Strong loading of Mikrotik at l2tp/ipsec?

Question

Mikrotik

Good afternoon!
I have mikrotik CRS125-24G-1S-2HnD-IN. Raised l2tp/ipsec on it. ISP speed 30Mbps.
When a client connects, the speed does not rise above 10Mbps, the processor is 100% loaded.
Raised PPTP for the experiment - everything is fine there. Mikrotik gives all the speed and loading 25-28%.
Can someone explain why that is?

/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des,aes-256-cbc
set h323 disabled=yes
/ip ipsec peer
add address=0.0.0.0/0 enc-algorithm=3des,aes-128,aes-192,aes-256 exchange-mode=main-l2tp generate-policy=port-override local-address=0.0.0.0 passive=yes secret=password
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0

Answer 1

And what is not clear? the processor is dead, does not have time to encrypt anymore

Answer 2

tools/profile what does it show? What is loading?

Answer 3

encrypting 68%.
firewall 8%
l2tp 7%
networking 4%

Answer 4

That's right, the processor is weak for strong encryption. Try to use only AES, in my experiments it turned out faster than 3DES.

Answer 5

Of course, the problem is the complexity of encryption. You can try just by password, without a certificate and check the speed. The result is to choose what is more important - security, or speed. Or change the hardware.

Answer 6

enc-algorithms=3des,aes-256-cbc

Encryption algorithms are bad:
3des - vulnerable and low speed
aes-256-cbc - heavily loads percent and low data transfer rate
aes-128-cbc - use only it, it has the highest speed, turn off other modes.
configure authorization by certificates, not by password. Only a certificate protects against a MITM attack