MikroTik

tdw

Fasttrack is not compatible with mangle, disable or remove the fasttrack-connection firewall rule.

tdw

I don't think that covers using the Qualcom/Atheros switch chip in the hEX PoE, only VLAN-aware bridges which would be handled by the CPU in this case and not achieve anything near wire-speed throughput. I've not had any slowdowns when configuring VLAN support directly on the switch chip, the existi...

tdw

For the OPs use case port isolation would likely not be sufficent. In this case creating a bridge, adding all of the ports to it and setting use-ip-firewall=yes under /interface bridge settings would provide the the most flexibility, but as pointed out is handled by the CPU so not going to achive wi...

tdw

It's more a case of undoing src-nat, but yes one of the main uses of connection tracking is to handle this. It is possible to apply both src-nat and dst-nat to a connection if a particular use case requires it. You would not be able to do away with connection tracking and have separate reverse rules...

tdw

Are all of your internal addresses within 10.42.0.0/16, otherwise they are different. For packets from the router itself you need a mark-routing rule in the output chain as this never hits prerouting . I've found mixing marking in mangle and routing rules can be confusing in complex setups. Certainl...

tdw

A quick search suggests that people have used other routers successfully, but Lit use an oddly small delegated prefix size of /62. It may also be worth experimenting with setting the DHCPv6 client rapid-commit=no (I believe the default is yes), you could try also try specifying prefix-hint=62 and po...

tdw

- but binding dhcp server to vlan 400 interface is not possible because it runs as slave device from ether 4. It is possible, the vlan400 /interface vlan attached to ether4 is not a slave, this term applies to members of a bridge. It is also not possible to bind two dhcp server on the same interfac...

tdw

It can be difficult getting past first-line support who typically know nothing and are working off scripts. You may have to resort to using the packet sniffer to capture the IPv6 RA and DHCP packets to see what is going on. I don't know if Lit use the router WAN MAC address to link prefix assignment...

tdw

If you will never require the VLANs to be present on more than one physical port then you can attach an /interface vlan directly to a port. The do not work as drawn, they merely add a VLAN tag for packets passing in one direction and remove it for packets passing in the other. Consider /interface vl...

tdw

Since the introduction of VLAN-aware bridges some years ago a single bridge is the recommended method. There are various potential issues when using multiple bridges https://help.mikrotik.com/docs/spaces/R ... figuration

tdw

Why is it that you have to specify `untagged=ether6` after you've already assigned the pvid (`pvid=200`) while adding `ether6` as a bridge port? You do not have to. What happens if I don't add `ether6` to VLAN 200's `untagged` list? It is added dynamically based on the PVID setting. There may have ...

tdw

You may have to add options to your logging rule to see detailed information - typically debug , and if there is too much output !packet can be useful too. The address looks fine - IPv6 uses link-local addresses in many places, rather than global unique addresses. Unfortunately the IPv6 standards al...

tdw

I'm frequently amazed about how few providers implement network ingress filtering per BCP38, if more did it it would help cut down spoofed address DDOS traffic. The route marking should be applied to everything except the ingress interface, otherwise packets will immediately be forwarded back out as...

tdw

Any advice?

There should be no need for routes or tunnel IP addresses as BCP is layer2 not layer3. There is an example in the old Wiki https://wiki.mikrotik.com/Manual:BCP_br ... _bridging) which has not been migrated to the new help pages.

tdw

L2 tunnels: https://help.mikrotik.com/docs/spaces/ROS/pages/100007937/VXLAN https://help.mikrotik.com/docs/spaces/ROS/pages/24805521/EoIP The OP appears to be attempting to use Bridge Control Protocol (BCP) which is part of the PPP standards. It might be considered old-fashioned compared with newer...

tdw

Why is it not sugestable to run a management vlan on vlan 1? I saw a lot of configurations, where people uses vlan 1, too. There is nothing technically wrong with using VLAN 1 or running management on it, you just have to be very aware of how different vendors use VLAN 1. With Ubiquiti the UniFi de...

tdw

When layer2 hardware offloading is active packets passing through the switch are not seen by the CPU at all https://help.mikrotik.com/docs/spaces/ROS/pages/328227/Packet+Flow+in+RouterOS#PacketFlowinRouterOS-FlowofHardwareOffloadedPacket so the packet sniffer will see nothing. You could add switch r...

tdw

Did you add the additional routing table? Unlike RouterOS v6 you have to explicitly create them in v7:
/routing table
add disabled=no fib name=WAN-A1

tdw

Historically the Mikrotik DHCPv6 server has only supported prefix delegation, not handing out individual addresses. The latest testing branch release (7.17) adds address delegation, details in the help pages https://help.mikrotik.com/docs/spaces/ROS/pages/24805500/DHCP#DHCP-EnablingIPv6Addressdelega...

tdw

MAC-based mechanisms don't provide authentication as it is trival for anyone to spoof a MAC address and gain access. Any authentication and authorisation setup will require ongoing management, if you already have a database of user credentials such as Windows / Azure AD it is possible to use those f...

tdw

There is a LTE interface: /interface lte apn set [ find default=yes ] ip-type=ipv4 use-network-apn=no which cannot exist on a mAP lite. And ovpn/hotspot/ipsec/bfd settings that seem to have no reason to exist. Likely a result of upgrading from RouterOS v6 to v7 as the config conversion isn't great,...

tdw

1.25Gbps max for connection speed BUT with a maximum data speed of 1Gbps and when you look at the block diagram, you'll see why. The optical data rate is 1.25Gbps as the PHY uses 8b/10b encoding - 1Gbps * 10 / 8 = 1.25Gbps . Each block of eight bits is encoded into ten bit symbols with no more than...

tdw

The .backup files are only intended to backup and restore the configuration on the same router. Mikrotik advise against restoring them even on the same model, let alone a completely different one. Create a .rsc with /export (or /export show-sensitive on RouterOS v7) on the existing device, this is a...

