MikroTik

atomicduck

Hello MikroTik guys, I have been testing WinBox 4.0 beta9 and I see some stuff have improved since last time I tried. It is good that you have returned with the tabs and overall stability is better. However, all in all I can't say that I like the new WinBox. It has some nice features, but is all doe...

atomicduck

I second this.

atomicduck

On a Mac it works relatively OK. I see a fair number of crashes, and initial search of devices on LAN is slow. Visibility is better than before, but I think the bg should be a bit lighter to increase contrast. I liked the new status on the botton. It is very useful. Header letters are very bad visib...

atomicduck

I am just building a small network on 1100AHx4, and have encountered a weird issue with Firewall: if I define a list for all local interfaces, and use it in the firewall it doesn't see to catch anything. Only if I define input for a bridge interface it catches something. Doesn't work: /ip firewall f...

atomicduck

Well, I fixed it. The router had the button stuck. Managed to put it in netinstall mode and it worked. HOWEVER - the router behaves in a weird way. The normal bridging didn't work after I got it up, and I just needed it as a simple switch. So I put it away for now and ordered a 260GS. Too much troub...

atomicduck

There are two (BTW confusing) ways to boot in Routerboot mode: 1) press the reset button and while it is pressed power the device, then keep pressed until the device appears in netinstall <- this will use the backup bootloader 2) power the device and immediately after press the reset button, then k...

atomicduck

I have one weird hEX which failed during upgrade, however I am not able to put it netinstall mode.

What happens is that the device just restarts at one point while I am holding the reset (at about 15-20s?).

I presume the device is irepairable, is there anything else I could try?

atomicduck

I have one mAP Lite that I use for Dynamic DNS on a location where the main VPN router seems to have crashed / exhibiting bugs. So I was wondering if it would be possible to set up an usable temporary WireGuard VPN on mAP lite... Did anyone measure what is the throughput? I am aware how ridiculous t...

atomicduck

Hello, I added second internet access to the main router (failover). I put it in its own bridge, made masquerade rules and added route with correct metrics. ROUTE: /ip route add check-gateway=ping comment="MAIN - SLOW INTERNET" distance=2 gateway=192.168.0.1 add check-gateway=ping comment=...

atomicduck

It's not rocket science. If you go the manual road, it MIGHT be possible you need to handle this in 2 steps. But you will only know once you see it failing. If you go the normal road as foreseen in Winbox/CLI, it SHOULD be a one-step thing. Also there, log file after reboot will tell you were you a...

atomicduck

I have tested this on mAP lite: 1. update to 7.12.1 worked as it should 2. update to 7.13.5 where i also added wireless package manually when updating also worked as it should So I conclude that it is indeed possible to manually install both the system and wireless package at once during an upgrade ...

atomicduck

So... call me stupid, but I still don't understand is it doable or not.. I will have to dig one older ap and test.

atomicduck

HOW did you do these upgrades ? Should be done using System / packages / upgrade (Winbox or CLI) Don't simply drop ROS package on files and reboot. If you used that approach, you should have dropped wireless as well. Every single legacy wifi device I upgraded past 7.12 towards 7.13.x, got the wirel...

atomicduck

Excuse my ignorance, but how? I have done a number of upgrades today, both to 7.12.1 and then to 7.13.5, and not one of the updates installed legacy wireless package automatically. All of these were active CAPs, and until I specifically installed wireless package, this didn't work. As for the Capsma...

atomicduck

If you use the normal upgrade proces (System / upgrade packages / Download and install) then 7.13 will "automagically" take care of required extra packages where needed (actually, the hooks are present in 7.12 since that's the one doing the download). It's even so that on some device NOT ...

atomicduck

I have a number of pseudobridge WiFi devices scattered around. Now, I wanted to update them all to newer ROS, but then it dawned on me that new ROS does not contain wireless drivers... Am I correct that after 7.12.1 I will have to physically access device to update it? Or is there a way to prepackag...

atomicduck

1- yes, 2 different capsman environments. One under wifi, one under wireless / capsman 2- yes. Don't believe me ? Try it :lol: I have a capac and hap ac2 running wifi-qcom-ac driver as standalone APs. Wifi-part needs to be reconfigured from scratch but this time in the wifi screens (if you use CLI,...

atomicduck

1- yes, 2 different capsman environments. One under wifi, one under wireless / capsman 2- yes. Don't believe me ? Try it :lol: LOL :-D Will test I have a capac and hap ac2 running wifi-qcom-ac driver as standalone APs. Wifi-part needs to be reconfigured from scratch but this time in the wifi screen...

atomicduck

Thank you. I think I get it now. - I can control new AND old versions of devices on one capsman (are there really two separete versions or they just include it in two diff packages?) - Are you sure I lose I loose radios? I see that routeros + wifi-qcom-ac on controller work? (kind of an issue for sm...

atomicduck

Ok... I won't lie - I am confused... So the situation is the following? -> 1. for Capsman i have two different versions now? 2. for devices like CAP-AC (and I have a lot of those) for wave2 I would need to install wifi-qcom-ac and loose 2.4 ghz? 3. on 4011 I have to use old Wireless to have both car...

