hEX slow WAN

Dear All,

I am having a strange behaviour with a brand new hEX and my new connection:
I activated a new line 40mbit/40mbit and config’d the Mikrotik router as follow (very simple for testing):

[admin@MikroTik] > export
# feb/22/2016 14:12:11 by RouterOS 6.35rc12
/interface ethernet
set [ find default-name=ether1 ] name=ether1-gateway
set [ find default-name=ether2 ] name=ether2-master-local
set [ find default-name=ether3 ] master-port=ether2-master-local name=ether3-slave-local
set [ find default-name=ether4 ] master-port=ether2-master-local name=ether4-slave-local
set [ find default-name=ether5 ] master-port=ether2-master-local name=ether5-slave-loca
/interface l2tp-server server
set max-sessions=unlimited
/ip address
add address=10.0.0.xxx/24 interface=ether2-master-local network=10.0.0.0
add address=xx.xx.xx.xxx/29 interface=ether1-gateway network=xx.xx.xx.xxx
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway
/ip route
add distance=1 gateway=xx.xx.xx.xxx
/system routerboard settings
set cpu-frequency=720MHz protected-routerboot=disable

Now when I try to upload or download from a pc connected to the hEX gw (used for testing a ftp trasfer between a remote server I manage on 500mbit line) I get around 15mbit speed in download and 10mbit speed in upload. Sometimes It starts higher around 28mbit but drop down quickly to the above speed.

But when I try to swap the hEX router with a pfsense box I got, I get full speed both in download and upload.

Any idea which can be the problem with the mikrotik? As I know the hw on it should handle well the speed.

pep

FTP is not a good test, because it usually makes a single TCP connection. Is the PFsense box a similar CPU ?

You should also enable Fasttrack, if you don’t want to test firewall speed (which you don’t use).

/ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related
/ip firewall filter add chain=forward action=accept connection-state=established,related

is interface properly auto-negotiate “full-duplex” 100Mb mode ? check status. and in case - try to force it to 100 full-duplex temporally.
you can overclock most HEX exemplars to 840Mhz without problem(1-2 degrees difference in temps).
try play with syncookies disabled (cuz its interfere with tcp window scaling and help congestion), temporally.
if thats not helps - change interface queue types from “none” defaults to pfifo (with 128-512 packet buffer), but thats generally not flawless idea.
most of mine HEX and HAP routers - done around 90-120Mbps even with “hard” traffic(torrenting and huge pps count)very fragmented and consumers with simpler config - can easily have up to 200mb.

pfsense box has 1ghz dual core cpu, added the fasttrack but nothing changed :frowning: :frowning: :frowning:


the interfaces properly negotiate 1Gbs full-duplex (chcked in both hEX and the switch CRS where hex is connected).
Syncookies was already disabled, tried enabling it but no luck.
Changed the queue type for interfaces but no luck again.

I even tried for testing to route all packet to the pfsense box as follow:

Cisco → hEX → pfSense → LAN

and I had no problem, download and upload at max speed of the connection. It seems like it’s something related to gateway interfaces but I have no idea where to look at.

I attach again the actual config as above with re-routing packet to pfSense box:

[admin@MikroTik] > export
# feb/23/2016 23:12:04 by RouterOS 6.35rc12
/interface ethernet
set [ find default-name=ether1 ] name=ether1-gateway
set [ find default-name=ether2 ] name=ether2-master-local
set [ find default-name=ether3 ] master-port=ether2-master-local name=\
    ether3-slave-local
set [ find default-name=ether4 ] master-port=ether2-master-local name=\
    ether4-slave-local
set [ find default-name=ether5 ] master-port=ether2-master-local \
    name=ether5-slave-local
/ip neighbor discovery
set ether1-gateway discover=no
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/system logging action
set 1 disk-file-name=log
/interface l2tp-server server
set max-sessions=unlimited
/ip address
add address=10.0.0.252/24 comment="default configuration" interface=\
    ether2-master-local network=10.0.0.0
add address=xx.xx.xx.xx/29 disabled=yes interface=ether1-gateway network=\
    xx.xx.xx.yy
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=10.0.0.252 name=router
/ip firewall filter
add chain=input comment="default configuration" protocol=icmp
add chain=input comment="default configuration" connection-state=\
    established,related
add action=drop chain=input comment="default configuration" in-interface=\
    ether1-gateway
add action=fasttrack-connection chain=forward comment="default configuration" \
    connection-state=established,related
add chain=forward comment="default configuration" connection-state=\
    established,related
add action=drop chain=forward comment="default configuration" connection-state=\
    invalid
add action=drop chain=forward comment="default configuration" \
    connection-nat-state=!dstnat connection-state=new in-interface=\
    ether1-gateway
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" \
    out-interface=ether2-master-local
/ip route
add distance=1 gateway=10.0.0.250
add disabled=yes distance=1 gateway=xx.xx.xx.zz
/system routerboard settings
set cpu-frequency=720MHz protected-routerboot=disabled
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=ether3-slave-local
add interface=ether4-slave-local
add interface=ether5-slave-local
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=ether3-slave-local
add interface=ether4-slave-local
add interface=ether5-slave-local

some devices (say SMC or HP-branded “by default” or some other(like ancient 3Com things too, for example))tend to behave errativally in case of detection of “flow control” disabled and trying “mitigate” it way to agressive even in full-duplex. thats unusual, but even rfc-compliant vendors had that issues in some of early betas in past(say juniper or alcatel/lucent BRAS/routers)firmwares so try for example - turn “on”(not “auto”) flow-control on interfaces temporally to check that out.