Need some help with HW offload on CRS310 and CRS305

Siliconoxide · March 26, 2026, 6:29pm

Hello. I need a little help getting L3 Hardware offload to work. Main switch is a CRS310-8G+2S+ with a CRS305-1G-4S+ attached on SFP+ port 2 of the CRS310. The large transfer is from a machine on CRS310's Ether 7 to a machine on CRS305's SPF+ #2. Neither switch is doing L3 HW offload. I have hw offload enabled on the bridge and each port. When I attempt a large transfer the cpu pegs at 100% and most of the network except that transfer slows down. Traffic is being passed on the same vlan.They are not being used a a router as that is handled by an OPNsense machine on CRS310's SFR+ port 1. IP Firewall is not in use on either. All Vlans are on a single bridge and all ports have the bridge tagged. Vlan filtering is enabled on the bridge. Both are on RouterOS 7.22. I am not sure what I am doing wrong and any help is appreciated.

CRS310 Config:

# 2026-03-26 14:20:47 by RouterOS 7.22
# software id = xxx
#
# model = CRS310-8G+2S+
# serial number = xxxx
/interface bridge
add admin-mac=xxxx auto-mac=no comment="BRIDGE FOR LAN" \
    ingress-filtering=no name=bridge priority=0x4000 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name="ether1 Talyn"
set [ find default-name=ether2 ] name="ether2 Home Assistant"
set [ find default-name=ether3 ] name="ether3 Blue Iris"
set [ find default-name=ether4 ] name="ether4 Ruckus R650"
set [ find default-name=ether6 ] name="ether6 Proxmox"
set [ find default-name=ether7 ] name="ether7 Brocade Switch"
set [ find default-name=ether8 ] name="ether8 Cisco Switch"
set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no name=\
    "sfp-sfpplus1 SFP+ Switch"
set [ find default-name=sfp-sfpplus2 ] auto-negotiation=no name=\
    "sfp-sfpplus2 OPNsense"
/interface vlan
add comment="Main VLAN" interface=bridge name=vlan10 vlan-id=10
add comment=VLAN20 interface=bridge name=vlan20 vlan-id=20
add comment="IOT VLAN" interface=bridge name=vlan30 vlan-id=30
add comment="CAM VLAN" interface=bridge name=vlan31 vlan-id=31
add comment=Guest interface=bridge name=vlan40 vlan-id=40
/interface list
add name=WAN
add name=LAN
add include=all name=management
/ip smb users
add name=drive
/routing id
add disabled=no id=192.168.1.5 name=id-1 select-dynamic-id=\
    only-static,only-vrf select-from-vrf=main
/routing pimsm instance
add disabled=yes name=pimsm-instance1 vrf=main
/disk settings
set auto-media-interface=bridge auto-smb-user=""
/ip smb
set domain=NT_DOMAIN enabled=yes
/interface bridge port
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface="ether1 Talyn" pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface="ether2 Home Assistant" pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface="ether3 Blue Iris" pvid=10
add bridge=bridge interface="ether4 Ruckus R650" pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface=ether5 pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface="ether6 Proxmox" pvid=10
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
    "ether7 Brocade Switch"
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
    "ether8 Cisco Switch"
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
    "sfp-sfpplus1 SFP+ Switch"
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
    "sfp-sfpplus2 OPNsense" pvid=10 trusted=yes
/interface ethernet switch l3hw-settings
set autorestart=yes ipv6-hw=yes
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=management lldp-med-net-policy-vlan=1
/ip settings
set icmp-rate-limit=100
/interface bridge vlan
add bridge=bridge comment="Guest VLAN" tagged=\
    "sfp-sfpplus2 OPNsense,ether4 Ruckus R650,ether8 Cisco Switch,bridge" \
    vlan-ids=40
add bridge=bridge comment="Main VLAN" tagged="sfp-sfpplus2 OPNsense,sfp-sfpplu\
    s1 SFP+ Switch,ether8 Cisco Switch,ether7 Brocade Switch,bridge" \
    untagged="ether1 Talyn,ether2 Home Assistant,ether3 Blue Iris,ether5,ether\
    6 Proxmox" vlan-ids=10
add bridge=bridge comment="IOT VLAN" tagged="sfp-sfpplus2 OPNsense,ether4 Ruck\
    us R650,ether8 Cisco Switch,ether7 Brocade Switch,bridge" vlan-ids=30
add bridge=bridge comment="20 VLAN" tagged="sfp-sfpplus2 OPNsense,sfp-sfpplus1\
    \_SFP+ Switch,ether8 Cisco Switch,ether7 Brocade Switch,bridge" vlan-ids=\
    20
add bridge=bridge comment="CAM VLAN" tagged="sfp-sfpplus2 OPNsense,ether8 Cisc\
    o Switch,ether4 Ruckus R650,ether7 Brocade Switch,bridge" vlan-ids=31
/interface detect-internet
set internet-interface-list=all lan-interface-list=LAN wan-interface-list=WAN
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface list member
add interface="ether1 Talyn" list=LAN
add interface="ether2 Home Assistant" list=LAN
add interface="ether3 Blue Iris" list=LAN
add interface="ether4 Ruckus R650" list=LAN
add interface=ether5 list=LAN
add interface="ether6 Proxmox" list=LAN
add interface="ether7 Brocade Switch" list=LAN
add interface="ether8 Cisco Switch" list=LAN
add interface="sfp-sfpplus1 SFP+ Switch" list=LAN
add interface="sfp-sfpplus2 OPNsense" list=LAN
add interface="ether1 Talyn" list=management
add interface="ether2 Home Assistant" list=management
add interface="ether3 Blue Iris" list=management
add interface="ether4 Ruckus R650" list=management
add interface=ether5 list=management
add interface="ether6 Proxmox" list=management
add interface="ether7 Brocade Switch" list=management
add interface="ether8 Cisco Switch" list=management
add interface="sfp-sfpplus1 SFP+ Switch" list=management
add interface="sfp-sfpplus2 OPNsense" list=management
add interface=vlan10 list=management
add disabled=yes interface=bridge list=management
/interface ovpn-server server
add mac-address=FE:00:AE:20:49:ED name=ovpn-server1
/ip dhcp-client
add interface=vlan10 name=bridge
/ip dns
set servers=192.168.1.1
/ip dns static
add address=192.168.1.5 match-subdomain=yes name=MikroTik type=A
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add distance=1 gateway=192.168.1.1
add distance=1 gateway=192.168.1.1
/ip smb shares
set [ find default=yes ] disabled=no
/ip tftp
add
/ip upnp interfaces
add disabled=yes interface=bridge type=internal
/ipv6 dhcp-client
add interface=bridge pool-prefix-length=64 request=address
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/routing igmp-proxy interface
add comment=Test disabled=yes
/snmp
set enabled=yes trap-interfaces=all trap-version=2
/system clock
set time-zone-name=America/New_York
/system health settings
set fan-min-speed-percent=10%
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.1.1
/system package local-update update-package-source
add address=192.168.1.5 user=admin
/tool mac-server
set allowed-interface-list=management
/tool mac-server mac-winbox
set allowed-interface-list=management
/tool romon
set enabled=yes id=D4:01:C3:6A:54:34
/tool romon port
add interface=management
/tool traffic-generator packet-template
add data=random header-stack=mac,ip,tcp ip-dst=192.168.1.5 ip-gateway=\
    192.168.1.6 mac-dst=28:52:61:41:CD:89/FF:FF:FF:FF:FF:FF name=\
    packet-template1
/tool traffic-generator stream
add mbps=5 name=str1 packet-size=512 tx-template=packet-template1

