MikroTik

peson

Hi, how did you set the peer on server side? what is the "my-id" on server compared to the cert id? Note: If you are using "My ID user FQDN" in IpSec config then "subjectaltname" extension should be set on certificate, and must match the value set on remote peers "...

peson

That's why I say that the QinQ starts in R2 and exracts in R1 other way around, i had to upload all in once , i thought that u can assume. Ok, this depends from where you look. I still wonder why you need to put vlid10 and 20 inside vlid 100 between R1 and R2? I fully agree to the expanation in #89...

peson

R1 extracts VLAN 100 to get access to VLAN 10 and 20, that's QinQ. The QinQ starts at R2 and extracts in R1 see the config on R1, vl100 is carries vl10 and vl20 and on R2 or all the way to the end users im tagging only vl100 That's why I say that the QinQ starts in R2 and exracts in R1 All incoming...

peson

Why do you need QinQ between R2 and R1?
there is no qinq between R1 and R2, where have u seen that?

R1 extracts VLAN 100 to get access to VLAN 10 and 20, that's QinQ.
The QinQ starts at R2 and extracts in R1

peson

Agree, @nichky Please explain. Does c1 and c2 need to send both untagged and tagged packets? NO, they are just only the end users Does VLAN 10 and 20 interfere with other VLANs in R2? vlan10 & vlan20 are part of qinq Is R1 just a router? yes one of the router in my cloud From/to where do you wa...

peson

Now I am again not sure what you actually want to achieve. Is the intention to have access to management of both R2 and R3 via the same subnet (and VLAN) or something else? Agree, @nichky Please explain. Does c1 and c2 need to send both untagged and tagged packets? Does VLAN 10 and 20 interfere wit...

peson

@nichky
Why do you need QinQ in this configuration?
Does vlid 10 and 20 interfere with other vlans in R2?
From this drawing and the configurations, why not use 10 and 20 as tagged vlan from R3 to R1?

peson

@sindy "But if..." Is why I'm asking for more information to provide help.
Assumptions make misunderstandings.

peson

which ethernet or goes where you can see from the topology. add bridge=br-vlan interface=eth2 pvid=10 That is untagged vlan to the clients Everything works fine, just im wondering how can i add Mngm vlan on R3 since im using Tag stacking on R2 (interface pointing ro R3) Some more information of you...

peson

@MikroTik - can you please let us know why the config that @sindy presented here doesn't work on v7, are you aware of this?

Have you tried the VLAN stacking feature on bridge ports?
Take a look at: https://help.mikrotik.com/docs/display/ ... agStacking

peson

Hello!
Long time, but....
What RADIUS backend are you using for this, Microsoft or other?
Cheers!

peson

Hello,
Have you upgraded to later version than 6.45.9?
I have the same problem on a production system running 6.46.8 (Long term) and thinking of upgrade to 6.48.4
Cheers!

peson

BTW nothing too obviously wrong in the config, other than nothing is made simple by CAPsMAN. Only thing I saw was some of the VLAN interface live on ether1, not the bridge – at least be consistant. Using the "VLAN Filtering" approach to set the generate CAP interface's VLAN may provide be...

peson

Did you solve this?
You need to setup bridge VLAN filtering.
Did you follow the capsman setup from pf device setup page?

peson

The performance must relate to something, If you get the performance that the cablemodem delivers, then fine, if you want to route traffic between local subnets, it will be slow. CRS1xx/2xx has a slow CPU when it comes to software bridging and routing. For switching traffic in L2 network it works al...

peson

The MAC-address for ether1 you set belongs to Verizon, is that the cable-modem/router? Yes its my cable router MAC address. To setup FIOS router as a bridge I need to setup ether1 port with MAC of FIOS router To make it work i reset Mikrotik ether1 MAC to the original value. With this change I am a...

peson

I made some progress. I made the changes and added firewall rules you suggested. Please let me know if the rules are good. After all the changes, I can now can ping 192.168.166.X but not 192.168.188.1 (FIOS router) or internet. So there is something wrong with my route setup. mysetup.rsc In the mys...

peson

Hi, 6 months ago we experienced exactly the same thing. CCR began to reboot and persisted even after the power supply was replaced. Optically, we saw that the capacitors C1442 and C1443 are inflated, so we had them replaced with new and better ones. Since then, everything is without problems. I beg...

peson

I want to share with you about a successful repair of a CCR1036-12G-4S. It started with the power supply which had the original capacitors, the bad ones. We installed a new power supply and everything worked as it should for two years. We started having temperature problems, at least what the router...

peson

As requested: ...snip... 59 ADo 10.235.103.0/24 10.250.3.10 110 60 ADo 10.235.254.0/24 10.250.3.10 110 61 ADC 10.250.2.0/24 10.250.2.3 vlan2-management 0 62 ADC 10.250.2.13/32 10.250.2.13 vlan2-management 0 63 ADC 10.250.3.0/24 10.250.3.14 vlan3-interrouter 0 64 ADo 10.250.10.0/24 10.250.3.12 110 ....

peson

As requested: ...snip... 59 ADo 10.235.103.0/24 10.250.3.10 110 60 ADo 10.235.254.0/24 10.250.3.10 110 61 ADC 10.250.2.0/24 10.250.2.3 vlan2-management 0 62 ADC 10.250.2.13/32 10.250.2.13 vlan2-management 0 63 ADC 10.250.3.0/24 10.250.3.14 vlan3-interrouter 0 64 ADo 10.250.10.0/24 10.250.3.12 110 ....

peson

Thanks for suggesting the /int eth swi port egress-vlan-mode=untagged for the interfaces and /int eth swi set forward-unknown-vlan=no for the switch Unfortunately neither of these appear to have had any effect. As far as the masking, I believe this is the correct way to configure IP Aliases with a ...

peson

Disconnect console before install of course disconnected Have you tried this 20s reset? "Release the button after LED is no longer lit (~20 seconds) to cause a device to look for Netinstall servers " Use a switch in between the CRS and the Netinstall PC and disabled firewall on the PC. Fo...

peson

Thanks for replying. You'll notice in my original post I mentioned the link that you have provided here as my source for example configuration. Could you point out what from the configuration you saw as being out of step with the 1xx series examples? First, this switch chip is awesome in terms of c...

peson

I don't see your issue....
Me neither.

