Losing flat ping packages over IPsec

RouterOS General
1

Status:
Two CCR1036 RouterOS 6.15 connected over SPF+ optic connection. Over Ethernet connection is created tunnel IPsec connection

Ethernet test
flat ping on Ethernet: NO pings lost

IPsec test
flat ping test: loosing 10 packages per hour; ( no other traffic on line)

IPSEC config

/ip ipsec peer
add address=192.168.197.2/32 enc-algorithm=aes-256 local-address=\
    192.168.197.1 policy-group=default secret=test
/ip ipsec policy
add dst-address=172.16.198.0/30 sa-dst-address=192.168.197.2 sa-src-address=\
    192.168.197.1 src-address=192.168.198.0/30 tunnel=yes

Any suggestions? Is 1590 MTU2 too low?

2

Packets can be dropped if they arrive out of order over the ipsec tunnel.
And 10 packets per hour is nothing, you shouldn’t worry about it.

3

Thank you for information.

Regarding that I have direct connection how high MTU2 would you suggest?

4

Set it according to your needs. CCRs support MTU up to 10k, so there shouldn’t be any problems with 1590 MTU