I am using a CRS312-4C+8XG as my main switch.
It is connected to two Proxmox servers via LACP.
On my Proxmox servers I run an OPNsense appliance for firewalling and intervlan routing.
I recently stumbled accross a strange behaviour regarding switching traffic: If I run iperf3 within the same VLAN I get near wire speed (~ 9.5 Gbit).
If I do VLAN routing via OPNsense I get around 5 Gbit but after some time the switch CPU gets to 100 % mostly at bridging and networking.
On CRS312 everything is HW offloaded.
The current config would be:
Code: Select all
# 2023-12-20 12:27:50 by RouterOS 7.13
# software id = BD85-SIEN
#
# model = CRS312-4C+8XG
# serial number = abc123
/interface bridge
add admin-mac=74:4D:28:B7:7C:A4 auto-mac=no fast-forward=no ingress-filtering=no name=bridge port-cost-mode=short priority=0x2000 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] l2mtu=1592 name=Desktop rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether7 ] l2mtu=1592 name="Mikrotik R1" rx-flow-control=auto tx-flow-control=auto
set [ find default-name=combo3 ] l2mtu=1592 name=ccr2004
set [ find default-name=combo1 ] l2mtu=1592 rx-flow-control=auto tx-flow-control=auto
set [ find default-name=combo2 ] l2mtu=1592 rx-flow-control=auto tx-flow-control=auto
set [ find default-name=combo4 ] l2mtu=1592 name=css326
set [ find default-name=ether2 ] l2mtu=1592 rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether3 ] l2mtu=1592 rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether4 ] l2mtu=1592 rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether5 ] l2mtu=1592 rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether6 ] l2mtu=1592 rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether8 ] l2mtu=1592 rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether9 ] l2mtu=1592 rx-flow-control=auto tx-flow-control=auto
/interface vlan
add interface=bridge name=vlan10 vlan-id=10
/interface bonding
add mode=802.3ad name=Proxmox1 slaves=ether5,ether6 transmit-hash-policy=layer-2-and-3
add mode=802.3ad name=Proxmox2 slaves=combo1,combo2 transmit-hash-policy=layer-2-and-3
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface ethernet switch port
set 1 l3-hw-offloading=no
set 2 l3-hw-offloading=no
set 3 l3-hw-offloading=no
set 4 l3-hw-offloading=no
set 5 l3-hw-offloading=no
set 6 l3-hw-offloading=no
set 7 l3-hw-offloading=no
set 8 l3-hw-offloading=no
set 9 l3-hw-offloading=no
set 10 l3-hw-offloading=no
set 11 l3-hw-offloading=no
set 12 l3-hw-offloading=no
/interface list
add name=WAN
add name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
add hotspot-address=192.168.10.248 html-directory=flash/hotspot name=hsprof1
/port
set 0 name=serial0
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/caps-man manager
set enabled=yes upgrade-policy=suggest-same-version
/interface bridge port
add bridge=bridge interface=Mathias-Desktop internal-path-cost=10 path-cost=10 pvid=10
add bridge=bridge interface=ccr2004 internal-path-cost=10 path-cost=10
add bridge=bridge interface=css326 internal-path-cost=10 path-cost=10
add bridge=bridge frame-types=admit-only-vlan-tagged interface=Proxmox1 internal-path-cost=10 path-cost=10
add bridge=bridge frame-types=admit-only-vlan-tagged interface=Proxmox2 internal-path-cost=10 path-cost=10
add bridge=bridge interface=vlan10 pvid=10
add bridge=bridge interface="Mikrotik R1" internal-path-cost=10 path-cost=10
/interface ethernet switch l3hw-settings
set ipv6-hw=yes
/ip neighbor discovery-settings
set discover-interface-list=none
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set max-neighbor-entries=8192
/interface bridge vlan
add bridge=bridge tagged=bridge,vlan10,Proxmox1,Proxmox2,ccr2004,css326 vlan-ids=10
add bridge=bridge tagged="bridge,Proxmox1,Proxmox2,ccr2004,css326,Mikrotik R1" vlan-ids=11
add bridge=bridge tagged="bridge,Proxmox1,Proxmox2,ccr2004,css326,Mikrotik R1" vlan-ids=20
add bridge=bridge tagged="bridge,Proxmox1,Proxmox2,ccr2004,css326,Mikrotik R1" vlan-ids=30
add bridge=bridge tagged="bridge,Proxmox1,Proxmox2,ccr2004,css326,Mikrotik R1" vlan-ids=31
add bridge=bridge tagged="bridge,Proxmox1,Proxmox2,ccr2004,css326,Mikrotik R1" vlan-ids=90
add bridge=bridge tagged="bridge,Proxmox1,Proxmox2,ccr2004,css326,Mikrotik R1" vlan-ids=500
add bridge=bridge tagged="bridge,Proxmox1,Proxmox2,ccr2004,css326,Mikrotik R1" vlan-ids=450
/interface list member
add interface=ether9 list=LAN
add interface=Mathias-Desktop list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface="Mikrotik R1" list=LAN
add interface=ether8 list=LAN
add interface=combo1 list=LAN
add interface=combo2 list=LAN
add interface=ccr2004 list=LAN
add interface=css326 list=LAN
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=192.168.10.248/24 interface=vlan10 network=192.168.10.0
/ip cloud
set update-time=no
/ip dhcp-client
add comment=defconf disabled=yes interface=bridge
/ip dns
set servers=192.168.10.103,192.168.10.104,192.168.101.170
/ip hotspot user
add name=user1
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.10.254
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set www-ssl tls-version=only-1.2
set api address=192.168.20.50/32
set api-ssl disabled=yes
/ip ssh
set host-key-size=4096 strong-crypto=yes
/ipv6 nd
set [ find default=yes ] advertise-dns=no interface=vlan10
add advertise-dns=no
/system clock
set time-zone-name=Europe/Vienna
/system identity
set name=Switch-CRS312
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=pool.ntp.org
/system routerboard settings
set auto-upgrade=yes boot-os=router-os
/system scheduler
add interval=1d name="schedule update" on-event="/system package update\r\
\ncheck-for-updates once\r\
\n:delay 3s;\r\
\n:if ( [get status] = \"New version is available\") do={ install }" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2022-04-18 start-time=03:00:00
/tool bandwidth-server
set authenticate=no
For comparsion I did also run some tests on my CCR2004 router which is in general in front of my OPNsense firewall.
With that routing config CRS312 is not getting to 100 % but CCR2004 does (which is kinda expected).
Anyone got ideas why my switch is having troubles with handling L3 traffic which is not being routed by itself?