Ugh.Ħ,5GBbs is total throughput that an appliance can process via VPN. This applies to all summated connections.ĩ00Mb/s for a ' elephant flow'. It's a very good value. However doing so would bottleneck the flow of a connection's packets down to the speed of the slowest or most congested core handling packets for that connection, as packets that have already been inspected and are ready for transmission get held/queued waiting for earlier packets to clear inspection on the slowest or most congested core. Should this single-core limitation per connection ever be lifted, there would need to be some kind of reordering mechanism on the firewall to ensure packets are delivered in order. Trying to spread the packets for a single elephant flow connection around to multiple cores raises the specter of out-of-order delivery, which if it happens will cause TCP to sharply curtail its send rate due to the congestion/problems it is seeing in the network flow and is an unmitigated disaster from a performance perspective. All the packets of a single connection (TCP or UDP) can only be handled by one core (whether it is a SND/IRQ or Firewall Worker), so in the case of an elephant flow all those packets will hit a single core and cannot be spread around to different cores to relieve the load. It is not a limitation per VPN tunnel specifically, so modifying the VPN Tunnel Sharing value will have no effect on your issue, the limitation is per individual connection (and a single VPN tunnel can carry multiple connections of course).

Has anyone seen more then 1Gb/s throughput on a single VPN-tunnel and a single connection beetween devices behind two CheckPoint devices? I know this is a marketing value and only relevant if using multiple connections. The datasheet for an 5600 appliance shows 6,5GBbs and following sk73980 there should be 429% refer the datasheet possible. Hardware encryption via AES-NI is on and we use the best IPSEC-parameter following sk73980. We do not see more then 50% CPU utilization on both cores for the SNDs, looks like there are some credits before hitting 100%CPU. Incoming and outgoing interface are on different SNDs.

SecureXL is on, all VPN trafic is fully accelerated. We tested 5600, 5800, 1380, all with the same result. We did some research with different appliances but did not get more then 900Mb/s for a single connection. I had a question regarding the throughput of one VPN site2site-tunnel.

Vpn site to site checkpoint