MikroTik

mbovenka

and the forced settings disables auto-negotiation. But it shouldn't.. The remote end should still autodetect what the local side it forced to. But it doesn't, at least not in my experience. Forcing speed and/or duplex disables autonegotiation. At least it does on any box I have ever handled (and th...

mbovenka

it's just autonegotiation or forced speed/duplex (which needs to be half-duplex if the other side has auto-negotiation and is not forced to full-duplex, otherwise we get a duplex mismatch with high packet loss) Why? Because autonegotiation defaults to the lowest common denominator when the other en...

mbovenka

OK, that's how I read it. Sorry for the misinformation.

mbovenka

mbovenka if you found some differences, report it to support@mikrotik.com so that it does not look like baseless accusation to my knowledge country regulations are correct I'm not running into it myself, but basing it on this thread: https://forum.mikrotik.com/viewtopic.php?t=206396 If I'm reading ...

mbovenka

The only solution is to forget about superchannel altogether ... it wasn't obeying country-specific regulatory constraints and as such is illegal. Since majority of users didn't care about country regulations (and created havoc), EU (and many other countries) now require implementation which reduce...

mbovenka

This is going against the essence of what a router/switch should be, heck even enterprise routers/switches do not even have any sort baked into it. Weeellll...: https://www.cisco.com/c/en/us/products/routers/4000-series-integrated-services-routers-isr/index.html But I agree, MT needs to stop with t...

mbovenka

You're aware that the RB3011 has an SFP port, not an SFP+ one? You can use an SFP in an SFP+ cage, but not vice versa.

mbovenka

What about those users mistakenly buying the CCR1036 R1 ? i experienced 4 times of PSU failure since 2018, average 1.5 years a blow.

I very much doubt whether there are still r1's in stock anywhere. I already got an r2 when I ordered mine 4.5 years ago.

mbovenka

BGP convergence will be faster on the 2004 (more single-core performance). For forwarding performance the 1036 wins.

So it depends on what's important to you.

mbovenka

I think squeezing all that in and have it passively cooled to boot is going to be a tall order. Especially if you want PoE to boot. I wouldn't count on something like that appearing any time soon.

mbovenka

So in summary: Access from outside -> works Access by domain name inside (over LAN) -> doesn't work Ping domain from inside -> Gives external IP address Currently the ER8411 is controlled by OC200, but I have also tested in standalone mode with the same result. I don;t know if the issue is caused b...

mbovenka

Unless your ISP feels like supporting a 3rd party ONT, which would be extremely rare Less so in the EU; ISPs are legally required to allow you to use your own equipment, and that includes the ONT. For GPON most ISPs are already there, XGS-PON is still a work in progress. My own ISP supports the use...

mbovenka

maybe this: https://www.servethehome.com/the-everyt ... teamgroup/

I stand corrected. Doesn't have the grunt to use as a daily driver desktop, but as a dedicated router it would be great.

mbovenka

I got an MS-01 for the SFP+ ports (as my personal workstation, not a server), and I am not aware of any other small form factor PC with 10G networking out of the box, barring using Thunderbolt external NICs.

mbovenka

Hackers knocking on your door. When I still ran L2TP VPNs I saw those all the time.

mbovenka

Defaults are not applied by updates. Once you have made a setting it will be saved and restored at reboot, you need to change it to 30 seconds yourself when you want that. New installations will get the new default. Interesting. That's not what I am used to (working mostly with the Big C @$dayjob)....

mbovenka

If set US, mikrotik say 5400Mhz no supported channels

Set the frequency to 5400 and the mode to 'superchannel'. Assuming the L11UG-5HaxD radios can physically do 5400 MHz, that should work: https://help.mikrotik.com/docs/display/ ... properties

mbovenka

Just for clarification, lets say the CCR2216: https://mikrotik.com/product/ccr2216_1g_12xs_2xq#fndtn-testresults He has a routing perfomace (512byte), 25 Firewall rules of 15552 Mbps (compared to the 20691 Mbps of the CCR1072). This seems not better to me? Or is a (TCP)-single-stream-connection dis...

mbovenka

This device is able to push routed (VLANx to VLANy) around 280-300Mbit/sec through a TCP- single -stream connection. Tested with different performance-tools, everytime same results. Because I have no reference, is this an acceptable value for such a configuration and device? This table: https://mik...

mbovenka

Veeam will take backup over this connection. As far as I understand from your description, the speed will not exceed 1g+ as it will create a single connection in veeam.

Yes. Unless Veeam has a way to use multiple TCP connections for a single host-backup, that is what will happen.

mbovenka

Balancing-rr is the only bonding method that sends packets from the same connection across different interfaces in the bond. But that isn't hardware offloaded, which is why the CRS CPU maxes out. 802.3ad is offloaded to the switch chip, but will send all packets belonging to the same connection acro...

mbovenka

You should have bought something else. CRSes are switches first, not routers, even if they can do routing. With the advent of L3 hardware offload they can route at wirespeed, but not all can also do L3 offload for NAT and firewalling, and the CRS310 can't . Looking at the test results , 500M is abou...

mbovenka

I also found out what went wrong with the software upgrade. In short: doing an upgrade with the switch powered by PoE is Not A Good Idea. When upgrading, the ports flap, including the management/PoE in port. You can guess the result, and the switch doesn't like it. At all. Luckily, a netinstall with...

mbovenka

L3HW offloading relies on L2HW offloading and that ports are members of the same bridge where you enable bridge vlan filtering, which I don't see from your config. This piece is missing from your config: /interface bridge add name=bridge vlan-filtering=yes Without it enabled, settings in /interface...

mbovenka

L3HW offloading relies on L2HW offloading and that ports are members of the same bridge where you enable bridge vlan filtering, which I don't see from your config. This piece is missing from your config: /interface bridge add name=bridge vlan-filtering=yes Without it enabled, settings in /interface...

