Hello,

I have problem with my CRS125 and ethernet throughput. I can reach roughly 50mbit/s to my WAN port. I'm having NAT in WAN, I have enabled fasttrack and changed WAN port queue type to ethernet-default. CPU load is about 30-40% and still I can't reach even close of my Internet connection speed (250mbit/s). With btest from CRS125 I can reach up to 100mbit/s to public btest server.

What have I been missed? What should I check? What could cause poor throughput?

Well - the CRS is a switch...

Use a router for routing!

Well - the CRS is a switch...

Use a router for routing!

Could not agree more

Well - the CRS is a switch...

Use a router for routing!

Not sure that's particularly helpful!
The data sheet says 689.8 Mbps when routing with 1500 byte packets and 25 ip filter rules, so there's a reasonable expectation of above 50M.

Presume the OP has checked that it's definitely the CRS causing this - you can get 250Mbps when you use a different router?

Yes. I can reach 250mbit/s by connecting my laptop directly to my ISP ethernet connector.

I tested a crs125 in our network (we use them for management switches in pops) and got 170Mbps up and down using the google speed test.
It's using NAT and has 10 ip firewall filter rules and fast track is not enabled.
It maxed out the cpu (>95%) for the test, so I guess that's about the limit.

As a test, I enabled fasttrack and the speed went up to over 400M.

The interface queue type is the default "only-hardware-queue".

So I guess you have something in your config inhibiting performance.

I have problem with my CRS125 and ethernet throughput. I can reach roughly 50mbit/s to my WAN port. I'm having NAT in WAN, I have enabled fasttrack and changed WAN port queue type to ethernet-default. CPU load is about 30-40% and still I can't reach even close of my Internet connection speed (250mbit/s). With btest from CRS125 I can reach up to 100mbit/s to public btest server.

What have I been missed? What should I check? What could cause poor throughput?

Are you btesting to the CRS125 ? you should always btest through it to another device.

CRS125 is at heart a switch with some routing functionality, you shouldn't expect too much from it. Best I have ever had was 125Mb throughput but that was without fast track.

Btest is an inefficient beast as well, you'd be better iPerfing through the router rather than in/out of it due to it's very low powered CPU.

It should be able to handle about 250/250 or 500/50 with fast track. It is similar to the RB2011.

So I guess you have something in your config inhibiting performance.

Definitely but what could it be? I have tested everything what has been suggested but nothing helps

If you have more than one bridge, it should drag.

Are you doing switching in hardware?

I have only one bridge and VLAN switching is done in hw .

Are you routing VLANs?

Yes I am. I have also NAT on my WAN interface.

Inter VLAN routing (not talking about routing to the WAN) would use the CPU. There's also only a 1Gbps link between the CPU and the switch chip.

As said, CPU load doesn't exceed 40%

You could still get bottle-necked by the CPU-switch link.

Do your ports show H in the Bridge pages?

Yes, each physical port has H.

You must not btest from the CRS, It is misleading.

I made a Ookla speedtest (http://www.speedtest.net/) and it gives 250mbit/s if I bypass CRS125. Behind switch I can roughly reach 50mbit/s

I made a Ookla speedtest (http://www.speedtest.net/) and it gives 250mbit/s if I bypass CRS125. Behind switch I can roughly reach 50mbit/s

Can you post your config?

Not sure what u are (not) doing with ur devices, but my rb2011´s are maxed out at about 35MBit with my configuration. So I would tend to think about adding a hap ac2 or similar as a router and you should be happy.

Here is my config. I tried to remove all confidental data. Hope I succeed.

Edit: Remove config. Not relevant

You need a ROUTER not a SWITCH WITH L3 CAPABILITY.
Your config is far beyond what I would ever want to deploy onto a CRS125, you are asking too much of it.

So, I have too much firewall rules and/or too much VLAN routing?

So, I have too much firewall rules and/or too much VLAN routing?

Yes.

Which one would be recommended? Small physical size would be good for me...

Which one would be recommended? Small physical size would be good for me...

Where is your budget at? A hAP AC2 could do what you want but so could a CCR1009. Budget plays a part.
I take it the CRS125 can be reused as a switch if you need that many ethernet ports?

Hap ac would be more suitable for my budget.

Maybe this then?
https://mikrotik.com/product/hap_ac2

Im just wondering why my cpu load is so low? shouldn't it be close to 100%?

I think some of your problem is that you are passing your bridge traffic through the IP firewall.
This will definitely slow everything down.
Since you are using vlans, you probably don't need to do this. Just do the firewalling at the point that traffic crosses vlans - unless you need security between lan devices in the same vlan.

Like I said before, I got over 400Mbps throughput on one of these boxes, despite having firewall rules and nat.

is your problem - so basically no fastpath and fasttrack.

Hmm.. Couldn't found that setting from web interface...

It is under WebFig > Bridge > Settings. Nevertheless, you can always open console via Console button in upper right corner.

Since you are using vlans, you probably don't need to do this. Just do the firewalling at the point that traffic crosses vlans - unless you need security between lan devices in the same vlan.

Traffic crosses VLANs in this device

Since you are using vlans, you probably don't need to do this. Just do the firewalling at the point that traffic crosses vlans - unless you need security between lan devices in the same vlan.

Traffic crosses VLANs in this device

I'm sure it does, but do you need to filter traffic in the same vlan? If it's only necessary to firewall between vlans then you don't need this.

I'm little bit confused now with interfaces, bridges and switches. If switch handles packet forwarding (L2) from port to port and to cpu also. Cpu is handling L3 packet filtering. Where do I need bridge, what is the functionality of it?

Bridge is like a switch (L2 as well), but implemented in software (so it bogs CPU) and can span different technologies (such as ethernet, wireless, sw interdaces like PPP endpoints or VLAN interfaces, ...)

So I wont probably need any bridge interfaces if I don't want to bridge PPP or similar interface directly to any other interface? May I remove bridge completely? Or can I remove just physical interfaces from it?

This maybe also might be related to another problem with hap ac performance. I have few different SSID in my hap ac. All wifi networks are managed from CRS125 with CAPSMAN. Every wifi network is in a separate VLAN. Maximum throughput I can reach via wifi is roughly down 20mbit/s and upstream 40-50mbit/s. It doesn't have anything related with rf because all channels are free only for my usage and distance from AP doesn't matter. Could this be related to CAPSMAN + wifi bound to VLAN + bridge?

A couple of us have already given you the solution....

You need a bridge - with Mikrotik software, most of the layer 2 stuff is now done through the bridge interface. The "H" you see when "/int bridge port print" shows that as much layer2 as possible is handed off to the switch chip, but the bridge config is still required.

What you don't need is to pass all of the layer 2 traffic through the firewall rules. This stops the hardware offload.
You can still have your firewall rules for traffic going between different vlans or to the internet.

So, turn this off: https://wiki.mikrotik.com/wiki/Manual:I ... e_Settings

This will result in higher throughput.

That setting helps and I get full throughput via ethernet ports of CRS125.

Probelm with wifi isn't probably related to this or bridging. Let's have another thread for it. Case closed and Thanks!