atomicduck

RB4011 is a special case since it has 2 different wifi chips. The choice you have to make is using wave2 drivers but only keeping 5GHz. Or continue using legacy drivers and keep both radios. Thank you. I will probably keep W2, but if I will have to have both WiFi interfaces - how do I proceed? What...

atomicduck

I have one 4011 device working fine (excellent actually) on ROS 7.12.1, but I don't see 2.4 GHz card with WiFi Wave 2 package. Unfortunately, client has some old devices that need 2.4 Ghz. If I upgrade to latest ROS, I understand that WiFi packages are installed by need, and not by default? I see th...

atomicduck

So you need to allow VLAN to VLAN traffic, but have a mandate to restrict by IP and port? If so, what you are doing seems reasonable in terms of rules and efficiencies. This was built for a very large distributed network that consists of 5 huge buildings with office spaces, production and warehouse...

atomicduck

UPDATE: The port list I defined here works fine. I maybe modified it a bit, but in essence that's it. (It seems everything works without RPC dynamic range.) Screenshot 2024-02-21 at 14.53.23.jpg Allowing only specific ports I filter out an ungodly amount of crap from the network... And everything wo...

atomicduck

Fast forward a bit. MikroTik S-RJ01 modules seem to not work well / work at all with RB2004, possibly other devices. I detected that the modules are failing in mysterious ways. For example, after a reboot some wouldn't start. Other just turned off after a while, and back on. Anyways, we have connect...

atomicduck

Here is an update; I have disconnected everything from router ecept my own laptop and internet feed. Tried checking routers own (VPN) ports open and nothing. Under NAT I can see that ports get triggered.

atomicduck

It would appear that you dont have the single allow dstnat rule in the forward chain but have created the firewall portion of every dstnat rule as a separate entry also in the forward chain. Or maybe not???? Q. Can you confirm if all those forward chain rules with dst are simply LAN to LAN or wireg...

atomicduck

Honestly, I can't spot the error in the config. Only one thing (actually two) is unclear for me and may cause access problems is /ip firewall nat add action=log chain=dstnat comment=TEST dst-port=45562 log-prefix=\ "NAT incoming" protocol=tcp add action=log chain=dstnat comment=TEST dst-p...

atomicduck

please clarify, you are trying to connect to port 3389 from router (?) to which address, internal or external (?) Thank you for replying. I am trying to port forward to 10.0.20.14 to 3389 I run wireshark a bit and I could see IP from main router when I used telnet on the server and also could conne...

atomicduck

I sincerely appologize. Here is the info: I am running 7.11.2 on CCR2004. Here is the config, I removed DHCP, capsman (works fine) Wiregaurd. /interface bridge add name=BR1 protocol-mode=none vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] name=ether1-MGMT set [ find default-...

atomicduck

I have a router with VLANned network. Internet access is masqueraded and internet access works. The issues are the servers are on and off accessible from outside? I have port forwards and they should work / work - I see rules triggered, and when I try to telnet to server (3389 port) from the router ...

atomicduck

I have just had an entire LAN drop after both DNS / DC servers dissapeared from the LAN. I took me about an hour (it is a very large site) to find out that after the restart of the main router (CCR2004) where I use them to connect servers to it using copper the simply did not start. I have temporari...

atomicduck

Maybe you should report it. When I did then could not replicate and after setting the address manually it worked OK for me.

atomicduck

I had an issue establishing links with XS+31LC10D module, and got an info from support stating that for: XS+31LC10D XS+2733LC15D modules, the following settings need to be applied when plugged in to SFP+ interface: /interface ethernet set sfp-sfpplus1 auto-negotiation=no speed=10Gbps full-duplex=yes...

atomicduck

But then you still have to use the same PSK for all users. This was exactly what I wanted to avoid. The idea, at least for me, is to have users defined in advance for stable or sensitve equipment. Everything else? Normal PSK and that's it. In any case, still waiting for the atomic duck blueprint fo...

atomicduck

Tried setting no-negotiate and static speed & duplex?

I had the same problem with XS+3LC10D and CCR2004 and CRS309 today and this helped. The cable was a short interconnect of 1M... I set the rate to low, same settings on both devices.

atomicduck

The problem is that EAP isn't supported by minimal systems (like printers and IoT devices), and that many devices do not work properly when both PSK and EAP are configured on the same SSID (although the standard and the configuration of RouterOS does allow that). Another problem is that configuring...

atomicduck

TBH, this is not that important. There is a solution to this problem via EAP, with an ability to assign username / password per user. That is perfectly fine. One should think in terms of manageability of computer networks, and sometimes logical separation is at least as important as a security aspec...

atomicduck

As I have segregated departments into their own VLANs, I need to allow those port IN specific from those VLANs. I made a list of ports needed for AD DC and file sharing work on Windows network: LINE BY LINE: # TCP Services /ip firewall filter add chain=forward protocol=tcp in-interface-list="LO...

atomicduck

Maybe this is related? v7.12beta7 has an RoMON fix...so maybe something was/is broken... *) console - improved system stability through RoMON session; What version are these RoMON problems happening? For me it was on 7.11.2. I reported this to MikroTik, we will see if they will consider it a unusua...

atomicduck

Maybe you actually have duplicate mac-address on the bridge interface someplace & it's not an RoMON issue. I'd really use leave id= unset. If it's switching look at the mac-address it's switching between, and compare with /ip/arp/print and /interface print proplist=name,mac-address I did compar...

atomicduck

Perhaps limit interfaces= to where you want RoMON? I guess you can use id=00:00:00:00:00:01 id=00:00:00:00:00:02 id=00:00:00:00:00:03 since RoMON used different ethertype & likely best it's NOT same as anything else. But I've let it figure it out and never seen an issue... so I may not be much ...

atomicduck

Super, I will be sure to link to it from the user article!!

