MikroTik

Zacharias

Use VLANs... Of course your wan port is not included inside the Bridge.
Also, if igmp-snooping is disabled then multicast traffic is flooded on all ports.

Zacharias

What i would do is, first of all upgrade to version 7 (if its not already upgraded), create appropriate vlans including one vlan dedicated to IPTV ( 105 if that's your IPTV vlan ), configure the Bridge vlan settings, mgmt vlan etc. and then enable bridge vlan filtering. After that multicast querier ...

Zacharias

There is the 2004 but sadly its throughput is no better than the 5009, when you compare filter rules to filter rules at 512 bytes.

You mean Bridge filter rules ?
In routing 2004 is better than 5009.

Zacharias

So, yours is r2 ? Or the revision is not mentioned?

Zacharias

I did update the switches to whatever was current that day. Ergo routerOS and board firmware.

Revision is not the same as firmware version.
The revision i think changes when there is a hardware change on the device.

For example, my CRS354 indicates as Revision : r2.

Zacharias

@gotsprings what is the revision version under /system routerboard ?

Zacharias

but I can't assign the DHCP server to multiple VLANs. I guess because the DHCP server is not your MikroTik router and its not aware of the VLANs... Right ? You could create the VLAN interfaces on your DHCP server then... Or a second cable, one for each VLAN between the DHCP server and the Router......

Zacharias

This works great sort of.

When using 802.3ad, you should know that all links participating in the aggregation must operate at the same speed and duplex mode..
In your case you've aggregated an SFP+ port with an ethernet port.

https://help.mikrotik.com/docs/display/ ... ng-802.3ad

Zacharias

The signal itself is not bad...
You got a really bad SINR... that means a lot of noise...

Zacharias

use-service-tag=yes

Service Tag is used when we need management access in cases that double VLAN tagging is used...
https://wiki.mikrotik.com/wiki/Manual:B ... ling_setup

Zacharias

But we are having a lot of problems with local devices staying connected That is a general description. Did you actually observe this problem yourself ? Any log check on the devices? The previous posts mention that the switch stops forwarding traffic until reboot, but in your case there is no such ...

Zacharias

Take a look here https://wiki.mikrotik.com/wiki/Manual:C ... with_VLANs

Zacharias

Do you have any extra packages other than the basics installed ?

Zacharias

I have tried it with filtering but nothing changed.

Probably because your configuration was wrong...

Zacharias

Indeed the default network diameter is 20, but this does not mean that RSTP won't work after the 20th Bridge...
Simply a new Root Bridge will be elected... https://wiki.mikrotik.com/wiki/Manual:S ... e_Protocol

Zacharias

As said earlier, but ignored, without Bridge VLAN filtering enabled, whatever configuration you' ve done under /bridge interface related to VLAN settings is simply ignored. Also, you've added a VLAN interface on a slave Interface https://help.mikrotik.com/docs/display/ROS/Layer2+misconfiguration#Lay...

Zacharias

In order to use the Bridge VLAN settings and the Bridge port pvid settings, Bridge VLAN filtering must be enabled.
Otherwise your Bridge interface is not VLAN aware...

And ofcorse before you enable it, you should read how it works otherwise there is a chance to lose connectivity with your device...

Zacharias

That is totally different...
Can you provide a network diagram of the Topology ?
And export with hide-sensitive the configuration of the CRS... Also manually remove serials, Public IPs etc if any visible on the config export...

Zacharias

Where is the VLAN 100 eth3 connected to on your MikroTik Router ?
On a Bridge Port or on a WAN port ?

Zacharias

I want devices on a specific vlan to only access devices on that vlan If you don't want a specific VLAN to access devices on another VLAN, you block that through the Firewall... Or if you have a drop all rule, then you accept the type of traffic you want before that rule as @anav already said... In...

Zacharias

Use the insert image icon...

The question is why you want to " forward " that VLAN to the rest of your network ?

Also, VLANs work on Layer 2 and they do not traverse Routers, Layer 3 devices...

Zacharias

I will agree on the network diagram...

Zacharias

Excellent - thanks for the updated info and the links.

Makes sense - once the interface is consumed as the passthrough device, the only way I can communicate with the SXT is through RoMON.

Thanks all.

You can solve that with VLANs...

Zacharias

The overall selection of models seems correct...