Rudy: Tried to PM you, but failed

peson

@peson Try TCP test. NV2 no scale properly for TCP. I try external machines 2x CCR for tests NO BOTTLENECK FROM CPU just NV2 scale like shiet.

Will expand the test with CCR1036.

peson

Now time for fix 40 MHz channel in this moment max speed only 150 Mbit for TCP :( + 1 Tried to use 40MHz instead of 20MHz using nv2 many years ago on a link that was up for nearly 7 years. It was rock solid but it did not become faster than 20MHz, in fact no differences at all. Flat out speed was a...

peson

Also on advice of MT support I decided to go with CVID tag stacking instead of c-vlan within s-vlan. I build following config: /interface bridge add ingress-filtering=yes name=bridge vlan-filtering=yes /interface vlan add interface=sfp-sfpplus1 name=vlan-gs-ser vlan-id=309 add interface=bridge name...

peson

Hi there, I'm looking for a qinad solution aswell. Currently I'm running 2 x CRS317 with a metro vlan provider in between them. There are several vlans on both sides that require to be connected by the s-vlan together. I'm running the vlan aware bridge configuration on both CRS'es. Some of the vlan...

peson

Am I right in saying that ACLs do not work at all on the CSS106? I've just replaced a RB260GSP and cannot even successfully enter an ACL, let alone test it.
Has anybody else been able to use them?

Not working!

peson

Currently products supports only TDD Band38 and Band39. You need the LTE Base Station for 3.5ghz? For which country and which exact LTE bands Band 42, 43 or 48? Also what other requirements you have like output power, any other hardware/software features? Here is info on the LTE bands: http://niviu...

peson

Now i´ve an AP with 26 ARM CPE. I wounder if i can do a stress test to all units at the same time, like high BW. You can, but you'll have to login to every unit and run it. You need a lot of open windows in your management PC..... And you'll find the maximum throughput is relatively low since the A...

peson

A sector with 15 clients a/n/40mhz and the one I've tested is old single core .ac. Under each picture you can find the protocol used. Sadly in 802.11 is not stable and clients gets a lot of disconnections so I'm sticking with nstreme. The conclusion is Mikrotik have lost speed in any protocol, a lo...

peson

A sector with 15 clients a/n/40mhz and the one I've tested is old single core .ac. Under each picture you can find the protocol used. Sadly in 802.11 is not stable and clients gets a lot of disconnections so I'm sticking with nstreme. The conclusion is Mikrotik have lost speed in any protocol, a lo...

peson

I'm on latest ROS (6.43.7 i think) and I have HW accelerated xor bonding between CRS317 and CRS326. It happened to me that bonding interface acceleration sometimes "derps" after you perform reconfiguration of interfaces and looses HW state. Putting interface down and up or rebooting devic...

peson

I'm on latest ROS (6.43.7 i think) and I have HW accelerated xor bonding between CRS317 and CRS326. It happened to me that bonding interface acceleration sometimes "derps" after you perform reconfiguration of interfaces and looses HW state. Putting interface down and up or rebooting devic...

peson

I got the same problem on 6.42.7.
Hardware offloading for bonding interface not working in CRS326.
Have you tried it on the CRS317?
Did you solve it?

peson

Split horizon is covered in the MTCINE training (https://mikrotik.com/pdf/MTCINE_Outline.pdf) I teaching it in the MTCNA classes I have since it's a very useful feature when configuring port isolation which is common used in ISPs networks. Of topic: I still have only one pair of glasses, but I need ...

peson

This might be helpful: /interface bridge add name=br-QinQ vlan-filtering=yes /interface vlan add interface=ether1 name=vl10-QinQ use-service-tag=yes vlan-id=10 /interface bridge port add bridge=br-QinQ interface=vl10-QinQ add bridge=br-QinQ interface=ether2 add bridge=br-QinQ interface=ether3 add br...

peson

@peson, correct, it is a deployment / project that i got involved late, asked info and got very little, i.e. network design, etc

Do you need to interfere with the customers vlans on layer 3. or is it only L2 tunneling you need.?
Any queuing or shaping involved?

peson

@peson, Sorry, cant answer for equipment other side, I asked numerous occasions but still did not get answer, have meeting with collocation engineers in the morning at 10:00

But they request you to have a s-vlan 10 carrying the customers inside with c-vlan 20, 30 and 40?

peson

Those configs won't work for you. Please, try to explain the whole chain of what you're trying to achieve. Review my questions above. Is it something like this: Cust2 -- untagged -- CCR:ether2 -- some core -- tagged 20@ISP router @peson, did you read my post, https://forum.mikrotik.com/viewtopic.ph...

peson

Those configs won't work for you.
Please, try to explain the whole chain of what you're trying to achieve.
Review my questions above.
Is it something like this:
Cust2 -- untagged -- CCR:ether2 -- some core -- tagged 20@ISP router

peson

I am treading in waters I have not done before and it is a semi live network, so I need to get my ducks in a row, below is what I need: Cust 1 ---- C-Vlan 10 ----- \ Cust 2 ---- C-Vlan 20 -------\--- CCR1036 -- S-Vlan 50 ---- Co Loc for ISP's / Cust 3 ---- C-Vlan 30 ---- / Customers coming in on th...

peson

I think you got something wrong in your settings for the Username and Password in the device settings. Check Status and RouterOS Status in the General settings tab. Router OS needs to be checked in the settings If the Username ans Password is correct, check the logged in users (/user active print) o...

peson

Hi, I agree with Jimmy.
A CRS326-24S-2S+RM would be great for the ISP business and maybe DX32 cascaded to a CRS352-48S-4S+RM as Jimmy wrote

( http://www.marvell.com/documents/rqWmeRpkMiKHMEthCEoJ/ ).
I put this on my wishlist.

