This is well known, RouterOS IPsec is ridiculously unstable at the moment. Reboot both ends at the same time (kill connection or flush SPI will not help). You can even observe this same behaviour on two routers directly connected that have no other interfaces or configuration but a gre tunnel with I...

Where is this posted? I did a quick search and didn't find anything.

viewtopic.php?p=724264#p724238

Mikrotik have publicly disclosed the details of the vulnerability, on a Sunday, in a way that a child could exploit it - before even providing a fixed beta, let alone a stable release version, let along giving us time to test and deploy it. Truly despicable behaviour there Mikrotik. Do you have no r...

Looking at the remaining workaround, usual end-user blocking any incoming traffic not already established / related, isn't impacted, right? You'd be limiting traffic to 2 new flows per second which is not an option except in the tiniest of networks. Now, there may be a higher value that is acceptab...

Officially no, but some posts suggest you can do it with the right Y-connectors https://forum.mikrotik.com/viewtopic.php?t=77535&start=100#p446454 https://forum.mikrotik.com/viewtopic.php?t=123799#p612739 Watch out for the overall current draw though. The mAP has a maximum potential draw of 1A a...

Perfect, thanks for confirming.

I'm wondering if the mAP has a 5V regulator for the USB port output.

i.e. whether I can power it 12V via the DC jack (necessary for PoE-out to a camera) and still have 5V supplied to a USB OTG modem.

We recently discovered a bug on CRS326 that it allows to forward packets that are internally tagged with PVID=1, this will be fixed in future versions, though this bug does not exist on CRS317. To avoid this bug, simply set PVID=2 to all ports that currently have pvid=1/no-pvid. Actually it looks l...

Hi artz, Thanks, yes I understand that ingress-filtering only applies to ingress traffic. And there are no untagged VLANs on this port. So there should be no untagged packets on ingress or egress. The only possible traffic from this port should be on VLAN tags 2031 and 2032. Yet here are the neighbo...

I am struggling to find a configuration that does not leak untagged traffic between ports on both the CRS326 and CRS317. Example with CRS326. All ports in a flat VLAN 1 except three special ports: ether9 should have VLANs 2030 and 2031 tagged, nothing untagged. ether10 should have VLANs 2030 and 203...

Yes that's possible, here is an example with the Python API #!/usr/bin/python3 import routeros_api import sys login_username = 'myuser' login_password = '123123' change_username = 'admin' change_password = '345345' connection = routeros_api.RouterOsApiPool('127.0.0.2', username=login_username, passw...

Here is a stupid script to handle "fallback" PPPoE credentials that will be tried one after another until one set succeeds. Use case example Your customer is migrating to another ISP, you know what the new credentials will be (but they won't work in advance of the migration), and you don't...

I contacted Proscend regarding the VPI/VCI settings for the 180-T and was told unequivocally that the device does not support ADSL. I found this very strange as the data sheet does have the ADSL2+ specifications, so I asked for clarification and was again told that they do not have any devices that ...

Well I have a definitive answer from Mikrotik support:

Yes, that is currently the behavior of VRFs, management can be done only if address is in main table.

Sigh. How many ISPs out there are going to allow management of their routers from the global table?

Is there any documentation for this switch yet? All the examples on the wiki state explicitly they are not for CRS3xx series. Not sure why Mikrotik think they can keep geting away with not providing documentation and having customers figure it out and document it for them. I'm struggling to get some...

@tangram - thanks, unfortunately adding a route to the default table didn't help: [admin@MikroTik] /ip route vrf> set 0 disabled=no [admin@MikroTik] /ip route vrf> /ip route print Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhol...

I want to keep a management port on each device for "local only" management using the 192.168.88.1 addresses. I wish to put this address and that interface into a routing-table so it does not pollute the global table (so the equivalent of "VRF-lite" on Cisco). In this example, et...