Zacharias

viewtopic.php?f=2&t=173692

That is a complicated explanation for otherwise a simple answer...

Zacharias

All physical interfaces (except WAN) are contained within one bridge, why?

A bridge is a virtual interface used to switch traffic between hosts.
So all member ports of a bridge are capable of communicating with each other in Layer 2...

Zacharias

Another idea would be to apply MSTP between Router A and Router B, disable any protocol-mode on the APs and STs between.
Then you could modify the internal path costs so that each VLAN could follow a different path and at the same time keeping redundancy enabled...

Zacharias

Have you ever seen a changelog to any modem firmware version ?

Zacharias

Easy dont use capsman.

Nice solution.

Actually capsman is really good... Especially in networks with many APs.

Zacharias

Instead of guessing, it would be best if you posted the configuration of both routers with /export hide-sensitive.. also remove any serials, public IPs if any etc...
Also a network diagram of the exact topology would be nice...

Zacharias

I would use OSPF.
Something like here viewtopic.php?t=149027

Your APs and your ST devices, must both be able to pass Tagged traffic on VLANs 10 and 20.

Zacharias

There is a problem MT has not many useful models

Actually there are plenty of really good Routers ( in your case ) to choose ...

Zacharias

Maybe zerotier ???
Seems it doesn't be available for 951G-2HnD (yet?)

.....we have only just 1 router....

Zerotier is available only in ARM devices with ROS v7.

You could use EoIP as suggested earlier or BCP https://wiki.mikrotik.com/wiki/Manual:B ... _bridging)

Zacharias

For road warrior setups, i would suggest either L2TP/IPsec or Wireguard...
https://help.mikrotik.com/docs/display/ROS/IPsec
https://help.mikrotik.com/docs/display/ROS/L2TP
https://help.mikrotik.com/docs/display/ROS/WireGuard

Zacharias

Many information are missing.
Where is ether2 going to ? another switch ?
What is the purpose of the second subnet ?

If you need to segmentate your network then VLANs is the way to go...

Zacharias

When you use your LTE device in passthrough mode, then the LTE device is responsible only for the Modem settings... It does not have internet itself, but instead it needs your Router to access the internet i.e. the device that the passthrough is going to. So, no, you don't need firewall on the LTE d...

Zacharias

So, did it work after changing the config according to my previous suggestion ?

Zacharias

ok thanks.

Zacharias

IGMP snooping ( Layer 2 Multicast Protocol ) is not supported in hardware by this device...
I guess you could use either PIM or IGMP Proxy

See here
https://help.mikrotik.com/docs/display/ROS/IGMP+Proxy
https://help.mikrotik.com/docs/display/ROS/PIM-SM

Zacharias

I thought so...
It would be great if VRRP had an internal procedure that could synchronize the configuration of the VRRP Routers without the need of a script...

Zacharias

I can't install Zerotier on this emulator

What emulation software are you using ?

Zacharias

or the full HA setup where the backup router inherits the complete configuration of the primary one

Inherits the complete config ? How ?
In VRRP ?

Zacharias

You have many mistakes in your configuration... As for the reason you don't have internet when connecting to either vlan10 or vlan20 is because you do not allow neither of these VLANs to make DNS queries to the router... More specifically, the DNS queries are blocked because there is a rule action=d...

Zacharias

The first week, we had random lockups and trouble keeping the eth port registered

It seems you have Layer1 issues...
Check the cable and the termination points...

Zacharias

ok, you can use the /23 network and use two pools for that particular network excluding the 10.0.1.0 and 10.0.0.255..
pool1 10.0.0.2-10.0.0.254
pool2 10.0.1.1-10.0.1.254

Supposing 10.0.0.1/23 is the gateway...

Zacharias

10.0.0.255 and 10.0.1.0 are not well accepted from all devices.

Can you provide more details on that ?
Or give an example ?

Zacharias

@rextended is right...
But in case is needed, you could use Port knocking.
Check here https://wiki.mikrotik.com/wiki/Port_Knocking

Zacharias

If you search in the forum you will find posts like this viewtopic.php?t=48762#p284203
mentioning models that are working...

Zacharias

Yes but so now is quickset VPN

I don't use quickset.
So i don't know.

Zacharias

@osc86 how about trying to netinstall the device ?

Zacharias

WG is easier to setup but this does not make OVPN bad.
It all depends on the requirements.

