Performance analysis of VPN protocols over lag architectures under varying MTU conditions

This thesis presents a performance comparison of two widely used VPN protocols, WireGuard and IPsec, under varying Maximum Transmission Unit (MTU) sizes and Link Aggregation (LAG) architectures. Various configurations—including Round-Robin, 802.3ad, single interface/single tunnel, and dual interface/dual tunnel setups—were evaluated using key performance metrics such as throughput, packets per second (PPS), CPU utilization, and transmission efficiency. The experiments were conducted on a multi-core Intel-based system using iPerf3 with both single and 20 parallel session tests across five different MTU values (ranging from 450 to 9200 bytes). The results show that WireGuard consistently delivers higher performance and lower CPU usage than IPsec, particularly with larger MTU sizes. While the Round-Robin mode achieved higher PPS, it also increased CPU load and caused packet reordering issues. In contrast, 802.3ad provided more stable multi-core utilization, though with slightly reduced throughput. The most efficient outcomes were observed with dual interface setups using WireGuard and high MTU values. Additionally, a mathematical model was developed to describe the relationship between throughput, MTU, CPU load, and encryption overhead. This model offers a practical tool for network engineers to design optimized VPN architectures, particularly for resource-constrained endpoint devices.