Network performance impact on OpenShift Container Platform 4 when configure IPsec with OVN-Kubernetes network plugin

Issue

• While evaluating OVN-Kubernetes we also enabled IPsec to secure traffic between nodes and found that once IPsec is enabled, we only achieve about 1/4 of the throughput vs. when IPsec is actually disabled. Can you please help us understand why this is (some impact is expected but not that much).
• We have enabled IPsec encryption for OVN following Configuring IPsec encryption. Afterwards, network bandwidth tests with iperf showed a heavy impact on the network performance.
  • Without ipsec: ~8Gbit/sec
  • With ipsec: ~2Gbit/sec