tdw

Multiple NAT tends not to be problematic these days, certainly Skype and other video calling / VoIP services are fine. Various gaming protocols are problematic with any sort of NAT, not much you can do about it. The CPU in the Cube is reasonably powerful so using one of the pair to provide router fu...

tdw

IP>Neighbours will show the CDP, LLDP & MNDP information received by device ports, adding the Interface Name column provides the port name on the other devices. If the device in question is not configured to send discovery information then Bridge>Hosts shows the source MAC addresses received by ...

tdw

So a device plugged into ether3 or ether5 receives an address from the range your base untagged network uses, and plugged into ether4 from the range VLAN 20 uses. Does configuring a port with a PVID of 10 similarly provide an address from the range VLAN 10 uses? Have you tried temporarily plugging t...

tdw

Did you previously have an IPv6 address assigned to the VLAN in question? It may be that if you add an address and then remove it the Mikrotik requires a reboot to stop the advertisment. There a a few things where a reboot is required to get the state consistent after changes, in this case it could ...

tdw

The switch VLAN setup looks OK - sfpplus1-4 are untagged with VLAN 10 and VLAN 20 tagged, ether1-24 are untagged only. There are some unnecessary entries in the switch configuration which I would suggest removing: /interface vlan add interface=sfp-sfpplus3-wall name=appletalk vlan-id=20 add interfac...

tdw

Managing the MikroTik on the untagged on the bridge and have the access point connected to ether2, which is untagged. It needs the VLANs for the SSIDs on the AP added as tagged. I'm unsure of your last question but I am forwarding DHCP from OPNsense but the VLAN have a static range they are assigne...

tdw

Which VLAN are you using for management of the Mikrotik (untagged on the bridge, VLAN 10 or VLAN 20), static or DHCP-assigned address, and which port is the AP plugged into?

tdw

How can I stop tagged vlan traffic from the switch leaking to the untagged vlan on the router? What do you mean by leaking? Is it possible to use a "hybrid port" with both unagged traffic and tagged traffic to trunk the VLANs between switches? Yes, although some people dislike this arrang...

tdw

The same with pinging, I can ping the neighbor if everything is configured on the interface, but cannot if it's configured via vlan. If you can't ping the other end of the /30 then it has nothing to do with OSPF, it is something more fundamental than that. Maybe firewall, impossible to tell without...

tdw

If your OPNsense router is providing VLANs and DHCP services the only configuration on the Mikrotik should be bridge ports & VLANs plus management address.

Is the AP you are setting up another device, or on this Mikrotik in which case there appears to be no configuration for it.

tdw

port 1 - truck, tagged (vlan1) to port 2 on main router port 3-39,41-42 (untagged) (41-42 to OOB of fiber switches) Vlan100 The default for Mikrotik bridge ports, including the internal bridge-to-CPU port, is VLAN 1 untagged. Many of the default settings do not appear in /export so this is not imme...

tdw

address=::90 from-pool=fiber6 specifies a local host address of 0000:0000:0000:0090 with a prefix from the pool. There is a longstanding gripe that you can't provide a prefix hint, e.g. ::90:0:0:0:1

tdw

AFAIK the required helpers for the MAP-E, MAP-T, 464XLAT and Lw4o6 methods are missing from RouterOS, the only successful implementations I've seen use DS-Lite. If enough people ask Mikrotik to add some/all of them it might eventually happen.

tdw

In the release notes for 7.13.x: Notice - Starting from RouterOS version 7.13, significant changes have been made to the RouterOS wireless packages. This is done due to a new product development which will require more disk space for hardware drivers so we had to split it in order to maintain old pr...

tdw

You have not fully configured user manager, see https://help.mikrotik.com/docs/spaces/ROS/pages/92635137/Enterprise+wireless+security+with+User+Manager+v5 There are differences between the original wireless and newer wifi drivers. From the help pages for the wifi driver "Properties related to E...

tdw

So i need to assign a remote-address in the ppp profile for the openvpn server, correct? But if i do this, the dhcp-server ist still invalid. Yes. Creating a DHCP server is not necessary. I changed the interface from dhcp-server from "ovpn-in1" to "bridge" and know the dhcp-serv...

tdw

Most VPNs are IP / layer 3, not ethernet / layer 2 and have their own mechanisms for client IP address assignment, they do not use DHCP. If the IoT devices are using their own inbuilt OpenVPN client the address will be provided from the pool or explicit addresses in the server PPP profile or secrets...

tdw

"vlan 100 between all switches as its OSPF routing vlan 100 and in turn PVID 100 between ports" is confusing - is VLAN 100 tagged or untagged from Site A - CRS / CRS - CRS / CRS - Site B. The posted configuration currently expects VLAN 100 tagged so changing ports to have a PVID of 100 wou...

tdw

Currently the bridge is not set to be VLAN aware so all tagged or untagged packets will pass between any ports, management will use VLAN 100 tagged. What are you trying to achieve?

tdw

No, it doesn't appear that model supports fast ethernet SFPs. See https://help.mikrotik.com/docs/spaces/R ... ansceivers

tdw

Likely you are mixing tagged and untagged on the bridge-to-CPU port, if you set pvid= on the bridge itself there should not be an /interface vlan attached to the bridge with the same VLAN ID. Post your configuration, otherwise it is just guesswork.

tdw

When creating the two RADIUS clients set service to direct requests to the desired server - hotspot for HotSpot authentication, or ppp for Point-to-Point client authentication (includes PPPoE)

tdw

AFAIK Mikrotik have only implemented RFC 3580 (single untagged VLAN) dynamic VLAN assignment, to support 'untagged plus one or more tagged' would require RFC 4675 (multiple tagged/untagged VLAN) too.

tdw

Disabling the secret will only prevent new connections from authenticating, existing connections will remain connected.

tdw

I do have the mikrotik router acting as a dns server, basically a caching server. Why? If the Mikrotik is configured in bridge mode it is acting as a switch, I would expect all of the usual gateway functions (DHCP, DNS, firewall) to be handled by your WatchGuard device. If the Mikrotik is providing...

