使用vSRX测试一下IPsec VPN各加密算法的性能差异

最新推荐文章于 2024-07-21 15:49:55 发布

Danileaf_Guo

最新推荐文章于 2024-07-21 15:49:55 发布

阅读量1k

点赞数 20

文章标签：网络服务器 linux 运维

本文链接：https://blog.csdn.net/gtj0617/article/details/136523940

版权

正文共：1111 字 13 图，预估阅读时间：2 分钟

我们前面介绍了Juniper虚墙vSRX的部署（Juniper虚拟防火墙vSRX部署初体验）、导入到ESXi（将Juniper虚拟防火墙vSRX部署在ESXi进行简单测试）、导入到EVE-NG（将Juniper虚拟防火墙vSRX导入EVE-NG），并在EVE-NG中简单测试了IPsec VPN的配置（配置Juniper虚墙vSRX基于策略的IPsec VPN（WEB方式）、配置Juniper虚墙vSRX基于路由的IPsec VPN（CLI方式））。

前面测的都是功能项，今天简单测试一下vSRX的转发性能，SRX配置使用导入时默认的2核CPU、4 GB内存的默认配置。

首先，我们在vSRX219的两个接口上分别挂一台主机，测试一下转发性能。

set interfaces ge-0/0/0 unit 0 family inet address 10.11.1.1/24
set interfaces ge-0/0/1 unit 0 family inet address 10.12.1.1/24
set security zones security-zone trust interfaces ge-0/0/0.0
set security zones security-zone trust interfaces ge-0/0/1.0
set security zones security-zone trust host-inbound-traffic system-services all
set security zones security-zone trust host-inbound-traffic protocols all
set security policies from-zone trust to-zone trust policy default-permit match source-address any
set security policies from-zone trust to-zone trust policy default-permit match destination-address any
set security policies from-zone trust to-zone trust policy default-permit match application any
set security policies from-zone trust to-zone trust policy default-permit then permit
commit

经过多次测试，综合转发性能在7 Gbps左右，最大值在8 Gbps左右。

为了相对准确，我们在vSRX220上面也测试一下。

测试数据稍微高一点，整体不超过5%，问题不大。

然后使两台设备互联，并创建基于路由的IPsec VPN，其中vSRX219的配置如下：

set interfaces st0 unit 0 family inet address 10.120.1.1/24
set routing-options static route 10.22.1.0/24 next-hop st0.0
set security zones security-zone trust interfaces st0.0
set security ike proposal ike authentication-method pre-shared-keys
set security ike proposal ike dh-group group19
set security ike proposal ike encryption-algorithm aes-256-gcm
set security ike policy ike proposals ike
set security ike policy ike pre-shared-key ascii-text qweasd123
set security ike gateway gw address 10.12.1.2
set security ike gateway gw remote-identity inet 10.12.1.2
set security ike gateway gw external-interface ge-0/0/0
set security ike gateway gw local-address 10.12.1.1
set security ike gateway gw local-identity inet 10.12.1.1
set security ike gateway gw version v2-only
set security ike gateway gw ike-policy ike
set security ipsec proposal ipsec protocol esp
set security ipsec proposal ipsec encryption-algorithm aes-256-gcm
set security ipsec policy ipsec proposals ipsec
set security ipsec policy ipsec perfect-forward-secrecy keys group19
set security ipsec vpn ipsec ike gateway gw
set security ipsec vpn ipsec ike ipsec-policy ipsec
set security ipsec vpn ipsec bind-interface st0.0
set security ipsec vpn ipsec establish-tunnels immediately
commit

vSRX220的配置如下：

set interfaces st0 unit 0 family inet address 10.120.1.2/24
set routing-options static route 10.11.1.0/24 next-hop st0.0
set security zones security-zone trust interfaces st0.0
set security ike proposal ike authentication-method pre-shared-keys
set security ike proposal ike dh-group group19
set security ike proposal ike encryption-algorithm aes-256-gcm
set security ike policy ike proposals ike
set security ike policy ike pre-shared-key ascii-text qweasd123
set security ike gateway gw address 10.12.1.1
set security ike gateway gw remote-identity inet 10.12.1.1
set security ike gateway gw external-interface ge-0/0/0
set security ike gateway gw local-address 10.12.1.2
set security ike gateway gw local-identity inet 10.12.1.2
set security ike gateway gw version v2-only
set security ike gateway gw ike-policy ike
set security ipsec proposal ipsec protocol esp
set security ipsec proposal ipsec encryption-algorithm aes-256-gcm
set security ipsec policy ipsec proposals ipsec
set security ipsec policy ipsec perfect-forward-secrecy keys group19
set security ipsec vpn ipsec ike gateway gw
set security ipsec vpn ipsec ike ipsec-policy ipsec
set security ipsec vpn ipsec bind-interface st0.0
set security ipsec vpn ipsec establish-tunnels immediately
commit

配置完成之后，查看IPsec协商状态。