General Discussion
  >> Fibre Broadband


Register (or login) on our website and you will not see this ad.


Pages in this thread: 1 | 2 | [3] | 4 | (show all)   Print Thread
Standard User ft247
(regular) Wed 28-Apr-21 22:15:23
Print Post

Re: Router hardware capable of routing 900mbps over PPPoE (F


[re: Pheasant] [link to this post]
 
In reply to a post by Pheasant:
I've run some bandwidth tests on Miktriotik CCR to CCR site to site VPN's and the results are interesting.


I'd be interested in this if you get a chance to share. So far in single tunnel L2TP/IPsec I'm hitting limits around 230Mbit with a CCR1009 to CHR. 1100AHx4 to CHR seems to do a bit better, up to 300Mbit and after that my connection can't do any better.
Standard User candlerb
(fountain of knowledge) Thu 29-Apr-21 08:05:13
Print Post

Re: Router hardware capable of routing 900mbps over PPPoE (F


[re: ft247] [link to this post]
 
In a datacentre application, I have more powerful Mikrotik boxes - 36-core CCR1036-8G-2SplusEM with gigabit uplinks (one uplink is 10G). However when I tried them for site-to-site GRE-over-IPSEC I didn't get more than about 400Mbps. This was for a single iperf3 stream over a single tunnel, both data centres in London. As far as I could see all the traffic hit a single core. As this was a live network I wasn't able to play too much. Turning on fastpath didn't help.

In the end I deployed separate Linux VMs running Wireguard, and now I can easily fill a gigabit of site-to-site VPN traffic. In fact, running a pair of Wireguard test VMs connected back-to-back on the same host, with only 2 vCPUs each, I can get 2.5Gbps+ of iperf3 through them.

Wireguard has been backported to the mainline Ubuntu 18.04/20.04 kernels, so it's now easy to deploy without building your own module. There was also an implementation made by Netgate for pfSense, but it was kicked out of FreeBSD over code quality issues. Hopefully a better version will make it there soon.

The other problem I have with Mikrotik IPSEC is that they don't have VTI mode, which I use everywhere as it allows BGP failover between tunnels and real links. That's why I ended up having to try GRE-over-IPSEC.

I'd say Mikrotik is probably fine for a VPN concentrator, where you have lots of separate IPSEC tunnels coming in - in which case, the tunnels will be spread over the cores.
Standard User mikehiow
(committed) Thu 29-Apr-21 10:07:34
Print Post

Re: Router hardware capable of routing 900mbps over PPPoE (F


[re: Spud2003] [link to this post]
 
Are you using yours with PPPoE?

I seem to be getting a fair amount of packet loss when saturating the connection.

I can create a simple queue to limit max speed, but I've got to knock around 10% off real world speeds to eliminate the packet loss.

Goodbye Hyperoptic. Now VM200 frown


Register (or login) on our website and you will not see this ad.

Standard User ft247
(regular) Thu 29-Apr-21 13:52:59
Print Post

Re: Router hardware capable of routing 900mbps over PPPoE (F


[re: candlerb] [link to this post]
 
In reply to a post by candlerb:
I'd say Mikrotik is probably fine for a VPN concentrator, where you have lots of separate IPSEC tunnels coming in - in which case, the tunnels will be spread over the cores.


That's my feeling too. With the new CCR2004 being ARM based, I wonder if Tilera (CCR10xx) will remain a development priority for them.
Standard User Spud2003
(fountain of knowledge) Thu 29-Apr-21 15:36:27
Print Post

Re: Router hardware capable of routing 900mbps over PPPoE (F


[re: mikehiow] [link to this post]
 
I'm on VDSL not FTTP so I am not running at your throughput, I'm just using the official tech specs. Try the Mikrotik user forums, they should sort out any issues - https://forum.mikrotik.com/index.php
Standard User aidanh
(newbie) Thu 29-Apr-21 16:22:34
Print Post

Re: Router hardware capable of routing 900mbps over PPPoE (F


[re: mikehiow] [link to this post]
 
This is normal behaviour when you saturate a link. The only way to properly control it is to make sure you are the bottleneck (ideally with something smarter than a dumb queue).

Standard User candlerb
(fountain of knowledge) Thu 29-Apr-21 16:30:04
Print Post

Re: Router hardware capable of routing 900mbps over PPPoE (F


[re: Spud2003] [link to this post]
 
I have used both RB4011 and the smaller hEX PoE with PPPoE, no problems. I enable "baby jumbos" so the MTU on the PPPoE interface is 1500, and on the physical link is 1508.

The hEX PoE has a single MIPS core. When I used it on my 300/30 FTTPoD, with fasttrack, routing 300Mbps of iperf3 traffic used about 35% CPU. Without fasttrack, e.g. when doing IPv6, it would saturate the CPU and not quite reach 300Mbps.

I still keep it as a backup, and as a PoE switch for powering my APs. It can do VLAN switching in hardware, which makes it actually faster at switching than the RB4011.
Standard User Pheasant
(experienced) Fri 30-Apr-21 07:27:03
Print Post

Re: Router hardware capable of routing 900mbps over PPPoE (F


[re: candlerb] [link to this post]
 
I ran a path MTU check over the PPPoE link by using the don’t fragment ping check trial and error method and it came to 1452. The actual MTU setting for the link is 1480. Running over IPSec the MTU is 1398

Edited by Pheasant (Fri 30-Apr-21 07:33:52)

Standard User Pheasant
(experienced) Fri 30-Apr-21 07:29:50
Print Post

Re: Router hardware capable of routing 900mbps over PPPoE (F


[re: ft247] [link to this post]
 
In reply to a post by ft247:
In reply to a post by candlerb:
I'd say Mikrotik is probably fine for a VPN concentrator, where you have lots of separate IPSEC tunnels coming in - in which case, the tunnels will be spread over the cores.


That's my feeling too. With the new CCR2004 being ARM based, I wonder if Tilera (CCR10xx) will remain a development priority for them.

It’s looking that way. The single tunnel IPSec performance for the 2004 is about three times that of the Tilera boxes around 3Gbps. Aggregate throughout is a lot higher for the Tileras because of the sheer core count.
Standard User candlerb
(fountain of knowledge) Fri 30-Apr-21 07:34:47
Print Post

Re: Router hardware capable of routing 900mbps over PPPoE (F


[re: Pheasant] [link to this post]
 
In reply to a post by Pheasant:
I ran a path MTU check over the PPPoE link by using the don’t fragment ping check trial and error method and it came to 1452. The actual MTU setting for the link is 1480.


That's strangely low. Without tweaks, I would expect MTU 1492 for a PPPoE interface (1500 - 8 byte PPPoE header). You're not running a VPN or anything like that over it?

Also, how are you testing? Using Linux:
ping -Mdo -s1472 x.x.x.x # => MTU 1500 (20 bytes IP header + 8 bytes ICMP header + payload)
Pages in this thread: 1 | 2 | [3] | 4 | (show all)   Print Thread

Jump to