I am planning how to do it, but I am currently working on this network I am building right now so no much time. But I will certainly make it, because it is very useful feature to have.

atomicduck

I wouldn't not mess with the "ID" – leave as default/unset. It will be automatically be assigned. I've used it for years, and never messed with id / mac-address, only secret. The "secret" on all routers DO need to MATCH (or all be blank). When enable, do the 3 routers all show u...

atomicduck

In the end it doesn't matter as long as it is a unique value.

I will set it to MGMT port MAC then by default, as the native functionality does not provide unique ID.

Thanks

atomicduck

Good question. I leave it blank/deselected and then it will take bridge MAC address on most of my routers (which usually makes most sense). It should be a unique identifier or you may run into problems further on when using romon. OK, so played with the setting and one one CRS328 when set again to ...

atomicduck

I enabled ROMON and noticed that three of the switches have an identical ROMON id. This is the config: /tool romon set enabled=yes id=00:00:00:00:00:00 /tool romon port set [ find default=yes ] cost=100 disabled=no forbid=no interface=all There is an additional line where I set the three secrets. Ho...

atomicduck

Atomic duck, when you get time can you add to the bottom of this thread a more detailed end to end step by step to achieve this functionality?

Will do!

atomicduck

Users are connecting with username/password in EAP (enterprise security) anyway. So random MAC is not a problem as long as all limits are bound to the username (RADIUS accounting and profile limits). In wifi "registrations", the used username for RADIUS is not visible, so I add it in the ...

atomicduck

@bpwl Thanks. Will test. MikroTik guide set the EAP TLS adn RAP PEAP for the outer atuh (1.st stage) and TTLS PAP, TTLS CHAP, TTLS MSCPAH1 , TTLS MSCHAP2 and PEAP MSCHAP2 for inner auth (st. 2). What I need to leave on 1 is: both EAP TTLS and EAP PEAP auth and PRAP MSCHAP2 in 2. As for Mikrotik-Wire...

atomicduck

Thanks. I have never used EAP before and I noticed interesting pattern - with iPhone I can connect to any username no problem, but not on windows or mac. I can connect only on not used before username/pass. Have you maybe noticed this behaviour too? Not really an issue, I even prefer it, but trying ...

atomicduck

What's wrong with AX3? @anav was always a proud hater of capsman, so he never learned its convoluted way. Now that wifiwave2 follows the path of capsman, he's suddenly lost. I can can put my 5c here for anyone interested: I have tested several wireless aggregators, the latest and most expensive bee...

atomicduck

No certificate .... that was exactly my problem also! https://forum.mikrotik.com/viewtopic.php?t=185562&hilit=userman#p765296 And I also only used PEAP and MSCHAPv2, not EAP-TLS. Creating the certificate for Userman was the solution. Code/exemple is in the MT HELP: https://help.mikrotik.com/doc...

atomicduck

Just curious, what WLANs are you trying to invoke such high security........... Are you protecting guest users from each other or what?? If you are asking me: - I have an industrial production facility where I need to connect pseudobridged devices as an ethernet port emulator so that industrial pri...

atomicduck

The unfortunate part of the IT is that new features are the name of the game...

atomicduck

@bpwl Thanks. I will then proceed to make a certificate using the tutorials you provided. I see you have made it last like 20 years or so, which is plenty. @pe1chl Yes, I am aware that an attack is possible, but this approach is essentially a workaround for simple multi-PSK approach, and probably mo...

atomicduck

LOL guys :-D you made me laugh Yeah... the main issue I have now is that I need to put a production network on, and it chrashes on current software. Not ideal and due installation is probably next week. What's wrong with AX3? I have set up an 4011 on Wave 2 and it works like a charm. I gather not th...

atomicduck

I added the Capsman (lcoal) under router and they do communicate, but users get rejected. I did not create certificates yet, as I hoped to skip that if possible. I just need specific login for specific user account and that's it. I did find some tutorials how to make this work usil EAP-TLS, but I do...

atomicduck

Radius client can not communicate with radius server aka (Userman) when general masquarading rule is applied. exclude 127.0.0.1 from masquerading & use 127.0.0.1 as Radius client & User manager IP. Use this code instead /ip/firewall/nat/add chain=srcnat action=masquerade src-address=!127.0....

atomicduck

Users are connecting with username/password in EAP (enterprise security) anyway. So random MAC is not a problem as long as all limits are bound to the username (RADIUS accounting and profile limits). In wifi "registrations", the used username for RADIUS is not visible, so I add it in the ...

atomicduck

Well... thanks? :-) For now I have make Capsman function as is, with APs on isolated network. It seems a lot of config to change everything (read I need some time to read and understand your config.) I also made the VLANs work as they should over capsman and added bridge horizon (capsman forwarding,...

atomicduck

Your concept is flawed! Every smart device (able to read vlans) should get its IP address from the management VLAN. This is where neighbours discovery really shines as there should also me a managmenet interface list entry populated only by the managment vlan and any other ports or interfaces you s...

