4 ms·

How is IPSec performance better than wg? I never heard this before, it sounds intriguing.

• hdgvhicv 9mo ago
  If you have an edge device which implements hardware IPsec at 10g+ but pushes WireGuard to software on an underpowered cpu then sure.
  • rebewhd 9mo ago
    While that's true, I'm not sure it's because of something inherent in IPsec vs WireGuard. It's more likely due to the fact that hardware accelerators have been designed to offload encryption routines that IPsec uses. One wonders what WG perf would look like if it could leverage the same hardware offload.
    • iscoelho 9mo ago
      Exactly this. I would love to see a commercial product with a hardware implementation for WireGuard, but it does not yet exist. IPsec, however, is well supported.
      • kosolam 9mo ago
        Thanks for your answers. I wonder though, from the perspective of a small user that doesn’t have requirements for such bandwidth, how does ipsec compare with wg on other metrics/features? Is it worth looking into?
        • iscoelho 9mo ago
          I'd use WireGuard in that case. The main reason WireGuard is popular at all is because it is approachable. IPsec is much more complicated and is designed for network engineers, not users.
          • kosolam 9mo ago
            Well yeah, so except being more complex and having hardware support, is there anything useful in ipsec? I meant a user in the general sense, not necessarily meaning a clueless non technical home user.
• iscoelho 9mo ago
  At this time, there is no commercial offering for hardware/ASIC WireGuard implementations. The standard WireGuard implementation cannot reach 10G. The fastest I am aware of is VPP (open-source) & Intel QAT [1], which while it is achieves impressive numbers for large packets (70Gbps @ 512 / 200Gbps @ 1420 on a $20k+ MSRP server), is still not comparable with commercial IPsec offerings [2][3][4] that can achieve 800Gbps+ on a single gateway (and come with the added benefit of relying on a commercial product with support). [1] https://builders.intel.com/docs/networkbuilders/intel-qat-accelerate-wireguard-processing-with-4th-gen-intel-xeon-scalable-processor-technology-guide-1673248114.pdf https://builders.intel.com/docs/networkbuilders/intel-qat-ac... [2] https://www.juniper.net/content/dam/www/assets/datasheets/us/en/security/security-products-comparison-chart.pdf https://www.juniper.net/content/dam/www/assets/datasheets/us... [3] https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/product-summary-specsheet https://www.paloaltonetworks.com/apps/pan/public/downloadRes... [4] https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/Fortinet_Product_Matrix.pdf https://www.fortinet.com/content/dam/fortinet/assets/data-sh...
  • iscoelho 9mo ago
    There are also solutions like Arista TunnelSec [1] that can achieve IPsec and VXLANsec at line-rate performance (21.6Tbps per chassis)! This is fairly new and fancy though. [1] https://www.arista.com/assets/data/pdf/Whitepapers/EVPN-Data-Center-Line-Rate-Encryption-with-Arista-TunnelSec-WP.pdf https://www.arista.com/assets/data/pdf/Whitepapers/EVPN-Data...
  • mlhpdx 9mo ago
    This lack of ASIC is interesting to me. If it existed, that would very much change the game. And, given the simplicity of WG encryption it would be a comparatively small design (lower cost?)