[kosolam]

How is IPSec performance better than wg? I never heard this before, it sounds intriguing.

[iscoelho]

At this time, there is no commercial offering for hardware/ASIC WireGuard implementations. The standard WireGuard implementation cannot reach 10G.

The fastest I am aware of is VPP (open-source) & Intel QAT [1], which while it is achieves impressive numbers for large packets (70Gbps @ 512 / 200Gbps @ 1420 on a $20k+ MSRP server), is still not comparable with commercial IPsec offerings [2][3][4] that can achieve 800Gbps+ on a single gateway (and come with the added benefit of relying on a commercial product with support).

[1] https://builders.intel.com/docs/networkbuilders/intel-qat-ac...

[2] https://www.juniper.net/content/dam/www/assets/datasheets/us...

[3] https://www.paloaltonetworks.com/apps/pan/public/downloadRes...

[4] https://www.fortinet.com/content/dam/fortinet/assets/data-sh...

[iscoelho]

There are also solutions like Arista TunnelSec [1] that can achieve IPsec and VXLANsec at line-rate performance (21.6Tbps per chassis)! This is fairly new and fancy though.

[1] https://www.arista.com/assets/data/pdf/Whitepapers/EVPN-Data...

[mlhpdx]

This lack of ASIC is interesting to me. If it existed, that would very much change the game. And, given the simplicity of WG encryption it would be a comparatively small design (lower cost?)

[hdgvhicv]

If you have an edge device which implements hardware IPsec at 10g+ but pushes WireGuard to software on an underpowered cpu then sure.

[rebewhd]

While that's true, I'm not sure it's because of something inherent in IPsec vs WireGuard. It's more likely due to the fact that hardware accelerators have been designed to offload encryption routines that IPsec uses.

One wonders what WG perf would look like if it could leverage the same hardware offload.