peson

Hey, I was just trying this: [Device.Name] # of Routes: [ros_command("/ip route print count")][device_performance()][Device.ServicesDown] In the Appearance settings in for our Dude-server, it runs as a CHR with ROS 6.39.2. It shows the amount of routes (3) on the view, so it works for me. ...

peson

Please provide a method of restoring previous STP mode, whereby Router OS would exclusively transmit and process BPDUs on (R)STP bridge ports. I furthermore don't see the point of having independent STP processes running for each bridge, if the STP BPDU frames are leaked to ports that aren't member...

peson

The object of my question is; does the radio become unstable if set to 4dBm or not? And if yes, where is the tipping point? We have a couple of short and very short links that run with 10dBm setting but still deliver -30dB at the other end. But I don't seem to be able to get 100% CCQ on these links...

peson

at the market its very rare a switch under 8-10 gigabit ports to support stp or rstp, looks like there is no economically viable to implement strong features on 5 port switch, many features are only seen on 10+ ports switches. not only on mikrotik, other brands are the same, looks like chipset limi...

peson

In most of the Europe (ETSI) we are limited to 30dB EIRP (5470 to 5725 MHz) in 5GHz, it's interesting to have some data of your EIRP (RF power from the radio + antenna gain). If the antenna have 30dB gain, you are limited to 0 dB power input, how does the radios behaves then? In the upper frequency...

peson

Test by new firmware.. Can you please tell us more about the configuration. TX-power settings, show a status of registred clients, etc. /Paul Hi, Because we test higher quality shielded antenna for isolate interference & noise.. Very happy, good result, but the shielded antenna so expensive.. T...

peson

Test by new firmware..

Can you please tell us more about the configuration.
TX-power settings, show a status of registred clients, etc.

/Paul

peson

As for the wireless TX-power I've wrote this topic in the Trainers closed area. The WiFi regulations in Europe limits the 5Ghz EIRP to 30dB, at least most of Europe. All the boards with built in a 5Ghz radio have the high TX-powered radios (-5HPnD). When PtP links with high gain antennas are built w...

peson

Can the ppl who had problems with POE report whether 1.14 fixed the Problem? I'm still unsure whether we should deploy a RB260GSP for our next locations. Hey, I've updated the switch and recalibrate the ports, but... I've connected the 912-radio on port 3, it was port 2, but when I recalibrated the...

peson

The major RB260GSP PoE out problems have been fixed in SwOS v1.14: http://www.mikrotik.com/download After upgrade it is recommended to do recalibration with "calibr" option in PoE out settings. Calibration process will ask to disconnect device from the port and return in auto mode when pr...

peson

i have an (MTU?) problem with CAPsMAN using manager forwarding mode; i already sent a mail to support@ and i'm awaiting response; thought i'd post here in the meantime. my setup is: CCR1036-12G-4S as CAPsMAN mixed devices as CAP: mostly RB2011UAS-2HnD, RB2011UiAS-2HnD, RB951-2n everything is runnin...

peson

(so it looks like the card is a Qualcom). Power-cycled the board and I still get exactly the same "Failed to load Gobi firmware" error message. Does anybody have any ideas? Alternatively, does anybody have any recommendations for cards which work in RB912s, which are readily available and...

peson

Are we just talking about the difficulty to work on or is the fiber which is ran along electricity HT cables unreliable and prone to failure. Both, the cables are better now but the early installations showed bad cable quality and the need of repair or servicing the cables is hard because the elect...

peson

Unless I am totally incorrect, fiber ran along with the overhead electricity HT cables on pylons has been very successful. That´s a big problem. Fiber cables running along with high power cables is very hard to do work on because of the problem with shutting down a high power line. We have this pro...

peson

Please send more information of the setup.
Is the MT AP or Station?
Is the Rocket AP or Station?
How is the WDS setup?

peson

Hello, it would be _very usefull_, to have posibility to tunnel L2 transit (including QinQ) through IP network. Many our customers want us, to independend few Mbps pseudowire from some village to main peering point at our telehouse, and get it with QinQ. L2tpv3 is perfect candidate: - It is simple ...

peson

AFAIK since a lot of stuff is happening in OS all the time, and guest and host has to do these things all the time, so each gets time-slice when to do stuff. If ping comes in wrong time it can miss current time-slice and get to the other one, hence the deviation. Can this be true, since the "h...

peson

Hi peson

it's working

thank you so much for the effort you applied to solve my problem.

really appreciated.

have a nice day!

Thanks for your appreciation.

peson

This is common problem with 493G - we noticed as soon as we started upgrading 493 with 493G (routing masthead 411 and 711 base station units) - problem solved by replacing with RB1100AH. Normis: Why do I keep thinking of the switching chip, when there is networking issues with G-models? Most of the...

peson

Did the bonded device will increase the capacity, if the overload is on the CPU?

Have you checked?

/tool profile

peson

Tried an other PC?
Tried without the SD and the mini-pci card?
And make shure that you don't have anything else connected, even if the interface are disabled.

peson

if it help to describe the solution , yes, think that we already know the src priavte ip/port and dst /port and we want to know the modified public src ip/port as built by src nat rule. The reqirement is that this natted src ip/port must be recorded/logged automaically by a firewall/filter/nat rule...

peson

Have you tried a system reset and only have one PC connected with DHCP enabled?
No other connections, only one PC.
Try the ping again, is it still the same problem?

peson

Bad news After more extensive testing I get no more packet lost using ping flood, but I still get random high latencies. I have been investigating more the "randomness" and I see it occurs every 70 seconds (more or less). Sometimes latencies are so high packets are lost, other times simpl...

peson

Hi folks do you think is possible to create a new chain, may be using a sort of trick (trough virtual interfaces, brdiges,etc) , to have extra processing just after srcnat rules (immediately after postrouting). My goal is to discover the ip used as src ip /port as applied by the src nat rules. To c...

peson

here are my setting: [tomeng@gw01] > ip firewall filter print 0 chain=forward action=accept src-address=192.168.9.5 out-interface=vl19-pub-gw 1 chain=forward action=accept protocol=gre in-interface=vl19-pub-gw [tomeng@gw01] > ip firewall nat print 13 ;;; Test PPTP chain=dstnat action=dst-nat to-add...

peson

Hi docmarius,

I have done with your setting is still not working.

