So yesterday I was given an opportunity to test this. Our provider to one of our PoPs dropped our 1Gb/s metro-e link after a manhole fire. In the building, we were able to find someone with a GPON service that's setup for 500/500. We only have an L3 switch there, and the switch cannot do anywhere near line-rate GRE tunneling since it is totally in software and is an old PowerPC 405 chip (cisco 3750). We had a spare RB2011, so I configured that and set it up to tunnel between this location with the dead metro-e connection and our main PoP using this GPON connection. Our customers all have public IPs, so I couldn't simply NAT them to this GPON connection... Routing is now just static - at our main PoP I point the subnets to the tunnel, at the Mikrotik, the same statics are set to point to the switch. For the other direction, the best I could come up with was policy routing - I mark everything inbound on the port facing the building switch and then have a route that matches that mark to push that traffic back to the tunnel. This works, but I feel like there's probably a better way. Normally we use OSPF, but I've only used that on Cisco so this was the "I fully understand how this works, so I'm doing it this way method".
So performance - not horrible, but not great. Impressive for the hardware I guess though. Getting roughly 90/90 and the cap here seems to be packets/second, which is maxing around 10K.
Firewall rules are minimal - just management access rules for 8291, 22, 80, 443. The packet marking is a single mangle rule. Profiling tells me this:
Code: Select all
[admin@568-mik-pilot] > /tool profile duration=1m
NAME CPU USAGE
The other measurement I know of shows that almost all my CPU is in interrupt, which I'll admit I don't know what to make of on Mikrotik.
Code: Select all
[admin@568-mik-pilot] /system resource> cpu print
# CPU LOAD IRQ DISK
0 cpu0 80% 78% 0%
[admin@568-mik-pilot] /system resource> irq print
Flags: ro - read-only
# IRQ USERS CPU ACTIVE-CPU COUNT
0 4 switch0 auto 0 388 316 263
1 5 switch1 auto 0 0
2 16 beeper auto 0 2 005
3 116 usbler auto 0 0
[admin@568-mik-pilot] /system resource>
Any thoughts on this? Any hardware recommendations, as I do want to setup a permanent backup using this tunnel method.
I'm especially curious about my packet marking - if that's really a pig, I can probably figure out OSPF.