atomicduck

Your understanding is about correct for what is needed. As long as there is some sort of connectivity, romon will work. Even if your complete IP setup is borked, it still works. I don't use secret at home. See here for more info. https://help.mikrotik.com/docs/display/ROS/RoMON Thank you very much,...

atomicduck

I presume you too manage devices directly from central router? You don't use winbox for scanning? Sometimes I do but when I see it doesn't come through, I use ROMON. I have never used ROMON before. Pls. see if I understand how ti works: 1. I set up the ROMON on central router, set ID and secret (BI...

atomicduck

The fact you use VLANs, is giving this to be expected behavior. What I do at home, is allow my personal PC access to all defined VLANs (since it has a fixed IP based on MAC address). At work I always connect from PC to 1 central router using ROMON and then I can move on. Thanks - I have this set al...

atomicduck

I made a MGMT VLAN and an AP VLAN. MGMT is for routers and switches, and AP is for AP. I isolated a bit that VLAN, and only CAPSMAN ports and some IP services are available. The AP ports are access ports on PoE switches, and I am reluctant to allow management VLAN there, because that makes accessing...

atomicduck

The plans are always changing and suspect vary a lot by country too... Apparently, Starlink Router is WiFi only. Go figure. (No business option where I am .) The ethernet adapter goes in-line between the dish and router on regular/"rectangular" ones. Also why I suspect it's still a USB bu...

atomicduck

I will definitely order an additional cable with it when I get to implementation. And perhaps an ethernet adapter too. They typically don't come with any (but they are always changing things, so check when you order) ... i had to check this. For anyone interested: https://api.starlink.com/public-fi...

atomicduck

Thank you very much for this informative and usable info.

I will definitely order an additional cable with it when I get to implementation.

atomicduck

BATTERY: But how do you prevent overcharging?? The AC/DC adapter that comes with battery has a voltage sensor. STARLINK: I also heard that starlink antenna array uses a *lot* of power... Have you had experience of how it feels using it in real life? I haven't monitored it closely, but SL typically ...

atomicduck

BATTERY: But how do you prevent overcharging?? I supposed you have circuitry to monitor both upper and lower voltages and stop charging, or you rely on internal battery circuitry? (Apart from that, this is rather smart setup..) STARLINK: I was actually thinking of using starlink as a backup in a nu...

atomicduck

Unfortunately no. It is a standard feature now. No, what is standard now is to use a "random" MAC. But it remains constant. In the first version a new random MAC would be selected every time a WiFi connection was made, or even when it roamed to another AP. That would cause overflow of DHC...

atomicduck

Users are connecting with username/password in EAP (enterprise security) anyway. So random MAC is not a problem as long as all limits are bound to the username (RADIUS accounting and profile limits). In wifi "registrations", the used username for RADIUS is not visible, so I add it in the ...

atomicduck

For this to work you need to disable that mis-feature. Also I think Apple has stopped doing that long ago. Unfortunately no. It is a standard feature now. May I ask how big is the system? We have about 250 Windows machines, a similar number of Android phones, and about 2500 "guest" device...

atomicduck

I sometimes use 24V battery packs on either PoE injector or as the DC IN, with the battery charge always plugged in to the grid. No AC/DC conversion and Mikrotik's don't really use all that much power, so $50-100 battery pack is often longer lasting/cheaper than APC-like AC UPS. The 24V lithium pac...

atomicduck

Anyways, it is nice to have unified way to do this. From what I understand, most, if not all of the new devices support the new bridge mode, so that is fine (and preferable) by me.

atomicduck

If it is purely UI decision, then why there are three different ways to set VLANs depending on underlying hardware? If we're thinking of same 3 ways, then: bridge with vlan-filtering is the unified solution, introduced in ROS 6.42. All newer devices can offload it to HW for some functions and some ...

atomicduck

I would second this. I don't agree ... and I wrote my reasoning in post #69 above. Configuring switch chip via bridge configuration interface has nothing to do with hardware topology, it's an UI design decission. IMO it's similar to dilemma between using 3D graphic card using GPU-specific ABI versu...

atomicduck

The only reason: MT has using cheap consumer chips which has "slow shared bus" to the physical ports ( eth1, eth2, eth3, ... ) and all the processing is done by the limited CPU. Other "large" vendors, they using ASIC chips for packet processing. The difference in short: "Yo...

atomicduck

May I ask how big is the system? - Complex solutions are warranted only on very large systems, and your solution does seem quite a hassle to develop and maintain. I presume your spans hundreds of machines. Probably in the range from 200-400? Or more? I just checked, and really - there is no replicat...

atomicduck

Yes it is possible to make WPA2-EAP work on Windows and e.g. Android and IOS, we have that here at my work. But I can tell you it is a royal pain in the b*tt to make it all working and to get the certificates installed etc. In the end I have made it all work automatically with INTUNE and a UBNT Lin...

atomicduck

MikroTik does not support having different PSK per device under WPA2-PSK. It *is* possible to do this under WPA2-EAP, but you will find that not all client devices support that, and when they do they may mandate the installation of a certificate (this is not strictly required for the protocol to op...