mbovenka

Bump. Anyone?

mbovenka

With L3 offload it will. The CRS309 is the cheapest switch that will do full L3 HW offload (with FW/NAT handling). That's why I got it to play with; for now my CCR1036 does a good job

mbovenka

Please read this post here: https://community.cloudflare.com/t/upcoming-certificate-renewal-for-1-1-1-1-public-resolver/594379 I installed that certificate chain as well. Didn't fix it, which is expected, as they use GTS at the moment, and not SSL.COM. Perhaps they plan on changing again, who knows.

mbovenka

I'm trying to do something that should be pretty simple, but I can't get it to work. What I want to do is use my CRS309 as my internet router (using L3 offload). My provider uses VLAN 300 on the uplink, so I need that on my uplink port (SFP-SFPPLUS8). The rest of the ports need no VLANs/can be acces...

mbovenka

I've explored some certificates from Google Trust Services and Cloudflare.com, but they didn't seem to work with my settings. Including verified and up-to-date information on obtaining the correct root CA certificates will greatly assist users in configuring DoH securely. Installing this Google Tru...

mbovenka

Do we get one core free of charge ?

Pretty much. The Prestera 98DX3236 (the SOC of the 16P) has a dualcore CPU: https://wifimag.ro/pdf/Prestera_98DX3336_pb.pdf

mbovenka

You're no doubt right. A 'CRS305+' falling between the current CRS305 & CRS309 should be possible, though. My CRS309 arrives tomorrow; new(-ish, I already use one as a switch) toy to play with. We'll see what happens when I try to push 3+ Gbps NATed traffic through it

.

mbovenka

I can see the use case for an edge router/CPE device for the multigigabit internet services that are being rolled out nowadays. I have 8 gigabit (ISP Odido in the Netherlands) and am running a CCR1036-8G-2S+ as my router, of which I only use the two SFP+ ports. If I could get a truly 10G-capable lit...

mbovenka

Upgrade to ROS 7. My E3372-320 did the same thing with 6.x. That's actually documented if you look here: https://help.mikrotik.com/docs/display/ ... ularmodems

mbovenka

Second: your router (assuming RB750Gr3) is able to route at around 380Mbps real-life (give or take). Still a pity that MT never implemented the NAT offoad the SOC is capable of in RouterOS, as UB did in EdgeOS for the EdgeRouter X & X-SFP (same hardware as the hEX & hEX-S). I used to use an...

mbovenka

Simple: the TILE CPUs are no longer made.

mbovenka

It's now documented that the 325 only works on ARM.

mbovenka

MikroTik has nothing to do with TILE being discontinued. This is CPU manufacturer that stopped making them. I didn't mean to imply MT had anything to do with that. Tilera got eaten by EZChip, EZChip by Mellanox, and Mellanox by Nvidia, which owns the IP now. Nvidia still makes BlueField DPUs (which...

mbovenka

Chip is not fabricated anymore Unfortunately Tile-GX Architecture do not gained traction in the market, is 10 years Old with no iterations nor improvements Yes, it's a pity. Lots of low(ish)-powered cores like the TILE is a good architecture for packet forwarding. Looks like MT is again going with ...

mbovenka

What you're looking for is mode 'station-bridge': https://help.mikrotik.com/docs/display/ ... tion+Modes

mbovenka

Yes, I only wanted to have a WiFi good coverage with high transfer rates, this was the reason I bought hAP ax3 (3 devices to cover a whole house). Do you think RB4011 would have been more appropriate for my needs (all network in my house is on 10Gbe)? It depends, but probably not. The 4011 doesn't ...

mbovenka

P.S: also why would you use another router, if this one can do everything?

Perhaps he just wants to use it as a switch + AP. I'm using a RB4011WiFI as such, simply because it was the cheapest AP with >1G uplink I could find at the time

mbovenka

The -325 is only supported on ARM CPUs (https://help.mikrotik.com/docs/display/ROS/Peripherals). Your hEX S has a MIPS CPU.

mbovenka

It's here:

https://wiki.mikrotik.com/wiki/MikroTik ... ansceivers

Does take a bit of digging, and I have been bitten by it when using a 1000BASE-BX-U SFP in my CCR1036.

mbovenka

I don't know why it doesn't autonegotiate, but it's in the docs that you need to fix the speed & duplex when using an optical SFP in an SFP+ cage, and autoneg won't work. A DAC isn't optical of course, but you are effectively trying to do the same thing.

mbovenka

Looks to me it should work. Have you tried setting speed & duplex to 1000/Full instead of Auto? I needed to do that when using an SFP in an CCR1036 SFP+ cage.

mbovenka

....those are sites that you only should touch with a very long set of pliers! The best is to find ASAP alternatives for them or just go back to before they existed.

Which is fine for your own little network, but of course not really an option for those that have actual clients to support.

mbovenka

It ought to work in any CRS3xx with Q+ (40G) or XQ (40/100G) ports. Whether it actually does, no idea, unless someone tries or MT chimes in about it.

mbovenka

Yep, same here. FS.com generic 10GBASE-SR's work fine here in a CCR1036, a RB4011, a CRS309 and a CRS305. Like you said, cheap too.

mbovenka

I was thinking like a jet pack or mifi kind of device and plug it into the router usb port and be able to get that as my wan connection Something like the abovementioned Huawei E3372 will work for that; I'm using one as backup to my fiber connection. Slightly updated list of LTE modems is here: htt...

mbovenka

The Input chain is for traffic destined for the router itself. A portforward isn't destined for the router itself (although the 'destination address' is the router), but for an internal system beyond it, and because the internal address of that system isn't known to the other end, the router needs t...

