ragepw
Mar 21, 2016, updated at 07:17:10 (UTC)
view1938
view3
0
Goto Top

CRS226-24G-2SRM Performance zu langsam

GermansolvedQuestionMikroTikOther systems
Hallo alle miteinander,

habe hier zuhause einen Mikrotik CRS226 für unsere Netzwerkverteilung. Leider zeigt dieser eine deutlich zu niederige Performace in Bandbreit / Datendurchsatz. Iperf / Jperf Messung zeigt eine maximale Bandbreite von nur ca. 40 MBit/s an. Bei einem Backup eines Rechners auf den Fileserver, werden max. 4,5MB/s von Windows erreicht und die CPU des Mikrotik Routers ist dann bei 100% Auslastung. Auch das testweise vollständige deaktivieren der Firewall, brachte keine messbare Verbessung. Im Werkszustand (Switching) gibt es keine Leistungsprobleme.
Hab den Switch ca. 1 Monat lang per Learning by Doing konfiguriert, aber hier komme ich leider meinen bescheiden Kenntnissen nicht weiter. Liegt die schwache Performance an meiner Config oder kann die Hardware soviel Routing nicht ab?

hänge hier mal einen Teil der Config an:

# mar/21/2016 07:49:11 by RouterOS 6.34.3
# software id = EZVN-0000
#
/interface ethernet
set [ find default-name=ether1 ] name=e1wan
set [ find default-name=ether2 ] name=e2master
set [ find default-name=ether3 ] master-port=e2master
set [ find default-name=ether4 ] master-port=e2master
set [ find default-name=ether5 ] master-port=e2master
set [ find default-name=ether6 ] master-port=e2master
set [ find default-name=ether7 ] master-port=e2master
set [ find default-name=ether8 ] master-port=e2master
set [ find default-name=ether9 ] master-port=e2master
set [ find default-name=ether10 ] master-port=e2master
set [ find default-name=ether11 ] master-port=e2master
set [ find default-name=ether12 ] master-port=e2master
set [ find default-name=ether13 ] master-port=e2master
set [ find default-name=ether14 ] master-port=e2master
set [ find default-name=ether15 ] master-port=e2master
set [ find default-name=ether16 ] master-port=e2master
set [ find default-name=ether17 ] master-port=e2master
set [ find default-name=ether18 ] master-port=e2master
set [ find default-name=ether19 ] master-port=e2master
set [ find default-name=ether20 ] master-port=e2master
set [ find default-name=ether21 ] master-port=e2master
set [ find default-name=ether22 ] master-port=e2master
set [ find default-name=ether23 ] master-port=e2master
set [ find default-name=ether24 ] master-port=e2master
/interface vlan
add interface=e2master name=vlan20_voip vlan-id=20
add interface=e2master name=vlan30_drucker vlan-id=30
add interface=e2master name=vlan40_server vlan-id=40
add interface=e2master name=vlan50_IPTV vlan-id=50
add interface=e2master name=vlan60_audio vlan-id=60
add interface=e2master name=vlan70_haustechnik vlan-id=70
add interface=e2master name=vlan80_kameras vlan-id=80
add interface=e2master name=vlan90_wlan vlan-id=90
add interface=e2master name=vlan100_wlan_gaeste vlan-id=100
add interface=e2master name=vlan110_pc vlan-id=110
/interface ethernet switch egress-vlan-tag
add tagged-ports=switch1-cpu vlan-id=10
add tagged-ports=switch1-cpu,e2master vlan-id=20
add tagged-ports=switch1-cpu vlan-id=30
add tagged-ports=switch1-cpu vlan-id=40
add tagged-ports=switch1-cpu vlan-id=50
add tagged-ports=switch1-cpu vlan-id=60
add tagged-ports=switch1-cpu vlan-id=70
add tagged-ports=switch1-cpu,e2master vlan-id=80
add tagged-ports=switch1-cpu,e2master vlan-id=90
add tagged-ports=switch1-cpu,e2master vlan-id=100
add tagged-ports=switch1-cpu vlan-id=110
/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=110 ports=ether22
add customer-vid=0 new-customer-vid=30 ports=ether6
add customer-vid=0 new-customer-vid=40 ports=ether24
add customer-vid=0 new-customer-vid=70 ports=ether4,ether23,ether3
add customer-vid=0 new-customer-vid=50 ports=ether12,ether21
/interface ethernet switch port
set 0 dscp-based-qos-dscp-to-dscp-mapping=no
set 1 dscp-based-qos-dscp-to-dscp-mapping=no
set 2 dscp-based-qos-dscp-to-dscp-mapping=no
set 3 dscp-based-qos-dscp-to-dscp-mapping=no
set 4 dscp-based-qos-dscp-to-dscp-mapping=no
set 5 dscp-based-qos-dscp-to-dscp-mapping=no
set 6 dscp-based-qos-dscp-to-dscp-mapping=no
set 7 dscp-based-qos-dscp-to-dscp-mapping=no
set 8 dscp-based-qos-dscp-to-dscp-mapping=no
set 9 dscp-based-qos-dscp-to-dscp-mapping=no
set 10 dscp-based-qos-dscp-to-dscp-mapping=no
set 11 dscp-based-qos-dscp-to-dscp-mapping=no
set 12 dscp-based-qos-dscp-to-dscp-mapping=no
set 13 dscp-based-qos-dscp-to-dscp-mapping=no
set 14 dscp-based-qos-dscp-to-dscp-mapping=no
set 15 dscp-based-qos-dscp-to-dscp-mapping=no
set 16 dscp-based-qos-dscp-to-dscp-mapping=no
set 17 dscp-based-qos-dscp-to-dscp-mapping=no
set 18 dscp-based-qos-dscp-to-dscp-mapping=no
set 19 dscp-based-qos-dscp-to-dscp-mapping=no
set 20 dscp-based-qos-dscp-to-dscp-mapping=no
set 21 dscp-based-qos-dscp-to-dscp-mapping=no
set 22 dscp-based-qos-dscp-to-dscp-mapping=no
set 23 dscp-based-qos-dscp-to-dscp-mapping=no
set 24 dscp-based-qos-dscp-to-dscp-mapping=no
set 25 dscp-based-qos-dscp-to-dscp-mapping=no
set 26 dscp-based-qos-dscp-to-dscp-mapping=no
/interface ethernet switch vlan
add ports=switch1-cpu,e2master vlan-id=80
add ports=switch1-cpu,e2master vlan-id=20
add ports=switch1-cpu,e2master vlan-id=90
add ports=switch1-cpu,e2master vlan-id=100
/interface ovpn-server server
set auth=sha1 certificate=mikrotik.crt_0 cipher=aes256 default-profile=\
    openvpn enabled=yes max-mtu=1492 port=443 require-client-certificate=yes


