MikroTik

netravnen

Nowhere. The Confluence space is the official DOCs. There are YouTube videos out from 3rd parties about how to set it up. Personally. I am still not fully satisfied with the stability of the IS-IS Daemon. Last I tried on 7.14. I had multiple devices where the IS-IS Daemon crashed after a few days. (...

netravnen

I am all ROS. Due to using the device as a L3 HW-offloaded Switch.

netravnen

Layer2 misconfiguration First Time Configuration Securing your router I recommend using Interface lists for matching incoming (and sometimes outgoing) interfaces in Firewall rules. Using interface lists your can implement a concept similar to security zones, if you wish to do so. Using interface li...

netravnen

Could someone provide a detailed and complete configuration script that includes: The default configuration RouterOS ships with (minus the VLAN 101 tagged on WAN) will get you a good stride to the end goal. if you are looking for the bare minimal configuration to get started using your own Tik rout...

netravnen

Example /route/filter/rule chains add chain=v6private comment="IPv6 Private" disabled=no rule="if (dst in fc00::/7) {accept}" add chain=v6private comment="supernet" disabled=no rule="if (dst in 2001:db8:beef::/48 && dst-len in 60-64) {accept}" add chai...

netravnen

From RFC7348 - Source Port: It is recommended that the UDP source port number be calculated using a hash of fields from the inner packet -- one example being a hash of the inner Ethernet frame's headers. This is to enable a level of entropy for the ECMP/load- balancing of the VM-to-VM traffic across...

netravnen

For me (RB1100AHx2, CRS309-8S+1G, both running 7.15.2 but confirmed on the RB1100AHx2 running 7.15.3) when IS-IS is configured on a VLAN interface that is a slave of a bridge, it kills fast path and fasttrack. I don't know if this is expected behaviour, but took me a couple of hours of digging toda...

netravnen

Hi all. If i specify isis level l2 only. [admin@RouterOS] /routing/isis/interface-template> print 0 instance=isis-instance-1 interfaces=eth1 levels=l2 ptp Mikrotik generate lsp with mistake isis.lsp.is_type field (wireshark notation) in binary 10. Juniper at other side print errors in logs "ba...

netravnen

Is there any chance this device to work with cisco AP or does it have LLDP LEAR 2? "LEAR 2"...? There have been several LLDP additions in the 7.15 - 7.16 branches. Including "LLDP MED Power TLV". https://help.mikrotik.com/docs/display/ROS/Neighbor+discovery#Neighbordiscovery-LLD...

netravnen

Please add a "Client MTU" option to wireguard peer configuration page, in order to set the MTU value in some occasion。 The interface MTU is device local. "Client MTU" must be set on the client side. For it to be part of the "Client Config" (that can be copy-paste) prov...

netravnen

But yes, EVPN and VXLAN in hardware would be a killer.

MVP static VXLAN HW-offload support would be a killer, IMO.

Even if MT charged an extra (non-exorbitant(!), preferably non-recurring) license fee for it. That made the cost less than competing (more expensive) competitor product offerings.

netravnen

With CHR you do not pay for a device and rather for a license, but it probably adds some overhead for Mikrotik, at least to handle these licences and ROS support. I don't think it's about overhead. It's about the fact that you are getting a lifetime license. You are basically funding all future upd...

netravnen

To confirm, You have read https://help.mikrotik.com/docs/display/ROS/OSPF... ? Example config I use (values randomised) on 7.14.3/7.15.1/7.16beta2. /routing ospf instance add in-filter-chain=ospf2-in name=ospf2-main originate-default=if-installed out-filter-chain=ospf2-out redistribute=connected,sta...

netravnen

RouterOS version 7.16 onward adds protocol support for:

CCR2116-12G-4S+
CCR2216-1G-12XS-2XQ
CRS518-16XS-2XQ
CRS504-4XQ
CRS510-8XS-2XQ

Looks promising with the expanded PTP support on newer devices in 7.16.

netravnen

RouterOS version 7.16beta has been released on the "v7 testing" channel! https://mikrotik.com/product/product_generated_in_2024_04_03_16_41_07 After upgrading to 7.16beta[1-2] I have two LTE interfaces instead of a single LTE interface on RBLHGGR...? This behaviour is only visibile after ...