I would agree if we were talking only for ROS v6 where OVPN could only run over TCP.
But in ROS v7 UDP is supported.

Zacharias

I will agree with @sindy.
Dropping all ICMP packets is really bad...
But dropping selectively though, there are occasions that it is a good practice..

Zacharias

OpenVPN, is not a requirement its a disease.............

And why is that ?

Which MT router would be best for

You got many choices...
Take a look here https://mikrotik.com/products/group/ethernet-routers

Zacharias

I don't see anything different in your config than what i suggested...
Details minor details..............

Like ?
You mean not posting a working config ?

Zacharias

Not all PCs are the same in terms of hardware...
So, did you disable all the network cards, wired or wireless, all the Virtual adapters if any, and tested again ?

Zacharias

Although zach is pretty close to the mark!

I don't see anything different in your config than what i suggested...

Zacharias

-A topology map ? You don't have a topology map of your network? If you want to see the devices discovered you can use ip neighbor print -LLDP-MED is supported after 6.48 *) discovery - added "lldp-med-net-policy-vlan" property for assigning VLAN ID; - What exactly is that you want to see ?

Zacharias

can all be removed

I don't agree.
Everything except, the Relay, the set ip-forward=no and the add address=192.168.1.2 interface=BR1 network=192.168.1.2, look totally fine to me.
Including the corrections i made in my previous post.

Zacharias

If you use lookup, in case that Gateway is not reachable it will fall back to the Main Routing Table, whatever that may be.
If you use lookup-only-in-table, if the Gateway is not reachable, you won't be routed at all to any other Gateway, including the Main.

Zacharias

You have mistakes in your VLAN configuration. The most important, you have PVID set on your wifi ports but at the same time you have set those ports as Tagged. By setting PVID we declare a port as an Access Port, meaning untagged traffic. A port that has both PVID set and at the same time is tagged ...

Zacharias

But why do you need to change the out interfaces ?

Zacharias

New interface bonding, diferent modes

What do you mean by New interface bonding ?

Zacharias

I think you can do both:

one pool with two ranges (10.0.0.2-10.0.0.254 and 10.0.1.1-10.0.1.254)

one pool (10.0.0.2-10.0.1.254)
Maybe anyone else can confirm?

Yes both can be done...

Zacharias

The more current through the PoE line, the more power dissipated, so the more heat generated.

According to specs, Max out per port output (input 30-57 V) 450 mA
So, i don't think the heat is caused by that...

Zacharias

How is the 5GHz backup failover implemented ?
I mean what triggers the switch on the 5 GHz in terms of configuration ? Any type of bonding etc. ?

Zacharias

Anyone knows anything about this *) lte - improved LTE interface detection for LtAP-2HnD devices; ?

Zacharias

I believe there are locations that do not have 3G coverage too...

Zacharias

@mkx thanks for the explanation.

Zacharias

station-bridge mode, the later is using 4-address mode So @mkx even in station bridge mode, 4-address format is used ? If for example, two clients ( PCs ) need to communicate through a wireless link, e.g. PC -> AP Bridge .... Station Bridge -> PC2, the Frame will include all RA, TA, SA and DA ? And...

Zacharias

Is it certain that there is a problem indeed ? That is not fixed on recent ROS releases ?
Anyone made a support ticket ?

Zacharias

you could also consider zerotier (goes through a third party) which is now an available module on MT OS.

But only for ARM devices...

CCR1009 is Tile architecture.

Zacharias

Anyone alse already tried this "STABLE" version?

i need to hard reset to make it work

After upgrading from what version ?

Zacharias

See here https://wiki.mikrotik.com/wiki/Manual:VRRP-examples
You can use MikroTik 3 as a switch.

Zacharias

*) lte - improved LTE interface detection for LtAP-2HnD devices;

Does this have to do with the LTE interface totally missing in some occasions ?

Zacharias

Wireguard. Dead simple. But it comes with a caveat, you need to be on ROS7. And that brings us back to post #2 ... Yes, but any device properly configured inside the network can be used for the Wireguard... In my case, the main router is not on V7, but i have another device in the network upgraded ...

Zacharias

ok, v6 does not show numbers 0,1,2,3 etc when printing /system health, so that got me confused...

Zacharias

Personally i mostly use LT2P/IPsec as a road warrior..
Lately i use wireguard too...