mbovenka

Hell no, f*ck Cisco CLI and their 1980s design, absoluetely no respect for modern day JSON, YAML-like data structure. Juniper and Nokia CLI FTW. Any programmer worth his salt, would never build a CLI like Cisco's. Why would de CLI need to have anything to do with your automation? The CLI is for hum...

mbovenka

- Under dhcp > networks I tried giving the network 192.168. 8 .x the existent gateway 192.168. 4 .1 but that didn't work (no access to internet) unless I changed under ip > address list the x.4.1 ip to be /16 instead of /24 so that is like the networks/mask under which the x.4.1 gateway is visible ...

mbovenka

Yes, pretty much. Technically, for the network definitions in your DHCP server config you could use any value for last octet, because ROS is smart enough to compute the network from the address and the netmask. But it's more usual to use .0 there. The 'gateway' entry in the DHCP config is the addres...

mbovenka

I agree. Switching on ROS is not intuitive at all. But still, having the necessary background and with little RTFM you can work your way through. They should have copied Cisco's way of doing switching (in terms of UI/UX/CLI). Much more intuitive and easier to troubleshoot. I agree that you can figu...

mbovenka

No, with a /24 netmask .0 is simply 'the network' and not a valid address. Same with .255 as the broadcast address. A warning would probably be good if you tried to assign them tot an interface as address.

mbovenka

But that's exactly what mGig is supposed to be for. Running 2.5 & 5Gbps over Cat5e. If you had Cat6a or Cat7 you could run 10Gbps. But the fun is, that doesn't always work either. I have used a known good 20m Cat6a cable and it would not go higher than 5Gbps. All in all, speeds higher than 1G ov...

mbovenka

I suggest you buy a Cisco router and see how much fun software upgrades are there, if you think MT is bad. It's quite simple, only upgrade if either: There are security flaws in the software you're running now. There is a relevant bugfix in the new version. There is a feature in the new version you ...

mbovenka

I don't have Loop problems, they are different broadcasts, there is no Router bridge. My problem is with the HW3 option Yes you do. To standard (Rapid) Spanning Tree the two links between your switch and your 2216 are a loop, even if they are in different VLANs/broadcast domains. You need to run MS...

mbovenka

Here it says we can monitor max 16 mac's !!

No, it says you can capture a maximum of 16 different MAC *protocols*. A filter like "filter-ip-address 192.168.1.0/24" will work just fine.

mbovenka

There is https://help.mikrotik.com/docs/display/ROS/Packet+Sniffer, but that doesn't say much about the streaming bit. It isn't all that difficult, though. Using Winbox, enable streaming (Tools -> Packet Sniffer -> Streaming) by putting in the IP address of the machine you're running your capture on...

mbovenka

I don't think you can save the Torch logs. But you could look at the Packet Sniffer tool. That can stream the capture to another machine where you can using Wireshark or Tshark to save it.

mbovenka

In the light of common practices in networking, it seems to me that jumping from 1G/s to to 10Gb/s is a too long jump as it introduces thermal or compatibility issues we didn't have to deal with in the past. Oh yes we did. I was there for the rise of Fast & Gigabit Ethernet. Thermal issues, not...

mbovenka

You could put the ports in a bridge, but note that the 1036 does not have a switch chip, so everything is done by the CPU.

mbovenka

Please confirm if it is true that the CRR1072 will be discontinued after this year

Given that the TILE CPUs are no longer made by NVidia (like @chechito already mentioned), and the CRS1036 is already discontinued, I would be almost surprised if it wasn't.

mbovenka

They are trying to introduce some feature to offload it to the chip, but I'm not interested in experimental switches. I need a solid performance layer 3 switches for datacenters. On datacenters, you don't use layer 2 switches on racks. The model I listed unless I can find information that comes dir...

mbovenka

That layer 3 performance, at least from the brochure, is something I would not even use at home.

That's the routing capability of the CPU. I mentioned L3 HW offload. That's wirespeed on all ports as long as you stay within its' limits. Read the page I linked to.

mbovenka

Switch Layer 3, Ethernet gigabit ports, 48 or 52 for rack cabinets, mostly will handle VLAN traffic. I need to be able to route traffic between VLANs which is why layer 3 is required. Looks like the CRS354 would fit: https://mikrotik.com/product/crs354_48g_4splus2qplusrm 48 gigabit ports with 4 10G...

mbovenka

There is no way to backport that into ROS6.

Well, they could potentially port the userspace implementation (wireguard-go). Not that I expect MT to do that.

mbovenka

Weird. My CRS305 upgraded to 7.10.2 from 6.43 without a hitch.

mbovenka

AFAIK the closest thing to stacking, supported by Mikrotik (ROS in particular), is port extender . IMO it's pretty poor approximation, but I guess there are use cases for port extender as well. It's arguably better than stacking, when used correctly. Look at Cisco Nexus port extenders and Catalyst ...

mbovenka

AFAIK Ookla speedtest is not IPv6 ready yet. Or am I mistaken.

The app isn't, but the website is ('ipv6.speedtest.net' works).

mbovenka

Looking at the test results for the CRS309, it seems that it's nowhere near capable of supporting 10Gbps with firewall rules in effect.

