I have a problem with ipSec +l2tp vpn speed, mikrotik CCR1009(vers. 7.11, road warrior connection). After upgrading to version 7.x, iPsec L2tp remained slow. There were no such problems with the 6.x versions.
In the office, the connection is 1gb/s, but at home 600Mbps. L2tp ipsec data transmission speed is not higher than 10-12Mbit/s. Download/upload without using L2tp ipsec vpn works fine at full line speed.
Configuration for router only “default rules” plus two L2tp rules (port 500,1701,4500)
Where to look for the problem? Maybe someone has had a similar situation?
Thank you!
It’s completely impossible to say since you forgot to mention the small detail about what you’re running at home and what encryption method is being used…
On the office side, there is a Fortigate firewall. ccr1009 is used at home. Everything was fine until I upgraded to version 7.xx
The problem is with the speed of sending from office to home.
Just a suggestion, start by conducting regular IPsec tests in both directions to verify that encryption hardware acceleration is functioning properly. Then, dig into stuff like MTU and other tunnel settings.
Btw, what encryption methods are supported in hardware by the Fortigate?
As I already wrote at the beginning of the post, this is not a permanent tunnel mode P2P. It’s a road warrior. I log out of Office at home to use home resources, data exchange, etc.
In this case, it does not matter which router is located in the office. If, for example, I try to connect Home-> Office, then there are no problems, the speed is as high as my connection line allows.
If I switch to office->Home, then there is a problem because l2tp+ipsec speed should be at least 55 Mbit/s with a line speed of 600 Mbit/s. Mikrotik was reset a while ago. That didn’t help either. I tried to close with him from other resources, the result is the same. The motherboard does not show “bad block”. Maybe the problem is the hardware accelerator? But then the connection speed would be very slow.
Very strange problem. If everything was ok with vers.6.xx, then the problem could be a soft bug?
Well, your description is very unprecise as to exactly what problem you are referring to. If it concerns a road warrior connection with, for example a smartphone using IPsec, there is nothing strange about 10-20 Mbit. Regarding the Office (Fortigate model ???) to Home (CCR1009) connection, I’d say there is a misconfiguration because you should be getting close to 600 Mbps if correctly configured, unless you are using a low-end model of the Fortigate.
And as I suggested earlier, start by troubleshooting common IPsec hardware acceleration issues by setting up a new tunnel with two new temporary test subnets.
You misunderstood me. The configuration can’t be wrong because a persistent vpn tunnel is not used.The office router does not need to be configured in this case.
I don’t need to build an independent P2P tunnel mode Fortigate<-> mikrotik. I “dial in” from the office via l2tp ipsec at home Mikrotik. This is about PC use only, no phones, etc.
Maybe the mikrotik itself needs something extra? As if it shouldn’t be, because everything was fine with version 6.xx
Whether the VPN tunnel is persistent or not is completely irrelevant. However, I still don’t get it regarding the “PC”. Please be more precise and describe what the network topology looks like in more detail and where the problem occurs:
PC (IPsec ‘road warrior’) → Home
PC (IPsec ‘road warrior’) → Office
PC (IPsec ‘road warrior’) → Home → Office
PC (IPsec ‘road warrior’) → Office → Home
PC → Home (IPsec) → Office
PC → Office (IPsec) → Home
. . .
. . .
Regarding V6 to V7, it’s a brand new kernel with a lot of changes, ie there is no guarantee of 100% backward compatibility:
FWIW, we have several customer sites running at full speed using IPSec with Fortigate and CCRxx thus I’m pretty sure it’s a configuration issue somewhere.
Everything is very simple.
I have one PC that is in the office and from which I make a “dial-up” to my home mikrotik . No schematics, no pc2, pc3, etc. There are many computers in the office, but it is only about one computer of mine.
As I wrote earlier, there are only “default rules” and two additional rules for ipsec on mikrotik. Everything. No additional extras.
In theory, it doesn’t matter which router is in the office (whether it is Tplink, Dlink, Cisco or something else), because the connection is made to my house. Everything is ok with the internet line in the office ( FG100E ), it works stably. The home ISP also ensures a stable connection.
=“” Regarding V6 to V7, it’s a brand new kernel with a lot of changes, ie there is no guarantee of 100% backward compatibility: “” =
Your comment about the 100% guarantee could be true.
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment=L2TP connection-state=new dst-port=\
500,1701,4500 protocol=udp
add action=accept chain=input comment="IKE IPSec" protocol=ipsec-esp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
Work PC (IPsec initiator) → Office default gateway (Fortigate) → Home (CCR IPsec responder), where the Fortigate just acts as a regular internet gateway, correct?
yes, one FG is this office gateway. And there are around 100 computers in the office and I’m the only one - I make a “dial in” to my home resource from my PC. Nothing more.
It’s easier to explain to you
I also tried the test - I connected to my colleague’s Mikrotik Rb4011 via L2tp from my work PC. Everything works perfectly, the ipsec speed is what his internet line provides.
When I connect to my house, ipSec is not as fast as it should be.
I guess I’ll try to downgrade to 6.49.7. I don’t see any other solution yet.
If you still want to troubleshoot the root cause, bring a laptop back home and try different key sizes that match the CCR hardware offload. Start using pure IPsec.
Then test it again at work.
Once everything works as expected, you can start adding other tunnels on top of IPsec.
Btw, I get approx 200-450 Mbps to my RB3011 v7.11 at home using AES 256 (CBC) depending on traffic segmentation and packet sizes.
