Yesterday I received my RB5009UG+S+IN.
There’s nothing mentioned about the ipsec performance on the product page, so I did some tests how it performs as a Home Router with an IPSec Connection to my Workplace.
I bought the RB5009 as a replacement for my CCR1009, which did a great job for the last 4+ years.
Although the CPU of the CCR1009 does offer hw acceleration, I wasn’t too happy with the results.
I only did single-tunnel tests, as this is what’s important to me, when single big files are transferred over ipsec.
I removed the default configuration, only set up ipsec and connected it to the fiber modem. No firewall rules installed.
PC === RB5009UG+S+IN == 500M/100M FIber == Internet == 1G/1G Fiber == CCR2004-1G-12S+2XS === PC
TBO I’m not impressed with these results. When the router is fully configured, Firewall Filter, Policy Routing, Multicast Routing, OSPF, QoS, CapsMan the results will be even worse.
In the long run, I’ll move to wireguard. In further tests I could fully utilize my 500Mbit/s connection using wireguard (CPU <50%), which is the only reason I won’t return the RB5009.
The CPU does have “Cryptography and CRC extensions”, so I hope they will be used in later releases of ROSv7. For now, I think the new CCR2004 is a way better choice, if ipsec performance is important.
We know! It’s just an informative post for people to give an indication what can be expected from this model in terms of ipsec (software) performance.
It’s not a rant against Mikrotik or the product itself. I still think it’s a good choice for a Homelab Router.
Yep 5009 look like a killing device for many task however lack of HW support for ipsec is frustrating ..
So again Mikrotik folks .. can you please end the drama and just confirm / deny about 5009 ipsec hw support.. should we expect hw support for ipsec with future ros7 release or not
i think you are going very aggressive in this topic
always in the history of MikroTik hw-acellerated ipsec was delivered several months after a device is released so we must be patient
this kind of feature (hw-accelerated ipsec) is not in the top priority when a new product is released, i think because of that the feature is not offered, to avoid this kind o misunderstanding
you bought this device knowing this facts, so assume your blame, instead of blowing a scandal to pressure manufacturer to follow your individual needs
if you are responsible for a network you only make responsible moves and decisions
also
keep in mind this is a routerOS 7 only board and this version of software is new so expect some issues and refining process who takes time
all the other facts you have mentioned are your personal assumptions
Very reasoned post Chechito, much thanks! (or muchas grassy ass as I would say to my mother and then she would scold me and I would reply hoder (how dare) you speak to me like that)!
In 2021 I will not say ipsec hardware support is a personal use case, pick any reason and will get the answer by your self, also the same apply and for the the question why is important.
So I don’t see nothing wrong for the people to ask.