CRS305 conifg:

# 2026-03-26 14:21:47 by RouterOS 7.22
# software id = xxx
#
# model = CRS305-1G-4S+
# serial number = xxx
/interface bridge
add admin-mac=xxx auto-mac=no comment="SFP+ Bridge" \
    ingress-filtering=no name=bridge port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no
set [ find default-name=sfp-sfpplus2 ] auto-negotiation=no
set [ find default-name=sfp-sfpplus3 ] auto-negotiation=no
/interface vlan
add comment="Main VLAN" interface=bridge name=vlan10 vlan-id=10
add comment=VLAN20 interface=sfp-sfpplus1 name=vlan20 vlan-id=20
add comment="IOT VLAN" interface=sfp-sfpplus1 name=vlan30 vlan-id=30
add comment="Guest VLAN" interface=bridge name=vlan40 vlan-id=40
/interface list
add name=WAN
add name=LAN
add include=all name=manage
/ip smb
set enabled=no
/interface bridge port
add bridge=bridge disabled=yes frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether1 \
    internal-path-cost=10 path-cost=10 pvid=10
add bridge=bridge frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1 \
    internal-path-cost=10 path-cost=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface=sfp-sfpplus2 internal-path-cost=10 path-cost=10 pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface=sfp-sfpplus3 internal-path-cost=10 path-cost=10 pvid=10
add bridge=bridge interface=sfp-sfpplus4 internal-path-cost=10 path-cost=10 \
    pvid=10
/interface ethernet switch l3hw-settings
set autorestart=yes
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=manage
/interface bridge vlan
# ether1 not a bridge port
add bridge=bridge comment="Main VLAN" tagged=sfp-sfpplus1,bridge untagged=\
    sfp-sfpplus2,sfp-sfpplus3,ether1 vlan-ids=10
add bridge=bridge comment="Guest VLAN" tagged=bridge vlan-ids=40
add bridge=bridge comment="IOT Vlan" tagged=sfp-sfpplus1,bridge vlan-ids=30
add bridge=bridge comment=VLAN20 vlan-ids=20
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface list member
add interface=sfp-sfpplus1 list=LAN
add interface=sfp-sfpplus2 list=LAN
add interface=sfp-sfpplus3 list=LAN
add interface=sfp-sfpplus4 list=LAN
add interface=ether1 list=manage
add interface=bridge list=manage
add interface=sfp-sfpplus1 list=manage
add interface=sfp-sfpplus2 list=manage
add interface=sfp-sfpplus3 list=manage
add interface=sfp-sfpplus4 list=manage
add interface=vlan10 list=manage
add interface=ether1 list=LAN
/interface ovpn-server server
add mac-address=FE:8A:AA:4F:0E:8E name=ovpn-server1
/ip address
add address=192.168.1.4/24 comment=defconf disabled=yes interface=ether1 \
    network=192.168.1.0
add address=192.168.1.131/24 comment=defconf disabled=yes interface=bridge \
    network=192.168.1.0
/ip dhcp-client
add interface=vlan10 name=client1
/ip dns
set servers=192.168.1.1
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add distance=1 gateway=192.168.1.1
/ip tftp
add
/ipv6 dhcp-client
add interface=bridge pool-prefix-length=64 request=address
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/snmp
set enabled=yes trap-interfaces=all trap-version=2
/system clock
set time-zone-name=America/New_York
/system identity
set name="MikroTik SFP+"
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.1.1
/tool mac-server
set allowed-interface-list=manage
/tool mac-server mac-winbox
set allowed-interface-list=manage
/tool romon
set enabled=yes id=D4:01:C3:71:79:51