# mar/21/2016 07:04:21 by RouterOS 6.34.3
# software id = EZVN-0000
#
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=dhcp ranges=10.10.10.1-10.10.10.98
add name=dhcp_pool2 ranges=10.10.20.2-10.10.20.254
add name=dhcp_pool3 ranges=10.10.30.2-10.10.30.254
add name=dhcp_pool4 ranges=10.10.40.2-10.10.40.254
add name=dhcp_pool5 ranges=10.10.50.2-10.10.50.254
add name=dhcp_pool6 ranges=10.10.60.2-10.10.60.254
add name=dhcp_pool7 ranges=10.10.70.2-10.10.70.254
add name=dhcp_pool8 ranges=10.10.80.2-10.10.80.254
add name=dhcp_pool9 ranges=10.10.90.2-10.10.90.254
add name=dhcp_pool10 ranges=10.10.100.2-10.10.100.254
add name=opvn4 ranges=10.10.200.13-10.10.200.14
add name=dhcp_pool11 ranges=\
    10.10.110.1-10.10.110.99,10.10.110.101-10.10.110.254
add name=dhcp_pool12 ranges=10.10.99.1-10.10.99.99,10.10.99.101-10.10.99.254
add name=dhcp_pool13 ranges=192.168.1.2-192.168.1.254
add name=opvn3 next-pool=opvn4 ranges=10.10.200.9-10.10.200.10
add name=opvn2 next-pool=opvn3 ranges=10.10.200.5-10.10.200.6
add name=ovpn1 next-pool=opvn2 ranges=10.10.200.1-10.10.200.2
/ip address
add address=10.10.10.100/24 interface=e2master network=10.10.10.0
add address=10.10.20.100/24 interface=vlan20_voip network=10.10.20.0
add address=10.10.30.100/24 interface=vlan30_drucker network=10.10.30.0
add address=10.10.40.100/24 interface=vlan40_server network=10.10.40.0
add address=10.10.50.100/24 interface=vlan50_IPTV network=10.10.50.0
add address=10.10.60.100/24 interface=vlan60_audio network=10.10.60.0
add address=10.10.70.100/24 interface=vlan70_haustechnik network=10.10.70.0
add address=10.10.80.100/24 interface=vlan80_kameras network=10.10.80.0
add address=10.10.90.100/24 interface=vlan90_wlan network=10.10.90.0
add address=10.10.100.100/24 interface=vlan100_wlan_gaeste network=\
    10.10.100.0
add address=10.10.110.100/24 interface=vlan110_pc network=10.10.110.0
/ip dhcp-client
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no \
    interface=e1wan
/ip dhcp-server
add address-pool=dhcp_pool2 disabled=no interface=vlan20_voip lease-time=1d \
    name=dhcp2
add address-pool=dhcp_pool3 disabled=no interface=vlan30_drucker lease-time=\
    1d name=dhcp3
add address-pool=dhcp_pool4 disabled=no interface=vlan40_server lease-time=1d \
    name=dhcp4
add address-pool=dhcp_pool5 disabled=no interface=vlan50_IPTV lease-time=1d \
    name=dhcp5
add address-pool=dhcp_pool6 disabled=no interface=vlan60_audio lease-time=1d \
    name=dhcp6
add address-pool=dhcp_pool7 disabled=no interface=vlan70_haustechnik \
    lease-time=1d name=dhcp7
add address-pool=dhcp_pool8 disabled=no interface=vlan80_kameras lease-time=\
    1d name=dhcp8
add address-pool=dhcp_pool9 disabled=no interface=vlan90_wlan lease-time=1d \
    name=dhcp9
add address-pool=dhcp_pool10 disabled=no interface=vlan100_wlan_gaeste \
    lease-time=1d name=dhcp10
add address-pool=dhcp_pool11 disabled=no interface=vlan110_pc lease-time=1d \
    name=dhcp11
/ip dhcp-server lease