netravnen

*) ptp - added PTP support for CCR2116 device; :) [admin@ccr2116] > /system/ptp bad command name ptp (line 1 column 9) :-( The PTP functionality seems to not be accessible in neither Winbox, nor the CLI... [admin@ccr2116] > /system/routerboard/print routerboard: yes model: CCR2116-12G-4S+ serial-nu...

netravnen

The example from the docs is: Add VLANs in the Bridge VLAN table and specify ports: /interface bridge vlan add bridge=bridge1 tagged=ether2 untagged=ether7 vlan-ids=200,300,400 Add Switch rules which assign VLAN id based on MAC address: /interface ethernet switch rule add switch=switch1 ports=ether7...

netravnen

/interface bridge vlan add bridge=bridge tagged=bridge,sfp1,vxlan1,ether2 vlan-ids=1401 add bridge=bridge tagged=bridge,sfp1,vxlan1,ether2 vlan-ids=1404 add bridge=bridge tagged=bridge,sfp1,vxlan1,ether2 vlan-ids=1500 Skip tagging the bridge interface unless you need an IP address added to the VLAN...

netravnen

what does mean "Unsupported capability received, code: 128 "?

Exactly what the capability codes is.

MikroTik ROS does not (yet) support capability code 128 (Prestandard Route Refresh (deprecated)).

Try disabling the capability on the remote peer.

netravnen

The full list of BGP capability codes are available here: https://www.iana.org/assignments/capabi ... odes.xhtml

netravnen

Thoughts. comments. This normal? Because those gateways are not reachable to router1. When I changed the gw in the filters that breaks it as well.. :(

Could you post an expect for the relevant /routing/filter/* part?

netravnen

CHR is x86_64 though. From a license perspective. The x86_64 is a license tightly knitted to the disk-id. With CHR being "cloud license" that can be moved from one CHR to another without "much hassle". Which is how I am used to perceive it. CHR != x86_64 (from a license perspect...

netravnen

I see what you mean. From the package page is can I added be seen that container is support on both x86_64 VM platform and CHR platform. https://help.mikrotik.com/docs/display/ROS/Packages > *) container - added support for running Docker (TM) containers on ARM, ARM64 and x86 (containers created bef...

netravnen

https://help.mikrotik.com/docs/display/ ... chitecture

According to the table, the container feature is not available on CHR.

The first video in the Container Series on the MikroTik YouTube channel lists the same information. Containers, part 1, 1m5s mark Playlist

netravnen

Depends on what you what to archive. How small you want your/accept your intervals to be. You could look into using MQTT for this (push model). Run a script on the MT device every <interval> which published the current up/down values to MQTT topic(s). Then have your service subscribe to the topics o...

netravnen

Looking into it a layer deeper. The on-link flag /ipv6 nd prefix does make sense in your scenario UNLESS all subnets are located on the same broadcast domain (which I assume is not the case). DHCPv4 support defining classless routes as a DHCP option. The draft for DHCPv6 seems to have not made it pa...

netravnen

I am still not sure how to convince the routing tables on laptops etc. to only route to those three ipv6 address blocks and perfer-v4 otherwise. Perhaps I need to just live with the default route and use firewall to achieve what I want? Maybe I send back an ICMP unreachable for all but the blocks I...

netravnen

For tunnelbroker, there is an example available on the old mikrotik wiki. I recommend using this as a starting reference point for your configuration.

netravnen

See the documentation for getting started with a VPN solution on MT: https://help.mikrotik.com/docs/display/ROS/Virtual+Private+Networks Wireguard is the simplest to get going with. In terms of configuration required. ZeroTier will require at minimum a free account with ZeroTier.com. & connectin...

netravnen

Hello, I have CRS326-24G-2S+RM router at my office and RB760iGS at home, and i would like to setup a secure VPN. I am a newbie to this, can i get some help please? Thank you. The CRS326 is what I would call a great L3 switch with HW-offloading functionality if used within it's documented capabiliti...

netravnen

https://help.mikrotik.com/docs/display/ROS/Traffic+Flow

Why not setup a Mikrotik CHR (KVM) in a lab to validate your design requirements?

netravnen

Looking way back at the comparison table, Virtual Links Supported ( ospf yes / is-is NO ). Isnt that a plus for OSPF? depends. and 'virtual links' is a big ambiguous. IS-IS requires an ethernet-like layer2 interface, it wont run over IPIP or Wireguard for example, but it will certainly work over an...