atomicduck

Would it work that I make images out from it, and post it one by one on the forum? This is rather usable presentation. Would do it.

atomicduck

Thanks. These monitoring tips are great. For me the most important one would be the temperature - sometimes AC units fail in server rooms and then things can get toasty. I was maybe thinking building my own, base on Pi https://www.instructables.com/How-to-Build-a-Raspberry-Pi-Temperature-Monitor/ Wh...

atomicduck

I would like to lift up security of mi WiFi networks, but still keeping it simple. Username / password for accessing wifi would be enough, but I would like to skip certificates. I would appreciate info in this regard, and a tutorial or two as I can't find anything. Other option would be a PSKs for e...

atomicduck

Thanks for info. Out of curiosity, how do you solve monitoring and reporting of MIkroTik systems and external sensors/batteries and such? Also re UPS, fullcapacity is a no-no in my opinion, one should always leave a large power margin when UPSs are concerned. The hack I mentioned regarding Back-UPS ...

atomicduck

#1 OK #2 Jesus. ... Don't you think that s a bit of an overkill? :shock: That system is really complex, have multiple fail points and is expensive to maintain. If I my suggest maybe a more sensible approach, given that you like to thinker - get an Smart UPS 750, or 1000 (they don't have a fan), or i...

atomicduck

I hope you add information about creating VLANs by new way... and how live with General vlan id:1 and others as Trunk. For now I use always this howto: https://mbum.pl/archive/vlan-po-nowemu.pdf (Presentation from Ihor Hreskiv at Mikrotik Beer User Meating at Poland 2019, mbum.pl) Pages: 34 - 50 I ...

atomicduck

So you chose an option to have external dedicated poe backup. I am thinking about this too, in a way that I would have a separate injector and an adapter for each device if I wont find a way to configure excess PoE switch ports to be redundancies. Have you maybe checked what happens when you plug/un...

atomicduck

I had an adapter fail on me during a rather large installation last week, so I scrambled to go there and replace it... I have a big box of them, just in case. (I think 20-30 adapters. :lol:) Then I started reading about PoE input and realized that some of the devices are built in such a way that if ...

atomicduck

we have retested 5009 - USB specification will change to 1.5A

I appreciate this very much. I love it that you are flexible enough to do this, and that you as a company keep the original appeal for your devices.

atomicduck

I still would not dare to have a MikroTik router with open webfig/winbox ports to the internet!
Only allow management from the "inside" or via a VPN.

Of course

atomicduck

My password strategy is twofold: For stuff that I have to login manually sometimes i use cca 15-25 char passwords that are also relatively easy to type. For stuff that I never type, I set the pass alphanumeric as large as the system accepts. Say 50, 100 or more random generated characters. So device...

atomicduck

I do use KeePass as well. Storing password in a cloud together with many other user, is a big bait for any hacker so it will be hacked soner or later. (or lost since site has corrupted disk) Same logic here. I have thousands of passwords, keys and encryption certificates. I do backup the databases ...

atomicduck

The scenario that this new practice (as mandated by the EU) tries to prevent is that new devices are deployed and left with a default (or no) password. That is a very common scenario (as indicated by "research scanners") and regulation has been made because manufacturers apparently did no...

atomicduck

1) Netinstall doesn't give a damn about your password, you might as well lose it. It doesn't, but deivice does pull default password on reinstall. You can force it not to it seems. 2) Are you concerned about security? What do you care if someone discover the default password, so you make a user of y...

atomicduck

Picture of label of every device with password and I store everything in Evernote. If you reset to factory conditions, you need to have those passwords again. You can also netinstall and apply your own default password. Hm. Istn't evernote a bit unsafe? I use KeePass and store everything there. Enc...

atomicduck

Had it too some months ago on an AC3.
Support said there was a mismatch between printed material off factory and online manual.

Yup, that's what I got from all of this...

How do you solve archiving passwords? Is it needed after you change pass?

atomicduck

Well, task successfully failed from my perspective :-) I thought I got a bricked device at first. Happened a few times, so no biggie I thought, that is why I did a netinstall (especially concerning that I did have a bricked 4011 recently). However, the change was NOT in the supplied manual. I did ch...

atomicduck

Info for users: I just spend 2-3h troubleshooting new 4011 on site, into which I couldn't login with default“ admin / empty. I did not see / notice that the device has a preset admin and WiFi passwords on the back of the device, which is different from hundreds of other devices I configured. If you ...

atomicduck

mostly container and rose tests - some heavy writes after that no use at all. p.s. Just checked 5009 - it seems that inner power delivery circuit should support 1.5A, we will recheck if there is a mistake in spec sheet. I think it would be great if that is so. Design for 1.5A, peaks maybe 10% more....

atomicduck

I personally have been using 1.7A rated Micron 5200 SSD via USB to SATA close to year with RB5009 - no issues so far.

