Hi, I have a problem with the throughput IPsec connections between CCR-1036 through POWERBRIDGE M10. When I am in the configuration of IPsec Policy IPsec Protocols set esp, throughput is only around 10 Mbits / s, when I switch on the ah, throughput have around 90 Mbits / s. I need to have an encrypted connection, what’s the problem? OS version is 6.27
/interface bridge
add name=bridge1
/interface ethernet
set [ find default-name=ether1 ] l2mtu=1990 mtu=1900
set [ find default-name=ether2 ] l2mtu=1590
set [ find default-name=ether3 ] l2mtu=1590
set [ find default-name=ether4 ] l2mtu=1590
set [ find default-name=ether5 ] l2mtu=1590
set [ find default-name=ether6 ] l2mtu=1590
set [ find default-name=ether7 ] l2mtu=1590
set [ find default-name=ether8 ] l2mtu=1590
set [ find default-name=ether9 ] l2mtu=1590
set [ find default-name=ether10 ] l2mtu=1590
set [ find default-name=ether11 ] l2mtu=1590
set [ find default-name=ether12 ] l2mtu=1590
/ip pool
add name=dhcp_pool1 ranges=172.17.1.50-172.17.1.55
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=bridge1 lease-time=3d name=\
dhcp1
/port
set 0 name=serial0
set 1 name=serial1
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether5
/ip address
add address=172.16.1.2/24 comment="default configuration" interface=ether1 \
network=172.16.1.0
add address=172.17.1.1/24 interface=bridge1 network=172.17.1.0
/ip dhcp-server network
add address=172.17.1.0/24 gateway=172.17.1.1
/ip firewall mangle
add action=change-mss chain=forward new-mss=1300 protocol=tcp src-address=\
192.168.100.0/24 tcp-flags=syn tcp-mss=!0-1300
add action=change-mss chain=forward dst-address=192.168.100.0/24 new-mss=1300 \
protocol=tcp tcp-flags=syn tcp-mss=!0-1300
/ip firewall nat
add chain=srcnat dst-address=192.168.100.0/24 src-address=172.17.1.0/24
add chain=srcnat dst-address=192.168.200.0/24 src-address=172.17.1.0/24
add action=masquerade chain=srcnat out-interface=ether1
/ip ipsec peer
add address=172.16.1.1/32 enc-algorithm=aes-128 generate-policy=port-override \
nat-traversal=no secret=test
/ip ipsec policy
set 0 disabled=yes
add dst-address=192.168.100.0/24 ipsec-protocols=esp sa-dst-address=172.16.1.1 \
sa-src-address=172.16.1.2 src-address=172.17.1.0/24 tunnel=yes
add dst-address=192.168.200.0/24 ipsec-protocols=esp sa-dst-address=172.16.1.1 \
sa-src-address=172.16.1.2 src-address=172.17.1.0/24 tunnel=yes
/ip route
add distance=1 gateway=172.16.1.1
add distance=1 dst-address=192.168.100.0/24 gateway=172.16.1.1
/system ntp client
set enabled=yes primary-ntp=172.16.1.1
/system ntp server
set enabled=yes multicast=yes
/system routerboard settings
set cpu-frequency=1200MHz memory-frequency=1066DDR