high cpu load with pfsense ipsec

[nsc]

Hy

We are using server based on AMD EPYC 4344P 8-Core Processor (1 Socket) / 16 Threads from OVH.

Network card is a dual 2x25Gbit : Intel Corporation Ethernet Controller E810-XXV for SFP (rev 02) in bonding mode.

We have PFSENSE KVM with multiple network card (virtio).
When backup start, with ipsec, load goes high (around 10) on 1 PFSENSE and dropped packets start on other VM on this host.

i'm aware than each virtio = 1 thread but we have only 14 vCPU allowed on this host for 24 network card, 38 threads for a 16 thread CPU.

i increase buffer ring from 2048/256 to 2048/2048 https://forum.proxmox.com/threads/network-packet-loss-in-high-traffic-vms.114993/

but maybe I'm just too optimistic that I should lower my vCPU / threads count on these host to handle high traffic ?

Thanks

nsc

 

[SteveITS]

Did you disable checksum offload ?

Pushing 25 Gbit through pfSense is CPU intensive. Hence TNSR. Netgate’s 8300 probably can’t get there, looking at the specs.(which show iperf but not imix)

 

[nsc]

we dont push 25gbit through pfsense, ipsec link is 1gbit for remote backup (with AES-XCBC protocol)
i missed the option "disable checksum offload", coming from vmware esx...