How long? And what are you holding on it? - Meaning are you using databases with constant access, or stuff to boot with only ocassional access?

atomicduck

I have successfully connected a hub and a couple of drives to a 5009 or 2004. If the drives weren't bad in the first place (which turned out to be the case for a couple), they came right up. So ROS handles multiple drives without an issue. Appreciaated. As for power consumption, the drive I have is...

atomicduck

A distributor told me that it will be available in end of August / beginning of September. :D :D :D :D Yeah. No way Anselmo. I waited for my own RB5009 for A YEAR. And currently I am waiting for a bunch for a project (10GBE backbone, routers, switches) of equipment for about a month now. Everything...

atomicduck

Yeah, it is a pity. I do have a RB4011 and I dislike the lack of a USB port (and the beeper). And of course the use of two different chip families for 2GHz and 5GHz (it is a wireless model). In the good old days we had the RB2011 which had all the options. But of course a weak CPU for today's speed...

atomicduck

And why do that on RB5009 and not on a machine really suited for the required processing power ? (database stuff can be quite resource intensive) Or is the test to see how it runs on RB5009 ? RB5009 is very powerful. It directly compares with Intel Core2 Duo E4500, which means it is more than power...

atomicduck

I need to do a bunch of tests on docker contaners for database engines and apache/php.

atomicduck

May I ask why? (I am too inclined to use it as is.)

atomicduck

Well, data for a year working without a problem would be OK... :_)

As for powered hub, that is actually a great idea. Can you recommend one?

atomicduck

I think the SATA SSD disks should be between 2-5W.. Which should fall in to 1A/5V range. As for passthhrough - the 5009 has to have a rectifier, as the input power can be from 12-24V all of which are a lot above USB voltage of 5 V (unless PD). Now... The Q is mainly the long term, because I know peo...

atomicduck

I was thinking to expand storage for my RB5009 with enclosure with USB SSD that I have standing around. I know from experience that normal laptop HDD will draw too much power, and over time USB poer / power circuitry will suffer. Can the router handle long term connection to SSD in enclosure? Anyone...

atomicduck

KUDOS

atomicduck

Here are a few notes on now to successfully use NetInstall on Intel Macs (works on all version od MacOS, tested last on Ventura). Steps: 1. Download same version of ROS installation and Netinstall for the bricked deivice (don't mix different Netinstall and ROS versions). 2. You need to have Windows ...

atomicduck

Neat! Just tested it and it works on CapsMan on 7.7, however only thu cli.

atomicduck

Any router that might be designed for use as a test bed or lab environment should be designed with a serial port. The fact that the RB5009 wasn't baffles me. Initially, it looked attractive till I saw the serial port wasn't there.. Just get a RB4011 instead.. -tp Exactly what I did. I decided to pu...

atomicduck

Let's make a request for MikroTik to make that setting an option? Something that can be flipped the same way other RouterBOOT settings can? I support that. Even if going to the board directly if there are headers there, that would be a viable option to recover router that died. Or make header ourse...

atomicduck

Probably not a good idea. It seems it would be very easy to brick the router this way...
I just won't use this thing in production and that's about it.

RB1100 is plenty.

atomicduck

Do you happen to have OpenWRT manual on how to do this? 5009 is ARM 64 bit which is plenty and a reason why I bought it.

atomicduck

I also got a reply from MikroTik support: both Woobm and USB-Serial adapters can work only if ROS is running, so no console for me. So I guess it better not break. LOL

atomicduck

Like on the back of the The Hitchhiker's Guide to the Galaxy book.

atomicduck

Crap. OK... So tell me this: I had a failed 4011 two months ago, as the storage got corrupted. That is the most plausible explanation of what happened to it. Netinstall did not work whatever I tried, it just got stuck on upload, so I had to reformat the storage, and reupload the routerboot that I go...

atomicduck

Probably there are some stuff lost in translation. 1. You CAN use serial<>usb adapters to connect to your RouterOS, IF: that adapter is properly recognized and configured under RouterOS and if RouterOS is functional. 2. You CAN'T use serial<>usb adapters as a debug port (if RouterOS crashed for som...

atomicduck

I am confused now - does this mean I wouldn't be able to connect to serial console using an adapter? (in usb-serial = serial-usb config)

atomicduck

I got a reply re connectivity -> USB-serial-nullmodemcable-serial-usb contraption should work no problems. It can be made even easier from two USB to TTL boards (super cheap from China, <$1, just get FTDI chips as they are least problematic), connect RX->TX, TX->RX, GND->GND and it's done. Easiest ...

atomicduck

What I do on "important" RB5009 is to sacrifice ether8 for mgmt port. I make it not part of the main bridge nor part of the LAN interface group and bind a static ip directly to ether8, allow winbox/webui/ssh on it. So if I mess up bridge settings or FW rules in a way not even MAC access i...

atomicduck

I got a reply re connectivity -> USB-serial-nullmodemcable-serial-usb contraption should work no problems.
I just ordered another usb adapter I know works fine and I tested over USB connection.

As for woobm I am still not sure if that is console connection or terminal connection.

atomicduck

This said, 5009 is a great device, but without serial I can't implement it anywhere as there is no backup access.

Backup for what? For have serial port onsite or use remotely the serial port?
[/quote]

Backup for when routeros is broken so I can fix it tru console.

atomicduck

Do not work on v7, see other topic about that.

Could you please provide me the with the thread link? I can't find it.

This said, 5009 is a great device, but without serial I can't implement it anywhere as there is no backup access.

atomicduck

Sure, there is the WOOBM:
https://www.youtube.com/watch?v=2yWrUQ_woKQ

But this doesn't connect to serial console? It is only for running routeros devices?

atomicduck

Yes, you missed reading the specs before buying it.

