Tunnel performance / Route public IPv4 to external Site

Dear Community,

we have one “main” network with bgp uplinks with thousands of IPv4 adresses available and some “islands”, not connected to the main network directly, with non bgp uplinks to the internet and only few IPv4 adressess.
Our solution to provide IPv4 adresses to our customers at these “islands”, we created a GRE tunnel from our main network to eacht “island”, and route our customers through these tunnels if they need a public IPv4 address.

The problem is, as we now provide higher datarates (up to 50M), this solution doesn’t work well. I did some bandwith tests with the following results
Site A: CCR1036-8G-2S+ (BGP Uplink router)
Site B: RB493G (Internet Uplink Router at one island)

All tests where TX from Site A to Site B, as we have an asynchronous uplink with 160M down and 10M up at Site B

Without tunnel to public ip at Site B: ~160M
Over L2TP without IPSEC: ~40M
Over GRE: ~25M
Over IPIP: ~8M very unstable

All tests with UDP and 1400 Bype packet size

Is there any better solution to route our public adresses to our customers at these “islands”, or is there no better solution then L2TP.
I know that tunneling always cost bandwith because of the overhead, but i did not think it will cost ~75% and more.

Kind regards,
Manuel Ritter

Are your devices, either end, maxing out CPU wise during the encapsulation? Were all of your tests done with or without encryption.

Just to be certain you are conducting your tests after setting the MTU on the routers and testing device (PC) and not using a packet size that would cause fragmentation?

If performance becomes a serious constraint you may find better forwarding performance with Cisco equipment. In the new Denali (16.x) releases for their 3850 switches they’ve enabled GRE (non-IPSec) in hardware. Alternatively the newer ISR 4k products are licensed at a throughput and will obtain that throughput regardless of what features are enabled (IPSec + GRE for example). The smaller ISR 4331 I believe starts at 100MB and can be upgraded to 300MB.

Love me some MikroTik but sometimes design requirements adjust where you put what kind of gear.