of the CPU used by the sending system. The percentages of CPU utilization with AH-SHA1 and AH-MD5 are nearly identical even though the throughput rate of AHSHA1 is better than AH-MD5. Figure 2.
PAGE 6
Authenticated AES and 3DES ESP by itself does not provide data integrity or data authentication. HP recommends that you use authenticated ESP for data privacy, integrity and authentication, such as ESP-AES authenticated with HMAC-SHA1 (ESP-AES-HMAC-SHA1).
PAGE 7
CPU utilization Figure 5 shows the percentage of the CPU used by the sending system. CPU utilization for ESP-AESHMAC-SHA1 is lower than CPU utilization for ESP-3DES-HMAC-SHA1, even though ESP-AES-HMACSHA1 provides the strongest encryption and better throughput rate. Figure 5.
PAGE 8
When using IKE (IKEv1 or IKEv2) for dynamic keys, HP-UX IPSec must negotiate the following security sessions, or Security Associations (SAs), with the remote system before it can transmit user data: 1. Internet Key Exchange (IKE) SA. 2. IPsec SAs. IKE SAs The IKE SA is the initial (“bootstrap”) or master SA. The systems use the IKE SA to verify system identities and to establish initial values for shared cryptography keys using a Diffie-Hellman exchange.
PAGE 9
Figure 7. Comparison of negotiation time for IKEv1 and IKEv2 with PFS off and on Negotiation time for IKEv1 and IKEv2 with PFS off/on 3.5 Time (seconds) 3 2.5 IKEv1 2 IKEv1 with PFS 1.5 IKEv2 IKEv2 with PFS 1 0.5 0 1 5 10 15 30 50 100 200 Number of SAs established Test System Configuration The data reported in this section was derived from tests performed on a system with the following configuration: • 1x Itanium 9100 series processor 1.
PAGE 10
Appendix A: Double dual-core (4-way) HP Integrity Server performance data Test configuration This appendix shows performance data for two double dual-core (4-way) HP Integrity (IA) servers with the following configuration: • HP Integrity BL860c Server Blade • 2x Itanium 9100 series processor 1.67 GHz, 2 logical processors per socket • Memory: 8161 MB (7.97 GB) • 2x 1000 Base-T card, operating with 1000 Mbps link speed (using 100/1000 Mbps switch) • HP-UX IPSec Version A.03.00 • OS version: HP-UX B.11.
PAGE 11
Figure 9. Two-way and four-way Service demand for ESP-AES-HMAC-SHA1 Comparative service demand for 2-way and 4-way systems Service demand (microsec/KB) 60 50 40 32.91 30 2-Way ESP-AESHMAC-SHA1 22.09 4-Way ESP-AESHMAC-SHA1 20 10 0 4096 Message size (bytes) MD5 and HMAC-SHA1 authentication Figure 10.
PAGE 12
Figure 11. Double dual-core (4-way) CPU utilization for raw IP, AH-MD5, AH-SHA1 Double dual-core (4-way) CPU utilization 120 Percentage (%) 100 80 Raw AH-MD5 60 AH-SHA1 40 20 0 128 256 512 1024 2048 4096 8192 16384 32768 Message size (bytes) Figure 12.
PAGE 13
Authenticated AES and 3DES Figure 13. Double dual-core (4-way) throughput for raw IP, ESP-3DES-HMAC-SHA1, and ESP-AES-HMAC-SHA1 Throughput (Mb/s) Double dual-core (4-way) throughput 2000 1800 1600 1400 1200 1000 800 600 400 200 0 Raw ESP-3DESHMAC-SHA1 ESP-AESHMAC-SHA1 128 256 512 1024 2048 4096 8192 16384 32768 Message size (bytes) Figure 14.
PAGE 14
Figure 15.
PAGE 15
Appendix B: Test methodology The netperf utility was used to measure HP-UX IPSec performance. The netperf utility can measure the per-crypto-type throughput and per-crypto-type CPU utilization for two-way and four-way systems. It can then use the data collected to estimate future performance demand and provide a platform that can scale appropriately for the customer's future demand expectations. Methods of measurement The SA measurement is based on the protocol analyzer timestamp.