Zacharias

No, there is no problem, it can be a client and a server...
However PPTP is not recommended because it is not a safe VPN protocol to use...

Zacharias

This is not what the command /system health print outputs...

Zacharias

What if you use CLI ?

Zacharias

You will see groups of ports stop forwarding traffic AT ALL until reboot.

ok.
The device has an uptime of approximately 2 weeks without any problems...

Zacharias

yes, I see the user want use VLAN:
MTU 9000 + 14 l2 heading + 4 FCS + 4 VLAN = L2MTU 9022

I didn't notice, did I do something wrong?

No, my mistake.. I forgot about the FCS

Zacharias

MTU 9000 + VLAN = L2 MTU 9022

9022 ?

Zacharias

I ve installed a CRS354 recently, not fully loaded yet, just a couple of ethernet ports and an SFP+ port.
I ve not seen any port flapping...
Versions 6.49.6
VLANs are used on the CRS...

Zacharias

You shouldn't be using PPTP anyways since it is not a safe VPN protocol.
You can search in the manual other VPN protocols https://help.mikrotik.com/docs/display/ROS/RouterOS
You could use among others L2TP/IPsec, Wireguard, OVPN etc...

Zacharias

We conclude that for that destination address the Routing Table that will be used ( if reachable ) is named VPN... If the rule is matched, since passthrough is checked it will proceed to the next rule... When you use the mark-routing parameter you create a new routing mark for a particular packet an...

Zacharias

Here you can see the devices that support L3 Hardware Offload
https://help.mikrotik.com/docs/display/ ... iceSupport

Zacharias

maybe is doable with scripting

I will agree on that...

Zacharias

As far as i know there is no Link Flap Prevention in MikroTik.

Zacharias

That is ok. They inherit the MAC of the interface they run on... I noticed on your other switch, you have set the PVID value... However, we set the PVID value on Access Ports... Between the other switch and the MikroTIK, you have a Trunk Port, meaning a port that passes multiple VLANs. So on your ot...

Zacharias

Do they have the latest version 7.3.1 ?

Zacharias

Is the port flapping frequent or not ?

flap protection

Does something like that exist ?

Zacharias

/interface vlan add interface=sfp2 name=ISP1 vlan-id=201 add interface=sfp2 name=ISP2 vlan-id=202 add interface=sfp2 name=ISP3 vlan-id=203 The above code is enough for the PPPoE client to Run on those Vlan interfaces, ISP1, ISP2 and ISP3. e.g. /interface pppoe-client add disabled=no interface=ISP1 ...

Zacharias

You can use cell lock...
https://help.mikrotik.com/docs/display/ ... ngCelllock

Zacharias

I agree with @chechito,
I don't think you can directly connect the Fiber on your device bypassing the ONT of your provider...

Zacharias

The RB5009 would be a good choice...
It has an SFP+ port and a 2.5Gbps Ethernet Port...
The newer model has POE in/out on all of its ports as well https://mikrotik.com/product/rb5009upr_s_in

Zacharias

To my knowledge there is no handshake on Passive POE. Only a resistance check ( detection process ), and if the PSE detects that there is a PD connected that meets the resistance requirements it will supply with Voltage the Device connected... However, on POE af,at,bt etc, after the detection proces...

Zacharias

I connect to the mikrotik, in the sfp port of the mikrotik I create three vlans (isp1 id=201, isp2 id=202 , isp3 id=203) I create a pppoe-client for those three vlans That is correct... But are you sure those VLANs are passed correctly from the Switch to the MikroTik ? e.g. is the Vlan configuratio...

Zacharias

In passive POE there is no handshake procedure... so no POE classification...
But i' ve not seen any af device running on 24V... That is why i asked if there is any reference on that ....

Zacharias

Not even that! Both static and dynamic servers are used in a round-robin fashion Well that's what the manual say in the first paragraph... When both static and dynamic servers are set, static server entries are more preferred, however, it does not indicate that static server will always be used (fo...

Zacharias

The "48" is jus a standard de-facto, but can be 30W at 24V and still 802.3at...

Any reference on that ?

Zacharias

/ip address add address=192.168.1.100/24 comment=defconf interface=sfp-sfpplus1 network=\ 192.168.1.0 The IP address must be assigned on the Master interface, in your example it should be the Bridge interface itself... Other than that i can't seem to find another problem... The Layer2 problems you ...

Zacharias

@rextended thanks...