netravnen

Nice. Just noticed the inclusion of IS-IS in the 7.13beta1. Time for testing it out. :D

netravnen

Yes I know about this option, but I guess to simplify my configuration file I prefer MD5, which I also use in OSPFv2. OSPFv2 can only do MD5 - https://docs.frrouting.org/en/stable-9.0/ospfd.html @vecino From the GitHub Issue tracker ( frrouting/frr#14398 ) It would seem HMAC SHA support in OSPFv2 i...

netravnen

MD5 encryption still doesn't work with OSPFv3 - testing between FRRouting 9.0.1 and 7.12. FRRouting vs FRRouting works fine. config: /routing ospf interface-template set *9 area=backbone-v3 auth=md5 auth-id=1 auth-key=************** ... log: default-v3 { version: 3 router-id: 10.***.***.1 } backbon...

netravnen

is-is is not TCP/IP, it's CLNP.

I know.

Why would it require IPv4 or IPv6 addressing to function?

feeling confused

Unable to comprehend how to respond

netravnen

I use QSFP to SFP28 adapter in CRS326. Auto negotiation is not working, link ok if only forcing 1G or 10G, but i need 25G. Just to be sure I got you right. Are you trying to run the ports at 25 Gbps speed in the CRS326-24S+2Q+RM that only supports 24x 1/10 Gbps, 2x 40 Gbps ports? From the brochure ...

netravnen

Yes. It is possible to run MPLS over Layer 2 tunnels over the internet. Think GRE, openvpn, L2TP, openvpn, VXLAN, and Zerotier tunnels as examples. Apart from which layer 2 tunnel type you use. Keep in mind the encryption overhead if going with GRE or L2TP or VXLAN. (usually openvpn, wireguard, or i...

netravnen

You will lose this device under windows. No driver support. Running stock kernel from upstream Debian or Ubuntu? (Can't see which linux based distribution you use.) Have the card myself running under proxmox with latest upstream 6.4.x kernel from proxmox no-subscription repository. To configure the ...

netravnen

viewtopic.php?p=1031026#p1031026

netravnen

viewtopic.php?p=1031026#p1031026

netravnen

Nothing confusing here

🆗

netravnen

Warning: mild rant about a confusing product name NEWSLETTER APRIL 2022 (#105) Read our latest newsletter and learn more about: * LHG LTE18 kit Argh. This is confusing. That both "LHG LTE18" and "LHGG LTE18" are used for this model. The product naming without double-G is IMO inc...

netravnen

Point 7. is what you are looking for. Before contacting us: If you have purchased your device from a distributor, please contact them first. Check documentation and configuration examples. Maybe answer is already there. Make sure that your issue is present with the latest version of MikroTik RouterO...

netravnen

Code bits has arrived. /routing/stats/process/print where tasks=isis # TASKS PRIVATE-MEM-BLOCKS SHARED-MEM-BLOCKS PSS RSS VMS ID PID RPID PROCESS-TIME KERNEL-TIME MAX-BUSY MAX-CALC 11 isis 0 0 0 0 0 12 402 1 2s870ms 3s340ms 10ms 10ms /ip/route/print where is-is /routing/route/print where is-is Havin...

netravnen

Hmm. Looking at the 7.12beta and 7.12rc changelog and no mention of IS-IS... Might be punted to after 7.12...

netravnen

Have you tried finding blogposts? https://nickvsnetworking.com/wireguard- ... -routeros/

netravnen

This looks weird (sfp-sfpplus3). I know the one bond is disabled. But still..

/interface bonding add disabled=yes mode=802.3ad name=Link_to_IT-lite slaves=sfp-sfpplus2,sfp-sfpplus3
/interface bonding add mode=802.3ad name=to_ccr slaves=sfp-sfpplus3,sfp-sfpplus4

netravnen

All the IP addresses are not assigned to an interface defined under /interface/vlan ? Assigning IP addresses directly to interfaces in a bridge or a VLAN interface defined under /interface/bridge/vlan is afaik the incorrect way of doing it with CRS3xx series switches. If HW-offleading is to be archi...

netravnen

All of a sudden BGP stopped working, no Connection, no Templates, nothing configured.