It is with L3 hardware offload. The CRS309 can do full L3 offload, including firewalling.

mbovenka

I use a Huawei E3372H-320 with my CCR1036 for exactly this purpose (backup). Needs ROS7 to work.

mbovenka

Your Huawei 3272 will probably work. I'm using a 3272h-320 that presents itself as an LTE interface with a NAT router and DHCP server 'at the other end' so to speak, on 7.1 and it works fine. Actually, I had to upgrade to ROS7 to get it to work to begin with, it wouldn't work with ROS6.

mbovenka

If you can pull cat6e (or cat7) UTP cables, then you could pull FO cables as well. And optical SFP modules generally don't suffer from the excessive heat generation problem. Plus the range is much longer. +1 for fiber. If you need new cable anyway, pull multimode fiber. The SFP+ modules are a lot c...

mbovenka

SFPs in an SFP+ (such as the 4011 has) cage need fixed speed & duplex, as you found out. That is documented somewhere, but it's somewhat hidden. I've been bitten by that too. The 2011 has an SFP cage, which is why that worked with AUTO.

mbovenka

if you want no heat you have to use 1G Base T module

Or use 10GBASE-SX and multimode fiber. Cheaper, too.

mbovenka

I was looking at that CRS312-4C+8XG-RM, but I am guessing that it doesn't handle a 10 gig WAN port (Cause I tried with the 305) The CRS312 will do NAT in hardware, if that's what you mean by 'WAN port'. As you found out, the 305 will not. https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offlo...

mbovenka

That's because NAT can be HW offloaded. PPPoE can't.

mbovenka

Do I need a specific SFP+ to" RJ45 connector? Special setting for the network interface on the PC? Setting on the CRS305 at the port level? Works for me with an S+RJ10 in the CRS305 and an Intel I225-V (Win10 Pro) at the other end. No specific setting needed at either end; they simply autonego...

mbovenka

Is ist possible to use 2.5G sfp+ in the router?
If yes: does anyone know wich modules are working?

The S+RJ10 will do everything from 10M up to 10G, 2.5G included. The machine I'm typing this on connects at 2.5G to one in a CRS305.

mbovenka

As you run the SFP+ port at 1G (and so probably are using an SFP): did you disable autonegotiation and set the port to 1G FDX? If you don't, the link will seem to come up, but no traffic will flow. Been there, done that...

mbovenka

I must have messed something up because I cannot ping the other 3 site's routers. I can ping all the sites from a Winbox session to the main site. I thought maybe I needed a route added locally on the laptop, but that didn't fix it. Probably the other sites don't know the route back to you. With yo...

mbovenka

I wasn't aware the S-85DLC05D could do 100M at all, and I can't find anything about it either. Same for the S-31DLC20D. So count your blessings if it works at all, I daresay. Where did you read that either SFP could do 100M?

mbovenka

If you want to run POE on all ports, probably. Note that it isn't at all unusual to ship a POE-capable box with a default PSU that won't power all ports.

mbovenka

Or you want to use an MBIM-driven 4G USB stick. I had to upgrade my CCR1036 to 7.x to get mine to work.

mbovenka

By adding the drivers for the Intel i225-V network chips for the x86 and CHR versions of RouterOS.

x86 ROS is dead or dying, and CHR leaves the hardware support to the hypervisor, as it should. I suggest using CHR.

mbovenka

Does sound like a transceiver issue. I use an S+RJ10 in my CRS305 to connect to my PC, and it autonegotiates and shows 2.5G just fine.

mbovenka

Thank you for your detailed answer! Thus, if we use the S+85DLC03D SFP+ modules instead of the Q+85MP01D ones, we'll have 10G connectivity between the "low speed" CCR2216 ports and the respective "low speed" ports of the CRS354. Otherwise, as we have only 2x100G spare ports on t...

mbovenka

We'd like QSFP28 ports on the switch side instead of QSFP+ or QSFP+ ports instead of QSFP28 on the router side so that we can utilize the full available bandwidth (40G or 25G), however the "mix and match" between the two seems to sacrifice performance and lock the maximum available speed ...

mbovenka

2. Which modules can be used at both sides to interconnect these units at maximum speed? Distance between the routers and the switches are below 300m, MultiMode fiber cabling is already in place. Your help is highly appreciated, as we are not familiar with the QSFP+/QSFP28 standards. 100G QSFP28 is...

mbovenka

So the same SFP+(10G) port will fit into SFP28925G) ports as well? and if that is Yes
Then i will assume QSFP+(40G) will also fit into QSFP28(100G) also?

Yes to both, I think, but I'm not 100% sure on the latter.

mbovenka

S+RJ10 should work in the SFP28 cages.

mbovenka

Will this router be fast enough to handle some modest routing, including IP masquerading and some basic filter rules at 1Gbps through the WAN port? No. Not by a long shot. A rough estimate of real-world performance of a given MT router is the '25 IP filter rules' test results with 512 byte packets....

mbovenka

And what is done to improve the situation, except for waiting? What we don't want is having to move away from Mikrotik as preferred brand (if there are other brands to move to...) , and I don't think Mikrotik wants that either. I don't think so either, but I also think that there is very little MT ...

mbovenka

Hap ac is a bit hybrid. It can easily be used for both. Quite so. I I'm using one as an AP, but it's a reasonably capable router if you want to use it as such. On the other hand I'm using something sold as a quite powerful router (RB4011 WiFi) as an AP and gigabit switch, simply because it was the ...

mbovenka

https://www.fs.com/de-en/products/15686.html should fit the bill. 40km@1310nm.

mbovenka

It's taking ~30 seconds to boot from cold. Are you seeing it faster than this? I'm not saying this is objectively a long time, it's just too long for our application!

Are you running STP? Might be Spanning Tree blocking the uplink port.

mbovenka

However, CRS305 has potential to surpass that mark by large margin, ROSv7 enables L3 HW offloading which means that in optimal scenario CRS305 will route traffic wirespeed (but only between SFP+ interfaces, ethernet port will always bog CPU). Note that the CRS305 will not do NAT offloading, which m...

mbovenka

The S+RJ10 can do 10/100/1000/2.5G/5G/10G.

mbovenka

No, they don't. 1000BASE-BX & 10GBASE-BX use different wavelengths.

mbovenka

If you can get by with 8 10G ports, the CRS309 is fanless.

mbovenka

Have the host ping its default gateway every minute or so. Easy with a cron job or scheduled task.

mbovenka

A good question but the BT engineer I spoke to didn't offer that as a option. Esp. as whilst it's a 1G fibre link, the client has only licensed 300Mbps.

