Hello.
After update RB2011UiAS-2HnD-IN on 6.35.2 or 6.36 inbound speed became slower at L2TP/IPsec (AES256 + SHA1):
http://www.speedtest.net/result/5349439075.png (CPU 60% when downloading)
On version 6.32.2:
http://www.speedtest.net/result/5349455563.png (CPU 100% when downloading)

Any ideas why so?

please check profile in tools then put photo here

Downloading: Uploading:

how many L2TP Client do you have ?

I have 1 client (on router), VPN server is VDS with Softether. Devices in local network 3, but if all devices except one is powered off, than nothing change.

Try use aes128


Have a good day!

If you need crypto on any of the mips routers, use aes128 with md5. You don't have a lot of power to work with. If I recall correctly, you are going to max out at 20mbps, with little to no rules. The RB3011 (current no crypto acceleration) will do 150mbps (I would expect 300mbps once acceleration is enabled). CCR is much higher.

Thank you. But why an old version of firmware it work with AES-256 on 24 mbps, but on current 14 mbps? Why downloading doesn't load fully CPU, when uploading do that? If CPU weak why uploading with AES-256 give 20 mbps?

I would assume it is because something changed in the firmware and the CPU is doing more work now. 
As for CPU load, that is because the encryption process takes more CPU power than the decryption process.
You should also look into using FastTrack on the VPN connections and the data that passes through them.
That will help reduce the CPU load.

I make video demonstration: In my logic if decryption need less CPU power, it must pass more data.
About FastTrack - where I can tune it?

Indeed, after the firmware update, there is no CPU load to 100%
The speed through l2tp lower than was specified person firmware.
Several times already met such comments on the forum.

I checked older versions and found, that last working version was 6.34.4. Video:
6.34.4: https://www.youtube.com/watch?v=-NlQYavQ78Y
6.35: https://www.youtube.com/watch?v=J0WTUJFkRJ0