SA mean Sector Antenna

You ' re right...

Zacharias

Ok, but then they should mention that passive PoE is supported in datasheet. They only wrote 802.3af/at everywhere.

All power options support a wide voltage range of 24 – 57 V
https://mikrotik.com/product/rb5009upr_s_in

Zacharias

11° (+/- 5,5°) the non-SA and 60° (+/-30°) the SA

@rextended, any chance you know what "SA" stands for ?
Also i can't find in the manual the +/- 5,5° and the +/-30°, so what do you mean by that ?

Zacharias

I agree with @pe1chl,
The only excemption in terms of priority would be between static and dynamic DNS entries, where the static are more prefered, but that does not indicate that the static will always be used...
https://help.mikrotik.com/docs/display/ROS/DNS

Zacharias

I would suspect the cables, are they copper or CCA? What exact cable is used?

I would agree on that too...
Check the cable termination too...

Zacharias

The recommended method ( in terms of hardware performance ) for that particular device, is the switch menu, since that way you will not loose the Hardware offload on your Bridge interface...
Other than that, you can use the Bridge VLAN filtering, but you will certainly have a performance drop...

Zacharias

You can send a .backup file or .rsc through Emails too...
e.g. using a script you can create those backup files and then from the MikroTik send them to an email account of yours automatically...

Example viewtopic.php?t=146575

Zacharias

/interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX default-forwarding=no disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge name=wlan2.4 security-profile=wpa2 ssid=map \ wireless-protocol=802.11 From your code above, set the ban...

Zacharias

@rextended ok i understand ...

Zacharias

I have multiple bridges setup on a RB960 To me that defeats the purpose of VLANs... RB960 supports VLANs under the Switch menu... So why would you make multiple Bridges ? If you enable VLAN filtering everything will be done in software in that specific device ... Also, when multiple Bridges are cre...

Zacharias

and set the lease time to 100 years.

Really ?

To me, if it was a lease renewal problem it would occur in exactly 12 hours and not in 12 hours and 5 minutes...
But yes, assigning a static lease might be a solution ...

Zacharias

vlan-filtering=yes

Why ?

Zacharias

I don't need to queue them to limit traffic

Then how ?

Zacharias

Is that so right? You should add the switch-cpu port also in /interface ethernet switch vlan and /interface ethernet switch egress-vlan-tag See again the Management access configuration in the Manual... https://help.mikrotik.com/docs/pages/viewpage.action?pageId=103841836#CRS1xx/2xxseriesswitchesex...

Zacharias

The CPU usage on your switches is still very very high...
Is there any other special configuration on the switches (that you excluded from the posted configuration above )?

For CRS1xx and CRS2xx devices read here https://help.mikrotik.com/docs/pages/vi ... =103841836

Zacharias

Are all the switches (with the port flapping issue ) CRS354 ?

Also can you please mention the CPU usage improvement ?

Zacharias

I mean the number sequence indeed is different.. so at one point you are right...
But i was looking at the actual diagram ignoring the numbering...

Zacharias

The Bridge should and must be added as Tagged member for those VLANs that need to have access to the CPU ( IP services and more )... In the case of a Switch, that is the Management VLAN... A switch handles Layer 2 traffic... So you only have the Management VLAN as Layer 3 traffic that needs the Brid...

Zacharias

@rextended the diagram is the same

@sindy, right...

Zacharias

Maybe you mean that the packets will pass through the prerouting, forward and postrouting chains while still in the Bridge ?
https://help.mikrotik.com/docs/display/ ... dgeForward

Zacharias

Although there is no relation between the VLANs and the SFP flapping, i can certainly see you have enabled Bridge VLAN filtering now...

Is there any improvement on the CPU usage now ?

Zacharias

how do you deal with the havoc it causes on NAT?

@sindy, what do you mean ?

Zacharias

What should be mentioned about Bridge Horizon is that its a software feature and disables hardware offloading when used on hardware offloaded ports... which is not relevant on APs has they don't offer this on WLAN interfaces The only question remaining is, do you have to do this on devices, e.g. a ...

Zacharias

No....
Read here https://help.mikrotik.com/docs/display/ ... NFiltering

Zacharias

Yep, I've tried Netinstall, I can't see Device after resetting

Did you actually netinstall the device ?
And after that the problem persists ?

Zacharias

I just want to understand what type of traffic the OP wants to limit...

