CX6-DX Crypto enable card IPsec full offload performance

[aarialhsuu]

Hi,

Hello, I am currently using ConnectX-6 Dx Crypto enable card PN:MCX623106AC-CDAT to test the throughput of IPsec packet offload.

When I enable packet offload, the throughput stays at 58 Gbps across 4 to 32 CPUs.

Could you please advise on how to configure the settings to reach 90 Gbps?

According to the test data on this page " Extend XFRM core to allow packet offload configuration [LWN.net] ", my baseline matches the report’s findings. However, once IPsec packet offload is enabled, throughput is limited to 58 Gbps.

Linux version : 24.04 LST , kernel 6.18

setup NIC: ConnectX6-DX dual port, 100 Gbps each. Single port used in the tests.

MTU settings: ip link set dev enp1s0f0 mtu 9000
IRQ affinity: mlnx_tune -p HIGH_THROUGHPUT

[namrata1]

Hi aarialhsuu,

Thank you for posting your query on NVIDIA Community.

Our general recommendation is to use latest DOCA version along with latest firmware version on a supported OS/kernel system prior to attempting any testing. This also involves validating a supported switch and cables are in use. The overall support matrix is listed on —> General Support | DOCA

Next, we recommend using iperf instead of iperf3 along with tuning the system for maximum performance —> EnterpriseSupport

Please also review the following article for additional details on ipsec perf → GitHub - huynguyen85/ipsec_perf: Performance test for ipsec offload · GitHub

Thanks,

NVEX Networking Technical Support Team.