Mikrotik CRS326-24G-2S+RM High CPU Usage

RouterOS General
1

Hello, I would like to inform you that my Mikrotik CRS326-24G-2S+RM device is unable to exceed a connection speed of 920 Mbps. In an environment where even lower-quality devices can reach 940 Mbps, this falls short of my expectations. Additionally, I have observed that the CPU usage during speed tests rises to around 90%. My setup is based on an FTTH infrastructure. I kindly request your assistance with this matter.

/interface ethernet set [find default-name=ether1] name=WAN
/interface vlan add name=VLAN35 interface=WAN vlan-id=35

/interface ethernet switch set [find] l3-hw-offloading=yes
/interface ethernet switch set [find] qos-hw-offloading=yes

/interface bridge add name=LAN vlan-filtering=yes igmp-snooping=yes
/interface bridge port add bridge=LAN interface=ether2 hw=yes
/interface bridge port add bridge=LAN interface=ether3 hw=yes
/interface bridge port add bridge=LAN interface=ether4 hw=yes
/interface bridge port add bridge=LAN interface=ether5 hw=yes
/interface bridge port add bridge=LAN interface=ether6 hw=yes
/interface bridge port add bridge=LAN interface=ether7 hw=yes
/interface bridge port add bridge=LAN interface=ether8 hw=yes
/interface bridge port add bridge=LAN interface=ether9 hw=yes
/interface bridge port add bridge=LAN interface=ether10 hw=yes
/interface bridge port add bridge=LAN interface=ether11 hw=yes
/interface bridge port add bridge=LAN interface=ether12 hw=yes
/interface bridge port add bridge=LAN interface=ether13 hw=yes
/interface bridge port add bridge=LAN interface=ether14 hw=yes
/interface bridge port add bridge=LAN interface=ether15 hw=yes
/interface bridge port add bridge=LAN interface=ether16 hw=yes
/interface bridge port add bridge=LAN interface=ether17 hw=yes
/interface bridge port add bridge=LAN interface=ether18 hw=yes
/interface bridge port add bridge=LAN interface=ether19 hw=yes
/interface bridge port add bridge=LAN interface=ether20 hw=yes
/interface bridge port add bridge=LAN interface=ether21 hw=yes
/interface bridge port add bridge=LAN interface=ether22 hw=yes
/interface bridge port add bridge=LAN interface=ether23 hw=yes
/interface bridge port add bridge=LAN interface=ether24 hw=yes
/interface bridge port add bridge=LAN interface=sfp-sfpplus1 hw=yes
/interface bridge port add bridge=LAN interface=sfp-sfpplus2 hw=yes

/interface ethernet set [find] mtu=1500
/interface vlan set VLAN35 mtu=1500

/ip address add address=10.0.0.1/24 interface=LAN
/ip dns set servers=1.1.1.1,1.0.0.1 allow-remote-requests=no

/ppp secret add name="XXXXXXXXXX" password="XXXXXXXXXX" profile=default
/interface pppoe-client add name=TT-FTTH interface=VLAN35 user="XXXXXXXXXX" password="XXXXXXXXXX" service-name="" add-default-route=yes
/interface pppoe-client enable TT-FTTH

/ip pool add name=DHCPPool ranges=10.0.0.2-10.0.0.254
/ip dhcp-server network add address=10.0.0.0/24 dns-server=1.1.1.1,1.0.0.1 gateway=10.0.0.1
/ip dhcp-server add name=DHCPServer interface=LAN address-pool=DHCPPool
/ip dhcp-server enable DHCPServer

/ip firewall nat add chain=srcnat src-address=10.0.0.0/24 action=masquerade
/ip firewall filter remove [find where chain=forward and action=accept]
/ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related,untracked hw-offload=yes
/ip firewall filter add chain=forward action=accept connection-state=established,related,untracked
/ip firewall raw remove [find where chain=prerouting and action=drop]
2

The CRS326-24G-2S+ (listed on the mikrotik website as a “Switch”) has the following performance results listed:

https://mikrotik.com/product/CRS326-24G-2SplusRM#fndtn-testresults

The device is primarily a switch with some limited routing features. For anything outside of this, including PPPOE, will require a higher level router device. With PPPOE you will need to get something more powerful due to the overhead.

3

Someone I know is using 10Gbps with this device.
https://youtu.be/2NMwWo2eesY?si=xn7NNG38Ks06wkzW&t=6011

4

Then I suggest you contact them for their config. Most likely they are not using a firewall(or a very minimal one) and are not using PPPOE.

I also suggest looking at

https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading#L3HardwareOffloading-L3HWFeatureSupport

for limits of l3hw offloading on the crs3xx switches. You should note the following for the crs3xx switches:

Below are some important features that these devices are missing when compared to other switch models:

Fasttrack and NAT connection offloading;
per-VLAN packet and byte counters.

5

CRS series are at the core a network switch. Yes they have some ability to do layer 3 in cpu, and some minor hardware offload, but you should 100% expect cpu to 100% cap out unexpectedly.
.
The CRS series is not what you should be using for routing. Try at minimum a RB5009 via the 10gbpt port as a router on a stick config, or go for a proper CCR series router.

6

Thank you everyone, with a little optimization the problem is gone.

7

Care to share what was done ? Thx :slight_smile:

8

Of course, but I would like to share it as a guide. I will share it when I’m available.