I have a problem with a client. We have a Mikrotik RB2011iL-iN device connected to a router from the provider that the client has at its headquarters (Movistar). We have it mounted behind because with the Mikrotik we have configured an IPsec tunnel against a Cisco ASA that is in a data center, it cannot be done on the provider's router. Up to this point everything works correctly. There is access to the Internet, the tunnel is raised and the two networks are visible. The problem is in the speed of the circuit. We connect a PC directly to the provider's router to do a speed test, giving the speed of the circuit (between 800/900 Mb). If we do the same test on a Mikrotik port we do not get more than 300 Mb.
The connection between the two computers is a private network, the provider's router has only opened the ports that we use for IPsec and the winbox port to access the mikrotik. What can cause you to lose so much speed. I leave you the configuration that I have on the router.
I hope you can help me to improve the speed.
RB2011iL is pretry old device and for today’s standards pretty slow. Official test results indicate[*], that this device is capable of routing at around 250Mbps, give or take. Which is what you’re getting. With some optimization it is possible to increase throughput, but I strongly doubt it’s possible to reach anything close to wirespeed.
[*]The experience goes that number, shown in Ethernet test results table as “Routing → 25 ip filter rules → 512 bytes” pretty well resembles real life performance. In any particular configuration actual number can be higher or lower, but this value is a decent estimate. Running ROS v7 doesn’t help either, experience shows that v7 speed is almost the same as in v6 in best case and it can be 20-30% lower in worst case.
Yes, it would be faster. How much? Check the official test results and do the math.
While RB3011 us a fery decent device, we’re still talking about old technology. If you’re going to invest non-negligible amount of money, then you may want to choose a more modern device. E.g. RB5009 is more or less in the same performance group (but faster since it’s 10 years younger).
have minor effect if client and server would successfully negotiate lower MTU value. Speed would drop by 10%-20% (depending on negotiated PMTU due to relatively higher overhead), @OP sees speeds in range of 1/3 of wanted, which is way lower than lower PMTU would cause
cause speed to drop even lower or even completely break connectivity because all oversize packets would be dropped if the offending router doesn’t perform IP packet fragmentation.
Only in case when offending router does fragmentation but suffers from performance bottleneck (I guess it would have to fragment all packets), the performance drop would be anything imaginable, including what @OP sees.
But it’s clear that RB2011 can not route at anything near 1Gbps, so even if MSS / MTU is an issue here, it’s not the only one.