Intro

Performance data is always a key criteria for selection of network solutions. But performance data is easily misconstrued, making vendor comparisons challenging, if not impossible. While Netgate is not in a position to vet other vendors' claims, we try to be 100% transparent with our performance test results. Packet traffic conditions, hardware vintage, software release, and test methodology can independently affect test results let alone en masse. So, we invite readers to remember the following when viewing TNSR^® software test data:

• Not all packets are created equal
• Not all CPUs are created equal
• The packet processing “tax” on the CPU varies dramatically by application
• Flow type (unidirectional vs. bidirectional) yields different results
• The level of encryption and availability of hardware assist matters
• Software-based packet processing technology is evolving rapidly
• Performance evolves with product software releases

Last, it should be understood that these numbers were generated in a controlled test laboratory and, therefore, cannot be guaranteed for "in the wild" environments.

Out test results are packaged and shared as follows:

• Non-encrypted traffic performance for TNSR running on commercial off-the-shelf (COTS) hardware (see below)
• Encrypted traffic performance for TNSR running on commercial off-the-shelf (COTS) hardware (see below)
• Performance data for Netgate appliances running TNSR is located here

Non-Encrypted Traffic Test Setup

Using a Dell R730 server, performance tests were run on three different platform configurations:

• • Bare Metal Integration (BMI)
  • KVM
  • VMware

Exact test specifications are shown here:

Non-Encrypted Traffic Test Results

Throughput results for L3 Forwarding, Firewall (forwarding with 10k ACLs), and Forwarding with 1:1 NAT are shown for each platform below:

¹ iPerf3 measures the maximum throughput using 1460 byte payloads and TCP framing.
² IMIX (Internet Mix) simulates typical Internet traffic with sets of 7 (40) byte packets, (4) 576 byte packets, 1 (1500) byte packets, plus Ethernet framing overhead. When measuring equipment performance using an IMIX of packets the performance is assumed to resemble what can be seen in "real-world" conditions.
³ a Worker is a CPU core assigned to packet processing operations

Encrypted Traffic (IPsec) Test Setup

Using a Dell R730 server, IPsec VPN tests were performed using a single CPU core with five different types of traffic - using both AES-GCM-128 with CPU-integrated AES-NI, as well as AES-GCM-128 with Intel® Quick Assist Technology (QAT).

Exact test specifications are shown here:

Encrypted Traffic (IPsec) Test Results

¹AES-NI instruction set extensions are used to optimize encryption and decryption algorithms.
² Intel® QuickAssist Technology accelerates and compresses cryptographic workloads by offloading the data to hardware capable of optimizing those functions.