SRX

Hi,

I have several hundred SRX300, some of them in cluster mode, they all worked on 15 version. A few weeks ago, I started updating them to the recommended version - 21.4R3-S4 and after the update I noticed that performance decreased. Decreased in part of IPsec. We received user complaints and alerts from monitoring systems about SPU utilization

The configuration remains exactly the same.

I started to figure it out and test load(iperf2 – 10 Mbit/s UDP one way flow) the SRXs and came up with this rule – SRX300 on 15 version 10 Mbit/s equivalent ~ 10% of SPU utilization, on 21 version equivalent ~ 25-30% of SPU utilization! We are talking about the same equipment and same configuration. I repeated this on version 20, the result was the same as on version 21.

I tried switching to GCM encryption, but it didn't help.

Perhaps someone has encountered this and can help. Thank you.

Out of curiosity, what is the 15 version you're using?

(I've got nothing; it's been a few years since I've had a firewall on 15, and don't recall a performance dip.)

Hi,

I have several hundred SRX300, some of them in cluster mode, they all worked on 15 version. A few weeks ago, I started updating them to the recommended version - 21.4R3-S4 and after the update I noticed that performance decreased. Decreased in part of IPsec. We received user complaints and alerts from monitoring systems about SPU utilization

The configuration remains exactly the same.

I started to figure it out and test load(iperf2 – 10 Mbit/s UDP one way flow) the SRXs and came up with this rule – SRX300 on 15 version 10 Mbit/s equivalent ~ 10% of SPU utilization, on 21 version equivalent ~ 25-30% of SPU utilization! We are talking about the same equipment and same configuration. I repeated this on version 20, the result was the same as on version 21.

I tried switching to GCM encryption, but it didn't help.

Perhaps someone has encountered this and can help. Thank you.

Hi,

I have several hundred SRX300, some of them in cluster mode, they all worked on 15 version. A few weeks ago, I started updating them to the recommended version - 21.4R3-S4 and after the update I noticed that performance decreased. Decreased in part of IPsec. We received user complaints and alerts from monitoring systems about SPU utilization

The configuration remains exactly the same.

I started to figure it out and test load(iperf2 – 10 Mbit/s UDP one way flow) the SRXs and came up with this rule – SRX300 on 15 version 10 Mbit/s equivalent ~ 10% of SPU utilization, on 21 version equivalent ~ 25-30% of SPU utilization! We are talking about the same equipment and same configuration. I repeated this on version 20, the result was the same as on version 21.

I tried switching to GCM encryption, but it didn't help.

Perhaps someone has encountered this and can help. Thank you.

There is a PR 1692526 which probably has something to do with this. The PR is not public, because no customer has reported it yet. It increases SPU utilization, and crashes it eventually. The trigger of this is the firewall events that SPU has to process for a logical interface, i.e. tunnel, loopback etc. In other words, if you have high number of firewall filters applied to logical interfaces like tunnel, Loopback interfaces (I have reason to believe that it is applicable to firewall filters applied on IFLs as well), you will face high SPU utilization and it can lead to crash in some scenario. You mentioned that you have IPsec implementation, probably this is the one that is affecting you. 

Note: I do not have the configuration, or details about the full setup, so this is just a guess. Please open a case with JTAC to verify.

Hi,

I have several hundred SRX300, some of them in cluster mode, they all worked on 15 version. A few weeks ago, I started updating them to the recommended version - 21.4R3-S4 and after the update I noticed that performance decreased. Decreased in part of IPsec. We received user complaints and alerts from monitoring systems about SPU utilization

The configuration remains exactly the same.

I started to figure it out and test load(iperf2 – 10 Mbit/s UDP one way flow) the SRXs and came up with this rule – SRX300 on 15 version 10 Mbit/s equivalent ~ 10% of SPU utilization, on 21 version equivalent ~ 25-30% of SPU utilization! We are talking about the same equipment and same configuration. I repeated this on version 20, the result was the same as on version 21.

I tried switching to GCM encryption, but it didn't help.

Perhaps someone has encountered this and can help. Thank you.