Excellent. Is there a way to access the device over USB port via serial adapter or something??

atomicduck

I just (finally) received RB5009, and I see no serial port? Am I missing something?

atomicduck

OK, so after a year of waiting I managed to get (pay for now) for my 5009... My distributor told me again MT prolonged delivery to April, and another distributor just rung me and told me they have one for me :o) The first one will return the deposit, and I paid to the second one. And of course it wa...

atomicduck

Thanks My general idea was to have a CRS328 or CRS112 in a rack, and then power the devices through it. Both of these switches have dual voltage output where 328 as PSU-s integrated and 112 via external adapters. I would skip non MT solutions and injecting power, because that would defeat the purpos...

atomicduck

For a while I have been thinking about centrally powering all of my devices in a specific communication or server closet. I'm currently using power adapters that came with devices, and that solution does work well. Given that essentially every MT device that I know has a power in Port maybe it would...

atomicduck

Set these values:
Proposal: aes-128cbc/sha1/modp1024
Profile: sha1/aes-128/ecp256

Had the same problem, and these work fine. I tested on latest Win 10.

atomicduck

You can create static interface for user and that one won't disappear: /interface l2tp-server add name=<interface name> user=<user name> This worked. I also got reply from Emil from support who noted that I should make a profile for the specific user and lock use only-one flag: /ppp profile set <us...

atomicduck

Thanks, will try both solutions today after work hours.
We had some other issues that I had to urgently fix, sorry for the pause!

atomicduck

Is it client or server? But in both cases, if you "defined L2TP interface", i.e. you definitely added something, it's either client interface that must be there, or optional "L2TP Server Binding", and both should be usable. What wouldn't work is the dynamic interface created for...

atomicduck

Ok, so I was digging a bit - if I make a profile per connection, I would be able to have a script run on connection up. Then I would add: /interface list member add interface=<l2tp-1> list="[LAN] Would this work? And on link down, I would have to remove it. However, I can't find the command to ...

atomicduck

here they are: (Also, the last two in members, shoudl show l2tp-connection1, but that one falls off after a day or so. /interface list add name="[INTERNET]" add name="[LAN]" add name="[INTERNAL LANS]" add name="[INTERNAL LANS + WIFI]" /interface list member ad...

atomicduck

Hello, not sure if this is by design, but RB1100AH on 6.48.6 is loosing setting under interface lists for VPN setting. I have defined a l2tp-connection1 as an interface under PPP, and when I define it under interface list, it is lost - upon reconnection I think. Is this by design? I use it for the n...

atomicduck

If your short in supply, see in which end-product those goods are being used which bring the highest margins. Sell those. Yes I get that, but the thing is that *everything* is more expensive now. Simple ICs are often several times more expensive than before (someone up commented exactly that), so I...

atomicduck

Now new trend is that older industry standard parts are being obsoleted in rapid fashion. Component MFGs are freeing up production lines for something more profitable. You mean in general, or as a result of shortage? As for my 5009, I managed to get on a waiting list. A friend form another co told ...

atomicduck

Thank you. I appreciate it.

atomicduck

@jbl42 - I am ranting... But it is two+ years now. From my perspective that is enough to fix the supply chain. I will read the article, hopefully it will shine some light on the issue. @chechito - I think I will have to go that route myself. The unfortunate part is that the planning is not months, b...

atomicduck

With all components in it ? Plenty of tesla on parking lots with parts missing. Where I live 1 year for a new car with personal config. Ok, now compare that with a pre-built router. No options, etc. Two pieces of metal, one cast and one sheet, two sets of LAN terminals, an USB, SFP, and some other ...

atomicduck

I just got info from distributor: CCR1009-7G-1C-1S+PC - not available at at all CCR2004-16G-2S+PC - February at the earliest What I don't understand is how is it possible that the supply circus issue lasts this long. I mean, how it is possible that there are no chips? Deliveries should really be a n...

atomicduck

atomicduck "But it's cheap." Apparently no one does proper QA anymore. But the webinar and talk with the reps back in Dec really got my interest. 6ghz radios that can run as 5ghz until there are more devices sounded awesome. But they missed a bunch of release dates. And here in the US... ...

atomicduck

I am looking everywhere. Found some locations around the globe, but TBH I doubt any of them actually have the thing on stock, regardless of online status. As for alternatives, I could either aim for: CCR2004-16G-2S+PC or CCR1009-7G-1C-1S+PC However, I wouldn't really bet on the availability. Have to...

atomicduck

I just called my dealer, and after waiting 7 months, got delayed to February 2023...

Not sure what to do, the only thing left is to get 4011 with wifi chipset. Even plain 4011 is not available.

atomicduck

I have a VPN link for external user that I need to limit to one server / several ports and just looking if my line of thought is OK: I need to create server binding interface in PPP, and then I use that port as an in interface, and allow forward to the specific local IP + ports, and block else. Shou...

atomicduck

Here we go again... Its just inevitable. Been to a Cambium conference last week. Seems that they don't have much if any supply chain issues. Most of their equipment is available immediately here, and I have to admit that sounds sweet. I waited to MikroTik PoE SW for 9 months this year, and waiting ...

atomicduck

Its just inevitable.