add address=10.10.30.1 client-id=**:**:**:**:**:** mac-address=\
    **:**:**:**:**:** server=dhcp3
add address=10.10.40.1 mac-address=**:**:**:**:**:** server=dhcp4
add address=10.10.70.1 client-id=**:**:**:**:**:** mac-address=\
    **:**:**:**:**:** server=dhcp7
add address=10.10.70.2 client-id=**:**:**:**:**:** comment=UVR1611 \
    mac-address=**:**:**:**:**:** server=dhcp7
add address=10.10.10.101 client-id=**:**:**:**:**:** mac-address=\
    **:**:**:**:**:**
add address=10.10.80.1 client-id=**:**:**:**:**:** comment=\
    "Cam \FCber Haust\FCr" mac-address=**:**:**:**:**:** server=dhcp8  
add address=10.10.20.1 mac-address=**:**:**:**:**:** server=dhcp2
add address=10.10.20.5 mac-address=**:**:**:**:**:** server=dhcp2
add address=10.10.90.10 client-id=**:**:**:**:**:** mac-address=\
    **:**:**:**:**:** server=dhcp9
/ip dhcp-server network
add address=10.10.10.0/24 dns-server=10.10.10.100 gateway=10.10.10.100
add address=10.10.20.0/24 dns-server=10.10.20.100 gateway=10.10.20.100
add address=10.10.30.0/24 dns-server=10.10.30.100 gateway=10.10.30.100
add address=10.10.40.0/24 dns-server=10.10.40.100 gateway=10.10.40.100
add address=10.10.50.0/24 dns-server=10.10.50.100 gateway=10.10.50.100 \
    wins-server=10.10.40.1
add address=10.10.60.0/24 dns-server=10.10.60.100 gateway=10.10.60.100
add address=10.10.70.0/24 dns-server=10.10.70.100 gateway=10.10.70.100
add address=10.10.80.0/24 dns-server=10.10.80.100 gateway=10.10.80.100
add address=10.10.90.0/24 dns-server=10.10.90.100 gateway=10.10.90.100 \
    wins-server=10.10.40.1
add address=10.10.100.0/24 dns-server=10.10.100.100 gateway=10.10.100.100
add address=10.10.110.0/24 dns-server=10.10.110.100 gateway=10.10.110.100 \
    wins-server=10.10.40.1
add address=192.168.1.0/24 gateway=192.168.1.1
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add chain=input connection-state=established
add chain=input connection-state=related
add chain=input disabled=yes in-interface=*1B
add chain=input in-interface=vlan20_voip
add chain=input in-interface=vlan40_server
add chain=input in-interface=vlan50_IPTV
add chain=input in-interface=vlan70_haustechnik
add chain=input in-interface=vlan80_kameras
add chain=input in-interface=vlan90_wlan
add chain=input in-interface=vlan100_wlan_gaeste
add chain=input in-interface=vlan110_pc
add chain=input comment=OpenVPN dst-port=443 protocol=tcp
add chain=input comment="Winbox \FCber OpenVPN" dst-port=8291 in-interface=\  
    all-ppp protocol=tcp
add action=log chain=input disabled=yes log-prefix="DROP INPUT"  
add action=drop chain=input
add chain=forward connection-state=established
add chain=forward connection-state=related
add chain=forward disabled=yes dst-address=!10.10.10.0/24 dst-port=\
    21,22,80,443,445,587,993,3000,5060,5222,5228,8080,8443 in-interface=*1B \
    protocol=tcp
add chain=forward disabled=yes dst-address=!10.10.10.0/24 dst-port=\
    161,162,5004-5020,5060,5222,5228 in-interface=*1B protocol=udp
