**EDIT**

I should have mentioned the ONT is a Nokia I-211M-L. Since this model only has a 1000Mbps data port, do you think it is possible there is an incompatability issue/ bottleneck with the 2.5G WAN? I assumed that the WAN port would negotiate down to 1000Mbps (according to the orange light, it does). I even explicitily set the negotiation mode. Perhaps therein lies the issue?

** EDIT 2 **

Okay, I am fairly certain that there is a bottleneck issue between the ONT and the router, when connected to the 2.5G WAN 1 port. I put a small, unmanaged 1Gbps switch between the router and ONT (ONT -> Switch -> 2.5G WAN 1). Immediate got symmetic upload and download speeds. 

My tentative conclusion is that the ONT has issues negotiating with the router. Very much interested in any one elses thoughts. 

@ArnoLa thanks for your report. I too am finding very weird behavior with the upload speeds of the ER7412-M2 router.

• Using a 2.5Gbps WAN with a 1Gbps ISP port (1000/400 service), I could get the full bandwidth down, but the upward speed would not exceed ~200Mbps (where my previous, much cheaper router could max out the upload speed no problem).
• I changed the ER7412-M2 2.5Gbps from 'Auto' to fixed 1Gbps and enabling flow control helped a bit, maybe ~250Mbps upward speed.
• Switching to LAN3, a 1Gbps WAN port, like you did, helped more, but still only ~280Mbps upwards speed.

But that is where I was stuck.

But now here's the weirdest thing. I turned on full IDS/IPS with "High" setting and detect and prevent enabled. As expected, my downward speed got clipped to only ~500Mbps which appears to be as fast at the ER7411-M2 can go with IDS enabled (even though CPU stays under 25%). BUT my upward speed INCREASED. With DPI & IDS enabled I now get the maxed speed of 400Mbps up. How an earth does adding a ton of overhead with IDS, increase upward throughput? That make no sense, but it is repeatable. If I disable IDS/IPS my max upload speed DECREASES again!

I suspect there is someone up with how TP-Link configure the Linux kernel buffers and how hardware acceleration is implemented. Enabling DPI & IDS in routers often requires disabling hardware network acceleration, so that you can inspect packets being forwarded that would otherwise skip the kernel. It looks like TP-Link need to take a serious look at this. Disabling h/w acceleration should not decrease speed. Some routers give you direct control over enabling / disabling h/w acceleration, possible TP-Link should consider that.

@Ethan-TP yes indeed, DPI and IDS examine packets and often have to disable h/w offloading it do it. I agree, they should only slow things down. So when they sped up my upload speeds that's weird right?

I have great updates! The problem is fixed. I replaced the 1Gbps ONT with a new 10GbE ONT and the problems with the ER7412-M2 went away.

I now get nearly line-speed with the ER7412-M2 now, both download and upload.

What is more, enabling DPI plus enabling IDS/IDP with 'High' settings ("12 of 12 Threat Categories Enabled") only drops the speed by ~5% That is beyond my expectations, because IPS on ER7412-M2 is only rated for about ~500Mbps, but I'm still getting ~1780Mbps with it enabled. Possibly the impact is higher with more diverse traffic or smaller packets? This was just speed tests and ISO downloads.

Someone else fixed their problem but placing a 1Gbps switch between the 1Gbps ONT and the TP-Link router. Based on these experiences it seems like TP-Link sometimes has a hard time with negotiation or flow control with some brands of 1Gbps devices. Could be the fault of either device. But at least I have a fix now.