Zacharias

Since Bridge VLAN filtering is not enabled ( and CRS3xx devices support bridge VLAN filtering in Hardware ) all the VLAN handling is done in software to the CRS...

Zacharias

Thats what i think too...

Zacharias

Since then we have massive problems with SFP. What kind of problem ? But the CPU runs almost permanently at 100% So its always stuck at 100% ? Also i think you could configure your VLANs in a better way... Although adding VLAN interfaces as Bridge ports is not wrong, there are cases it could cause ...

Zacharias

What is connected on ether 4 ?

Zacharias

Its not booting or it does a boot loop ?

Zacharias

What should be mentioned about Bridge Horizon is that its a software feature and disables hardware offloading when used on hardware offloaded ports...

Zacharias

As @sindy said, they need 3rd party software, but they are easy to use...

Also in v7 the RB4011 supports VLAN in Hardware using Bridge VLAN filtering, in case you need them in the future... Its out of the scope of your question but since i mentioned ROS v7 i think it should be mentioned...

Zacharias

I recently did a backup and I could restore this in the another manually, I had no problem I never said it can't be done.. Read the first paragraph here https://wiki.mikrotik.com/wiki/Manual:System/Backup System's backup file also contain the device's MAC addresses, which are also restored when the...

Zacharias

I have a RBLtAP-2HnD in a production environment... The device regularly loses the LTE interface completely, the interface disappears... A reboot only " fixes " the problem... The device has Ros and firmware at 7.3.1 .. Modem firmware also updated to the latest v 033... Anyone had any simi...

Zacharias

Have you read about passthrough on LTE devices ? https://help.mikrotik.com/docs/display/ ... ughExample

Zacharias

It is not suggested to use a .backup file to another device...

Zacharias

I guess you mean RB2011...
I would use another VPN protocol, on V7 you have many nice choices like wireguard and OVPN with UDP support...

Zacharias

You could create an address list with specific IP addresses that can access the router either with winbox, telnet or SSH and exclude that IP from the allowed ones... This would require a correct firewall configuration... Also, you could set the allowed IPs under ip/services for ssh, telnet, winbox e...

Zacharias

Also, do not press the reset button before applying power - doing so would switch to a backup bootloader which is usually not what you need.

It will switch to the backup bootloader but the device can still be reset with no problems...

Zacharias

169.254.x.y/16 simply means that you do not get an address from the DHCP server because it is unavailable for any reasons... so it is not a faulty address... you can learn more about it by searching for "Automatic Private IP Addressing"... Did you try to connect the hap to another computer...

Zacharias

The device has a POE in and a POE out port...
What exactly is the question ?

Zacharias

thanks for the follow up Zacharias, is there any conflict on setting this in the parent queue? i can probably try reverting to *default*, and see if there is any change...

No there is no conflict, it simply does nothing... you can test and see how it goes...

Zacharias

You can create a PPP profile, and in that profile you can specify the list you want those PPP clients that use that profile to be added... Example: ppp/profile/add name=ppp-profile interface-list=LAN local-address=192.168.0.1 remote-address=192.16 8.0.2 and then interface/ovpn-client/add name=ovpn p...

Zacharias

Not relevant to the initial question but,
as in the simple queues with a parent-child setup, the queue type should be set on the child queues and not on the parent...
Unless i don't remember correctly...

Zacharias

Yesterday I bought a hAP ac³ which is not cheap and with great disappointment I found that it does not play sounds

Why do you need a beeper ?

Zacharias

Could it be that this particular CAP is talking to the CAPsMAN using L3 rather than L2 @sindy indeed that was the case causing the double traffic counting... However, ( i' ve noticed that in the past too ), setting an Upload/Download Max Limit to Unlimited does not work... Either on a Parent-child ...

Zacharias

I could try that yes, thanks... However, now i was looking on another network with similar setup ( more complex though ) and multiple VLANs, i do use L3 again ( i prefer it ) for communication between CAP and CapsMan i do not observe the same behavior... And the address of the CAP fits in the target...

Zacharias

Could it be that this particular CAP is talking to the CAPsMAN using L3 rather than L2 (i.e. /caps-man remote-cap print shows its IP address rather than its MAC address) and the IP address of the CAP fits into the target of the queue? Why its always that simple ? You 're most probably right... Any ...