CRS 310:


[admin@MikroTik] > /interface/bridge/port/print 
Flags: I - INACTIVE; H - HW-OFFLOAD
Columns: INTERFACE, BRIDGE, HW, HORIZON, TRUSTED, TRUSTED-RA, FAST-LEAVE, BPDU-GUARD, EDGE, POINT-TO-POINT, PVID, FRAME-TYPES
#    INTERFACE                 BRIDGE  HW   HORIZON  TRUSTED  TRUSTED-RA  FAST-LEAVE  BPDU-GUARD  EDGE  POINT-TO-POINT  PVID  FRAME-TYPES                            
0  H ether1 Talyn              bridge  yes  none     no       no          no          no          auto  auto              10  admit-only-untagged-and-priority-tagged
1  H ether2 Home Assistant     bridge  yes  none     no       no          no          no          auto  auto              10  admit-only-untagged-and-priority-tagged
2  H ether3 Blue Iris          bridge  yes  none     no       no          no          no          auto  auto              10  admit-only-untagged-and-priority-tagged
3  H ether4 Ruckus R650        bridge  yes  none     no       no          no          no          auto  auto              10  admit-all                              
4 IH ether5                    bridge  yes  none     no       no          no          no          auto  auto              10  admit-only-untagged-and-priority-tagged
5  H ether6 Proxmox            bridge  yes  none     no       no          no          no          auto  auto              10  admit-only-untagged-and-priority-tagged
6  H ether7 Brocade Switch     bridge  yes  none     no       no          no          no          auto  auto               1  admit-only-vlan-tagged                 
7  H ether8 Cisco Switch       bridge  yes  none     no       no          no          no          auto  auto               1  admit-only-vlan-tagged                 
8  H sfp-sfpplus1 SFP+ Switch  bridge  yes  none     no       no          no          no          auto  auto               1  admit-only-vlan-tagged                 
9  H sfp-sfpplus2 OPNsense     bridge  yes  none     yes      no          no          no          auto  auto              10  admit-only-vlan-tagged                 
[admin@MikroTik] >

CRS305:

[admin@MikroTik SFP+] >  /interface/bridge/port/print  
Flags: I - INACTIVE; H - HW-OFFLOAD
Columns: INTERFACE, BRIDGE, HW, HORIZON, TRUSTED, TRUSTED-RA, FAST-LEAVE, PATH-COST, INTERNAL-PATH-COST, BPDU-GUARD, EDGE, POINT-TO-POINT, PVID, FRAME-TYPES
#    INTERFACE     BRIDGE  HW   HORIZON  TRUSTED  TRUSTED-RA  FAST-LEAVE  PATH-COST  INTERNAL-PATH-COST  BPDU-GUARD  EDGE  POINT-TO-POINT  PVID  FRAME-TYPES                            
0  H ether1        bridge  yes  none     no       no          no                 10                  10  no          auto  auto              10  admit-only-untagged-and-priority-tagged
1  H sfp-sfpplus1  bridge  yes  none     no       no          no                 10                  10  no          auto  auto               1  admit-only-vlan-tagged                 
2  H sfp-sfpplus2  bridge  yes  none     no       no          no                 10                  10  no          auto  auto              10  admit-only-untagged-and-priority-tagged
3  H sfp-sfpplus3  bridge  yes  none     no       no          no                 10                  10  no          auto  auto              10  admit-only-untagged-and-priority-tagged
4 IH sfp-sfpplus4  bridge  yes  none     no       no          no                 10                  10  no          auto  auto              10  admit-all

Buckeye · March 26, 2026, 9:45pm

Can you post output of /interface/bridge/vlan print on both devices as well?

