Going “Insane” fast with Aviatrix High Performance Encryption (HPE)

Cloud Service Providers’ IPsec VPN solutions are limited to 1.25 Gbps regardless if you have a direct connection to the cloud with 10 Gbps or more. The reason is that CSP VPN gateways establishes a single tunnel and because of that the ethernet interface of those virtual devices can only direct incoming packets to a single core limiting the performance to a single CPU core, regardless how many CPU cores there are.

Insane Mode

Aviatrix Insane Mode tunneling techniques establishes multiple tunnels between two virtual routers allowing all CPU cores to be used for performance scaling with the CPU resources.

Aviatrix Insane Mode can achieve 10Gbps, 25Gbps and beyond, leveraging multiple CPU cores in a single instance. The following Google Cloud compute engine models supports Insane Mode:

  • n1-highcpu-4
  • n1-highcpu-8
  • n1-highcpu-16
  • n1-highcpu-32
  • n2-highcpu-4
  • n2-highcpu-8
  • n2-highcpu-16
  • n2-highcpu-32
  • c2-standard-4
  • c2-standard-8
  • c2-standard-16
  • c2-standard-30
  • c2-standard-60

Use Cases

  • High performance Encrypted Transit
  • High performance Encrypted Peering performance
  • High performance encryption over Direct Connect/ExpressRoute/FastConnect/InterConnect
  • Overcome CSP Gateways performance and route limits

Performance Results

https://docs.aviatrix.com/HowTos/insane_mode_perf.html?highlight=performance%20benchmark#activemesh-insane-mode-encryption-performance

Constraints

  • Gateway subnet should be at least a /26
  • It is recommended to avoid deploying other instances in the same subnet

Deployment

The insane mode is enable during the deployment. If using terraform the mc_transit module insane_mode = true variable triggers its deployment. Here is my tf file:


module "mc_transit" {
source = "terraform-aviatrix-modules/mc-transit/aviatrix"
version = "v2.0.0"
cloud = var.cloud
cidr = var.vpcs["firenet"]
region = var.region
account = var.account
enable_transit_firenet = true
enable_bgp_over_lan = var.bgpolan
insane_mode = var.insane
lan_cidr = var.vpcs["lan"]
bgp_lan_interfaces = [{
vpc_id = aviatrix_vpc.bgpolan.name
subnet = var.vpcs["bgpolan"]
}]
ha_bgp_lan_interfaces = [{
vpc_id = aviatrix_vpc.bgpolan-ha.name
subnet = var.vpcs["bgpolan-ha"]
}]
}
module "firenet_1" {
source = "terraform-aviatrix-modules/mc-firenet/aviatrix"
version = "1.0.0"
transit_module = module.mc_transit
firewall_image = var.firewall_image
firewall_image_version = var.firewall_image_version
#bootstrap_bucket_name_1 = var.storage_bucket_name
egress_cidr = var.vpcs["egress"]
egress_enabled = false
inspection_enabled = true
instance_size = var.instance_size
mgmt_cidr = var.vpcs["mgmt"]
password = var.password
}
module "mc-spoke" {
for_each = {
"spoke30" = "spoke50"
"spoke40" = "spoke60"
}
source = "terraform-aviatrix-modules/mc-spoke/aviatrix"
version = "1.1.2"
account = var.account
cloud = var.cloud
name = "gcp-${each.value}-${var.region}"
region = var.region
cidr = var.vpcs["${each.value}"]
inspection = true
transit_gw = module.mc_transit.transit_gateway.gw_name
ha_gw = true
instance_size = var.instance_size
single_az_ha = false
insane_mode = var.insane
}
resource "aviatrix_vpc" "bgpolan" {
cloud_type = 4
account_name = var.account
name = "gcp-bgpolan-${var.region}"
subnets {
name = "gcp-bgpolan-${var.region}"
region = var.region
cidr = var.vpcs["bgpolan"]
}
}
resource "aviatrix_vpc" "bgpolan-ha" {
cloud_type = 4
account_name = var.account
name = "gcp-bgpolan-ha-${var.region}"
subnets {
name = "gcp-bgpolan-ha-${var.region}"
region = var.region
cidr = var.vpcs["bgpolan-ha"]
}
}

view raw

gistfile1.txt

hosted with ❤ by GitHub

It deploys a BGPoLAN enabled HPE (insane) FireNet hub with 2 x FortiGates and 2 x spokes for testing. If deploying the transit gw from the Controller GUI there is a checkbox to enable/disable HPE:

Exploring

Insane Mode between between a Transit GW and a Spoke Gateway, the Aviatrix Controller automatically creates the underlying peering connection and builds the tunnels over it:

We can count 15 tunnels between a transit gw and a spoke with insane mode enabled :

  • we can see the private IPs are used to form the tunnels

A “vanilla” gateway uses the public ip and we count only two tunnels per transit-spoke pair:

References

https://docs.aviatrix.com/HowTos/insane_mode_perf.html?highlight=performance%20benchmark#activemesh-insane-mode-encryption-performance

2 thoughts on “Going “Insane” fast with Aviatrix High Performance Encryption (HPE)

Leave a Reply