add chain=forward dst-address=!10.10.20.0/24 dst-port=80,389,443,5060,25 \
    in-interface=vlan20_voip protocol=tcp
add chain=forward comment="F\FCr Haust\FCr \D6ffnung" dst-address=\  
    !10.10.20.0/24 dst-port=8090 in-interface=vlan20_voip protocol=tcp \
    src-mac-address=**:**:**:**:**:**
add chain=forward dst-address=!10.10.20.0/24 dst-port=5004-5020,5060 \
    in-interface=vlan20_voip protocol=udp
add chain=forward dst-address=!10.10.40.0/24 dst-port=\
    25,80,443,445,515,587,993,5001,5060,8080,9100 in-interface=vlan40_server \
    protocol=tcp
add chain=forward dst-address=!10.10.40.0/24 dst-port=\
    161,162,3671,5004-5020,5060 in-interface=vlan40_server protocol=udp
add chain=forward dst-address=!10.10.50.0/24 dst-port=\
    80,443,445,3306,5038,8080 in-interface=vlan50_IPTV protocol=tcp
add chain=forward dst-address=!10.10.50.0/24 dst-port=3306 in-interface=\
    vlan50_IPTV protocol=udp
add chain=forward dst-address=!10.10.70.0/24 dst-port=80 in-interface=\
    vlan70_haustechnik protocol=tcp
add chain=forward dst-address=!10.10.80.0/24 dst-port=80,443,554,8000 \
    in-interface=vlan80_kameras protocol=tcp
add chain=forward dst-address=!10.10.90.0/24 dst-port=\
    21,22,80,443,445,587,993,2424,5060,5222,5228,8080,8443,9100 in-interface=\
    vlan90_wlan protocol=tcp
add chain=forward dst-address=!10.10.90.0/24 dst-port=\
    3389,554,515,5001,5900,5912,8090,19444,40000 in-interface=vlan90_wlan \
    protocol=tcp
add chain=forward dst-address=!10.10.90.0/24 dst-port=\
    161,162,554,5004-5020,5060,5222,5228,5600,5900,5912,9777 in-interface=\
    vlan90_wlan protocol=udp
add chain=forward dst-address=!10.10.100.0/24 dst-port=80,443 in-interface=\
    vlan100_wlan_gaeste out-interface=e1wan protocol=tcp
add chain=forward dst-address=!10.10.110.0/24 dst-port=\
    21,22,23,80,443,445,587,993,2424,3000,5060,5900,8443,9100 in-interface=\
    vlan110_pc protocol=tcp
add chain=forward dst-address=!10.10.110.0/24 dst-port=\
    3389,554,1865,5001,5038,8080,8090 in-interface=vlan110_pc protocol=tcp
add chain=forward dst-address=!10.10.110.0/24 dst-port=\
    161,162,554,3671,5004-5020,5060 in-interface=vlan110_pc protocol=udp
add chain=forward comment="Regel f\FCr OpenVPN" dst-address=!10.10.200.0/24 \  
    dst-port=22,25,80,443,445,993,2424,3389,5060,5900,8090,9100,40000 \
    in-interface=all-ppp protocol=tcp
add chain=forward comment="Regel f\FCr OpenVPN" dst-address=!10.10.200.0/24 \  
    dst-port=161,162,5004-5020,5060 in-interface=all-ppp protocol=udp
add action=log chain=forward disabled=yes log-prefix="DROP FORWARD"  
add action=drop chain=forward
/ip firewall nat
add action=masquerade chain=srcnat out-interface=e1wan
add action=dst-nat chain=dstnat comment="SIP Zugang" disabled=yes dst-port=\  
    5060 protocol=udp to-addresses=10.10.40.1 to-ports=5060
/ip smb
set domain=HOMENET enabled=yes interfaces=\
    vlan110_pc,vlan80_kameras,vlan50_IPTV,vlan40_server,*F00030

