Slow speed routing inter vlan CCR1036-12G-4S

Hello everyone, as described in the title I have an inter vlan speed problem, my network diagram is:

The interface eth1 and eth2 form a bridge for the LAN, there I created the VLAN 10, in the switchs I created the access ports and the trunk ports. All Hardware is gigabit ethernet. My router is:
routerOS: 6.37.5
routerboard: yes
model: CCR1036-12G-4S
factory-firmware: 3.33
current-firmware: 3.33
upgrade-firmware: 3.33

Configuration:

# jan/17/2018 10:43:19 by RouterOS 6.37.5
# software id = CQL1-KYMM
#
/interface bridge
add name=bridge1
/interface ethernet
set [ find default-name=ether2 ] comment="ETH 2" mac-address=\
    E4:8D:8C:08:7F:15 name=LAN
set [ find default-name=ether3 ] comment="ETH 3" mac-address=\
    E4:8D:8C:08:7F:16 name=LAN1
set [ find default-name=ether1 ] auto-negotiation=no mac-address=\
    E4:8D:8C:08:7F:14 name=WAN
set [ find default-name=ether4 ] mac-address=E4:8D:8C:08:7F:17
set [ find default-name=ether5 ] mac-address=E4:8D:8C:08:7F:18
set [ find default-name=ether6 ] mac-address=E4:8D:8C:08:7F:19
set [ find default-name=ether7 ] mac-address=E4:8D:8C:08:7F:1A
set [ find default-name=ether8 ] mac-address=E4:8D:8C:08:7F:1B
set [ find default-name=ether9 ] mac-address=E4:8D:8C:08:7F:1C
set [ find default-name=ether10 ] mac-address=E4:8D:8C:08:7F:1D
set [ find default-name=ether11 ] mac-address=E4:8D:8C:08:7F:1E
set [ find default-name=ether12 ] mac-address=E4:8D:8C:08:7F:1F
set [ find default-name=sfp1 ] mac-address=E4:8D:8C:08:7F:10
set [ find default-name=sfp2 ] mac-address=E4:8D:8C:08:7F:11
set [ find default-name=sfp3 ] mac-address=E4:8D:8C:08:7F:12
set [ find default-name=sfp4 ] mac-address=E4:8D:8C:08:7F:13
/interface gre
add !keepalive local-address=X.Y.Z.A name=Tunnel0 remote-address=\
    X.Y.Z.A
/ip neighbor discovery
set LAN comment="ETH 2"
set LAN1 comment="ETH 3"
/interface vlan
add interface=bridge1 name=vlan10 vlan-id=10
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc,3des pfs-group=none
/ip pool
add name=clientes ranges=10.10.10.2-10.10.10.10
add name=dhcp_pool2 ranges=192.168.21.190-192.168.21.210
add name=dhcp_pool3 ranges=192.168.1.200-192.168.1.220
/ip dhcp-server
add address-pool=dhcp_pool3 disabled=no interface=vlan10 name=dhcp2
/ip pool
add name=dhcp_pool1 next-pool=dhcp_pool2 ranges=192.168.21.135-192.168.21.145
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=bridge1 name=dhcp1
/ppp profile
add change-tcp-mss=yes dns-server=8.8.8.8 local-address=10.10.10.1 name=\
    L2TP_VPN_PROFILE remote-address=clientes
/queue type
add kind=pcq name=NTTsw_Descargar pcq-classifier=src-address \
    pcq-dst-address6-mask=64 pcq-limit=19000000KiB pcq-rate=19M \
    pcq-src-address6-mask=64 pcq-total-limit=19000KiB
add kind=pcq name=NTTsw_Subir pcq-classifier=dst-address \
    pcq-dst-address6-mask=64 pcq-limit=19000000KiB pcq-rate=19M \
    pcq-src-address6-mask=64 pcq-total-limit=19000KiB
/queue tree
add max-limit=19M name=nttsw_descargar_total packet-mark=\
    nttsw_descargar_total parent=bridge1 queue=NTTsw_Descargar
add max-limit=19M name=nttsw_subir_total packet-mark=nttsw_subir_total \
    parent=WAN queue=NTTsw_Subir
/system logging action
add bsd-syslog=yes name=logUdpRemote remote=192.168.21.146 syslog-facility=\
    local1 target=remote
add bsd-syslog=yes name=logTcpRemote remote=192.168.21.146 syslog-facility=\
    local0 target=remote
/interface bridge port
add bridge=bridge1 interface=LAN
add bridge=bridge1 interface=LAN1
/interface l2tp-server server
set default-profile=L2TP_VPN_PROFILE enabled=yes ipsec-secret=\
    ############ max-mru=1460 max-mtu=1460 mrru=1600 use-ipsec=\
    yes
/interface pptp-server server
set authentication=pap,chap,mschap1,mschap2
/ip accounting
set enabled=yes threshold=2560
/ip accounting web-access
set accessible-via-web=yes address=192.168.21.54/32
/ip address
add address=X.Y.Z.A interface=WAN network=X.Y.Z.A
add address=192.168.21.1/24 interface=LAN network=192.168.21.0
add address=172.16.1.2/30 interface=Tunnel0 network=172.16.1.0
add address=X.Y.Z.A interface=WAN network=X.Y.Z.A
add address=X.Y.Z.A interface=WAN network=X.Y.Z.A
add address=X.Y.Z.A interface=WAN network=X.Y.Z.A
add address=X.Y.Z.A interface=WAN network=X.Y.Z.A
add address=192.168.1.1/24 interface=vlan10 network=192.168.1.0
/ip dhcp-server lease
add address=192.168.21.138 client-id=1:14:2:ec:3a:62:ac mac-address=\
    14:02:EC:3A:62:AC server=dhcp1
add address=192.168.21.139 client-id=1:14:2:ec:3a:62:82 mac-address=\
    14:02:EC:3A:62:82 server=dhcp1
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8 gateway=192.168.1.1
add address=192.168.21.0/24 dns-server=192.168.21.50 gateway=192.168.21.1