Makes no difference technically. It's probably just a question of "you didn't order it terminated on copper, so you get fiber".

mbovenka

Never really worked with fibre but I think I need a short fibre cable and an article I found suggested I needed a SingleMode LC SFP transceiver. Does this sound right? I think you can use SFP in SFP+ but not the other way around. Looking at the color of the SFP clasp (black), it's probably multimod...

mbovenka

I'm curious if there will be any 48V models of the CRS2004, it will they be AC-only? Preferable fanless models as well.

IIRC, there will be a fanless version of the CCR2004-16G-2S+.

mbovenka

RB911: Series 9 board, 1 10/100 Ethernet port, 1 wireless interface
RB912G: Series 9 board, 1 10/100/1000 Ethernet port, (potentially) 2 wireless interfaces

That's how the board naming comes out. How many wireless interfaces does the 912 actually have? If 1, that may be why it shows as a 911 in ROS.

mbovenka

Something else that I'm thinging It may didn't work because the setting were applied only on my side.

Quite possible. If the other end is a similar setup, it may well have to be done there as well.

mbovenka

Thanks. I have tried this bit it didn't work. The transceiver that the ISP gave me is quite old so I'm thinking of buying a new one and try again.

Probably best, those 1G SFPs aren't very expensive. I can vouch for it working with multiple 1000BASE-BX-U BiDi SFPs in my CCR1036-8G-2S+.

mbovenka

I've been bitten by this as well. You need to disable autonegotiation and force 1G link speed & full duplex:

https://wiki.mikrotik.com/wiki/MikroTik ... ansceivers

mbovenka

Does anyone know of a single mode SC module to suit HEX S ? The device I need to connect the mikrotik has a wavelength of R1490nm/T1310nm so as I understand I need opposite wavelength of T1490nm/R1310nm. Anyone have any previous experience with this and care to share a working product? Are you sure...

mbovenka

..getting to start being interested in the RB5009 (although I'd rather wait until 2x10G/SFP+

I wouldn't hold my breath for that if I were you. I expect such a beast would cannibalize the CCR2004-16G-2S+ too much. More 2.5G ports would be nice, though.

mbovenka

The 317 with L3 HW offload will do the trick for IPv4, but offload has as yet no support for IPv6.

mbovenka

You can use the 1000BASET port on the 305 to uplink to your gigabit switch. ROS makes no difference between the ports.

If you want 10G as uplink you'll need something like a 326, yes.

mbovenka

A CRS305? That will do wirespeed routing with RouterOS 7.1b6. not with SwitchOS.

mbovenka

Last summer, when it got close to 40C around here, the two S+RJ10s I have in use (one in a CRS309 and another in a RB4011, both passively cooled devices) reached 100C and lived to tell the tale. They didn't even switch off; just soldiered on. But I second the use of fiber if at all possible. Lots ch...

mbovenka

Off course RouterOS 7 supports Layer 3 switching but that's a specific use case, do not replace common router Actually, a 'common router' (IPv4 routing and little else) is exactly what it *does* replace. Depending on the ASIC, it can even do firewalling and NAT in hardware. Pretty much everything y...

mbovenka

The CRS305 will not do NAT in L3 HW offload, just standard routing. The CRS309 will, if you want to go the L3 HW offload route.

mbovenka

Just kidding, just curious as to what functionality switch stacking gives you??

Single control plane.

mbovenka

216.239.35.0...
I know for sure that is not an NTP server.

Tell Google that; it's time1.google.com. Yes, .0 is a perfectly legal address, depending on the netmask.

mbovenka

No, it doesn't. All I could get out of them abour it is that they 'are looking at the L3 capabilities of the ASIC, but no promises'.

mbovenka

Well, you know how rumors are! Incorrect information. How did you arrive at CRS320?

Because it has 20 ports (16 x 1G + 4 x 10G).

mbovenka

What hardware offload does CCR2004 have?
Can it do L3 offload on LACP link?

It has none. The CPU has to do it all.

mbovenka

I'm a bit confused about the best 10gb SFP+ switch/router for my home lab. I initially thought the CCR2004 was the right choice, but then I was reading its switching performance was terrible. My requirements include: -Support at least 10x SFP+ 10Gbps ports -Good 10Gbps switching performance -Good L...

mbovenka

I'm guessing CRS326-24S+2Q+RM?

mbovenka

Assuming you need a router, you need something with an SFP+ cage and use a copper SFP+ like the S+RJ10 in it. Cheapest option is a RB4011, cheapest with multiple ports is a CCR2004.

Switches with 10G copper ports will also do 2.5G.

mbovenka

Look at this: https://www.fortinet.com/blog/threat-re ... the-wild-2

Like I said, it's a Windows trojan. Your routers don't run Windows and *cannot* be infected themselves. You need to figure out why your IDS software is misidentifying the source IP. Are you NATting somewhere?

mbovenka

That's a Windows trojan. How are your Mikrotiks supposed to be infected? They don't run Windows. I'd take a long hard look at any Windows boxes in your network.

mbovenka

Take a look at:

https://wiki.mikrotik.com/wiki/Manual:IP/ARP#Proxy_ARP

mbovenka

I need to sort out the following case: Topology: PC with OPC server (192.168.0.220) - Switch from company network ( 192.168.4.0/24 ) – mAP 2nd( 192.168.4.180/24) – ETN device (no option for gateway setup, only static IP 192.168.4.153) I cannot communicate with the Ethernet device. Please advise wha...

