tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: reverse processing order: NAT, IPsec ?

On Fri, Jun 12, 2009 at 03:14:34PM -0500, David Young wrote:
> I don't see why there should be a profusion of interfaces if there isn't
> a profusion already for other reasons, such as a profusion of tunnel
> interfaces.

If you can get the amount of memory used by 5,000 tunnel interfaces down
to the amount of memory used by the datastructures for 5,000 tunnel-mode
IPsec SAs and SPD entries now, most of my concern goes away.  I guess it
would also be desirable to benchmark and see that it's no slower than the
current FAST_IPSEC implementation, under load, as well.


Home | Main Index | Thread Index | Old Index