tdw

I'm not sure how the entries have appeared in the Mikrotik ARP table unless those devices have been attempting IP communications with it. The Mikrotik ARP modes are detailed in the manual https://help.mikrotik.com/docs/spaces/ROS/pages/100892687/ARP#ARP-ARPModes . There is no equivalent to the ARP-R...

tdw

IPv6 gateways are usually a link local address, the client specifies both the link-local address and interface in its routing table - they should appear as link-local-address%interface

tdw

If the Mikrotik is operating as a layer 2 bridge the only ARP traffic destined to or from the Mikrotik will be for its management and the gateway addresses, typically you would have a single ARP table entry on the Mikrotik for the gateway. The gateway ARP table will contain entries for all of the cl...

tdw

When using remote addresses for a VPN connection from a subnet which is attached to an ethernet-like interface (ethernet port, vlan, etc.) you have to enable proxy ARP otherwise local devices on that subnet cannot reach the VPN client. Firewall rules may then prevent traffic as although the addresse...

tdw

Large L2 broadcast domains can be problematic, especially if you exceed the maximum forwarding table entries in switches across the network. Each VLAN should have a separate IP address range and gateway, otherwise it would need some likely bodgy combination of proxy ARP, VRFs and NAT. There should b...

tdw

Also, you only need create /interface vlan entries for VLANs accessing IP services on the Mikrotik itself, for VLANs which are just passing between switch ports they are unnecessary.

tdw

With no firewall rules the Mikrotik will forward packets unless explicitly disabled. What does /ipv6 route print show? And is the ISP routing the additional prefix to the Mikrotik WAN address, or just presenting it on the WAN link? The latter requires the somewhat hacky ND proxy, which Mikrotik does...

tdw

If you have been allocated allocated P.P.P.160/28 why is the router .162/30? It should be /28, and enable proxy-arp for the public PPPoE clients to work. There is no /ppp profile named RCL-Admin referenced by the entries in /ppp secret , there is one named Admin . Not sure why you have local-address...

tdw

@tdw, as I mentioned in my initial post, my primary intention is to configure it statically. I’m simply assigning addresses to the ether4 and ether6 interfaces. Once I manage to achieve external access through the global address I defined for them, I’ll move on to configuring the devices behind tho...

tdw

There doesn't appear to be any active entries under /ipv6 nd so devices attached to ether4 or ether6 will not be sent router advertisments telling them what the network prefix or gateway address is.

tdw

Terminate the ISP IPv6 connection on the Mikrotik, use the DHCPv6 client to receive a delegated prefix and the DHCPv6 server to serve some of this to the other router.

tdw

Search for the errant MAC address in the bridge hosts table on the switches and radios in your network. You should really have DHCP snooping or bridge filters / switch ACLs to prevent rouge DHCP servers, otherwise genuine clients who are closer (in terms of round-trip time) to the problem client sit...

tdw

The EN7562CT seems to be some internal code of Mikrotik as Google can only find it on Mikrotik pages I did find a teardown of a TP-Link router for the Chinese market which uses it https://www-acwifi-net.translate.goog/25800.html?_x_tr_sl=zh-CN&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc and in...

tdw

SNMP v1 & v2c are not particularly secure, however as SwOS doesn't support writes the worst case is information disclosure. There are other issues with SwOS - the UI uses basic digest authentication, content is not encrypted, the password is stored as hex ASCII in the configuration file. Some mi...

tdw

Just reran some tests. While traffic testing and pushing about 1Gbps (laptop to wAP AX , UDP, over Wifi) , cpu on Hex Refresh was 0 to 1%. All ports have H indicator except for ether1 (which is to be expected with the new HW config). I swapped the Refresh for the old Hex I have at my desk. I used e...

tdw

As IPv6 requires multicast any badly behaved or configured switches inbetween can prevent IPv6 from working, faulty implementations of DHCP or IGMP snooping are often the cause. So if you have switches between your router and end device(s) check if connecting a device directly to the router works as...

tdw

TDW's route will lead to graying or loss of hair. This is the sort of scenario 802.1X was designed for. There may be wrinkles in the Mikrotik implementation, which would be addressed with more use and feedback, but with FreeRADIUS and HP switches 16 years ago it was fine. (Odd silvering appeared be...

tdw

Setting pvid= is irrelevant with frame-types=admit-only-vlan-tagged as untagged packets are discarded.

tdw

It depends on the capabilities of the switch chip. Certainly the CRS1xx/2xx devices support MAC-based VLANs, the CRS3xx/CRS5xx devices do too but probably not in a suitable way for your use case. Dot1x would probably work, the port connected to the device at the couch would be set up to use your hom...

tdw

I can't recall if not having a gateway= setting under /ip dhcp-server network omits a gateway being sent, certainly the Mikrotik will make up DNS servers if there is no entry unless the No DNS option is set. If it does there seems little point in changing it with a script based on external gateway r...

tdw

I've read through the link, and from the best of my understanding, I have VLAN 1 set as tagged on the CPU-facing bridge port? Or am I completely missing something? Yes, however /interface bridge add name=LAN-bridge includes default settings of pvid=1 and frame-types=admit-all which presents VLAN 1 ...

tdw

As @mkx states it is unlikely to work nicely. As the ethernet ports presented in the UI are logically multiplexed over a single connection between the switch chip and CPU, using proprietary vendor headers added to the packets, there can be undocumented interactions between software features and prog...

tdw

shouldn't it then "retry" them after 1 minute like it says it will? Bug notwithstanding there are various DFS timers: Channel availability check (CAC) where the radio listens before selecting a channel for use, this is 1 minute except where any of the channel overlaps with 5600-5650MHz in...

tdw

Because the channels you restricted it to use are only DFS ?
All UK & Europe outdoor fixed wireless channels require DFS

tdw

The upnp and nat-pmp settings are unnecessary if the local device is originating the connections. In any case for setups where you do not have a public IP on the client router only PCP works and requires support in the providers AFTR (DS-Lite) or CGNAT (IPv4 only) gateway. With DS-Lite there should ...