Wäre schön wenn ihr mir helfen könntet.

Gruß
Andreas
comment-contentCommentShareShare
Share on Facebook Share on Twitter Share on Reddit Share on Linkedin

Content-Key: 299680

Url: https://administrator.de/contentid/299680

Printed on: April 24, 2024 at 22:04 o'clock

3 Comments
Latest comment
Goto Top
Mitglied: 119944
119944 Mar 21, 2016 updated at 08:37:31 (UTC)
Goto Top
Moin,

ist ein bekanntes "Problem"...
Die MikroTik Switches sind beim routen einfach extrem langsam und dafür nicht zu gebrauchen.
Jeder hEX Router hat mehr Leistung als der CRS226, deshalb solltest du diesen wirklich nur als Switch verwenden und ggf. mit einem RB2011, RB3011 oder CCR betreiben.

Siehe auch:
http://forum.mikrotik.com/viewtopic.php?t=84648

VG
Val
Member: ragepw
ragepw Mar 21, 2016 at 08:58:12 (UTC)
Goto Top
Wie verbinde ich den CRS226 am besten mit z.B. dem RB2011, über die SFP Ports oder Port Trunking. Die ganzen Dienste wie Firewall, DHCP Server, VLAN und OpenVPN kommen dann auf den RB2011?

Gruß
Andreas
Mitglied: 119944
119944 Mar 21, 2016 at 09:30:08 (UTC)
Goto Top
Wie verbinde ich den CRS226 am besten mit z.B. dem RB2011, über die SFP Ports oder Port Trunking.
Kommt immer drauf an, würde aber den SFP Port verwenden.
Die ganzen Dienste wie Firewall, DHCP Server, VLAN und OpenVPN kommen dann auf den RB2011?
Genau. Der CRS226 arbeitet dann als reiner L2 Switch und der RB2011 macht die Arbeit.
Wobei dann ein CRS125 ausgereicht hätte, der Vorteil des CRS226 liegt ja in den 10G Ports.

Ansonsten wäre der RB3011 sicherlich auch empfehlenswert aber da gibts noch einige Kinderkrankheiten.
Oder ein CCR1009 wenn du die 10G Anbindung des Switches nutzen willst: (vermutlich Overkill face-wink)
http://routerboard.com/CCR1009-8G-1S-1Splus

VG
Val
GermansolvedQuestionMikroTikOther systems
Hotly discussed
gleixnerdCheck of ZFW Firewallgleixnerd - 5 CommentsjstrickerWireguard VPN on UDM Pro behind Fritzbox - Handshake did not completejstricker - 3 Comments