Here some tests that I have done with iperf:

Virtual Machine in proxmox ------> Virtual Machine in Oracle : Bandwidth: 0,95 MBytes/s
Proxmox physical server ------> Oracle physical server : Bandwidth: 1,17 MBytes/s
Proxmox physical server ------> Other proxmox physical server: Bandwidth: 102 MBytes/s
Virtual Machine in proxmox ------> Interface VLAN Mikrotik: Bandwidth 40 MBytes/s
Virtual Machine in proxmox ------> Interface Bridge Mikrotik: Bandwidth: 48 MBytes/s
Oracle physical server -------> Other Oracle physical server: Bandwidth: 111 MBytes/s
Virtual Machine in Oracle -------> Interface Bridge Mikrotik: Bandwidth: 45 MBytes/s
Virtual Machine in oracle ------> Interface VLAN Mikrotik: Bandwidth: 24 MBytes/s

If you need more data, ask for it. I appreciate any help or hint, thanks.

Hi, any solution to this? I have almost the same config on a rb3011.
If i enable global “use-ip-firewall” on the bridge, speed drops to 200Mbits on inter vlan traffic.

Cpu is only at 40-50%

Please help :slight_smile:

hi davidhs,
did you ever get a resolution to this issue?

also it looks like you may have left out some of your configuration maybe?
ie i see you have 2x PCQ queue types setup using packet-mark=
(but then i dont see any /ip firewall mangle rules, nor any /ip firewall rules at all)
(nor any /queue simple entries, if you have any).

if above really is your entire config. ( /sys export ) then i dont see any problems, except you could try adding vlan10 to each eth interface, and then adding all 4x interfaces to the bridge (should not make any difference vs your current /int bridge port setup, though).
(unless maybe if you have MTU 9k vs mtu 1500 type setting issues)

lmk, tks