PPTP is working on port 1723 and tunnel gre, so we can only forward port 1723 and can not forward protocol=gre. that why not working

any idea

Check the order of your NAT rules and your forward filter set.

peson

So I have listed three IP Public IPs. All of them can be ping-ed just fine. Ex: 1.1.1.1, 1.1.1.2, 1.1.1.3 Currently all machines including Email Server are using the 1.1.1.1 when going outside. I want email server to use 1.1.1.2. add action=src-nat chain=srcnat disabled=no out-interface=internet sr...

peson

Finally hacked my way through setting up OpenVPN in ethernet/TAP mode. However, after doing so, and running JPerf/IPerf on machines at either end, I get really poor throughput. I'm using SHA-1 / AES-256-CBC on a RB450G - and I get at max throughput around 10Mb/s, but then have drops down to 2Mb/s f...

peson

What is the easiest way to limit SXT to 8Mbps on bridged network? How to create the queue?

Thanks
-Jon

Easiest way is to limit the ethernet interface.
/interface ethernet set ether1 bandwidth=8M/8M

peson

It's a good documentation with useful information.
Read it carefully, it will help you with your questions

peson

I checked the manual and packet flow chart prior to posting, just to make sure I wasn't losing my mind. From log - 17:35:54 firewall,info input: in:ether1 out:(none), src-mac 00:0d:9d:a0:f2:31, proto UDP, 10.36.55.200:68->255.255.255.255:67, len 328 Do you have problem with unauthorized DHCP servers?

peson

I am using 20mhz only. Its working perfectly in 5GHZ-A now, so will leave it alone as bandwidth increased of N are not required. If also seen the occasional WDS storm in 5.19 using 2.4 Grooves and 2.41 firmware, although nowhere near as bad as pre 5.18. In my mind there is something not 100% still....

peson

eth1<(in) vlan native(untagged)+vlan100(tagged) eth2>(out) vlan native(untagged) eth3>(out) vlan native(untagged) eth4>(out) vlan 100 (tagged) eth5>(out) vlan 100 (tagged thanks It can be solved with the switching chip configuration or bridging interfaces. Do you need wire speed switching? Do you n...

peson

Basically:
Input chain, filter traffic going to the router. (DST address of the router)
Forward chain, filter traffic going through the router. (SRC and DST is not on the router)

Read more:
http://wiki.mikrotik.com/wiki/Manual:IP ... ter#Chains

peson

Thats why they talked about "soon" and are ignoring any request for comment in this thread. Sure... Yeah, it frustrates us too because we have to keep renaming voltage.ko modules inside mips routerboards. By the way not easy on boards without official serial port. We have a 3.3V to RS232 ...

peson

Maybe I misunderstand you, does EoIP runs over the vlan10? Then I agree that the ether2 L2MTU should be 1504 In your example, it's not QinQ you're running, since EoIP encapsulates the whole ethernet frame from ether2 I still advice you to run BCP with L2TP instead of EoIP it's less CPU intensive. BR...

peson

So for a QinQ packet comming from a Cisco Trunk the RoutBOARD's interface L2MTU should be 1504?

A QinQ packet have 2 VLAN tags, so the L2MTU needs to be at least 1508.

peson

I assume that you done some sniffing of the negotiation and seen that the PPP-Max-Payload aren't in PADI and PADR.

Then ok, I agree that MT should include RFC 4638 in ROS code.
Add a feature request at:
http://wiki.mikrotik.com/wiki/MikroTik_ ... e_Requests

peson

Also did try this before. Did not actually function, because my filter, filtered DHCP on bridge, which is part of Ether1, braking DHCP on Ether1. Did not however try and fix it because i found the gateway has to be in the same network as ip range, which would any how defy the purpose. Try this: /in...

peson

This is printouts from my pppoe-client and server. Client: > int pppoe-client monitor pppoe-rt-bfs-2 status: connected uptime: 16m16s idle-time: 55s active-links: 1 encoding: MPPE128 stateless service-name: rt-bfs-2 ac-name: rt-bfs-2 ac-mac: 00:0C:42:A4:7A:51 mtu: 1500 mru: 1500 local-address: 172.3...

peson

Thanks for the reply. That is what i thought as well, however because of the bridge it is not that easy. Also Mikrotik A give ip's and is also the gateway. Did try to mark packages and route out ether 2 instead of EOIP, but you cant mark ether1 data. It is part of the bridge and the bridge just for...

peson

Thanks very much guys, I shall report back in a day or so and see how it goes. Is there a list of recommended hardware, NIC cards/chipsets etc? Look in: http://wiki.mikrotik.com/wiki/Supported_Hardware It will probably work on any PC, except KVM support. I recommend Intel NICs and Atheros for WiFi ...

peson

I am using DELL R210 which has interface supports Jumbo Frame. But when I try to change MTU to above 1500 in ROS. It doesn't allow. Why? I am using ROS 5.9. Thanks, Works for me: int ether set ether3 mtu=9000 [admin@MikroTik] > int eth pr Flags: X - disabled, R - running, S - slave # NAME MTU MAC-A...

peson

What is the distance from point A to the "higher location"?

peson

I need some more information.

Send printout from:
/int bri exp
/int eth exp
/int vlan export

peson

It would be nice if this could be supported on Router OS so that we don't have anymore to use MLPPP over single link tunnels (and the associated overhead) for desired MTU larger than 1492.