Also, your description and the comments in the config don't match.

Please make a diagram, even a photo of a hand drawn sketch is much better than words for quickly understanding how things are connected.

Also, if you are using the CRS devices as switches (which is what they are designed for), then what is the purpose of more than one vlan interface on each CRS? You would normally have only a single "connection" to the CPU (that's what the vlan interface is, a "connection" from the switch to the "router block").

You stated that the two devices are both on the same vlan. If that is the case, and iff both hosts are in the same ip network, then the traffic should never even be making it to the CPU, it should be forwarded in the switch chips of the CRS devices. If the two hosts are not in the same subnet, then the traffic will still need to be routed by the pfsense box, even though the pfsense box will retransmit right back through the same vlan interface the thraffic was received on.

Last question: is only ipv4 involved?

Siliconoxide · March 26, 2026, 11:03pm

CRS310:

[admin@MikroTik] >  /interface/bridge/vlan print 
Flags: D - DYNAMIC
Columns: BRIDGE, VLAN-IDS, CURRENT-TAGGED, CURRENT-UNTAGGED
#   BRIDGE  VLAN-IDS  CURRENT-TAGGED            CURRENT-UNTAGGED     
;;; Guest VLAN
0   bridge        40  bridge                                         
                      ether4 Ruckus R650                             
                      ether8 Cisco Switch                            
                      sfp-sfpplus2 OPNsense                          
;;; Main VLAN
1   bridge        10  bridge                    ether2 Home Assistant
                      ether7 Brocade Switch     ether6 Proxmox       
                      ether8 Cisco Switch       ether3 Blue Iris     
                      sfp-sfpplus1 SFP+ Switch  ether1 Talyn         
                      sfp-sfpplus2 OPNsense                          
;;; IOT VLAN
2   bridge        30  bridge                                         
                      ether4 Ruckus R650                             
                      ether7 Brocade Switch                          
                      ether8 Cisco Switch                            
                      sfp-sfpplus2 OPNsense                          
;;; 20 VLAN
3   bridge        20  bridge                                         
                      sfp-sfpplus1 SFP+ Switch                       
                      ether7 Brocade Switch                          
                      ether8 Cisco Switch                            
                      sfp-sfpplus2 OPNsense                          
;;; CAM VLAN
4   bridge        31  bridge                                         
                      ether4 Ruckus R650                             
                      ether7 Brocade Switch                          
                      ether8 Cisco Switch                            
                      sfp-sfpplus2 OPNsense                          
;;; added by pvid
5 D bridge         1                            bridge               
;;; added by pvid
6 D bridge        10                            ether4 Ruckus R650

CRS305:

[admin@MikroTik SFP+] > /interface/bridge/vlan print  
Flags: D - DYNAMIC
Columns: BRIDGE, VLAN-IDS, CURRENT-TAGGED, CURRENT-UNTAGGED
#   BRIDGE  VLAN-IDS  CURRENT-TAGGED  CURRENT-UNTAGGED
;;; Main VLAN
0   bridge        10  bridge          sfp-sfpplus2    
                      sfp-sfpplus1    sfp-sfpplus3    
                                      ether1          
;;; Guest VLAN
1   bridge        40  bridge                          
;;; IOT Vlan
2   bridge        30  bridge                          
                      sfp-sfpplus1                    
;;; VLAN20
3   bridge        20                                  
;;; added by pvid
4 D bridge         1                  bridge          
[admin@MikroTik SFP+] >

Diagram, I hope this better explains my mess. Let me know if you would like me to add anything:

Yes, they are being used as switches and I thought that is how vlans were configured on a Mikrotik. An interface for each vlan as well as the vlans configured on the bridge. Setting up the vlans were a bit of a chore for me as they aren't as easy as the basic Cisco switch.

Yes, that is how I thought it should work. The devices in this conversation are both on the same subnet and vlan. I can confirm that the transfer is not hitting the opnsense box as well. The transfer in question is from 192.168.1.8 to 192.168.1.137.

Processor usage while transfer is active:

Yes, only IPV4 in use.

rplant · March 27, 2026, 2:17am

My only (unlikely) thought is that perhaps you are using large packets and they are being fragmented by the CRS310.

Buckeye · March 27, 2026, 4:22am

Assumptions: Brocade ICX6450-24p is configured with Eth9 as access port for vlan 10, and switch-port connected to CRS310 Eth7 has vlan 10 tagged.