Any indicators of the "error" you gathered afterwards? Any log entries indicating what could have had happened?

netravnen

From another forum post about the same topic, I have the CSS610-8G-2S+ switch. Using the Mikrotik S+RJ10, the SwOS lite gives you the option to set manually only 1G, 100M & 10M speeds. On auto speed mode (and only on auto) you can get 10G, 5G & 2.5G speeds. The other side is connected to my ...

netravnen

What if you set autonegotation off on both sides and set speed on 5G ? Or 2.5G ? This might be what you are missing. 1. Force the same speed on both ends of the link, and 2. disable auto-negotiation completely on both ends of the link. /interface/ethernet/set <INTERFACE> speed=5G-baseT auto-negotia...

netravnen

Hello, first time poster. I'm redoing my old homelab and have purchased two CRS328-24G-2S+RM switches and a hEX S for firewall. I've been trying to MLAG the hEX S across both switched and am missing something so I decided to create a virtual environment in VMWare workstation to play and debug what ...

netravnen

https://help.mikrotik.com/docs/display/ ... l+Overview

According to the wiki. It is on the way with snippets initial code arriving in 7.12

netravnen

https://help.mikrotik.com/docs/display/ ... l+Overview

Initial support is listed for 7.12. So I assume more features to arrive IS-IS related in the future.

netravnen

> CCR2004/CSS326-powered gaming festival

viewtopic.php?p=1016956#p1016956

netravnen

Noticed on the Youtube stream of CrossTalk solutions a CCR2216-1G-12XS-2XQ being used at the LTX 2023 WhaleLAN event. ⟶ https://youtu.be/A-6vv_FG2B4?t=2218

netravnen

According to this page ⟶ https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading#L3HardwareOffloading-L3HWMACAddressRangeLimitation(DX2000/DX3000seriesonly) Creating multiple bridges The devices support only one hardware bridge. If there are multiple bridges created, only one gets hardware...

netravnen

Hi, My main issue/trouble with how the Prefix ID assignment is done. Is that I reboot the router (software upgrade). I cannot count on the Prefix (i.e. the /64 sub-delegated [by the ROS router] out of SP delegated /48) being stable. Meaning I experience a changing /64 Prefix. Which is quite annying....

netravnen

@MikroTik, Does RouterOS v7 support specifying a static "IPv6 Prefix ID" on per-interface basis? Just rebooting my MikroTik router is a frustration. Due to every IPv6 enabled Local Area Network Interface changing the assigned /64 Subnet. To clarify, my provider assigns a reasonbly static /...

netravnen

+1

1. EVPN

netravnen

if (bgp-as-path 11111|22222) {reject} else {set bgp-local-pref 120; accept;} From https://help.mikrotik.com/docs/pages/viewpage.action?pageId=74678285 bgp-as-path {regexp} If the regexp follows normal syntax should the path not be written as "^(11111|22222) .*"? if (bgp-as-path "^(11...

netravnen

Running RouterOS 7.1rc4 on a CCR1009-8G-1S-1S+. I set up a DHCP Client to request a /48 Pool from my Provider. Now I want to provide a /64 from this Pool to two VLAN's. But the system tells me that the Pool is exhausted after the first /64 assignement. Did I do something wrong? https://help.mikroti...

netravnen

Is the set-up like this? LAN --> MT router --> WG tunnel --> VPS --> Internet, where the MT router is doing the PAT towards the Internet? Or LAN --> MT router --> WG tunnel --> VPS --> Internet, where the *VPS* is doing the PAT towards the Internet? (PAT: Port address translation, aka. Firewall mang...

netravnen

_As a MikroTik user and product consumer I want better reliability in performing manual upgrades So that the possibility for ending up with a broken install is limited_ ## Description Recently I performed a manual re-install of a CRS326 with ROS 7.1b6. By mistake, I downloaded the wrong image from t...

netravnen

you think really routeros go test from If done on a reactive basis with the dns server on the network being the routeros gateway. And done before the connection + dns reply is delivered to the client on the inside of the gateway router. It should (in theory!) be very feasible to implement. Entries ...

netravnen

use these lists for traffic forwarding, not blocking

What about a solution using an external server to expand e.g. the Google as-set (using e.g. bgpq3) into an ip-prefix lis. That could then be imported (push from server, or pull from RouterOS) as an address list into the firewall config context?

netravnen

Use an external DNS server as a work-around (i.e. dns blackhole, instead of blocking the traffic on IP level.)