Zacharias

Hi, I recently noticed that a simple queue: /queue simple add max-limit=10M/100M name=test queue=\ pcq-upload-default/pcq-download-default target=\ 192.168.23.0/24,192.168.11.0/24 Would count the traffic twice on a Capsman VLAN interface: /interface vlan add interface=bridge name=vlan23 vlan-id=23 /...

Zacharias

@sindy thats just to ballance the weight equally ?

Zacharias

The simplest thing you could do is create a second bridge for wlan1 and wlan2, assign an IP address to that bridge ( different from the one used now ), create a DHCP server on that bridge, and then on policy routing rules for that subnet use as table your ISP2 table.

Zacharias

Revet back to 6.48.6.

Is like you want install Windows 11 on a old Pentium with 1GB of RAM and 1GB of HDD...

I will agree...

Zacharias

R2 adds a tag to what ingresses through the wireless interface using its wireless driver settings... Thats why R2 handles wlan1 and wlan2 traffic as tagged... /interface bridge vlan add bridge=bridge1 tagged=ether2,wlan1 vlan-ids=111 You could as well treat the wireless interface as your ethernet po...

Zacharias

No, it rejects the part where the MRRU of e.g.1600 Byte is requested, then it falls back to 1480 ...

Zacharias

https://help.mikrotik.com/docs/display/ ... cy+Routing

Zacharias

I can see the configuration reject on wireshark when there is a mismatch on the MRRU on any side under LCP protocol...
Any other interesting part i should look into ?

Zacharias

@sindy in general i know that the MRU during the negotiation process is calculated depending on the ppp max payload received compared to the MTU and depending on the sizes the max mru will be calculated...

I am interested to any extra info or reference you have...

Zacharias

That's what i mean, it is pointless if not supported by both sides....

Have you ever wondered why MRU is specified for PPP* interfaces?

You mean MRRU?
why ?

Zacharias

@sindy, how can you specify mrru if you don't know the mrru being used from the other side ? or even if it supports it ?

Zacharias

Thanks @mkx, now i do understand...

Zacharias

So any device with a USB port, could be accessed just using a usb cable ?
I thought it was only possible when a console port existed ...

Zacharias

First seperate the networks of the two ISPs, as you mention both are on the network 192.168.8.0...
The simplest thing you can do is routing rules... https://help.mikrotik.com/docs/pages/vi ... d=59965508

Zacharias

That sounds correct ( i mean that it doesn't work )
You ve added vlan13 on ether1, so what egresses ether1 will have a tag applied.

Since you have a bridge i would advise you to set the vlan direcly on the bridge interface ( supposing ether1 is member of the bridge ) and test again ...

Zacharias

@sindy hap ac3 seems to not have a console port...
So how that would be possible ?

Zacharias

@mkx, but isn't that an example of inter vlan routing ? If a device on e.g. vlan10 tries to reach a device on vlan20, and there is a Router that can route those vlans in between , then vlan10 device will successfully communicate with vlan20 device and vice versa . The way you explained it, i underst...

Zacharias

RSSI = -25 dBm
RSRP = -59 dBm
SINR = 10 dB
RSRQ = -10 dB
RSRQ = -8.0 dB

Those values are good...
You don't mention what LTE device you' re using with what modem... ?
Also, ROS version, firmware version and modem version ?

Zacharias

someone did it on purpose so that they could remotely control that device via virtual serial ...

Could that be indeed possible ?

Zacharias

Yes, but the interesting part would be if we knew what was the reason it didn't work...
For example by a configuration export...

Zacharias

I don't understand what is the point of PVID 10 on your Trunk port ether9... Is there any type of untagged traffic generated from the Switch ( on the left ) where ether8 port belongs that you want to make member of Vlan10 on the right switch ? Even if there is a reason for doing that ( there might b...

Zacharias

You don't need any NAT to access a local device within the same subnet...

Zacharias

Did you upgrade the firmware too or only the ROS ?

Zacharias

Never seen that...

Zacharias

All of those VLANs (3500, 3508, 3510, 3518, 3520, 2528) will be tagged on egress/ingress on the physical interfaces.

They will be tagged on egress...
Not on ingress....

On egress a tag will be applied..
On ingress the vlan id will be checked and removed accordingly...

Zacharias

What egresses the above ports will have a Tag applied...