mbovenka

From the wiki, I understand that L3 hardware offloading is currently only in the CRS317. No, in the newer betas more devices are supported: https://wiki.mikrotik.com/wiki/Manual:CRS3xx_series_switches#L3_Hardware_Offloading, look for 'List of supported devices and their limits' The CRS328 isn't amo...

mbovenka

The ONT I have now is a ONT Huawei EchoLife HG8010H is there any way to understand the correct SFP knowing that the HG8010H is perfect ? That Huawei is a GPON device. Although it's possible to get some GPON SFPs to work (there is a thread in the forum about it), it's far from easy. I wouldn't bothe...

mbovenka

Hello, in my company we successfully used Huawei E3372h-153 to connect several remote sites via UMTS+IPSec to HQ: the hilink mode works well, despite it's "minimum functionality" In past, I've tried myself other models (like E3372h-320) with no success. The E3372h-320 (version 10.0.3.1) w...

mbovenka

what network equipment do you use or easier, how do I know how to choose the right one? My intended hardware is described in Optical cable and SFP advice - MikroTik feedback is really highly appreciated the SFP are my last piece in the puzzle. I'd say that this: https://www.fs.com/de-en/products/37...

mbovenka

Just tried it with my E3372h-320 (connected to a CCR1036-8G-2S+ running 7.1b1). Both unplugging it and a power reset work for me; the stick comes back afterwards.

mbovenka

Cable is strretched already. :) Same like on the picture. So i Need two different SFPs....type like you said? One is reciever and one transmitter and is it full duplex? :) Because there is stretched only one fibre cable and we need full-duplex communication :) What you have is simplex (single stran...

mbovenka

Only the SFP+ ports support 2.5G, and only when you use a multi-rate SFP+ in them, like the S+RJ10.

mbovenka

Investigation of 98DX3236 switch ship's L3 capabilities is on the roadmap. Please do not misread: it is investigation not development.

Interesting nonetheless. I await with bated breath ;-)

mbovenka

Nonetheless, you are right that CRS317 or CRS309 is a better choice (than CRS312/326) for hardware-accelerated stateful firewall, but for a different reason: CRS317 and CRS309 have twice larger hardware memory . CRS317/CRS309 can offload up to 4.5K connections to the hardware (4K in case of NAT) wh...

mbovenka

That would be not good enough - it would have 40g links, which... let me quote from the newletter:

No it wouldn't. 'XS' is 25G SFP+, 'XQ' is 100G QSFP+

mbovenka

There is a CCR2016-1G-12XS-2XQ coming, if we may believe the innards of the ROS7 binaries. That's all I'm aware of.

mbovenka

Or arguably CRS317 if you count it as mediocre router. Which is quite dated performance level. Unless you can work within the limitations of L3 hardware offload , in which case ROS7 will work wonders for it. Edit: By the way, the L3 offloading wiki page mentions a switch I haven't seen anywhere els...

mbovenka

Thank you for the links. Any suggestions for SFP copper and a couple of NIC's so I can catch up my PC's? *Edit: and if possible, can be acquired on Amazon? For copper I'd just get MikroTik's own S+RJ10s. They are cheap (well, as cheap as 10GBASE-T gets, that is...) and are guaranteed to work. They ...

mbovenka

What equipment recommends? CRS326-24G-2S+RM , or RB4011IGS+RM? You do significant routing & firewalling. CRSes are switches, not routers. This is changing with the advent of L3 offload in ROS7 for some CRS3 series switches, but a) the CRS326 isn't among those, and b) L3 offload is as yet very b...

mbovenka

New Mikrotik CRS328-24P-4S owner and I am looking for optical recommendations for the SFP+ ports and cable. I would like to run at least one of them in fiber. The run will be long'ish, about 60-70ft. Welcome in the wonderful world of MikroTik :-) For a 60" fiber run, I'd use 10GBASE-SR optics ...

mbovenka

My R610 would get up near 400/400

So do both my hAP ac & RB4011, with a 866Mbps PHY rate (OnePlus 5T as client).

mbovenka

It's half-broken supported in the new beta version 7.

What's 'half-broken' about it?

mbovenka

On a PC does it show up as a storage USB drive with software in? If it does, you need to reflash it to 'Stick' mode which I found impossible.

Upgrading to ROS7 beta might also help. It works for a E3372h-320 in HiLink mode anyway, which behaves the same under ROS6.

mbovenka

How does the hAP AC compare to the hAP AC2 ? Better WiFi, slower CPU. So if you want it as an AP/basic wired switch, the AC is the better choice, if you want to use it as a router with integrated (somewhat less capable) WiFi and switch the AC2 is better. In your case, the hAP ac is probably the one...

mbovenka

I 4 1 do NOT believe that It will do routing at wire-speed ... why I do not believe that .... because for L3 wire-speed requires an ASIC and non of the hardware specs I see have that L3 ASIC in the gear. Yes there will be an improvement in performance but nowhere near wire-speed. What do you think ...

mbovenka

Can I get an update on how this worked out for you? I am looking for performance data on using the CRS328 in RouterOS mode to do both routing and switching for a small business network. https://mikrotik.com/product/crs328_24p_4s_rm#fndtn-testresults The '512 byte & 25 IP filter rules' results a...

mbovenka

Interesting as I have mostly default configuration out of the box. Only changed IP for LAN interfaces and done. Did you do anything to enable HW Offload on yours? No, nothing. I use mine as a plain wired switch & AP, so all interfaces in a single bridge, STP disabled. That's pretty much it.

mbovenka

mkx I disagree with your statement. I have an RB4011 with no VLANs (all ports on the bridge interface only) that I support for a client that doesn't get HW Offload even with no VLANs: So I don't expect wired speeds between LAN ports inside of the RB4011. That's why I use them as Edge router only wi...

mbovenka

looks awesome, if only I could understand what was being said :-)

Switching on closed captions helps 😁

mbovenka

The hAP AC works well too, if you want a few wired Gbit ports to go with the wireless.

mbovenka

Is it possible to flash to the standard firmware on the device wiping it completely without being able to actually get into the web interface of the device?