tdw

There is no sign of any /ipv6 address or /ipv6 dhcp-client in the export yet you have DHCPv6 logging data

tdw

With the default configuration anything initiated from a LAN device has access to the internet - you don't have to add anything, so what are you trying to achive with these additional rules?

tdw

Having a link local address for the default gateway is normal. Provide all of your IPv6 configuration, not just part of it - commonly the DHCP client settings should not add a default route and only request a prefix, not an address, also there should be no /ipv6 nd entry for the interface providing ...

tdw

Think about re-using legacy 2-wire cabling in your house. It is unlikely to be of good enough quality. 100BASE-T1 requires a pair with specifications similar to Cat5e and 1000BASE-T1 similar to Cat6A, both have a reach of 15m being primarily targeted for automotive use. 10BASE-T1L has a reach of 1k...

tdw

The SoC appears to be from Airoha, and being a subsidiary of MediaTek I doubt there will be any useful information on the open web. From the block diagram the switch chip is only connected to four of the five ports so it can't be used as a wire-speed 5-port switch, unlike all of the previous 5-port ...

tdw

CCR2116: Port 13 has 2 VLAN interfaces, each VLAN interface assigned to separate bridge, an IP address assigned to each bridge. Two bridges, two subnets. There are many pitfalls with this approach https://help.mikrotik.com/docs/spaces/ROS/pages/19136718/Layer2+misconfiguration , use a single VLAN-a...

tdw

It isn't a property. As an aside I'm not sure why load appears in both properties and monitor values, logically it would only be in the latter with the other measured data. To display from the command line :put ([/system/ups/monitor 0 once as-value]->"line-voltage") If you wish to access m...

tdw

Another very sad thing about the new device: it has passive PoE-in with input voltage range of 12V-28V. MT really should move to 802.3 PoE-in ... Reducing the range (the current hEX and many older products support 8-30V) makes it useless for sites with 12V float-charged lead-acid batteries which va...

tdw

At the end of they day it's down to personal preference, as switches and APs are not doing any routing I prefer disabling that functionality with /ip settings set ip-forward=no and /ipv6 settings set forward=no . With the IPv6 change the device becomes a host rather than a router - these roles have ...

tdw

/ipv6 nd set [ find default=yes ] disabled=yes Can I take from that advice that you believe the ND implementation in RouterOS is useful only for the device that owns the IPv6 prefix, as opposed to clients? That is, that RouterOS doesn't know how to acquire IPv6 addresses via NDP itself? Rather it h...

tdw

Some bridge settings broke multicast until very recent versions of 7.x which prevented IPv6 from working properly The /ipv6 nd settings cover parameters for both hosts and routers, you should not be advertising anything on the switch as it is a host device not a router. My settings for a device runn...

tdw

A port can only be a member of a single bridge. The default behaviour of a bridge is to act in the same manner as an unmanaged switch - it learns MAC addresses and forwards packets with any ethertype including untagged IP or tagged VLAN. To change the behaviour so differing VLANs can be passed throu...

tdw

By default OSPF instances will use the main routing table, you can specify a VRF to be used instead.

Otherwise you may be able to use protocol property in your existing filter to determine the source, there are also rtab and vrf properties for routing table and VRF names.

tdw

Local services have no access to VLAN 10 with that configuration - add the bridge as a tagged member of the VLAN under /interface bridge vlan and create an interface vlan attached to the bridge.

tdw

The DHCPv6 server cannot be used to assign individual client addresses https://help.mikrotik.com/docs/display/ ... CPv6Server

tdw

None of the UniFi controllers do, Ubiquiti reserve VLAN ID 1 within their switches and access points for untagged traffic. You can untag any VLAN you wish on the Mikrotik hybrid port (e.g. VLAN 10 in Anav's example), being untagged on the wire any use of a VLAN ID within a particular device is irrel...

tdw

You would still get a web browser window opening when the captive portal is detected, it may be possible to configure the browser to provide SSO credentials at this point. For deployments with many users it is more common to use WPA2-Enterprise for WiFi and 802.1X for wired connections - there is no...

tdw

See https://datatracker.ietf.org/doc/html/rfc6333 section 4.2

tdw

The Mikrotik DHCPv6 server only provides prefix delegation not client addresses, see https://help.mikrotik.com/docs/display/ ... -Summary.3.

If your clients do not support or you do not wish to use SLAAC you will have to set up a third-party DHCPv6 server

tdw

Also see viewtopic.php?t=184070

tdw

The OP is using a layer 3 switch to provide the routing for their VLANs, not the Mikrotik. I have not tried it, but from the documentation all of the DHCP servers should use the same interface= setting (the OPs bridge in this case) and also specify the Relay Agent IP with relay= for the correspondin...

tdw

I was just about to post suggesting setting add-default-route=no to the DHCPv6 client so the PPPoE default route is used. What are the /routing rule entries for? I've made posts previously regarding DS-Lite setup. These used AFTR provided by DNS, they would need some modification to use the DHCPv6 o...

tdw

Providing the print output from a random set of sections isn't particularly helpful, post the output of /export in a code block (the [] icon above the message box when composing a message) after redacting serial number and any other identifying information. The usual errors with setting up IPv6 is n...

tdw

Given the addresses posted previously you have set the NTP client on the modem to use 192.168.0.1?

tdw

Certainly in the current firmware (v5.2.5) you cannot set a default route - under Configuration > Routing when adding a new route only subnet masks of /8 to /32 are supported, so unless you know the specific address range an external NTP server, and that it will not change, using the Mikrotik is a b...

tdw

The Vigor has no routes other than 192.168.0.0/24 so cannot communicate with anything other than the directly connected Mikrotik. I normally enable the NTP server on the Mikrotik, specify its address (192.168.0.1 in this case) on the modem, and add a firewall rule to allow UDP port 123 input from th...

