IPSEC VPN slow behind Mikrotik Router

RouterOS General
1

Hello,

For a customer, I use Mikrotik RB3011UiAS-RM for “just router” with an SFP fibre converter on an 1gbps FTTH line with 8 RIPE IPs.
On “LAN” of the Mikrotik, there is the 8 RIPE IPs, WAN gets his IP via PPPoE. Speeds with Speedtest et al OK (down/upload betreen 950 and 1000mbps).

At the ethernet ports, there are two HA Firewalls from SonicWALL, behind the SonicWALLs is the LAN. From LAN, the internet speed is the same high.

But when I make an IPSEC Tunnel between the SonicWALL Cluster and lets say my HA Firewall (different XGS-PON Router), I just have 7.5MByte/sec / 60mbps over the VPN Tunnel.
When I make the IPSEC VPN from the SonicWALL Cluster and transfer data, the CPU of the Mikrotik RB3011UiAS-RM goes up to 80%.

For tests, I’ve made the same Tunnel from my XGS-PON to another customer (different Router, slower SonicWALL, just G.fast), the data transfer is triple from the Mikrotik.
Another test with the same Firewall without custer, but still on 1gbps FTTH (no router, just FTTH media converter), the speed goes up to 55MByte/sec / 440mbps, means over 7 times faster than the Mikrotik..

How ist this possible as the Mikrotik route factually has nothing to do with the IPSEC process and therefore should not limit the traffic, but sitll the CPU goes up?
Does anything have to be disabled on the Router?
Firewall is factually off, it is just forward all.

Tried disabling IPSEC, still no faster connection.

If anyone has a clue, I’m open for your input.

2

The first thing to come to my mind is increased packet rate due to fragmentation of the IPsec transport packets, so whilst the bit rate increases only up to, say, 10 % as compared to the amount of the payload traffic of the IPsec connection, the packet rate almost doubles; if, on top of that, some of the non-first fragments get lost, which I have seen to happen too many times unfortunately, the endpoints of the IPsec payload start retransmitting the lost packets, further increasing the load. Can you check this direction of thinking using sniffing?