The two hosts involved in the "large transfer" are the Proxmox1 and Proxmox2, and they are configured to use untagged traffic. The two proxmox hosts are plugged into access ports, both on vlan 10. And both proxmox hosts are using the "192.168.1.0/24" subnet for the transfer.

The "100% CPU" is on the CRS switches? Is it only on the CRS310?

When a transfer is happening, what does /tool/profile show the CPU spending time on? That will at least give a clue as to what to focus on.

I don't see anything obviously wrong with the vlan config, but are you trying to use the CRS310 as an SMB server? That probably won't work out well.

How did you get your switch configured, and what was your guide?

There is a lot of stuff in your config that isn't needed for the relatively simple goal you state (to be a L2 vlan aware switch). For example, where did the need for ovpn in the config arise? Why is detect-internet on? If you are not using ipv6, get rid of the /ipv6 stuff. And what were you doing with /tool traffic-generator? and the L3-HW routing stuff should be removed. Also the /routing/pimsm stuff at least until you get things working as a switch.

I don't have any CRS switches, but if you want the routing to be done by the pfsense box (this applies only to traffic in different subnets), then I would get rid of the switch l3-hw stuff from the config. That's a more advanced topic, and it is for routing between different vlans in the switch.

The closest analogue to RouterOS/linux vlan interfaces in Ciscoland is the SVI. It's the thing you can attach ip addresses to that connect to a specific vlan in the switch. If you want routing between vlans, then the vlan interfaces are the "connection points" into specific vlans in the switch, where each vlan is like a specific wire in a cable that are normally isolated from each other.

Here's a useful supplement to other docs. It was recently offline, but when I looked today, it was back online. It is a bit easier to digest than the official MikroTik docs that are more of a reference manual than user guide. MikroTik RouterOS Documentation https://mikrotikdocs.fyi/

See this section VLANs on MikroTik RouterOS: A Complete Guide

But first, let's find out what the CPU is spending time on with /tool/profile while a transfer is in progress.

There are some things that should be on and are the default values, but it appears that they have been disabled. Example: ingress-filtering on the bridge, which should be left on unless you can explain why you don't want it on.

raimondsp · March 27, 2026, 9:00am

Hey there,

If both devices are in the same VLAN ((in your case - vlan 10), L3HW is not involved. In this case, CRS310 is acting as a L2 bridge, forwarding traffic between hosts.

First, check if the bridge is learned host MAC addresses:

/interface/bridge/host print

and see if MAC addresses of both hosts appear on the list with VID 10. If, for some reason, packet's destination MAC address isn't learned, L2 bridge floods the traffic to all ports, including CPU in your case. Speaking of which, if you don't need inter-VLAN routing, you may remove the bridge interface from VLAN members - it will prevent traffic flooding to the CPU.

Also, what kind of traffic is sent between those two hosts (unicast, multicast, broadcast)?

Siliconoxide · March 27, 2026, 2:09pm

All your assumptions are correct

Both the CRS310 and CRS305 hit the CPU

CRS310:

[admin@MikroTik] > /tool/profile 
Columns: NAME, USAGE
NAME             USAGE
networking       12%  
interface-mgmt   1.5% 
user-mgmt        0%   
telnet           0.2% 
winbox           3.5% 
ethernet         0.2% 
bridging         11.7%
console          5.2% 
resource-mgmt    0.7% 
ipc              3.5% 
profiling        0.7% 
kernel           22%  
romon            3%   
prestera_dx_mac  20.5%
www              0%   
led              0%   
radvd            0.2% 
total            84.9%


[admin@MikroTik] > /tool/profile 
Columns: NAME, USAGE
NAME             USAGE
networking       12%  
interface-mgmt   22.5%
user-mgmt        0%   
telnet           0%   
winbox           0.2% 
ethernet         0%   
queue-mgmt       0.2% 
bridging         14.7%
console          1.7% 
resource-mgmt    0.5% 
ipc              2.2% 
config-db        0%   
profiling        1.2% 
kernel           20%  
romon            0.5% 
8021q            0%   
prestera_dx_mac  22.5%
www              0%   
led              0.2% 
total            98.4%

CRS305:

[admin@MikroTik SFP+] > /tool/profile  
Columns: NAME, USAGE
NAME                USAGE
networking          14%  
interface-mgmt      0%   
telnet              0%   
winbox              0.2% 
ethernet            0%   
queue-mgmt          0%   
bridging            13.7%
console             9.7% 
neighbor-discovery  0.2% 
resource-mgmt       0%   
ipc                 0%   
profiling           0%   
kernel              22.2%
romon               0.2% 
prestera_dx_mac     21%  
www                 0.7% 
led                 0%   
radvd               0%   
ntp                 0%   
total               81.9%
-- [Q quit|D dump|C-z continue]


[admin@MikroTik SFP+] > /tool/profile  
Columns: NAME, USAGE
NAME                USAGE
networking          12.5%
interface-mgmt      25.7%
telnet              0.2% 
winbox              0%   
ethernet            0.5% 
queue-mgmt          0%   
bridging            12.7%
console             0.2% 
neighbor-discovery  0%   
routing             0%   
resource-mgmt       0.2% 
ipc                 1%   
kernel              25%  
romon               0.5% 
prestera_dx_mac     19%  
www                 1%   
led                 0%   
snmp                0.7% 
keyman              0%   
total               99.2%

I had played with teh SMB using a USB stick. You are correct, it did not work well. I've cleared that out.