tdw

Yes, the election process will be the same as described for RouterOS https://help.mikrotik.com/docs/display/ROS/Spanning+Tree+Protocol#SpanningTreeProtocol-Electionprocess as this is defined by the protocol. There doesn't appear to be a mechanism to manually adjust the port path cost in SwOS, it is ...

tdw

An interface cannot be both tagged and untagged for egress with the same VLAN ID

tdw

No. The RADIUS servers enabled for a particular service are tried in order specified. The later ones are only used if there is no response, an accept or reject response terminates the request. If the first two servers are only for the login service you could remove the ppp service from those, the th...

tdw

A route gateway is usually an IP address through which the target addresses are reachable, an interface name is normally only used on point-to-point links with /32 addresses. So in your case it would be 192.168.0.x where this is the address of the router which is also connected to the 192.168.122.0/...

tdw

According to the description in the OP, folks at the ISP use the method mentioned in par. 4.1.4 of the RIPE document, i.e. they sacrifice a single /64 from the /48 they gave you as a link subnet. I still suspect on their side of the link they are doing the equivalent of /ipv6 address add address=20...

tdw

Out of interest how is the provider supplying the /48? If they are just presenting a /48 directly rather than routing it via a transit subnet they are one of the providers who really don't know what they are doing with IPv6 - see https://www.ripe.net/publications/docs/ripe-690/ section 4.1 for discu...

tdw

Ethernet-like interfaces are transparent to VLANs, it is just another ethertype. Adding an IP address to an interface handles IP and ARP ethertypes for IPoE, these are untagged on the wire. The /interface vlan entries are wrappers which add a VLAN ID for packets being sent to the parent interface, a...

tdw

Also, you didn’t mention the role of the 10.0.0.1 gateway in all this. It could be a crucial piece of information especially if it’s a router connecting the two networks. I'm not sure what that address would be, I went up and looked over all the equipment. There's no additional routers, switches, w...

tdw

If you add a logging topic of ppp, debug and post the redacted (e.g. username) results that may show something up.

tdw

Have you tried connecting both with and without encryption? If one end requires encryption and the other does not support it the connection setup will fail, I would expect the connection not to require encryption as MPPE has not been secure for years and would be unnecessary overhead for the ISP con...

tdw

From the documentation: SwOS supports SNMP v1 and v2c (the Response for GetRequest, GetNextRequest and GetBulkRequest) and uses IF-MIB, SNMPv2-MIB, BRIDGE-MIB and MIKROTIK-MIB (only for health, PoE-out and SFP diagnostics). SNMP traps and writing SwOS configuration are not supported. Available SNMP ...

tdw

Rules are evaluated in strict order, if you drop any packets arriving from an interface in the WAN list destined for an interface in the LAN list before other rules then bidirectional communication will always fail. With the not working example replies to connections initiated from LAN devices will ...

tdw

As @erlinden stated you need a UniFi controller to configure their APs as the stanadlone app only provides limited functionality. The controller is available as an appliance, baked into a number of their gateway products but also still as a software installation for Linux, MAC and Windows.

tdw

It may not be connected directly but there is an external connection "we can access their Seimens HMI's through their 3rd party website". I certainly wouldn't suggest jumping straight to v7, however v6 long-term and cleaning up whatever cruft has accumulated in the config would be a good s...

tdw

From the first post the Mikrotik is running v6.38.1 which was released seven years ago and has numerous vulnerabilites including remote authentication bypass. Hopefully it is not directly exposed to the internet otherwise it will have been compromised, even so it would make a great jumping off point...

tdw

As mentioned the Mikrotik DHCP server does not support matchind agent circuit ID information in DHCP requests so you would need to run a DHCP server elsewhere and configure that to return fixed addresses for the specific ethernet ports, or from a pool otherwise. If there are multiple routes for the ...

tdw

There is not an easy way to allocate an address based on physical port rather than MAC or Client ID - whilst Mikrotik can include Option 82 for ports in a bridge the DHCP server has no mechanism to use the Agent Circuit ID. For your setup with additional small subnets then adding static routes on th...

tdw

The specific case of 2^x can be implemented as a bitwise shift: 1 << x

tdw

The source port is picked by the remote client initiating the connection, typically anything greater than 1023 but not fixed.

tdw

The bridge-to-CPU port settings are incorrect - you are trying to use it simultaneously untagged, by /interface bridge having pvid=200 , and tagged, by having an /interface vlan attached to the bridge with vlan-id=200 ). It is also missing from the /interface bridge vlan entries. Furthermore none of...

tdw

If the cAP ax is working as expected when connected directly to the router (as per OP's first image), but not when connected via the switch (per second image) the most likely cause is a misconfiguration of the switch, although it isn't clear which VLAN the cAP management connection is using - 10, 99...

tdw

An /interface vlan object merely inserts the specfied VLAN tag for packets on ingress and removes them on egress. When configuring a Mikrotik device as a switch you may have various untagged and tagged VLANs configured on several ports, but only a single VLAN configured to transit the bridge-to-CPU ...

tdw

What messages are there for the PPPoE client interface in the log?

tdw

No, 11:7 is VLAN ID 11 with priority 7.