Have you tried max-mtu=1500 and max-mru=1500?

peson

Read this: http://wiki.mikrotik.com/wiki/Manual:BCP_bridging_(PPP_tunnel_bridging) http://wiki.mikrotik.com/wiki/Maximum_Transmission_Unit_on_RouterBoards I advice you to use BCP over L2TP with MLPPP support over single link instead of EoIP, then you don't have to mind about the packet size through ...

peson

I actually have a spare PC with 4 NIC's in. So do I just download the ROS ISO for the PC / x86 and boot the CD, or is there some special installation requirements with a PC? Cheers Read: http://wiki.mikrotik.com/wiki/Manual:CD_Install You can install on a harddisk, USB flash, CF or whatever device ...

peson

VDSL2 :) Can the MT not just do the PPP and then pass all traffic to another router which then handles the NAT setup? Then you need to route the traffic through the MT to the NAT router and that you ISP route that NAT-IP through your MT's IP. So, I bet that the CPU is busy with the MLPPP. Do you ha...

peson

Any quick tutorial on how to do this? Would turning off connection tracking really make a noticeable difference to the CPU utilisation as I was the only PC on the network at the time of doing the speedtest? http://wiki.mikrotik.com/wiki/Manual:BCP_bridging_(PPP_tunnel_bridging) This require your IS...

peson

Just wanted to see if the switch was involved in the configuration.
I can't see anything wrong in the configuration so, the last thing to test is to configure the RB 450G as a bridge and add an other router for the NAT and firewalling.

/Paul

peson

/interface ethernet set 0 name=Gateway set 1 mtu=1520 name=LAN set 2 mtu=1520 name="Line 1" set 3 mtu=1520 name="Line 2" set 4 mtu=1520 name="Line 3" Need NAT so can't turn connection tracking off (unless I just use the RB for the MLPPP and then bridge it to another ro...

peson

Either of:
- Use .1 as the default gateway in LAN1 and .254 in LAN2
- Setup mangle rules to route traffic directly to Internet for non local traffic.

There is many ways to do this.

peson

1) Is it possible to restrict users to a specific VLAN? 2) What if they needed access to more than one VLAN? 3) What attributes would I need to send from the RADIUS server to restrict traffic? 4) Any useful tutorials for the above? :) Setup filters-chains in the firewall and use the RADIUS Filter-I...

peson

make sure you have connected Ether1 port of the device, directly to the PC with netinstall, and that the PC has all firewall/antivirus services off. Turn off the RB750GL, hold the button, keep holding the button and turn on the device, keep holding the button for 25 seconds, then release it. ... an...

peson

Could you send a printout from:
/int bridge exp comp
/int pppoe-cli exp comp
/int eth exp comp

Turn off connection tracking if not needed.

peson

the correct command is:
"add action=set-priority new-priority=7 out-interface=vlan1"

Note that it applies only for RouterOS v3.0
may i know how to set vlan priority to 1 in v5.18?

Is it the switch configuration or a bridge configuration?

peson

[admin@] /ip firewall nat> print Flags: X - disabled, I - invalid, D - dynamic 0 X ;;; place hotspot rules here chain=unused-hs-chain action=passthrough to-addresses=0.0.0.0 1 chain=dstnat action=dst-nat to-addresses=IP_PROXY to-ports=3128 protocol=tcp in-interface=vlan1 dst-port=80,443 Is this rul...

peson

Oh, sorry, I forgot to mention that. I am only using ether1 on both units. So, yes, it is going through the first switch chip. What ports are connected directly to the SoC? ether13? Perhaps I should try running the same test again, but using ether13. Nathan: Look in "/int eth po print" an...

peson

MT tells you to 'tweak' your config or disable packages, etc. That is complete work around, if it works, and comes with no explanation. It is not a solution to a problem. The only solution to this problem is one that comes with a sane explanation. Or maybe MT has no clue where to start. I get that ...

peson

all Can you confirm this? I can't recall it exactly, but I think there where negative reports for RB433AH too. I have never had my AH crash on me, and I have had it running in parallel with my 450G during all of these tests. It's even running off the same 24v power supply that gives more than one o...

peson

if you didn't get an answer, paste your ticket number and I will check why. Maybe some experiment is being done, and the responsible person is waiting for result, before replying to you. My ticket: Ticket#2012012666000134 What about my suggestion in collude together in an organized way? /Paul Lates...

peson

if you didn't get an answer, paste your ticket number and I will check why. Maybe some experiment is being done, and the responsible person is waiting for result, before replying to you.

My ticket:
Ticket#2012012666000134

What about my suggestion in collude together in an organized way?

/Paul

peson

Wazza, you need to contact support. Send us your image, send us problem description, and steps how to reproduce problems you are facing. If we can repeat it, we can fix it. Normunds! This is the problem, we all contribute with facts and sending you supout files. I've done this myself and haven't he...

peson

hardware watchdog on all recent (as in several years) RouterBOARD products Ok, so it's both soft- and hardware based? From the Wiki: This menu allows to configure system to reboot on kernel panic, when an IP address does not respond, or in case the system has locked up. Software watchdog timer is u...

peson

Im still running my testing rb450G, power supply Sunny 12V 2A, 4 metarouters (2x ROS + 2xOpenWRT) with connected console, running TOP command and ssh connection from external machine. Now i have 4d 14h uptime. Is this with or without watchdog enabled? My 1100AH Rev. A keeps running with the watchdo...

peson

The 2 1100s that I configured from the exports that peson sent to me have not crashed/rebooted/frozen, and in about 30 minutes they will have hit the 24 hour uptime mark. I am not convinced that they will exhibit any symptoms, but I will continue to watch them. (Once they hit 48 hours at around thi...

peson

So never longer than 24 hours? And you've definitely not seen anything close to 100 hours?

No, not with watchdog enabled, without watchdog, 8d5h and still running.

I will watch for them and let you know of my results.

Sent
I'm looking forward to hear about your results

/Paul

peson

how long would you say it takes on average before one of your RB1100AH reboots?

