IPSEC Site - To - Site

RouterOS Beginner Basics
1

Hello

I have RB3011 and RB2011iLS routers. I made SITE-TO-SITE IPSEC TUNNEL and i would like to transfer files over internet.
Main problem when transfering from RB2011iLS network to RB3011 router network is CPU Load which is getting to 100% (RB2011)
What should i change to decrease cpu load ? Should i set lower peer enc algorithm or proposal or even using other solution?

/ip ipsec proposal
add auth-algorithms=md5 enc-algorithms=3des name=md5_prop pfs-group=none
/ip ipsec peer
add address=xxxxxxxxx/32 dh-group=modp1024 enc-algorithm=aes-128 secret=
“345dxfcgxcvg45”
/ip ipsec policy
add dst-address=192.168.12.0/24 proposal=md5_prop sa-dst-address=xx.xxx.xx.xx
sa-src-address=xxxxxxx src-address=192.168.xx.0/24 tunnel=yes

2

How much throughput you get? RB2011 isn’t that much powerful and it doesn’t have any hw accelerated encryption, so it’s possible that you’re hitting the limit and there’s nothing you can do with this device. But it could also be misconfigured firewall, e.g. if you’d have some extensive L7 filters or something. So tell us the speed and someone will tell you if it’s ok (not me, I don’t have RB2011).

3

in Winbox, Tools- Profile tells you what is using your CPU