CCR1009-8G-1S VPN Performance

RouterOS General
1

Hi guys,
I need to create a Site-to-Site VPN between two sites, do you think that 2 x CCR1009-8G-1S should be able to have a 1Gbps VPN performance?

Thanks,

2

Anyone?

3

Short answer no.

More detailed answer:

The release of 6.24 might have improved ipip/eoip over ipsec throughput but my understanding is that the CCR’s are capable of 400-500Mbps single tunnel performance for nat’d vpn tunnels depending on encryption, and closer to 150Mbps single tunnel performance when using routed VPN tunnels like ipip/Eoip/gre.

RB1100AHX2 can do 400 Mbps give or take on either nat’d or routed tunnels I believe.

Hopefully we get VTI support in ROS at some point, but I am not holding my breath.

4

Heh? Ok, so am I understanding this correctly…

  1. IPSEC encapsulated tunnels will be faster than non encapsulated tunnels? I presume this would be because of UDP vs. TCP transport mechanisms?
  2. Unencrypted tunnels, will pretty much be limited to 150Mbps (which is what we are seeing too)? Even at 150Mbps though, all CPU’s are virtually idle - so yes. Hard to see that this is a ‘CPU limitation’ when the CPU’s aren’t heavily utilized. This is looking more like a SOFTWARE limitation as the hardware is idle really (less than 5% CPU load with 1.2Gbps traffic routed through 10 x IPIP tunnels).

Based on the above, I suppose the only way to get better performance would be to use multiple tunnels?

Where did you get this info from? I’ve had various tickets at MT due to performance issues, and not even they mentioned the above - ever. We are however seeing max 150Mbps on IPIP (routed) tunnels… This is like a ‘lightbulb’ moment for me. MT really, REALLY needs to make a CCR wiki page and DOCUMENT these shortcomings and limitations…

PS: Running 6.24 currently and not really seeing any improvement based on the above limitations