RB1000 - IPsec over 150+ locations -> CPU 100%

I have quite weird problem, RB1000 configured for central place with 150+ small consumer routers (dlink, zyxel) in remote locations connected thru IPsec (ESP tunnels).
All works OK for 5-30min (seems to be random time but under a hour definitely) until CPU goes bezerk to 100% (before that with all IPsec tunnels CPU usage is 0-15% max); all tunnels drop, remote peer list is cleared and installed-sa list is inacessible. Tunnels are then slowly built up again until next drop in x minutes. During all that time CPU is nailed at 100% (also later if I remove RB1000 from the network). Some time after the start of 100% CPU also the whole ip ipsec menu is inaccessible (ssh/winbox), no reply on the commands…

Tried this on 3.30 and 4.2 routeros versions, same results.

Anybody had a similar setup maybe on some other version of routeros that is working? Is there maybe a limit to number of IPsec tunnels (from the CPU usage when working normally I’d say 150 is still quite low for this hardware)?

There was a bug that a lot of installed SAs may crash Ipsec. It will be fixed in v4.3.

Thnx, good to know.

will this bug be fixed in version 3.30 as well?

With my current findings, it’s still a problem in 4.x, 4.3-4.5 versions showing the same symptoms - no improvement yet :frowning: