How are you testing the throughput? I have 12 1009-8G-1S-1S+ in production and I can push the following:
Latency(RTT) Bandwidth (iperf -c -P8)
5ms 330Mbit
22ms 255Mbit
1ms 320Mbit
Note that on paper, the CCR can push 1Gbit+ over IPSec with hardware acceleration but good luck reconstructing that stream with TCP, it will be completely out of order. Some stacks/configs will handle it nicely but it isn’t a very nice flow. Testing this will look beautiful with UDP. Mikrotik loves to advertise this as a feature and benchmark but I fail to see anyone using this in the real world. The IPSec hardware acceleration is basically a useless feature until they can maintain the order on a per-flow basis.
TLDR: Don’t use CBC. It is a disaster:
See: http://forum.mikrotik.com/t/eoip-packet-reordering-with-ipsec-load-balancing-across-cores-per-packet-vs-per-flow/96935/2
I top out around 300Mbit for a single IPSec session. My throughput is still rather disappointing given the physical links are 1Gb+ but it works for my current workload.
My config rough config:
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha1 enc-algorithms=aes-128-ctr
/interface eoip
add allow-fast-path=no ipsec-secret=SECRET !keepalive mtu=1428 name=XXX remote-address=A.B.C.D tunnel-id=16
/ip firewall connection tracking
set enabled=no