I’m currently using hAP ac² as edge router at home. Unfortunately it seems that I reached its performance limits. My load is really uneven and mostly 1 core is loaded (cpu3) which constantly sits at 100% while other cores closer to 40%. Nevertheless I’m getting packet drops when traffic exceeds around 80 mbps. Profiler shows 50% core load on firewall. The other 50% is spread across other stuff, notably networking and queues.
I’m using probably all most resource intense functions like heavy per-packet mangling, PBR, bridge-ip-firewall, global parent queue-tree etc etc. No fasttrack obviously and that’s probably not gonna change.
What are my upgrade options? I’d prefer something with hardware switch (with VLANs support) because I’m also using this router as bypass-switch in order to allow bypassing inline IPS and transparent proxy if any of them is down. Mikrotik has severe issues with NAT when the sane packets go several times through connection tracking.
I’m getting impression that RB3011 is the only device that checks all those boxes… But there’s no desktop variant… Does 3011 physically fit RB2011-IN enclosure? Because I have one spare RB2011 that i don’t use anyways around
I went from hAP ac² to RB4011iGS+RM in order to achieve gigabit speed IPv6 routing with stateful firewall, which isn’t possible on hAP ac² due to the lack of IPv6 fasttrack.
My workaround for the lack of hardware switching with vlan filtering is to use one of the switch groups with vlan filtering completely disabled and connect it to a bunch of hAP ac²s which serve as combined wifi access point and vlan filtering access switch. You might be able to find similar workarounds for your use case.
And although it is disappointing that the rb4011 cannot do vlan filtering in hardware, its CPU is indeed fast enough to do it in software which is probably fine for most use cases as well.
I thought about using external switch but I don’t think it’s this simple in my case. Because I have scripted VLAN filtering that is reconfigured dynamically with 20ms switch time in order to detect whether master proxy is up. This script is executed evey 13 seconds:
If i remember correctly changing VLANs on switch chip is the only way to reliably change traffic path for 20ms. Reconfiguring software VLAN interfaces had significantly higher latency. And monitoring proxy on switch would be quite tricky (this script is actually supposed to switch VLANs when proxy hangs / there’s misconfiguration on proxy side. Not only when device is completely down. Proxy also doesn’t support VRRP nor any other clustering protocols since It’s HA cluster of 2 completely different proxies - F5 and Nginx)
It’s just.edge router for low bandwidth traffic. I hoped it’s gonna be fine xD. I’m using CCR1009 as primary router for LAN.
Surprisingly “enterprise routers” don’t provide such functionality since in most cases they’re not so easily scripted. I’d need to get some legit load balancer with monitoring capabilities and HA, eg second F5 but this hAP is set up exactly to avoid getting second load balancer which costs 3 kidneys.
RB3011 looks fine but form factor is suboptimal. In fact if it wasn’t rackmount-only I’d buy it time long ago. Thus I’m interested whether it’s possible to mod 3011 into 2011 enclosure? (assuming I have 2011-IN laying around to use as enclosure donor)