You could try a netinstall.

mbovenka

OK, I stand corrected, if that's your experience. But just saying 'no, it only has 4 cores' isn't very helpful...

mbovenka

Yes, and those 4 cores are a *LOT* more powerful than the ones in the CCR1009. The CCR2004 has close to 3 times the forwarding performance of the 1009.

That may not entirely map into a 3 times lowering of the CPU load of the OP, but the CCR2004 will no doubt be a step up.

mbovenka

If it still appears in Winbox, you could try connecting through the MAC address. If not, a netinstall with an older ROS version might indeed fix it.

mbovenka

How about CRS309-1G-8S+IN? Or you need is 10GBase-T ?

He needs (more than) 12 ports total.

mbovenka

the chip in the image seems to be blown out from my Groove. any idea what chip it is? and what should i replace it with? It's a DC/DC stepdown converter: http://radiokomponent.com.ua/pdf/is/LSP5502.pdf Costs next to nothing: https://www.amazon.com/IndustrialMaker-10pcs-LSP5502-LSP5502SAC-Authentic/...

mbovenka

The USB port of my CCR1036-8G-2S+ now works again

mbovenka

NAT Hardware Offloading ! Great news. When is this coming to the actual router products like CCR series or new router products ? Not going to happen. They don't have the hardware for it, up to and including the CCR2004. Maybe, just maybe, the CCR2016 will be an ARM64/PresteraDX combo, but I wouldn'...

mbovenka

!) added FastTrack and NAT hardware offloading support for CRS317-1G-16S+RM;

Holy...<beep>. When is this coming to other CRS3xx switches? The CRS305 in particular? Please pretty please?

mbovenka

To be able to realistically saturate 100Gbps line, router would have to be able to route at at least 250Gbps according to official test results ... and this number should stand where there's 4538Mbps for CCR2004. Not sure if CCR2016 will be that much faster than existing CCR2004. Unless they pull a...

mbovenka

And I (sadly?) share views by @BartoszP ... that 100Gbps is nowadays too expensive for MT range. And I don't mean the possibility of adding a 100Gbps interface, I'm talking about capability of routing at that speed. The as yet hypothetical CCR2016 could, if we look at what the current CCR2004 can d...

mbovenka

Of course not. We were talking about 100G internet connections. At least, that's what we started out with.

mbovenka

There is, besides a few other CCR2004s, a CR2016-1G-12XS-2XQ (12x25G, 2x100G) in the offing, as discussed here (thread called 'just leaving this here'). At least references to it are hidden in the RouterOS 7beta binaries. Given the price of the current CCR2004, I wouldn't be surprised if it turned o...

mbovenka

https://www.rogers.com/business/product ... rnet/fibre

So a new breed of Routers etc may be upon us very soon

Bring on that CCR2016-1G-12XS-2XQ, MikroTik

mbovenka

802.1BR is NOT MC-LAG and has a different use case. It is for bridge extension, port expanders and the like. You could possibly use it for stacking... I didn't say it was the same. I said that it probably would bring it with it, and I stand by that. It makes it possible to have LAGs with members co...

mbovenka

The IEEE 802.1BR support added to 6.48beta12 will eventually give us that, and more: *) crs3xx - added initial Bridge Port Extender support (CLI only); *) crs3xx - added initial Controlling Bridge support for CRS317, CRS309, CRS312, CRS326-24S+2Q+ and CRS354 devices (CLI only); A full IEEE 802.1BR i...

mbovenka

But then it seems MT doesn't consider VLANs to be SoHo feature as the built-in switch chip is just fine as long as one doesn't use VLANs. True, it seems that way. But I beg to differ, and probably a lot of SOHO networkers along with me. The 4011 is an awesome little box for the price (I even bought...

mbovenka

However, I can see understand why the RB4011 has such a dumb switch-chip. Is not supposed to be used as a switch, only as a port-expander. But then the device is somewhat unsuitable for SoHo-usage. Exactly. It would be better at what it is if it had a somewhat more capable switch chip, one capable ...

mbovenka

You're using CRS317 as router and CRS317 as router sucks ... throughput maxes at around 400Mbps. If you'd user CRS317 as a switch, then it would be able wirespeed transfers. So think about the reason why you use CRS317 in routing mode and how you can avoid doing that. Upgrading the CRS317 to ROS 7b...

mbovenka

I agree that something is missing between the RB4011 and CCR2004. The RB4011 is a bit more tilted against Home-usage. CCR2004 is a datacenter device. I've been thinking about the MT routing & switching lineup in general. IMHO, it's due for a cleanup. What I would do, were I MikroTik: 1) Ditch t...

mbovenka

i dont need WiFi or many RJ45. What i need is a powerfull router with min. 2x SFP+ let the router be a router and nothing more Agreed. There is room between the RB4011iGS+RM and the CCR2004-1G-12S+2XS for a router with a small number of 10G interfaces. Something like a CCR version of the CRS305.

mbovenka

"no way" "route" Please be much much more specific, you present the subject like routing would be some magical high overhead process. I suggest you look at the link cited in the message before yours. It doesn't get more specific than that and it shows that yes, routing is 'some ...

mbovenka

I'm little bit affraid about using non-stable, beta release. It's my home router but it is like production environment and it's heavilly used specially these days. That's a choice you'll have to make for yourself. The 4G stick will work, and my CCR1036-8G-2S+ has been running 7.0b8 for 27 days now ...