That was back in 2024. I can't recall what guide I used but It didn't work 100% and I did get help on an OPNsense forum.. I initially thought a problem I had was OPNsense related.

It was been working fine all this time because I've never did a transfer this large. I might move some multi gig files, or photos. I might start a larger transfer then walk away. Any back ups are done at night when I wouldn't notice a network issue. This transfer is around 9tb and runs for days. Or it should have ran for days if I didn't have to stop it when the network chokes.

This is the command being executed on the proxmox host. Moving around 9tb of a lxc container:

root@proxmox:~# pve-zsync  sync   --source  "tank0/subvol-102-disk-0"  --dest 192.168.1.137:zpoolext --verbose --maxsnap 1  --name tankbackup

I do not remember how that got there. I have Opnvpn on the opnsense, no need on the CRS.

I thought I had disabled that mess. It is now.

I think I just looked around at that just to see when/if I could use it.

That must have been there stock as I don't even know what that is much less have added any config to that. And it was on both switches.

This is all I want to do for not. I would like to eventually move some routing off the opnsense to the CRS, but I'd much rather just take care of this transfer issue for now.

I'll review that and see if there is something i may have missed.

Fixed.

I'll also update the config here since there were some changes made. I'll only post the CRS310 for now as changes will be mirrored to the CRS305