Everything between, 1-24 hours.
Will send you an export compact from the host and guests.
/Paul

peson

I don't have your particular 1100AH, and you don't have mine. Who knows: if it is a hardware issue, maybe there is a problem with your board that my board doesn't have? I have two brand new boards acting the same. If you can describe for me exactly how yours is set up (or, better yet, send me '/sys...

peson

Hmm... PPC is stable? 450G is unstable? This might be a big problem for all of us, some says this, some says that. Who are right? MT staff? No they seem to struggle with the MR implementation. We the testers and MT committed users? No, at least this is my opinion, we are testing this differently. Du...

peson

This is all useful information for the developers to know. -- Nathan I agree with Nathan, all information for the devs is useful. That's why I want to put together a "task force" with knowledge from us and MT. As I wrote in my reply: http://forum.mikrotik.com/viewtopic.php?f=15&t=6074...

peson

I am secretly hoping that both the 1100 and 1100AH either crash or reboot, because I'd hate to think that my 1100AH cannot run reliably at 1333MHz. ;) -- Nathan I'm running both my 1100AH Rev A at the factory set speed. One has the watchdog disabled and the other has it enabled. The one with the WD...

peson

new boards should have good capacitors on them and does not need replacement. about RB1100AH - what you have configured there? try to check what you have set and if recreating this with original disabled on another MR causes the same problem. Also, you could send configuration over so i can try to ...

peson

The 1100AH has rebooted 3 times today. The 450G didn't reboot at all until I put the original 24V 800mA power supply back on it. Now it has rebooted twice. I'm having the same experience from my 1100AH Rev A. routers, but after disabling the watchdog it doesn't reboot anymore, at least for last 3d1...

peson

That should do it. Hopefully others will find this useful. I hope to continue to find time to make changes and enhancements; ultimately, I want to get either FreePBX or some other web-based Asterisk GUI running on MetaROUTER along with Asterisk. -- Nathan Thanks for sharing the nice work Nathan :-D...

peson

Another thing is that the Rev A have the encyption chip and the Rev B doesn't. Not to stray too far off-topic here, but...how do you know the Rev. A has the encryption engine on its CPU? I thought only the RB1000 CPU had that. -- Nathan sys resour pr uptime: 9w6d2h21m50s version: 5.12 free-memory: ...

peson

If you are satisfied with L2TP encryption then follow the guide in: http://wiki.mikrotik.com/wiki/Manual:BCP_bridging_(PPP_tunnel_bridging) If you need IPSec, add a peer on the VPN concentrator, like: /ip ipsec peer add address=0.0.0.0/0:500 secret=secureword generate-policy=yes On the dynamic route...

peson

Nathan, note that my crash-log came from the MR not from the 450G itself. The watchdog of the MR rebooted it, but the host stayed alive. I've noted the difference between 1100AH. It's sad that Mikrotik didn't put a revision note on the routers. Another thing is that the Rev A have the encyption chip...

peson

i love export compact

Thank you man!

Glad to help!

peson

Why do you put the wlan1 interface into the bridge on the omnitik?
Remove it!

IP-addresses must be set on the bridge, not on interface inside the bridge.
Change the IP on the omnitik to belong to the bridge!

Think this helps

peson

You need to provide more information from your configuration.
Please post:
ip export compact
mpls export compact
int export compact

From onmitik and one of the sxt.

peson

Hi, i got it... the oid is 1.3.6.1.4.1.9.9.150.1.1.1.0 but i dunno where it come from, i just got it from the google. I think that is active AAA sessions in the router, so it will count hotspot, pptp, l2tp, pppoe, etc.. AAA sessions To get it to work with MRTG, you need to count the active users ta...

peson

Hello, We have 2 links, one is wireless and one is fiber, and one end there is mikrotik 1200 and other is cisco, has anybody configured STP between these two ? Please share your experience and how to achieve this. Many thanks, Watch my presentation from MuM 2009: http://mum.mikrotik.com/presentatio...

peson

Hello, Could someone give me the CLI (Terminal) command that will addthe following Queue? I need it in a script that will crate hundreds of simimilar queues. Thank you for accorded time! Hope this will help you: http://wiki.mikrotik.com/wiki/Automated_Usage_Script_without_usermanager#Final_Notes ht...

peson

Hi... Just wonder know, how can i get the active hotspot online user oid in order for me to monitor the online active user by the prtg/mrtg. thanks. Count the number of: mtxrHotspotActiveUserIndex oid=1.3.6.1.4.1.14988.1.1.5.1.1.1 You get the oid's from the command: ip hotspot active print oid. You...

peson

Good initiative Timberwolf :-D. Nice work Nathan :-) It looks like you've put lots of effort on this. I have a ticket at MT about the same reboot problem on RB1100AH. I've done tons of testing with different configs on the RB1100AH and nothing helped. Until now, I gave it all up with the MR testing....

peson

1. Does this problem deal with only DDWRT or ROS Virtual machine too? 2. How it works on PPC architecture? 3. What device is the most stable for runing MR wit ROS Image? How long uptime they have? As you can read from my previous posts, the MR aren't useful in any platform. If you want virtualizati...

peson

good, waiting for your results. Some results, or to be more precise, different config settings between MetaROUTER and KVM. Janis! correct me if I'm wrong about my assumptions and conclusions. I'm trying to understand the different configurations based on my Linux knowledge and how-to configuring tu...

peson

Tweaking your configuration until the system runs stable isn't a solution. At best that's a workarround and nothing you let your customers play with. Totally agree on this. As long there aren't any description and manuals provided with confirmed and tested configurations, the MR aren't usefull. No....

peson

Timberwolf, so your opinion is not to use MR at all, at least not until a stable version is available? ;) Yes, that is exactly my opinion. And my impression is, that this will be never. So, your saying MR in general on all platforms including PPC platform? And you're not agree on the statement? : h...

peson

Just don't configure anything and everything will be almost fine.

