Hardware requirements to feed multiple IPSec connections

Hello everybody,

background is a VPN-Gateway probably (status: planning) running SuSE 8.2,
Kernel 2.4.21 and latest stable FreeS/WAN to establish a VPN with another
gateway of the same brand. Additionally that first gateway will have to
feed other incoming VPN-connections like Roadwarriors with PPTP or
(hopefully) other IPSec implementations. The static VPN tunnel runs over a
2MBit SDSL line in the first place, more lines or higher bandwith for that
line will probably come.

Question is: How much work is it for the hardware to encrypt and decrypt
IPSec traffic? What requirements would we have to meet in order to feed at
least 5MBit/s of IPSec traffic on that box?

I was quite sure that it would not be a problem for recent PC hardware to do
that job, but someone made me think about it, because he believed
otherwise.

Thanks for all hints and tips!

Kind regards,
--
- Nat

www.bleeding.de | www.metal-germany.de

-= Bleeding for Metal | c/o Madhouse Of Cain =-
-= P.O. Box 39 23 | 30039 Hannover | Germany =-

Natanael Mignon <nat DeleteThis @bleeding.de> wrote in
news:eis3db-0s7.ln@f4.intranet.bleeding.de:

> Hello everybody,
>
> background is a VPN-Gateway probably (status: planning) running SuSE
> 8.2, Kernel 2.4.21 and latest stable FreeS/WAN to establish a VPN with
> another gateway of the same brand. Additionally that first gateway
> will have to feed other incoming VPN-connections like Roadwarriors
> with PPTP or (hopefully) other IPSec implementations. The static VPN
> tunnel runs over a 2MBit SDSL line in the first place, more lines or
> higher bandwith for that line will probably come.
>
> Question is: How much work is it for the hardware to encrypt and
> decrypt IPSec traffic? What requirements would we have to meet in
> order to feed at least 5MBit/s of IPSec traffic on that box?
>
> I was quite sure that it would not be a problem for recent PC hardware
> to do that job, but someone made me think about it, because he
> believed otherwise.
>
> Thanks for all hints and tips!
>
> Kind regards,

I would recommend you look at
http://www.freeswan.org/freeswan_trees/freeswan-2.00/doc/performance.html

But for a mere 5MBit you won't need much of a machine. And bear in mind if
you compile with AES support the throughput increase (I believe) 40% on a
given platform.