speed-test between CCR2004 and CCR1009

malas · Tue Feb 16, 2021 8:59 am

Hi, there
I'm a newbie on the Mikrotik devices.

I've been using a CCR1009 for 5 years in my company.
As the company is growing, we opened the new head office.
I installed a CCR2004 in the head office and the old CCR1009 was placed in the branch office.
To use site-to-site VPN between head office and branch office, I've configuring the devices step-by-step.

When I test the wan through a web based test site, each office's network speed shows a up/down 500Mbps.

When I run speed-test to public static ip address, it shows a following result.
For the server(CCR2004) and client(CCR1009) speed-test result shows up 458Mbps / down 486Mbps.
For the server(CCR1009) and client(CCR2004) speed-test result shows up 94.3Mbps / down 93.9Mbps.
I can't understand why the result is different by connection direction.

When I run speed-test to private local ip address through a EOIP/ipsec tunnel, it show a following result.
For the server(CCR2004) and client(CCR1009) speed-test result shows up 380Mbps / down 88.4Mbps.
For the server(CCR1009) and client(CCR2004) speed-test result shows up 88.3Mbps / down 380Mbps.
I can't understand why the result of direction from CCR2004 to CCR1009 is poor.

I ask for help.
Thank you.

[admin@BO Router] > /tool speed-test address={public ipaddr of HO Router}
              status: done
      time-remaining: 0s
    ping-min-avg-max: 6ms / 6.79ms / 8.17ms
  jitter-min-avg-max: 1us / 432us / 1.53ms
                loss: 0% (0/200)
        tcp-download: 486Mbps local-cpu-load:35%
          tcp-upload: 458Mbps local-cpu-load:16% remote-cpu-load:15%

[admin@HO Router] > /tool speed-test address={public ipaddr of BO Router}    
              status: done
      time-remaining: 0s
    ping-min-avg-max: 5.36ms / 6.23ms / 7.16ms
  jitter-min-avg-max: 0s / 518us / 1.35ms
                loss: 0% (0/200)
        tcp-download: 93.9Mbps local-cpu-load:3%
          tcp-upload: 94.3Mbps local-cpu-load:1% remote-cpu-load:6%

[admin@BO Router] > /tool speed-test address={local ipaddr of HO Router}
              status: done
      time-remaining: 0s
    ping-min-avg-max: 6.71ms / 7.71ms / 9.08ms
  jitter-min-avg-max: 4us / 479us / 1.84ms
                loss: 0% (0/200)
        tcp-download: 88.4Mbps local-cpu-load:13%
          tcp-upload: 380Mbps local-cpu-load:33% remote-cpu-load:22%

[admin@HO Router] > /tool speed-test address={local ipaddr of BO Router}
              status: done
      time-remaining: 0s
    ping-min-avg-max: 6.82ms / 7.63ms / 8.99ms
  jitter-min-avg-max: 1us / 561us / 2.02ms
                loss: 0% (0/200)
        tcp-download: 380Mbps local-cpu-load:26%
          tcp-upload: 88.3Mbps local-cpu-load:2% remote-cpu-load:14%

[admin@BO Router] > /system resource print
             uptime: 3w16h19m10s
            version: 6.46.8 (long-term)
         build-time: Oct/29/2020 08:29:55
        free-memory: 1633.9MiB
       total-memory: 1984.0MiB
                cpu: tilegx
          cpu-count: 9
      cpu-frequency: 1200MHz
           cpu-load: 1%
     free-hdd-space: 66.4MiB
    total-hdd-space: 128.0MiB
  architecture-name: tile
         board-name: CCR1009-8G-1S-1S+
           platform: MikroTik

[admin@HO Router] > /system resource print
             uptime: 1d4h30m38s
            version: 6.48 (stable)
         build-time: Dec/22/2020 11:20:49
   factory-software: 6.46.4
        free-memory: 1702.8MiB
       total-memory: 1792.0MiB
                cpu: ARMv7
          cpu-count: 4
      cpu-frequency: 1700MHz
           cpu-load: 0%
     free-hdd-space: 88.6MiB
    total-hdd-space: 129.0MiB
  architecture-name: arm64
         board-name: CCR2004-1G-12S+2XS
           platform: MikroTik

mkx · Tue Feb 16, 2021 10:13 am

/tool speed-test is quite heavy on router's CPU and can easily be bottleneck itself. So if you really want to check VPN throughput, use PCs connected to each router and run iperf test through routers and connection between them.

Other than that, both CCR2004 and CCR1009 support HW encryption for VPN, but they HW offload only part of ecryption algorithms and key lengths. Consult this table and make sure VPN encryption parameters are chosen so that both devices can offload encryption.

malas · Tue Feb 16, 2021 5:07 pm

After upgrade both devices into latest 6.48.1, all symptom has been cleared.
The speed-test to static public ip between the CCR2004 and the CCR1009 shows up/down 450Mbps for any direction.
And, the speed-test to local ip via EOIP/Ipsec tunnel shows up/down 180Mbps for any direction.

Thank you.

anav · Wed Feb 17, 2021 5:24 pm

That makes NO sense to me whatsoever.
If your real world ISP to both and routes inbetween yield 450Mbps between each device (and remember they are both capable of way more than 1gig of traffic in either direction SO ARE NOT THE LIMITING FACTORS) then your IPSEC should be almost exactly the same. This is due to the fact that both at Least a GIG of IPSEC SPEED. There should be no significant loss in throughput!!

malas · Thu Feb 18, 2021 11:01 am

As your reply, I tested again.

For speed-test in MT, about 450Mbps to public ip.
For speed-test in MT, about 450Mbps to local ip via EOIP.
For speed-test in MT, about 133Mbps to local ip via EOIP/Ipsec.
For iperf3 in local PC, about 450Mbps to local ip via EOIP.
For Iperf3 in local PC, about 220Mbps to local ip via EOIP/Ipsec.

speed-test between CCR2004 and CCR1009

speed-test between CCR2004 and CCR1009

Re: speed-test between CCR2004 and CCR1009

Re: speed-test between CCR2004 and CCR1009

Re: speed-test between CCR2004 and CCR1009

Re: speed-test between CCR2004 and CCR1009

Who is online