Hello,

I will expose my situation, maybe someone could have the solution:

LAN 1 / LAN 2 are in indifferent locations and are connected by l2tp/ipsec. The bandwith test between both routers is aroud 400 Mbps UDP, send and receive, MTU 1380.

LAN1 (rb1100) has virtual servers running on DELL with vmware, linux and windows and also terminals connected direct to the router.

LAN2 has just the rb4011 router with one synology NAS and one laptop.

If I copy a file from a windows laptop from LAN 1 to the synology of LAN 2, the speed is aroud 350 Mbps.

If I copy from the synology of LAN 2 to the windows laptop of LAN 1, no more than 50 Mbps.

If I backup a VM from LAN 1 to the synology of LAN 2 the speed is around 50 Mbps.

How can I use the full tunnel speed?

Thanks

How can I use the full tunnel speed?

Thanks

Ipsec requires strong cpu.
https://help.mikrotik.com/docs/display/ ... celeration
You should use hardware acceleration.
E.g. top speed for ipsec for 4011 according to perf specs:
https://mikrotik.com/product/rb4011igs_ ... estresults
AES-128-CBC + SHA1 is for top speed.
I normally use 1024 or 2048 modp.

Unfortunately you did not specify the exact model of your 1100
AHx2 is pretty fast:
https://mikrotik.com/product/RB1100AHx2 ... estresults
AES-128-CBC + SHA1 is for top speed
AHx4 even faster
https://mikrotik.com/product/rb1100ahx4 ... estresults
AES-128-CBC + SHA1 is for top speed


So set appropriate hw accelerated ciphers , unset unsupported.
1. Ip-ipsec-proposals. Check all proposals.
2. Ip-ipsec-profiles. Check all profiles.

Older rb1100 modifications are very slow for ipsec.
You should use same mtu on both sides.
(I use mtu=1400 , and perf tests as well)