Cisco 892 Low WAN Speeds [closed]

Question

I'm getting really not-gigabit-close speeds on my Cisco 892 Router. LAN speeds are fine (750-800Mbps) but WAN speeds are awful. I have a PPPoE connection, and when doing a speedtest I get an average-max of 360-370Mbps with the router's CPU at MAX when doing the test.

Running config:
Building configuration...

Current configuration : 5253 bytes
!
! Last configuration change at 15:35:01 GMT Sun Aug 12 2018 by admin
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname HomeRouter
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
clock timezone GMT 3 0
clock summer-time GMT recurring
!
crypto pki trustpoint TP-self-signed-2201272373
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-2201272373
 revocation-check none
 rsakeypair TP-self-signed-2201272373
!
!
crypto pki certificate chain TP-self-signed-2201272373
 certificate self-signed 01
  //////////////////////////////////////////////////////////////////////
!
!
!
!
!
!
!
!


!
ip dhcp excluded-address 192.168.1.1 192.168.1.14
ip dhcp excluded-address 192.168.1.5
!
ip dhcp pool clienti_LAN
 import all
 network 192.168.1.0 255.255.255.0
 domain-name acasa.local
 dns-server 1.1.1.1 1.0.0.1
 default-router 192.168.1.5
!
ip dhcp pool pc_main
 host 192.168.1.77 255.255.255.0
 client-identifier 01d0.17c2.9ba5.36
!
ip dhcp pool ciscoap
 host 192.168.1.6 255.255.255.0
 client-identifier 0138.90a5.1970.00
!
!
!
no ip domain lookup
ip domain name acasa.local
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
cts logging verbose
license udi pid C892FSP-K9 sn FCZ191494LJ
!
!
/////
!
!
!
!
!
ip ssh authentication-retries 2
ip ssh version 2
zone security in-zone
!
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0
 no ip address
 speed 1000
!
interface GigabitEthernet1
 no ip address
!
interface GigabitEthernet2
 no ip address
!
interface GigabitEthernet3
 no ip address
!
interface GigabitEthernet4
 no ip address
!
interface GigabitEthernet5
 no ip address
!
interface GigabitEthernet6
 no ip address
!
interface GigabitEthernet7
 no ip address
!
interface GigabitEthernet8
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface GigabitEthernet9
 description RDSWAN
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip tcp adjust-mss 1452
 duplex auto
 speed auto
 pppoe enable group global
 pppoe-client dial-pool-number 1
 no cdp enable
!
interface Vlan1
 description LAN
 ip address 192.168.1.5 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
!
interface Dialer1
 ip address negotiated
 ip nat outside
 ip virtual-reassembly in
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 1
 dialer idle-timeout 0
 dialer load-threshold 1 either
 dialer persistent
 dialer-group 1
 ppp pap sent-username XXXXXXXXXX password 0 XXXXXXXXXXXXX
 ppp ipcp dns request accept
 ppp ipcp route default
 ppp ipcp address accept
 no cdp enable
!
ip forward-protocol nd
ip http server
ip http secure-server
!
!
ip nat inside source list 100 interface Dialer1 overload
ip nat inside source static tcp 192.168.1.77 80 interface Dialer1 80
ip nat inside source static tcp 192.168.1.77 8080 interface Dialer1 8080
ip nat inside source static tcp 192.168.1.77 25564 interface Dialer1 25566
ip nat inside source static tcp 192.168.1.77 3306 interface Dialer1 3306
ip nat inside source static udp 192.168.1.77 7 interface Dialer1 9
ip nat inside source static tcp 192.168.1.77 27000 interface Dialer1 27021
ip nat inside source static udp 192.168.1.77 27000 interface Dialer1 27021
ip nat inside source static tcp 192.168.1.77 3389 interface Dialer1 3389
ip route 0.0.0.0 0.0.0.0 Dialer1
!
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
!
line con 0
 logging synchronous
 login local
 no modem enable
line aux 0
line vty 0 4
 session-timeout 5
 login local
 transport preferred ssh
 transport input ssh
line vty 5 15
 session-timeout 5
 login local
 transport preferred ssh
 transport input ssh
!
scheduler allocate 20000 1000
!
!
!
end

When doing the speedtest util:

HomeRouter#show processes cpu sorted
CPU utilization for five seconds: 97%/94%; one minute: 20%; five minutes: 15%
 PID Runtime(ms)     Invoked      uSecs   5Sec   1Min   5Min TTY Process
  93       32624        7344       4442  1.60%  1.76%  1.67%   0 c800_dx_mrvl_sta
   2         352         166       2120  0.40%  0.06%  0.04%   0 Load Meter
  15        1740        2173        800  0.40%  0.09%  0.10%  10 SSH Process
  97         432      100499          4  0.16%  0.11%  0.10%   0 Ethernet Msec Ti
 136        2340        4072        574  0.16%  0.10%  0.08%   0 IP Input
 392        1940         839       2312  0.16%  0.11%  0.10%   0 Per-Second Jobs
 386         260        1602        162  0.08%  0.01%  0.00%   0 IP NAT Ager
 243          20        1598         12  0.08%  0.00%  0.00%   0 CCE DP URLF cach
 390          72         169        426  0.08%  0.00%  0.00%   0 Compute load avg
 307         316       12821         24  0.08%  0.02%  0.00%   0 MMA DP TIMER
  10           0          74          0  0.00%  0.00%  0.00%   0 WATCH_AFS

Answer 1

Slightly better than 350Mbit/s? That's probably about as good as it's going to get with an 890 series and with NAT. NAT is probably causing the CPU load, here.

Don't forget: This product range is aimed at the market segment where a branch office with barely a dozen users needs feature rich (IPSec, mabye MPLS, QoS for voice and video, dynamic routing, dial-backup, etc) connectivity to HQ, and where the internet breakout is very probably at HQ anyway. Cisco places it in the 25Mbit/s market - at my former employer's, we used it with WAN services up to 50Mbit/s.

If the device needs to be in the serveral-hundreds-of-Mbit/s range, and it's got to be Cisco, better look at the ISR 1100 series or a low-end model of the ISR 4000 range (with BOOST licence).