# The wildcard domain (*.google.com) and all subdomains will be resolved as 127.0.0.1 - dnsmasq.conf
address=/.google.com/127.0.0.1

netravnen

Did some testing with the new MLAG feature and wrote a blog post on it. Have you considered e.g. using a GRE tunnel interface as the peer-port to be able to ensure IP multi-path redundancy in your test topology? Thereby avoiding relying on the physical peer interface not being interrupted during no...

netravnen

https://help.mikrotik.com/docs/display/ROS/ROSv7+Basic+Routing+Examples

/routing/bgp/rpki
add group=myRpkiGroup address=192.168.1.1 port=8282 refresh-interval=20

/routing/filter/rule
add chain=bgp_in rpki-verify=myRpkiGroup
add chain=bgp_in match-rpki=invalid action=reject
add action=accept

?

netravnen

https://help.mikrotik.com/docs/display/ROS/v7+Routing+Protocol+Status Seeing as the focus is on OSPF as the IGP of choice. Unless the routing daemon powering RouterOS is "best of breed" open source(ish) choice... IS-IS in RouterOS I can only see in a far far far away future. As it's the ch...

netravnen

It's insane with ISPs that use PPPoE in such speeds. Customers will spend most of their CPU resources to encap/decap packets. It's just sad. Can you say AS3320 Deutsche Telekom ... :( Had to ditch my trusty 2011, since routing with pppoe (WAN), NAT, and a few dusin FW rules, anything (DL) much more...

netravnen

Does MikroTik have any plans to support IPv6 for the management of devices running SwOS?

I wish they have the feature in the pipeline. It's similar to waiting for ROSv7. You know the feature is coming some day. Just not what the expected timeline for its release is.

netravnen

If you execute a packet capture for 564/tcp on either the router, client or middle device in the path. Does the contents for the packets reveal anything?

netravnen

Hi! Still need an RPKI implementation. Here in Brazil, our RIR start to permit the use of RPKI. And here in Latin America a great number of ISP running they ASes on Mikrotik boxes. A major PRO PLUS for implementing RPKI support directly into ROS! The business case becomes stronger and stronger for ...

netravnen

Yes, SwissIX for example. YYCIX in Calgary AB, Canada is starting to implement as well. https://yycix.ca/communities.html I'm sure it's just a matter of time before we cannot even peer in the in exchange without it. Validity state Standard Extended Large Prefix is included in client's AS-SET None N...

netravnen

Thank you very much for this information. Any idea when ROS 7 will be available for testing? I'm willing to test RPKI for you (IPv6 and IPv4 routes) if you send me the code as soon as it's available ;) I agree with J.Z. here. If you are willing to accept select community members into an Alpha stage...

netravnen

We have plans for RPKI in RouteroS v7 Any chance one can be a test pilot along-side Jan Z. on this one? Alpha testing ROS 7? 2014 was around first time RPKI was asked about. Not we hit 2018.... Still ways to go for ROS 7 being available with RPKI and Large BGP Communities support (I assume?).

netravnen

Have MikroTik ever had a discussion about the format of rackmounts. So to be able to mount TWO instead of only ONE RBx00x device in 1 rack-unit ? Would love to have the option of mounting 2 RBx00x devices in 1U instead of having to use 2U. See this example from Juniper SRX100: https://rickmur.com/wp...

netravnen

Didn't you hear? Almost all v7 features have been backported to v6! No. I have not (before now) stumbled across that information. At least we now have kids control and detect internet! Super essential features for routers running BGP in the public internet :lol: :lol: So looking forward to when Rou...

netravnen

Looking away from RouterOS v6.x running IPv6 BGP [tables]? Not being able to verify IPv6 routing table (when not main table!) is really a big deal. (But seeing the routes exists by the number the route counter shows. :sigh:) And doing policy routing rules for anything else than main table in IPv6. I...

netravnen

Dear MikroTik, The following 3 feature are partly a major showstopper for me when trying to deploy IPv6 here in 2018. 6 years since 2012 and 20 years since the RFC was published in 1998. 1. No way to view IPv6 not in main routing table. (Imported via BGP peering sessions from eBGP speakers over IPv6...

netravnen

+1

dnscrypt-proxy added as a separate npk package ?

So initially not a full-blown server. Just a forwarder.

Search found 83 matches