Zacharias

All untagged packets entering port ether2 will get a Tag applied with VLAN id=10... So your computer becomes a member of Vlan 10.
All packets leaving port ether2 that match VID=10 will have the Tag stripped...

Zacharias

If you can't connect through IP or MAC you can always use a console cable yes...

Zacharias

Export with hide-sensitive, remove manually any more sensitive info and post that configuration inside code tags...

Zacharias

All ports except ether2 are configured as trunk ports... What goes out a trunk port will have a Tag applied, and what comes in must have a Tag... Your ether2 is an access port, so what goes out an access port will have its Tag removed... An exception of the above are the hybrid ports, but those do n...

Zacharias

HAP AC2 has an Atheros8327 switch chip that does support VLAN Tables in hardware but only by configuring the Switch chip directly from the Switch menu. It does not support Bridge VLAN filtering in hardware. So its up to you to decide if you need it or not and what the performance impact might be in ...

Zacharias

The mantbox for some reason does not advertise 1000M...
Did you try however to disable auto negotiation on both sides, and set the speed manually to 1000M full duplex, just for testing ?

Zacharias

Are you sure that is the export ?

Zacharias

What i can see from your picture is that the RBD22UGS does not advertise 1000M...
But on your export it shows that it does advertise 1000M.

Did you try to reset, if possible, the RBD22UGS and check again ?

Zacharias

Distance between crs and RBD22UGS ?

Zacharias

What is the question?

You are so correct on that

... I just guessed that probably the question is why there is no 1gbps advertising from the RBD22UGS

Zacharias

Did you test the SFP on another device ?

Zacharias

What is the export of the command interface/ethernet/print detail where name=ether3

Zacharias

As you can see from the manual, DHCP snooping does not work on Hardware offloaded bonded interfaces. https://help.mikrotik.com/docs/display/ROS/CRS3xx%2C+CRS5xx%2C+CCR2116%2C+CCR2216+switch+chip+features#CRS3xx,CRS5xx,CCR2116,CCR2216switchchipfeatures-DHCPSnoopingandDHCPOption82 Also, according to t...

Zacharias

I totally agree with @sindy. Also take a look here https://mikrotik.com/product/crs354_48p_4s_2q_rm#fndtn-testresults You can see the routing performance of this device... The device has advanced switching capabilities.. i would not use it for routing purposes... I would suggest you a router for tha...

Zacharias

Form the image, appear a MTU error.

How can you tell that ?
Because of different l2mtu between qsfp and ether1 port ?

Zacharias

Hello Probably after a failed firmware upgrade on R11e-LTE6 ,idon't see the "lte" interface. Is a possibility of recovery R11e-LTE6? Never had such an issue. What is the ROS version of your device ? You could try ROS v7 as well... Also what do you mean probably ? When you were upgrading t...

Zacharias

Take a look here https://help.mikrotik.com/docs/display/ROS/CRS3xx%2C+CRS5xx%2C+CCR2116%2C+CCR2216+switch+chip+features#CRS3xx,CRS5xx,CCR2116,CCR2216switchchipfeatures-DHCPSnoopingandDHCPOption82 DHCP snooping does not work on hardware offloaded Bonding interfaces... And 802.3ad ( as well as XoR )is...

Zacharias

am I right in assuming this would be the MAC of the port it connects to on the hEX?

yes

Your problem seems to be DNS related... But since i 've seen no configuration, it might as well be some misconfiguration on the LTE device or the Router...

Zacharias

This happens even if with that website the pcc has been expliciy bypassed.

Can you post your PCC configuration ?

Zacharias

I guess I need to use the serial port

Correct...
Personally, i always have a serial cable with me just in case...

Zacharias

However, I still only get IP through the LTE side as it refuses to resolve DNS (I can open Google.com using it's IP, but click on a link/URL and it says noooo :P) Am not really sure i understand. Who can not resolve a dns ? The LTE device itself ? The Router ? A computer connected on the network wh...

Zacharias

What i would do is, Create a /30 network between the Router and the LTE device, that would be my management VLAN. Then i would use either another VLAN for the passthrough or just the ethx interface. Then on the LTE device i would create a default route pointing to the Router, using the VLAN network....

Zacharias

Please draw a network diagram with at least your router, the CRS328 and any other device ( if any ) between them.
Then export with hide-sensitive the CRS's configuration and manually remove any other sensitive info from the config-export.

Search found 3501 matches