# 2026-03-27 10:01:41 by RouterOS 7.22
# software id = xxxx
#
# model = CRS310-8G+2S+
# serial number = xxxx
/interface bridge
add admin-mac=xxxx auto-mac=no comment="BRIDGE FOR LAN" name=\
    bridge priority=0x4000 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name="ether1 Talyn"
set [ find default-name=ether2 ] name="ether2 Home Assistant"
set [ find default-name=ether3 ] name="ether3 Blue Iris"
set [ find default-name=ether4 ] name="ether4 Ruckus R650"
set [ find default-name=ether6 ] name="ether6 Proxmox"
set [ find default-name=ether7 ] name="ether7 Brocade Switch"
set [ find default-name=ether8 ] name="ether8 Cisco Switch"
set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no name=\
    "sfp-sfpplus1 SFP+ Switch"
set [ find default-name=sfp-sfpplus2 ] auto-negotiation=no name=\
    "sfp-sfpplus2 OPNsense"
/interface vlan
add comment="Main VLAN" interface=bridge name=vlan10 vlan-id=10
/interface list
add name=WAN
add name=LAN
add include=all name=management
/routing id
add disabled=no id=192.168.1.5 name=id-1 select-dynamic-id=\
    only-static,only-vrf select-from-vrf=main
/disk settings
set auto-media-interface=bridge auto-smb-user=""
/ip smb
set domain=NT_DOMAIN enabled=no
/interface bridge port
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface="ether1 Talyn" pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface="ether2 Home Assistant" pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface="ether3 Blue Iris" pvid=10
add bridge=bridge interface="ether4 Ruckus R650" pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface=ether5 pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
    interface="ether6 Proxmox" pvid=10
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
    "ether7 Brocade Switch"
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
    "ether8 Cisco Switch"
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
    "sfp-sfpplus1 SFP+ Switch"
add bridge=bridge frame-types=admit-only-vlan-tagged interface=\
    "sfp-sfpplus2 OPNsense" pvid=10 trusted=yes
/interface ethernet switch l3hw-settings
set autorestart=yes ipv6-hw=yes
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=management lldp-med-net-policy-vlan=1
/ip settings
set icmp-rate-limit=100
/interface bridge vlan
add bridge=bridge comment="Guest VLAN" tagged=\
    "sfp-sfpplus2 OPNsense,ether4 Ruckus R650,ether8 Cisco Switch,bridge" \
    vlan-ids=40
add bridge=bridge comment="Main VLAN" tagged="sfp-sfpplus2 OPNsense,sfp-sfpplu\
    s1 SFP+ Switch,ether8 Cisco Switch,ether7 Brocade Switch,bridge" \
    untagged="ether1 Talyn,ether2 Home Assistant,ether3 Blue Iris,ether5,ether\
    6 Proxmox" vlan-ids=10
add bridge=bridge comment="IOT VLAN" tagged="sfp-sfpplus2 OPNsense,ether4 Ruck\
    us R650,ether8 Cisco Switch,ether7 Brocade Switch,bridge" vlan-ids=30
add bridge=bridge comment="20 VLAN" tagged="sfp-sfpplus2 OPNsense,sfp-sfpplus1\
    \_SFP+ Switch,ether8 Cisco Switch,ether7 Brocade Switch,bridge" vlan-ids=\
    20
add bridge=bridge comment="CAM VLAN" tagged="sfp-sfpplus2 OPNsense,ether8 Cisc\
    o Switch,ether4 Ruckus R650,ether7 Brocade Switch,bridge" vlan-ids=31
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface list member
add interface="ether1 Talyn" list=LAN
add interface="ether2 Home Assistant" list=LAN
add interface="ether3 Blue Iris" list=LAN
add interface="ether4 Ruckus R650" list=LAN
add interface=ether5 list=LAN
add interface="ether6 Proxmox" list=LAN
add interface="ether7 Brocade Switch" list=LAN
add interface="ether8 Cisco Switch" list=LAN
add interface="sfp-sfpplus1 SFP+ Switch" list=LAN
add interface="sfp-sfpplus2 OPNsense" list=LAN
add interface="ether1 Talyn" list=management
add interface="ether2 Home Assistant" list=management
add interface="ether3 Blue Iris" list=management
add interface="ether4 Ruckus R650" list=management
add interface=ether5 list=management
add interface="ether6 Proxmox" list=management
add interface="ether7 Brocade Switch" list=management
add interface="ether8 Cisco Switch" list=management
add interface="sfp-sfpplus1 SFP+ Switch" list=management
add interface="sfp-sfpplus2 OPNsense" list=management
add interface=vlan10 list=management
add disabled=yes interface=bridge list=management
/ip dhcp-client
add interface=vlan10 name=bridge
/ip dns
set servers=192.168.1.1
/ip dns static
add address=192.168.1.5 match-subdomain=yes name=MikroTik type=A
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add distance=1 gateway=192.168.1.1
add distance=1 gateway=192.168.1.1
/ip tftp
add
/ip upnp interfaces
add disabled=yes interface=bridge type=internal
/ipv6 dhcp-client
add interface=bridge pool-prefix-length=64 request=address
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/routing igmp-proxy interface
add comment=Test disabled=yes
/snmp
set enabled=yes trap-interfaces=all trap-version=2
/system clock
set time-zone-name=America/New_York
/system health settings
set fan-min-speed-percent=10%
/system logging
set 3 action=memory
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.1.1
/system package local-update update-package-source
add address=192.168.1.5 user=admin
/tool mac-server
set allowed-interface-list=management
/tool mac-server mac-winbox
set allowed-interface-list=management
/tool romon
set enabled=yes id=D4:01:C3:6A:54:34
/tool romon port
add interface=management

Siliconoxide · March 27, 2026, 6:58pm

Well, one of the changes did something. The transfer has been running for over an hour with low processor usage, roughly 1-5%.

[admin@MikroTik] > /tool/profile 
Columns: NAME, USAGE
NAME             USAGE
interface-mgmt   1.7% 
telnet           0%   
winbox           0%   
logging          0%   
queue-mgmt       0%   
bridging         0.2% 
console          0.2% 
resource-mgmt    0%   
ipc              0.7% 
profiling        0.2% 
kernel           0.2% 
prestera_dx_mac  0%   
led              0%   
www              0.5% 
total            3.7% 


-- [Q quit|D dump|C-z continue]

Any idea which change had the effect? I do still need to clean up the Vlan mess I have. Although I will stop the transfer and reboot the switches to see if this sticks.

You mean the tagging of the bridge on the vlans?

Unicast in this case.

Buckeye · March 27, 2026, 7:24pm

Hard to say. My guess:

/interface detect-internet
set internet-interface-list=all lan-interface-list=LAN wan-interface-list=WAN

that, along with all the extra non-needed vlan-interfaces (that have now been removed).

See Detect Internet warnings.

I have never used it, because of all the negative comments on the forum concerning it.

But internet-interface-list=all to me looks like a misconfiguration.

Do you remember why you enabled it?

