Cpu bottle neck on CRS328-24P-4S+

RouterOS
1

Hi I have CRS328-24P-4S+

I have it attached to a Cable 500/50 plan internet connection

I have noticed i get bottle neck at around 18Mb/s and when i use winbox I can see cpu is around 100%

I am presuming I should be able to get a lot more . what can I do to identify the problem

I have ipv4 & ipv6 running on this and I have firewall set up for both

I have a single switch with multiple vlans attached to it

it seems to be the port attached to my cable modem and then routed / switched that has the limitation

I believe.

i use this for the POE funcitonality I have a ccr1036 - ex from work I am pretty sure i can push faster that this crs. I was thinking to connect it up do just l2 on the crs and push the vlan that the internet comes in on to the ccr. But ... the crs is in the house and is quiet the ccr is in the shed and is noisey ...

what do you need dumped from the config here and how do i do it safely - no passwords etc

2

get a router

3

First of all, CRS328 is a switch.
It CAN be used as a router, but it's not good at it.
Routing, firewall, ... all possible since it runs ROS but it's not the right device to handle it.

But even then you should be able to get somewhere around 200Mbps or more via WAN.
We need to see config to determine what you already did.

(since I think you are already looking into that direction):
Is it an option to consider the WAN input via a separate VLAN, bring it to the CCR which then can act as router-on-a-stick, then bring everything back via other VLAN to CRS and let it do what it does best: switch and distribute. You only need 1 cable connection between CRS and CCR configured as trunk to carry 2 VLANs. If done correctly, CRS328 should be able to HW offload VLAN handling (as far as I remember).

4

All CRS switches are capable of doing switching (including VLANs) in ASIC at wirespeed without considerable CPU load. Older CRSes (CRS1xx and CRS2xx) required special configuration of switch chips, all newer CRS devices can offload properly configured bridge to hardware.

Regarding configuration export: in terminal windows execute command

/export file=anynameyouwish hide-sensitive

(the hide-sensitive is only available and required if you're running ROS 6.x.y). Fetch resulting file to your management computer, open it with your favourite text editor, redact any remaining sensitive data (passwords, device's serial number, etc.) and then copy-paste it inside the "Preformatted text" block of a post. And by "redact" I mean obfuscate the sensitive context, don't simply remove it (because then we wouldn't know that certain setting is actually there).

5

edit

removing config - think from my next post the 25 lines of firewall rules is what is killing performance ...

6

Using the product page

CRS328-24P-4S+RM	98DX3236 all port test
Mode	Configuration	1518 byte	512 byte	64 byte
kpps	Mbps	kpps	Mbps	kpps	Mbps
Bridging	none (fast path)	104,3	1266.6	273,5	1120.3	449	229.9
Bridging	25 bridge filter rules	104	1263.0	104,6	428.4	104,5	53.5
Routing	none (fast path)	104,3	1266.6	273,9	1121.9	343,5	175.9
Routing	25 simple queues	104,3	1266.6	136,9	560.7	137,4	70.3
Routing	25 ip filter rules	64,8	786.9	65,9	269.9	65,8	33.7

I defintely have more than 25 ip filter rules

I have a spare one of these

https://mikrotik.com/product/hap_ax_s

E62iUGS-2axD5axT EN7562CT 1G all port test
Mode Configuration
kpps Mbps
Bridging none (fast path) 340.3 4132.4 389 1593.5 402.6 219
Bridging 25 bridge filter rules 190.6 2315.1 197 806.8 193.9 105.5
Routing none (fast path) 300.3 3646.6 340.5 1394.7 342.2 186.1
Routing 25 simple queues 173.1 2102.6 174.3 713.8 171.9 93.5
Routing 25 ip filter rules 117.8 1430.3 121.6 498.1 117 63.6

which is a bit better

but

https://mikrotik.com/product/CCR1036-12G-4S-149

CCR1036-12G-4Sr2 Tile 36 core max possible throughput test
Mode Configuration
kpps Mbps
Bridging none (fast path) 1300.4 15792.1 3759.4 15398.5 28808.0 14749.7
Bridging 25 bridge filter rules 1300.4 15792.1 3760.4 15402.6 5163.5 2643.7
Routing none (fast path) 1300.4 15792.1 3762.4 15410.8 28808.0 14749.7
Routing 25 simple queues 1300.4 15792.1 3762.4 15410.8 7643.1 3913.3
Routing 25 ip filter rules 1300.4 15792.1 3033.9 12426.9 3049.7 1561.4

is the best.. so turn off all of the l3 routing on the crs and push all of it through to the ccr1036 ...

7

And now I look at it from another angle since you present new info.
Make sure to do the evaluation what is best for your situation.

A CCR is a beast of a device and comes with related power usage, obviously.
For a 500/50 line ?
Maybe a tad overkill, if you ask me ?

Might be easier to simply place that AX S in front of that CRS.
If I do may make a suggestion if you want to use it: DON'T use ether 1 as WAN. Use another port.
Look at the block diagram and you will see why.

OTOH if you have that CCR otherwise lying around doing nothing and you really want to use it, be my guest.

8

:0 i do like the 1036 - used them at work till we replaced them... sigh have to get new fans for them though they are tooo noise in the house lucky they are only $20 so

9

While I agree that ether1 on the AX S has problems, I am not sure I understand how that would be obvious from the block diagram. ether1 on the L009 is also connected directly to CPU (like the hap AX S or HEX refresh, both of with have ether1 directly connected to the CPU), but the L009 doesn't have the problems with ether1 that the new MikroTik routers based on the EN7562 have. Whether it is a hardware problem or driver problem is still unclear, but there are still performance problems with ether1 on the MikroTik EN7562 based routers.

For a WAN connection, what is the disadvantage of of a directly connected ether1? About the only disadvantage I can think of is if you want to pass through a vlan for VoIP or IPTV, where having the WAN on a switch-port would be an advantage. But for most home setups, a separate port with dedicated cpu port should be an advantage, not a disadvantage.

10

You are correct with your remark, I should have clarified it is a specific (current) problem on AX S.
So hopes are still there it is a thing which can be solved by SW.