You are missing the bridge-to-CPU interface in the bridge VLAN membership:
/interface bridge vlan
add bridge=newBridge tagged=newBridge,bonding1 vlan-ids=10
add bridge=newBridge tagged=newBridge,bonding1 vlan-ids=11

tdw

Providers initially offered IPv6+IPv4 dual stack, it is becoming more common for them to only implement IPv6 and use one of the many tunneling mechanisms for IPv4 - see https://www.rfc-editor.org/rfc/rfc9313.html for information on the most prominent ones. It is possible to configure DS-Lite on Mikr...

tdw

There are many pitfalls using multiple bridges, so best avoided. Do you need a bridge? If your network is only connected to a single port you can simply add a vlan interface to that port: /interface vlan add interface=ether1 name=vlan10 vlan-id=10 then add different subnets to the two networks ( eth...

tdw

You are attempting to use the bridge-to-CPU interface both untagged (by setting pvid=1500 under /interface bridge ) and tagged (by having an /interface vlan with vlan-ids=1500 ) which leads to all sorts of unexpected behaviour. Also setting the PVID under /interface bridge port makes no sense with f...

tdw

Degrading the cabling will never guarantee that the link will operate at 10Mbps. The endpoints transmit their capabilities in the regular fast link pulses and pick the best available speed and duplex option both are capable of, see https://en.wikipedia.org/wiki/Autonegotiation . Depending on the eth...

tdw

The BT Digital Voice offering is a closed system, you have to use the SH2. There was a thread on the thinkbroadband forum https://forums.thinkbroadband.com/fibre/t/4670157-re-bt-fttp-with-digital-voice-alternative-to-smart-hub-2.html where someone managed to detect and spoof enough information for t...

tdw

where did pvid=1 come from.. and which is what I think would be the 'native vlan' setting.. and should be changed to 666.. VLAN 1 is the default PVID as you have not specified anything different. /interface bridge port add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1...

tdw

A Mikrotik array is not JSON. Either use the :serialise function in newer versions of RouterOS v7, or construct a data variable containg valid JSON. For example:
:local jsondata "{\"mac\":\"aa:bb:cc:dd:ee:ff\",\"ip\":\"192.168.100.80\"}"

tdw

The requested pool should only hand out /64s, not the entire /62. The assigned address should not use the all-zeros host address as this is reserved for 'all routers in subnet' - either use an explicit non-zero address, or alternatively eui-64=yes to generate the host address from the interface MAC ...

tdw

I don't know if the default items in /export have changed in v7, but certainly in RouterOS v6 /interface ethernet switch ingress-vlan-translation entries have explicit customer-vid=0 . Also, are the bridge ports actually hardware-offloaded - they should have an H flag showing in /interface bridge po...

tdw

It looks like gibberish from ChatGPT or similar. With CDP being a proprietary Cisco protocol Mikrotik do not treat the multicast address it uses as special, so it should propagate throughout the broadcast domain of the layer 2 network. I've not checked EoIP interfaces specifically but certainly all ...

tdw

How did you configure your new ax3, from an /export of the old device, or from a .backup?

tdw

I would imagine rules are processed before switching, but wouldn't imagine port isolation would apply unless the ports are being switched in the chip - with hw=no the packet flow would be etherA > CPU interface > software bridge > switch chip interface > etherB, it isn't passing directly between eth...

tdw

Mikrotik added :serialize and :deserialize commands in v7 which support JSON. I've not tested to see if it handles nested arrays.

tdw

The physical ports on the device are wired to the switch chip so packets will always pass through and be processed by the switch. The underlying architecture has a single interface beween the switch chip and CPU - the ether1..etherX interfaces shown in winbox/CLI are logical interfaces, the driver m...

tdw

You cannot use the same IP subnet on multiple layer2 / ethernet interfaces, the device would have no idea of which interface to send ARP requests to.

tdw

No, traffic between VLANs passes through forward, not input. Unless your Mikrotik has a switch chip with L3 hardware offload the routed traffic is still handled by the CPU, fasttrack merely skips some of the processing and typically improves performance by a factor around 2-3 times. You could qualif...

tdw

This should not be necessary /ppp profile set *0 remote-ipv6-prefix-pool=kpn-pool it is used for PPPoE servers, not clients. This is likely the issue /ipv6 dhcp-client add add-default-route=yes interface=pppoe-kpn pool-name=kpn-pool \ pool-prefix-length=48 request=prefix use-peer-dns=no as DHCPv6 ha...

tdw

The lease client-id values for some of the entries look odd - have they been editied as they would usually be 1:xx:xx:xx:xx:xx:xx, where xx:xx:xx:xx:xx:xx is the client MAC address.

If a client includes a client ID in the DHCP request the Mikrotik will use this in preference to the MAC address.

tdw

By default packets will be forwarded between subnets. As there isn't an option to change the firewall policy you could either add a firewall filter rule to drop any forwarded packets with /ip firewall filter add action=drop chain=forward or even disable all forwarding with /ip settings set ip-forwar...

tdw

You can specify an optional single IP address for L2TP users in /ppp secret, see https://help.mikrotik.com/docs/display/ ... erDatabase

tdw

On ether1 is my main vlan trunk to my base switch forwarding all vlans (including vlan 30 tagged). Those vlans were configured in the switch configuration to allow hardware offloaded vlans (vlan filtering with offload is not supported on rb3011). This interface is thus the only member of brLAN. Thi...

tdw

When running a PPPoE server having an IP address on the interface is unnecessary as the client IP traffic is encapsulated within the PPPoE packets. You can add an IP address to the interface for specific use cases, two common ones are for management of radios in fixed-wireless access networks, and f...

tdw

That isn't the CA, download it from Let's Encrypt. The RADIUS server certificate is only required by usermanager on the Mikrotik, no need to export it.

tdw

A file with a .crt extension can, and often does, contain PEM encoded content. Unless you are using self-signed certificates you will not have the private key for the CA certificate. The purpose of the the CA certificate on the client is to validate the authenticity of the signer of the server certi...

tdw

It maybe that the PSE controller provides voltage, current and power information and they choose to display it. Certainly some other vendors 802.3af/at-only switches do so. There are other converters, e.g. PoE Texas / PoE World have a huge range for a variety of uses https://shopify.poe-world.com/co...

tdw

AFAIK the Netgear only provides nominal 48v, the options change the initial negotiation. You can use an 802.3af/at to 24V passive converter - either the Mikrotik RBGPOE-CON-HP, or Ubiquiti INS-3AF-I-G (can only provide a maximum of 12W so OK as long as you don't have power consuming devices plugged ...