Timberwolf, so your opinion is not to use MR at all, at least not until a stable version is available?

peson

What Janis means is, please contact support with details about your problem. I've contacted the support and waiting for a solution for me. Is there anyone who runs MetaROUTER on RB1100AH (5.X) and it runs stable without reboots? My test now is a separate box that only runs MetaROUTERs inside, so th...

peson

what configuration you have? All problems about MR on PPC routers was resolved by adjusting configuration

I have a support ticket that you are familiar with.
/Paul

peson

I guess you only could try yourself, there is extremely less feedback on Metarouters altogether. And, without wanting to bash MT, there seems to be no clear understanding of the cause on MIPSBE, so every MIPSBE based board should be viewed as affected. Even a small software update might tip those b...

peson

Yes. Although thats a more complex scenario - i simply want to run the run hotspots on vlan5 , ap management on vlan 2 rather than manage the aps via ip bindings in hotspot server Can you upload the results of: /int mesh export /int wire wds export /int bridge export Are you going to use different ...

peson

Anyone? Happy to pay for a trainer/consultant.

Is it something similar to this you want to achieve?
http://mum.mikrotik.com/presentations/2 ... ngwire.pdf

/Paul

peson

Correct, the content matcher still breakes the filtering. I disabled the rules with content matcher and it works again. WARNING!!! Do not use this version in production system, at least not in x86 systems. It breakes your firewall settings. /Paul Can you be more specific? I have about 200 rules on m...

peson

I just tested NetInstall. It formated and installed the setup thing on a USB drive that had older RouterOS on it. After booting this USB drive - Setup did not find any harddrives. And with v3 this works. I also tested to upgrade RC1 to RC3 in demo mode. In log it states the package was installed. B...

peson

WARNING!!!

Do not use this version in production system, at least not in x86 systems.
It breakes your firewall settings.

/Paul

peson

I can't send the support file because i change the RB450 to rb532 with 2.9. I try doing system reset and make the config again, but still with the same problem. Is there any difference with IPSEC 2.9 with 3.0?? Max Max Can you send me the configuration? I need: /ip ipsec export /ip fire filter expo...

peson

Sergejs!
Just a note about Hide Password option in Winbox.
Why isn't the IPSec secrets hided when HP option is enabled?
/Paul

peson

I got my x86 v3.14 working against a NetScreen and an old x86 2.9.38.
I had to reconfigure v3.14 from the beginning.
My advise is to reset the config and restart from the beginning.
/Paul

peson

Nothing sexy with this

cat /proc/net/vlan/config
VLAN Dev name    | VLAN ID
Name-Type: VLAN_NAME_TYPE_PLUS_VID
vlan2          | 2  | eth0
vlan4          | 4  | eth0
vlan5          | 5  | eth0
vlan10         | 10  | eth0

peson

Jesse, glad to hear that you got your configuration to work the way that you like. This confirm that there is a bug/error in the configuration of bridges and interfaces in ROS. When I'm doing this on my Debian box I create a bridge for each VLAN I want to use. This way I can put a physical interface...

peson

Sergejs, did you try te IPSec between v3 and v2.9?
/Paul

peson

I it's not working, ten it's something for Mikrotik developers.
It should work

peson

Netrat,
I have done this before, but it might have been a Linux box and not ROS.
Since ROS is Linux it should work. I will setup this config in my lab with v3.
I'll keep you informed how it works out.
/Paul

peson

When you make the bridges you need reassign the IP address to the bridge and NOT the interface. peson I know you don't like doing it this way, but would you post a config for this example? If you have vlans on two physical interfaces that you need to bridge how else do you configure it? True, but I...

peson

Jesse,
As you wrote each VLAN needs it's own bridge, that's basically how a switch work.
You need to create a bridge for the native VLAN.
Read my replies in this topic:
http://forum.mikrotik.com/viewtopic.php ... 18#p125118
/Paul

peson

Hi, You need to create one bridge interface for each VLAN you want to use. On top of the WDS you create one or more VLAN interfaces. Then you put the VLAN interfaces with the same VLAN-ID into the same bridge. ie: ether1-vl2 ether1-vl10 wds1-vl2 wds1-vl10 wds2-vl2 wds2-vl10 br-vl2 = ether1-vl2, wds1...

peson

Hi Maximan, I've experienced the same between v2.9.x and v3.x. I cannot get the phase 1 to complete between a v3 and v2.9. It seems to be in the initial negotiation that it fails. Sergejs, can you confirm that the IPSec between v3 and v2.9 really works. I've been tested x86 to x86 and I have no more...

peson

rgraham! First I want to say that I like your intention :-) After you clarified your configuration and the purpose of the bonding, bridge and VLANs I get the idea of what you are doing. I think you are doing something wrong when you can't add the VLAN to the bonded interface. I think you have to cha...

peson

rgraham! I just want to put some comments of your post. This is the common mistake many users are doing :-(. Adding the vlan interfaces to a bridge, wrong!!! Think of how a switch work: if you put a vlan tag (4byte extra) on an interface it adds the tag to traffic leaving the interface, not to the b...

peson

Stefano,
please send me more information of your configuration with IP-address settings, filter rules amy bridge rules, etc.

regards,
Paul

peson

Just netinstalled a 133c system with only wireless package and system package of course.
The system runs smoothly until I install the NTP package.
/Paul

peson

sorry Uldis, I'll never call you Normis again

peson

no, no, this way you define filter only.
You need an ACTION that can modify VLAN features like VLAN ID or priority

Ok, I missunderstod you about this.
I thought that you allready have the priority set from a switch, so it's the reverse.
Then you have to go for 3beta as Normis wrote.

peson

Not sure if this help, but you can give it a try.
/int bridge filter add vlan-id=2 vlan-priority=7.
You may need a sniffer to figure out if it does anything with the packets.

peson

Vlan transport over wireless bridge (WDS) is working perfectly. No limits. Plus, you can add management vlan to bridge interface. You can read more about how to build VLAN over a wireless network from our presentation in MuM in Krakow, http://mum.mikrotik.com/presentations/2007_1/PL07_Roamingwire.p...

peson

Hey, we need to know more about your config to get an idea of the problem.
What´s the design of your network?
All those EoIP, are they between wireless systems or is it also wired system included?