Buckeye · March 27, 2026, 7:56pm

I assume he means this:

/interface bridge vlan
add bridge=bridge comment="Guest VLAN" tagged=\
    "sfp-sfpplus2 OPNsense,ether4 Ruckus R650,ether8 Cisco Switch" \
    vlan-ids=40
add bridge=bridge comment="Main VLAN" tagged="sfp-sfpplus2 OPNsense,sfp-sfpplu\
    s1 SFP+ Switch,ether8 Cisco Switch,ether7 Brocade Switch,bridge" \
    untagged="ether1 Talyn,ether2 Home Assistant,ether3 Blue Iris,ether5,ether\
    6 Proxmox" vlan-ids=10
add bridge=bridge comment="IOT VLAN" tagged="sfp-sfpplus2 OPNsense,ether4 Ruck\
    us R650,ether8 Cisco Switch,ether7 Brocade Switch" vlan-ids=30
add bridge=bridge comment="20 VLAN" tagged="sfp-sfpplus2 OPNsense,sfp-sfpplus1\
    \_SFP+ Switch,ether8 Cisco Switch,ether7 Brocade Switch" vlan-ids=\
    20
add bridge=bridge comment="CAM VLAN" tagged="sfp-sfpplus2 OPNsense,ether8 Cisc\
    o Switch,ether4 Ruckus R650,ether7 Brocade Switch" vlan-ids=31

The only place that vlan membership for the "CPU port" (which the "bridge" represents) needs to be enabled is for vlan10 (which is your effective "management interface")

The way it is now, all broadcast/multicast traffic on vlans 20,30,31,40 are being delivered to the CPU and it receives interrupts and then has to inspect the frame to see which interface it was intended for. It will then see that there is no vlan interface to deliver to and ignore the traffic, but is still gets interrupted. Leaving the bridge out of the vlan membership for the extra vlans eliminates that. But the switch is still able to forward the ethernet frames (within the same vlan), i.e. it will still work as a L2 switch for the vlans 20,30,31,40. Removing the bridge is like blocking scam callers on your mobile phone so you don't have to be interrupted, just to see it was a scammer. So it would have the most effect if you had a lot of broadcast/multicast traffic. With unicast traffic, once the mac is learned, the switch will only forward to the port for which the mac address was last seen on (until mac ages out due to inactivity).

You can verify this by removing the bridge from vlan 40, and then verifying that you can still access the guest network, if you want to verify in a limited scope before making a larger change.

For more info about "switch operation", I recommend watching
Everything Switches do - Part 1 - Networking Fundamentals - Lesson 4 and
Everything Switches do - Part 2 - Networking Fundamentals - Lesson 4 by Ed Harmoush

Siliconoxide · March 27, 2026, 11:51pm

I sent everything into a reboot, all 3 switches, opnsense and both proxmox hosts. The transfer has been running now for 1 hour and low CPU use! And the network is no longer bogging down. Now to wait a few days for the transfer to finally finish.

I believe this has resolved the issue. Thank you for the help sorting out my mess.

I have no idea why I did that. I should have researched that better in regards to its effects. I guess just assumed it would monitor for an internet connection.

I made those changes, the bridge is only tagged on vlan 10. Aside from security, would there be any benefit to creating a true management lan and only tagging the bridge there?

jaclaz · March 27, 2026, 11:57pm

Detect-internet is not-so-casually the object of Rule #5, JFYI:
The twelve Rules of Mikrotik Club

Buckeye · March 28, 2026, 1:26am

Security is the main reason, as it is limiting the "attack surface" of what can even try to log into the switches. Also if you are using an insecure version of SNMP (less than v3), having it one a more secure vlan is better, but again, in a home, does it matter? It is a classic convenience vs security tradeoff.

In a home where you can limit who connects to your management lan, you can use you "management" lan for other things, like your trusted devices. i.e. trusted == management.

I would still recommend using a non-trivial password, just in case some malware gets onto some "trusted" device. The pfsense device would be a bigger target than the CRS switches, since it probably has a much more powerful cpu and is the gatekeeper. But having access to management of the switch grants you the privilege make any port "trusted", whether it should be or not.

You have already separated IoT, guests, and your cameras into their own "islands", and as long as your pfsense firewall is configured correctly, then it should be able to prevent the traffic on separate vlans from being able to communicate with each other. Things on the same vlan won't need the router at all to be able to communicate with each other, a corollary being that the firewall won't be able to prevent intra-vlan communication; it can only block inter-vlan traffic.

In a business environment, having a dedicated vlan for management, server ilo access, etc. is much more important.

You currently have a single place where traffic can get from one vlan to another, and that is your pfsense box. That makes things much simpler than having multiple routers, and enabling L3HW is essentially making your switch act as a "limited" router.

Unless you have massive amounts of inter-vlan traffic, I wouldn't even look at L3HW offloading. It will make things more complex, and then you won't have one place to control traffic flow between vlans (which is now your pfsense box).

Siliconoxide · March 29, 2026, 11:43pm

I had no idea that feature was so bad. Lol.

I don't have much of anything going between vlans. All the large transfer items are on the main vlan. The vlans are more to limit which devices can see what and which ones get internet access. Keeping track of vlan routing on 5 switches with 3 different operating systems doesn't sound like fun. Out of the 3 switch brands, mikrotik is the most involved/confusing to set up just to use vlans. I'm glad I got this figures out so I could set up my third proxmox machine.

Thank you for all the help.