tdw

fasttrack is not compatible with mangle, disable it

tdw

CRS devices are primarily switches, the CPU is not particularly powerful and not intended to provide anything approaching wirespeed routing - you might get around 400Mbps on a CRS310. Whilst the switch chips in CRS3xx and CRS5xx devices support L3 hardware offloading the device in the CRS310 does no...

tdw

You will need to find out which tunneling mechanism the ISP supports. It is possible to do DS-Lite which is basically an IPv4 in IPv6 tunnel (search my posts for examples), but newer methods such as Lw4o6 and MAP-E require support in the client router which Mikrotik have not implemented.

tdw

Those device certificate settings look to be incorrect. The CA Certificate should, given the name, be the Let's Encrypt root authority certificate - Windows and other OS will already have this installed as a trusted CA. The Device Certificate should not be the server certificate and likely be not in...

tdw

It does. SFPs which support Digital Diagnostic Monitoring (DDM) as specified by SFF-8472 store a variety of threshold and calibration data in non-volatile memory at address A2h.

AFAIK RouterOS doesn't read and decode this, only the standard data as specified by INF-8074 at address A0h.

tdw

It's difficult to tell exactly as there are many redundant entries referring to objects which have been deleted ( something=*id ), but it appears the home LAN (192.168.20.1), some device management for radio links (10.20.0.1) and a local address for PPPoE client connections (172.20.0.1) share the sa...

tdw

IP packets from PPPoE clients do not arrive on the bridge, each one has its own interface named <pppoe-USERNAME> so using in-interface=bridge1 in mangle rules will not match anything from clients.

tdw

Instead of specifying an IPsec secret in the EoIP interface create IPsec proposals, policies, peers & identities as required, when the EoIP encapsulated traffic matches the policy it will have IPsec applied as specified.

tdw

Instead of specifying an IPsec secret in the IPIP interface create IPsec proposals, policies, peers & identities as required, when the IPIP encapsulated traffic matches the policy it will have IPsec applied as specified.

tdw

No. Both Mikrotik and Ubiquiti have proprietary protocols to provide better performance than regular WiFi, especially for PtMP setups. Whilst these extensions are optional on Mikrotik devices they cannot be disabled on the newer Ubiquiti devices, including airMAX AC ones. Even if you could a LiteBea...

tdw

So option a is effectively the default config but with an additional /interface vlan to handle the WAN traffic being tagged. Unless you are likely to have multiple WAN ports, want to be able to easily swap which ports are WAN and which are LAN, passthough additional provider/operator VLANs for IPTV ...

tdw

Your are missing the bridge-to-cpu port, the /interface bridge vlan entries tagged=ether1 should be tagged=bridge,ether1 . You also need /interface vlan entries to remove tags on egress from the bridge-to-cpu port / add them on ingress to the port, plus IP addresses. See https://forum.mikrotik.com/v...

tdw

When I turn off vlan-filtering, only vlan 1 works. What do you mean by 'works'. ether1-6 will be able to communicate with each other, if VLAN 1 untagged also has to transit the ether24 and sfp-sfpplus4 trunks then change frame-types=admit-only-vlan-tagged to admit-all Unrelated, there is no need to...

tdw

Set up your own RADIUS server & frontend on-prem or hosted elsewhere / subscribe to a cloud-based service (e.g. CloudRADIUS, JumpCloud, Foxpass) and use WPA2-Enterprise for wireless / 802.1X for wired authentication with username/password and/or certificates. All locations should use this data/s...

tdw

In Winbox the VLAN tab of a bridge interface contains the settings of the bridge-to-CPU port, in exactly the same way as the VLAN tab of a bridge port does for other ports added to the bridge. These are layer 2 settings - they will not stop your Guest & IoT networks from accessing some IP servic...

tdw

The processor in the switch chips on SwOS-only devices is very limited so it is highly unlikely that any encryption can be added. From the Marvell datasheet Target Applications section "Smart and Lightly Managed switches: Integrated microprocessor enables lightly managed switches with the addit...

tdw

I suppose the Media Connector type (EEPROM address A0h, byte 2) could be set to either 0Bh 'Optical Pigtail' or 23h 'No separable connector' instead of 21h 'Copper pigtail' (from SFF-8024 Table 4-3 Connector Types). For SFPs, per SFF-8074, bytes 14-18 specify the maximum length for 9/125, 50/125 &am...

tdw

When you say Neighbours do you mean OSPF Neighbours or IP Neighbours? Use PTMP rather than broadcast, v7 'ptmp-broadcast' is compatible with v6 'ptmp'.

tdw

Your ISP could be intercepting any DNS requests not destined for their servers and redirecting them.

tdw

See https://help.mikrotik.com/docs/display/ROS/Services

tdw

I'd rather see bridge "the CPU facing port" become a distinct item ... just like switchX-cpu port in switch chip configs. IMO this would prevent quite some confusion which arises from the fact that there are 3 different items (switch-like entity, CPU-facing port and interface) all named t...

tdw

In fact, I think /interface/vlan should have some option/attribute that automatically adds tagged=bridge (as a dynamic .../bridge/vlan) – so Layer3/IP work without messing with bridge vlan table at all. So whole /interface/bridge/vlans complexity be only needed for hybrid ports or Layer2-only switc...

tdw

If the public address is routed via the private address it should not be attached to the interface, but rather exist on a loopback interface and the preferred source address set for traffic originated from the Mikrotik itself. /interface bridge add name=local protocol-mode=none /ip address add addre...

tdw

If the 192.168.1.x addresses use a subnet mask of /24 then 192.168.1.0 is not a valid address, so I would expect it to never work.

