After upgrade from 6.47.8 IPSEC-IKEV2 from windows 10 client -> mikrotik CCR 1009 using eap-radius stopped working. After downgrade everything works fine again. RADIUS sends access-accept, windows client tries connecting for some time than just times out. No errors in mikrotik. Just doesn't work. D...

After upgrade from 6.47.8 IPSEC-IKEV2 from windows 10 client -> mikrotik CCR 1009 using eap-radius stopped working. After downgrade everything works fine again. RADIUS sends access-accept, windows client tries connecting for some time than just times out. No errors in mikrotik. Just doesn't work. Do...

I had chance to do some more comparisons and tests and it seems that it's specific Tile issue. With 2 rb4011 (arm32) with same config I had consistent throughput with parallel streams in the 550 Mb/s range with GRE over IPSEC. Replacing one rb4011 with ccr 1009, same config - one side dropped to 300...

I asked around some people and also at reddit (I copy/pasted now text below), yet still I didn't found the reason for this behaviour. I made today another test (I got my hands on new rb4011). I took one CCR1009 and RB4011 - reset config (no default) - both upgraded to latest stable (6.46.6) and firm...

After some searching I found this topic on these forums, which explains a bit more how IPSEC should be handled by the CCR with - probably - some sort of ip/port src-dst based on peer. https://forum.mikrotik.com/viewtopic.php?t=140855 This would certainly explain why from side B to side A in my tests...

I tried different variants: IPIP with IPSEC GRE with IPSEC EOIP with IPSEC pure IPSEC and in every case I have very similar results (only difference being "max single connection throughput" but that's not an issue right here). without IPSEC I'm getting paralel streams spread across cores i...

My issue - that I realised after my initial post - is that from one side of the tunel number of connections doesn't matter - it's capped up to a single stream. I've done some more tests and I still have no idea why and what is the actual expected behaviour. As I said, both sides of the tunel are equ...

I've done some more testing/firewall tweaking and I've got some better results but also stumbled upon issue - which someone might maybe sched some light on? 1) I managed to reach up to 350 Mb/s in "pure" IPSEC (tunnel mode, no tunneling protocols like IPIP/EOIP) in single TCP stream (both ...

I knew that for single tunnel only 1 core will be used, what I don't fully understand is that why my "numbers" differ so much from the datasheet for single tunnel and why my CPU won't even max out. If I run "just" IPIP tunnel (no IPSEC encryption on top of it) i can push using ip...

My tests are also through the router and can't achieve so far anything above 220-ish Mb/s. For single connection (one client PC using tunnel for iperf and or file transfers from server behind other tunnel end) I see 2 cores being used at they're being used at around 70-80% max. I've been doing tests...

Hello, [at the bottom is the TL,DR...] I'm trying to figure out what I might be doing wrong with my IPSEC setup, as I get much lower throughput than "advertised" and uplink is capable. scenario 1) For test purposes I have: left side: file server / iperf3 server -> mikrotik ccr 1009-7g-1s-1...

I did check again, if after any of the updates somehow magically it will start working, but no. ROS 6.42.3, latest freeradius (3.0.17) and windows 10 (1803) client, everything looks the same. IKEV2 with eap-only, using certificate signed by another self-signed (untrusted) CA. CA is added to windows ...

Hello, I'm sorry to say that I did not. I was hoping that someone might have some answer here on the boards :). I've tried again after going up to win 10 1803 and with most recent freeradius/MT versions but everything seems the same. I'll try again with windows 7 client, when I get a hold on one, to...

Hello, I'm having issues with SSTP on mikrotik (version 6.41.3, CCR 1009) with freeradius 3.0.14 as backend.I'm testing with windows 10 client. SSTP with "local" users works just fine, i'm using certificate signed by well-trusted CA (geotrust), no issues there. Issues arise when I try to a...

Right now I'm using 6.39 (stable) and eap-radius for ikev2 still doesn't seem to work. For sstp it works without any issues. For IKEV2 RADIUS server receives request, sents "acceps-accept", which Mikrotik receives (in MT log I clearly see "received access-accept" with all relevan...

I did manage to get ikev2 with rsa signature running, but I'd much rather go for the eap radius authentication. I've been trying to make it work, but I can't seem to do it. I'm tryng to connect using android with strongswan client. Using "certificate" works OK, but when I change to "e...