peson

Hey, Have a look at our presentation from MUM in Krakkow: http://mum.mikrotik.com/presentations/2007_1/PL07_Roamingwire.pdf This will give you an advice of how to create VLAN´s and trunk those with MT´s into other switches. Some code snippet for you to look into: int vlan add name=eth1-vl2 vlan-id=2...

peson

Johan!
Have a look in our presentation from MUM in Krakow and it will give you some ideas of how to setup VLAN´s and HotSpot in a wireless environment.

peson

I suggest you to weed that script from unnecessary lines. e.g. this one. / routing bgp set enabled=no as=1 router-id=0.0.0.0 redistribute-static=no \ redistribute-connected=no redistribute-rip=no redistribute-ospf=no It is default configuration, it is even not used. Leave only those things that you...

peson

there is a limitation of 64KB, it can't be increased, but the files are usually smaller than that. if not, try to remove some rules, and import them later via another file. Normis: I fail with scripts that have more than 29 lines, the file is only 2kB. I´m using 2.9.38, can you please verify this p...

peson

Many thanx again for many useful tips :) Have now tried some configurations but i have another question. We have a topology like this: LanSwitch - MT AP --- MT Bridge - MT AP ---- MT Bridge - LanSwitch The switches are Cisco catalyst 2950 with ports in trunk mode. In the middle are a tower with two...

peson

Peter!
Could you please contact me at e-mail periksson at roamingwire.com.
I have some ideas for you

/Paul

peson

[quote="papwalker"]In case anyone still has doubts here is a screen dump of a VPN client connecting to a vpn server where the server IP is the same as the remote IP. In this instance is is not a pix box at the other end but a mikrotik howevewr if you try to connect a MT to a pix that uses ...

peson

What kind of PPPoE clients are used?

Try break the bridge and set up two PPPoE server instance with different service names, if you need traffic between the interfaces set up routing

For the RADIUS part, try reduce connection between MT and RADIUS with firewall rules.
/Paul

peson

I've noticed when using the netinstaller that if you don't specify a configuration script when installing directly to flash (usb card reader etc) the installation fails when installing upon the actual device (a wrap in my case). So is the configure script simply the exported configuration from a MT...

peson

That´s exactly on the "other side" for me, I´ll start digging

/Paul

peson

I installed all 7 routerboards i had and am only left with 1 on the roof... so testing still has not happened yet. Hopefully next week I will get back to this.

Sam

I´ve done some testing, read this:
http://forum.mikrotik.com//viewtopic.ph ... t=532a+564

/Paul

peson

hello, try to add ghost server IP to allowed IPs in /ip hotspot ip-binding section. This will allow communication between workstations and server. Stoned. I have allready tried adding the MAC to be logged in automatic. I think this will do the same as adding theIP. hello, In addition to this, check...

peson

we will check this

Hey, Normis.
Have you done any testing, if so when is a correction planned.

peson

I have to mention that the HotSpot is a bridge with two interfaces one EoIP and one bonding of two physical interfaces.

peson

Hey, we got problem with ghost in a students network,which is a HotSpot. We want to have ghost running without to have the computers logged in. Ghost uses multicast to make an installation of a whole network in minutes. Is it possible to run those multicast without having to turn of the HotSpot? Doe...

peson

Has anyone managed to get the configure script to work? Has anyone a sample that I can build on? Hey, There seems to be a limitation of the size of the script used when doing the netinstall. I have tried the same as you have and discovered it the hard way :-( Try a script that is just a few lines a...

peson

Ahh so is this Install issue a wide spread problem? I've got 3 routers i cant winbox too because it crash's but atleast they work Yeah, you are not the only one who have problem with crashing winbox efter upgrading to 2.9.24. Yes I´m using winbox the latest 2.2.10 version... :) but it still doesn´t...

peson

IFor such cases it's handy to just have a "standard" PC around where you can put the DOM (or CF, for that matter) in and do the installation there. As Normunds said, RouterOS doesn't even care if it's running on a different IDE port than at installation time (just tested this successfully...

peson

Normis, this was what I did: -I wrote the Install-image to the CF using USB adapter on my windoze, this is what I always do -I installed the CF into the CF socket on the iBase system. -The system booted from the slave disc in the 1:st IDE channel -I marked the packages I wanted and hit install. -The...

peson

since 2.9 it doesn't matter where you install it, it will boot from whatever drive you first install it on, includes secondary master, secondary slave etc. Normis, it didn´t work to install into /dev/hdb, but when i shorted the JP2 and the disc was handeld as a master disc the installation worked s...

peson

[quote="cmit"]Then you're blown :twisted: ... RouterOS will ONLY run from /dev/hda, i.e. IDE primary master. Sorry... I got a support mail from iBase this morning saying: "About Master/Slave selection for CF, we reserved this function but we didn't solder header or jumper on MB893-B1....

peson

Had nobody ever done something like this before? Come on guys i know it must be something simple

You need do setup static WDS interfaces between the routers.
When done and function, add the VLAN:s you want to tied with the WDS interfaces /Paul

peson

I have tried to install RouterOS into a CF in a onboard adapter. The CF is handled as a slave disc on the first IDE channel. I have written (as I alwas do) the install disc image to the CF and the installation starts but fails when it tries to create the filesystem. The system is a iBase FWA9106. I ...

peson

I just want to say : if you see thousands of BitTorrent connections, verify whether these are just SYN packets sent from client and dropped by your server or whether these are actual live connections transferring data. The connections are established, so it's not only SYN packets. The connections a...

peson

Hi all,
With this rule I thought I blocked all P2P connection trough the router:
0 chain=forward p2p=all-p2p action=drop.
When I check in the connection table, I see allot of bit-torrent connections.
In RC6 this worked fine, but now in RC9, it don't.
Does anyone know if this is a bug?

BR, Paul

peson

Thanks Normis! I will wait for the release of 2.9

peson

Hello, I've got problem with adding chains to my ppp chain. I got a total of 25 chains, but when I add a chain with a sequence number above 19 to a ppp-profile, the log says that the chaincould not be found. The chains above # 19 could be refered to from other chains and they works. I'm running 2.8....

Search found 195 matches