Page 1 of 1

GRE tunnel performance?

Posted: Thu Aug 17, 2017 9:06 pm
by sporkman
Which model can get me 500Mb/s or more at about 40K PPS over a GRE tunnel? Any of them? I assume CCRs are out because GRE can't use multiple cores, right?

No encryption, No VPN, just a GRE tunnel.

Re: GRE tunnel performance?

Posted: Thu Aug 17, 2017 9:56 pm
by dgnevans
I cannot find the forum post that discusses a fix to a re-ordering problem on tunnels using mutli-core. I believe it is resolved.

Re: GRE tunnel performance?

Posted: Thu Aug 17, 2017 10:08 pm
by doneware
as long as there is no fragmentation in the game, packet reordering should have no practical effect, especially if fastrack is in play. it's just about stripping off the outer IP and GRE header and forwarding the encapsulated IP packet as it is towards its destination address. as far as i know routerOS does not support gre sequencing (at least it is not exposed to the cli, and i did not see any traces in my packet captures), so should be packets arriving in any particular order, they will be forwarded in the very same sequence - practically the router does not recognise they are not arriving in order. so it's the IP destination's job to buffer and handle the OO traffic.

but that's all theory and it depends how the code is written in RouterOS.

Re: GRE tunnel performance?

Posted: Fri Aug 18, 2017 9:34 pm
by sporkman
So yesterday I was given an opportunity to test this. Our provider to one of our PoPs dropped our 1Gb/s metro-e link after a manhole fire. In the building, we were able to find someone with a GPON service that's setup for 500/500. We only have an L3 switch there, and the switch cannot do anywhere near line-rate GRE tunneling since it is totally in software and is an old PowerPC 405 chip (cisco 3750). We had a spare RB2011, so I configured that and set it up to tunnel between this location with the dead metro-e connection and our main PoP using this GPON connection. Our customers all have public IPs, so I couldn't simply NAT them to this GPON connection... Routing is now just static - at our main PoP I point the subnets to the tunnel, at the Mikrotik, the same statics are set to point to the switch. For the other direction, the best I could come up with was policy routing - I mark everything inbound on the port facing the building switch and then have a route that matches that mark to push that traffic back to the tunnel. This works, but I feel like there's probably a better way. Normally we use OSPF, but I've only used that on Cisco so this was the "I fully understand how this works, so I'm doing it this way method".

So performance - not horrible, but not great. Impressive for the hardware I guess though. Getting roughly 90/90 and the cap here seems to be packets/second, which is maxing around 10K.

Firewall rules are minimal - just management access rules for 8291, 22, 80, 443. The packet marking is a single mangle rule. Profiling tells me this:

Code: Select all

[admin@568-mik-pilot] > /tool profile duration=1m
ethernet 8.5%
console 0.5%
firewall 56%
networking 30.5%
winbox 0%
management 0.5%
routing 0.5%
profiling 0.5%
telnet 0%
bridging 2.5%
unclassified 0%
total 99.5%
The other measurement I know of shows that almost all my CPU is in interrupt, which I'll admit I don't know what to make of on Mikrotik.

Code: Select all

[admin@568-mik-pilot] /system resource> cpu print
0 cpu0 80% 78% 0%
[admin@568-mik-pilot] /system resource> irq print
Flags: ro - read-only
0 4 switch0 auto 0 388 316 263
1 5 switch1 auto 0 0
2 16 beeper auto 0 2 005
3 116 usbler auto 0 0
[admin@568-mik-pilot] /system resource>
Any thoughts on this? Any hardware recommendations, as I do want to setup a permanent backup using this tunnel method.

I'm especially curious about my packet marking - if that's really a pig, I can probably figure out OSPF.

Re: GRE tunnel performance?

Posted: Mon Aug 21, 2017 11:32 am
by Ascendo
90/90 on a 2011 is impressive! RB1100AHx2/4 or CCR1009 should easily get you line rate, probably with encryption too.