Also use a better VPN protocol than PPTP, fundamental vulnerabilities have been known for over 10 years making it insecure.

tdw

Also if you set edge=yes on the Mikrotik bridge ports connecting to the Cisco(s) they will ignore any received and not send any BPDUs (equivalent to PortFast ) which may allow you to change to a single bridge. This means that it will ignore the BPDUs that the Cisco's send, turning the Cisco into a ...

tdw

There are various potential pitfalls https://help.mikrotik.com/docs/display/ROS/Layer2+misconfiguration but impossible to say if you have hit any of these with seeing the configurations. Also if you set edge=yes on the Mikrotik bridge ports connecting to the Cisco(s) they will ignore any received an...

tdw

Nothing obvious assuming that change is only applied to /interface bridge port (two entries), /interface bridge vlan (three entries on two lines) and /interface vlan (one entry) as you can't have two bridges with the same name. Do the Current Tagged and Current Untagged columns under Bridge > VLANs ...

tdw

I hadn't spotted that was missing, having bridge-TPP in the tagged list for VLAN 40 is unnecessary. Under /interface bridge port the pvid= setting specifies which VLAN untagged ingress traffic is assigned to. Under /interface bridge vlan ports in the untagged= interface list have the VLAN tag remove...

tdw

The bridge name bridge-TPP refers to both the bridge and the implicit bridge-to-CPU bridge port so you are connecting VLAN 40 on ether4 untagged to the CPU tagged. To connect ether4 untagged to ether5 tagged requires the following change to /interface bridge vlan : add bridge=bridge-TPP tagged= brid...

tdw

Set reformat-hold-button and reformat-hold-button-max. The device cannot be reset, only completely reformatted by holding the reset button for a time between the two values and will then require a netinstall as described in the link provided.

tdw

See https://help.mikrotik.com/docs/display/ ... bootloader. You can disable the Winbox service but that will prevent anyone using it, a usual recommendation is to make Winbox accessible only via a VPN connection to or from the device.

tdw

Which drivers are you using on the hAP ax2? Likely https://help.mikrotik.com/docs/display/ ... stfeatures

tdw

This caught me out a few weeks ago when converting from 6.x to 7.x. Although it isn't mentioned anywhere in the documentation I could find /routing ospf interface-template has some hidden functionality where specifying type=ptp swaps the local and remote addresses, try add area=A disabled=no network...

tdw

Nothing immediately obvious. Possibly if there is much broadcast or multicast traffic on your management VLAN that will be processed by the CPU, even if then discarded.

Using VLAN 1 tagged is uncommon but shouldn't be the cause.

tdw

I don't believe you can do this as pool allocations are 'sticky' - for any particular MAC address and username combination the previously used IP is issued when reconnecting. Only a reboot, no free pool addresses (which forces a cleanup), or not being used for some time resets this behaviour.

tdw

I'm not sure why the Mikrotik supplicant works without a certificate on the server. The certificate provides the keying material for the TLS tunnel used by PEAP in addition to providing identity information. Per the previously linked page for Windows supplicants they will not work unless the certifc...

tdw

One bridge. See https://forum.mikrotik.com/viewtopic.php?t=143620 , https://forum.mikrotik.com/viewtopic.php?t=173692 , https://help.mikrotik.com/docs/display/ROS/Switch+Chip+Features#SwitchChipFeatures-SetupExamples for RouterOS, https://help.mikrotik.com/docs/pages/viewpage.action?pageId=76415036#...

tdw

Pretty much all EAP methods will not work unless the server presents a certificate - are you sure FreeRADIUS isn't using some default certificate, whereas usermanager will need one creating

tdw

What certificates are you using for the EAP part. Windows requires the CA to be in the machine certificate store, there are other caveats too https://wiki.geant.org/display/H2eduroa ... iderations

tdw

Yes, use Netinstall https://help.mikrotik.com/docs/display/ROS/Netinstall

tdw

If the client connected using an IP / layer3 VPN has an address which falls within the subnet used on a local ethernet / layer2 network it requires the use of proxy-ARP. Note the naming of L2TP can be misleading - it refers to layer2 tunneling of PPP packets, not the client IP data itself.

tdw

It forces any bridged traffic to also pass through IP firewall chains https://help.mikrotik.com/docs/display/ROS/Packet+Flow+in+RouterOS#PacketFlowinRouterOS-BridgeForward , this is only required if you wish to apply firewall rules, where bridge ACLs are insufficient (e.g. as they are stateless), or...

tdw

CRS devices are primarily ethernet / layer2 switches with some IP / layer3 functionality, i.e. limited performance as the CPU is not particularly capable. RouterOS v7 introduced L3 hardware offloading, however the DX2000 in the CRS310-8G+2S+ only supports routing offload, not fasttrack and NAT conne...

tdw

Using a bridge as a local/loopback interface will not work if the addresses are presented directly - just add the addresses to the WAN interface, for example: /ip address add address=155.13.35.202/29 interface=ether1 add address=155.13.35.203/29 interface=ether1 Only if the additional addresses are ...

tdw

See https://help.mikrotik.com/docs/display/ROS/Dot1X#Dot1X-Server . The guest-vlan-id functionality is odd, other vendors allow access to a guest VLAN immediately until dot1x authentication completes. Other than making a feature request to Mikrotik there isn't much you can do to reduce the time. Not...

tdw

The RouterBoard firmware is equivalent to the BIOS on a PC - it handles the initial chipset configuration and RouterOS loading. It is persistent unless upgraded or the device is completely reflashed with netinstall. Historically the firmware and OS used different version numbering. At some point the...

tdw

Did you drop the existing connection? The server binding will be used when the client reconnects.

tdw

That isn't something I have used, if it doesn't have options for specfic RADIUS reply attributes it depends if it has any mechanism for adding generic/custom ones.

tdw

Two routes is correct - one from the point-to-point tunnel, the second the subnet route.

However you can't have the same subnet on both your CHR and the remote client, routing relies on subnets not overlapping with each other as it has no way of knowing which interface to use if they do.

tdw

You do not have pppoe-out1 added to the WAN interface list.

tdw

It doesn't need any scripting, use a server binding : /interface sstp-server add name=sstp-in-lsstp user=lsstp When a connection is made with the username specified the named interface, sstp-in-lsstp in this case, is created instead of the usual <sstp-lsstp> dynamic one. Obviouly only works for a si...

Search found 2072 matches