Community discussions

MikroTik App
 
sporkman
newbie
Topic Author
Posts: 26
Joined: Thu May 02, 2013 4:37 am

GRE tunnel performance?

Thu Aug 17, 2017 9:06 pm

Which model can get me 500Mb/s or more at about 40K PPS over a GRE tunnel? Any of them? I assume CCRs are out because GRE can't use multiple cores, right?

No encryption, No VPN, just a GRE tunnel.
 
User avatar
dgnevans
Member
Member
Posts: 465
Joined: Fri Mar 08, 2013 11:24 am
Location: Zimbabwe
Contact:

Re: GRE tunnel performance?

Thu Aug 17, 2017 9:56 pm

viewtopic.php?t=87892
I cannot find the forum post that discusses a fix to a re-ordering problem on tunnels using mutli-core. I believe it is resolved.
 
User avatar
doneware
Trainer
Trainer
Posts: 596
Joined: Mon Oct 08, 2012 8:39 pm
Location: Hungary

Re: GRE tunnel performance?

Thu Aug 17, 2017 10:08 pm

as long as there is no fragmentation in the game, packet reordering should have no practical effect, especially if fastrack is in play. it's just about stripping off the outer IP and GRE header and forwarding the encapsulated IP packet as it is towards its destination address. as far as i know routerOS does not support gre sequencing (at least it is not exposed to the cli, and i did not see any traces in my packet captures), so should be packets arriving in any particular order, they will be forwarded in the very same sequence - practically the router does not recognise they are not arriving in order. so it's the IP destination's job to buffer and handle the OO traffic.

but that's all theory and it depends how the code is written in RouterOS.
#TR0359
 
sporkman
newbie
Topic Author
Posts: 26
Joined: Thu May 02, 2013 4:37 am

Re: GRE tunnel performance?

Fri Aug 18, 2017 9:34 pm

So yesterday I was given an opportunity to test this. Our provider to one of our PoPs dropped our 1Gb/s metro-e link after a manhole fire. In the building, we were able to find someone with a GPON service that's setup for 500/500. We only have an L3 switch there, and the switch cannot do anywhere near line-rate GRE tunneling since it is totally in software and is an old PowerPC 405 chip (cisco 3750). We had a spare RB2011, so I configured that and set it up to tunnel between this location with the dead metro-e connection and our main PoP using this GPON connection. Our customers all have public IPs, so I couldn't simply NAT them to this GPON connection... Routing is now just static - at our main PoP I point the subnets to the tunnel, at the Mikrotik, the same statics are set to point to the switch. For the other direction, the best I could come up with was policy routing - I mark everything inbound on the port facing the building switch and then have a route that matches that mark to push that traffic back to the tunnel. This works, but I feel like there's probably a better way. Normally we use OSPF, but I've only used that on Cisco so this was the "I fully understand how this works, so I'm doing it this way method".

So performance - not horrible, but not great. Impressive for the hardware I guess though. Getting roughly 90/90 and the cap here seems to be packets/second, which is maxing around 10K.

Firewall rules are minimal - just management access rules for 8291, 22, 80, 443. The packet marking is a single mangle rule. Profiling tells me this:

Code: Select all

[admin@568-mik-pilot] > /tool profile duration=1m
NAME CPU USAGE
ethernet 8.5%
console 0.5%
firewall 56%
networking 30.5%
winbox 0%
management 0.5%
routing 0.5%
profiling 0.5%
telnet 0%
bridging 2.5%
unclassified 0%
total 99.5%
The other measurement I know of shows that almost all my CPU is in interrupt, which I'll admit I don't know what to make of on Mikrotik.

Code: Select all

[admin@568-mik-pilot] /system resource> cpu print
# CPU LOAD IRQ DISK
0 cpu0 80% 78% 0%
[admin@568-mik-pilot] /system resource> irq print
Flags: ro - read-only
# IRQ USERS CPU ACTIVE-CPU COUNT
0 4 switch0 auto 0 388 316 263
1 5 switch1 auto 0 0
2 16 beeper auto 0 2 005
3 116 usbler auto 0 0
[admin@568-mik-pilot] /system resource>
Any thoughts on this? Any hardware recommendations, as I do want to setup a permanent backup using this tunnel method.

I'm especially curious about my packet marking - if that's really a pig, I can probably figure out OSPF.
 
Ascendo
Frequent Visitor
Frequent Visitor
Posts: 67
Joined: Sun Sep 09, 2012 12:06 pm

Re: GRE tunnel performance?

Mon Aug 21, 2017 11:32 am

90/90 on a 2011 is impressive! RB1100AHx2/4 or CCR1009 should easily get you line rate, probably with encryption too.

Who is online

Users browsing this forum: ggayan and 93 guests