mbovenka

They advise me to upgrade to beta (7) version of OS . I have the same stick, and it does the same. With 6.x it flips between two USB IDs, that of a 4G stick and that of a mass storage device, and the link is up when it behaves as a 4G modem. Upgrading to ROS 7beta8 worked for me connected to a hAP ...

mbovenka

I was thinking iperf3 is single-thread (single stream) and so for multi-thread one has to use iperf v2. The last time I had tested iperf3 the server part could not accept multiple connections. So I switched back to iperf v2. AFAIK iperf3 will let you run multiple TCP streams in parallel, with the -...

mbovenka

Normis, am I way off base here, or should I send you to jail??? ;-) LOL :-). Yes, you're off base. It's not the physical interfaces, but the number of data streams like TCP sessions that matters. Across the Internet, you don't need to have 10G to run into this; that's why things like BitTorrent and...

mbovenka

What kind of BS answer is that? The test results from MT clearly show the OP should easily reach 10Gigs (12-26K very doable) one way. Even IPSEC shows at 4K That's not a BS answer, @anav. Those test results are with many streams in parallel (look at RFC2544). It's quite possible that a single strea...

mbovenka

The CCR2004 probably comes close enough in practice, assuming your firewall is simple: https://mikrotik.com/product/ccr2004_1g_12s_2xs#fndtn-testresults Connecting everything with 10G on a CRS305 will still limit you to the routing performance of the RB4011, and it won't do full 10G, as you can see ...

mbovenka

Yes, if you have a C S S326 it will handle VLANs, but it will not route between them; it's an L2 switch only. A C R S326 will (when running RouterOS), but it's not powerful enough to route 10G. Not by a long shot. The RB4011 comes closer , if you make a 10G router-on-a-stick out of it. But in essenc...

mbovenka

I don't really understand what you mean. If only the router knows about the VLANs, how is the switch going to handle them? And yes, SwOS will do VLANs as well. I would put the NAS and your workstation in the same VLAN, because otherwise yes, you'll be bottlenecked by the external router, or the rout...

mbovenka

I upgraded my NAS with a 5G USB based ethernet NIC. When connected to the CRS305, SwOS reports the link as 10G, while the NAS reports its link as 5G. Shouldn't the CRS305 be reporting 5G? Also, I am only getting about 500Mbits of throughput. If I connect the NAS to a 1Gbit switch, I get the full 90...

mbovenka

Never thought of using phone like that except when travelling, but nice job!! The LTE interface RouterOS creates isn't really one, you can't talk directly to the 4G network through it. It behaves more like an P2P Ethernet interface with a NAT router & DHCP server on the other end (much like the...

mbovenka

https://blog.ligos.net/2018-03-01/Mikro ... lover.html

Good writeup. That's pretty much how I did it, except that I used an Android phone in USB tethering mode, which gives you an LTE interface automatically (it acts like a 4G stick in that regard).

mbovenka

In general I can agree with that (I am just now in the process of migrating some internal systems at $dayjob from SuSE 10.0 to something current) but you should also consider that waiting too long to upgrade can also make it more painful to finally do so.

True (I'm looking at you, NX-OS

).

mbovenka

True, but the problem is that the routing in CRS and many other devices is not fast enough for that. We "regularly" see disappointed CRS users here who kind of expected it. We can point them to CCR and they usually will have no problem (certainly not with CCR2004) but then they start to e...

mbovenka

Probably they consider the processor on this chip very powerful. I have managed many L3 routing switches from the wellknown manufacturers in that field, and most of them have a much slower control plane processor than this (or else they have written their firmware in interpreted BASIC...). Those ma...

mbovenka

I think those devices like the 98dx8216 are positioned as L3 switching devices with the processor only intended for use as management/monitoring processor. (to run a configuration UI and provide services like SNMP) Yes, they are. The CPU in the SOC is meant purely as a control plane: CLI/web interf...

mbovenka

Of course we would not have had this discussion when it was released as a CCR2004-1G-4S+2XS but then probably prople would ask for "more ports" :D Probably :D. The real solution to this of course is to build something with ARM64 as control plane processor and PresteraDX as data plane forw...

mbovenka

Interesting the cage I bought for my 260 works fine in the CCR1009, but the RJ45 from ubiquiti does not. They look exactly the same physically with a different sticker. Why would the ethernet page show boxes for VENDOR, if the bloody thing doesnt accept other vendor products LOL. Because they do? I...

mbovenka

I believe the hardware acceleration you're referring to on the CRS is for VLANs.

No, the CRS317 has L3 offloading (hardware-assisted routing) as of ROS7.0b6.

mbovenka

I'm a network engineer at $dayjob, and my motto is simple: don't upgrade unless you *must*. And 'must' means one of two things: 1) there turns up a colossal security hole in the software you're running (and it must be in functionality you actually use) or 2) newer software has functionality you abso...

mbovenka

Why? The big boys are no different. They build their own hardware, and virtual stuff to run under your hypervisor of choice. And for much the same reason MikroTik decides to depreciate x86 and focus on CHR.

mbovenka

Anyone else having problems with the CCR1036-8G-2S+ USB port under 7.0b8? I upgraded my CCR from 6.46.1 to get my Huawei 3372h-320 working (tested on a hAP ac). But on my CCR, the stick isn't recognized. In fact, nothing is; nothing shows up in USB resources, whatever I connect to it (USB memory sti...

mbovenka

you have a lte1 flapping interface. Please check when lte1 is down if usb device is still detected in system \ resource \ usb ? You use HiLink mode with dhcp-client at lte1 then what show you his GUI when you connect to him ? Means, uptime and session uptime or maybe you have some custom firmware ?...

Search found 345 matches