If all would be perfect, what would you hope for?

atomicduck

:-) a netadmin's horror story from hell. One really has to understand the scope and the philosophy behind MikroTik, and either accept it or move on. Their way of doing stuff is producing very useful and versatile equipment for cheap. Most of the stuff they make is not available anywhere else. Take l...

atomicduck

Yeah... Those are quite specific issues and I can relate to them.
What provider you used to fix the issue?

atomicduck

I am curious what was the issue at hand for you? Regarding the MirkoTik WiFi, one has to not expect hgih transfer speeds, as devices used are predominantly older iteration of WiFi and simple to maintain when you get a grip with CapsMan. That said, I get 80-100 mbps routinely in a well covered facili...

atomicduck

moderator note: do not quote preceding post, use "post Reply". CapsMan / MikroTik is hardcore. It is really hard to do stuff in it sometimes, but the good thing is that when things are set they are rock-solid. I have a number of installations, and number of devices is usually 20-30, somet...

atomicduck

Can you please help me identify where I'm wrong? Hello, just a few quick notes: you can make it all work, but as there is no "smarts" integrated in Coapsman, roaming depends on signal availability. My approach for this problem is to install enough access points, and set signal levels rath...

atomicduck

RB450Gx4 could actually work fine.

5009 is an overkill tho... And you couldn't get one if your life depended on it. I am waiting for mine for more than half a year.

atomicduck

I'd really suggest hAP ac² rather than hEX Gr3 for this purpose. The price is about the same, and the throughput is better. So unless you need the microSD slot, it is a better value for money. You can keep the WiFi disabled if that's a concern. The issue with hAP is that it doesn't look professiona...

atomicduck

@nichky Thanks. That is what I did. L2TP worked fine, and in essence I am saturating 20/20 link, even with IPsec. However, MikroTik support told me that I can expect the hEX PoE to top out at about 20-something mbps, so that's that, I suppose. @sindy I think hEX PoE is not supposed for this purpose....

atomicduck

I maybe made a mistake utilizing hEX poe for a tunnel... I thought it has IP sec acceleration like it hEX sibling, but I am not sure. Does anyone know what throughput can I get over L2TP/IPsec with AES128 tunnel (basic)? I am currently saturating 20/20 link, getting some 14-15 usable Mbps throughput...

atomicduck

Thank you. That document is amazing really, as it is highly useful. I hope my government would do things like that... I implemented your suggestions, as I think they are valid. As for certs vs PSK, I use this VPN for site to site, and keys are 250 chars long, complex gibberish. If someone manages to...

atomicduck

Hello, I have a Q regarding IPsec encryption algorithms, after some testing of SSTP and abysmally slow connection speed (about 5-6 mbps whatever I do) I established L2TP/IPsec connection which seems to work fine. Now, I understand that by default encryption is rather weak, so I wanted to doublecheck...

atomicduck

What, too cheap to splurge for the CCR1072-1G-8S+ router ? ;-) LOL :-D I would be very hard pressed to explain why I would need something like that hahahaha :o) (Also I am happy that I don't really need something like this.) The overall selection of models seems correct... Thanks. What I am aiming ...

atomicduck

Appreciated.

atomicduck

Hi guys - I am preparing to upgrade a large-ish multi building network to 10Gbit backbones. Here are some ideas I have; would appreciate a comment or two is the general thinking OK... :-) We have a number of servers in central server room, and soon 5 closets in different buildings connected via fibe...

atomicduck

Thanks guys :-) I will try making holes to IPs for starters for these non-HTTP ports for AirPrint, and then will see how this behaves. Not sure will it work, but won't know until I test. Another this that occurred to me is that Android clients won't be able to print to AirPrint devices. No Google Pr...

atomicduck

Hi all, I have a Capsman network with 13 CAP AC APs, 8 of which are in dry-board rooms + 5 CAP XL in warehouse halls. I have set up 2.4 GHz and 5GHz channels manually, and was careful to set 2.4 GHz channels not to overlap. The question is how to set signal levels? - currently I have set signal leve...

atomicduck

We have a WiFi network that can't see the the physical network, but some users require AirPrint capabilities from a mobile phone to our printers. I have separate WiFi for internal connections, but would like to set up some holes in the firewall to allow airprint. Did anyone tried to do something sim...

atomicduck

I have it configured as dynamic off. The best approach is what you suggested below; will rearrange the list and set the obligatory SSID as master, and voila.

Thanks!

atomicduck

Practical question - in CapsMan there is one master configuration with SSID, and then I have slave configurations with different SSIDs.

How do I turn off the master configuration SSID off? - If I just disable the master config, all slaves are down (as it should be).

Thanks

atomicduck

Thanks guys.

atomicduck

If it's under warranty, I would rma it. if not, perhaps someone else can give you things to check on the board itself for repairs.

It is under warranty. Will return it!

Just curious, is the 48V adapter supposed to be able to power the device alone, or it _requires_ 24 AND 48 volt PS'es?

atomicduck

It should not matter. I would try with one power supply at a time, if you have different ones, try those. From your description, this is the poe version of the switch, if it was not then you could also try to power via poe in. Yes, this is PoE version, CRS112-8p-4s-IN. I tried with only 24V, 48V, a...

atomicduck

CRS112 just died on me. It doesn't want to turn on. I needed to move it, and I disconnected power - not 100% sure, but I think I first disconnected default 24V, leaving 48V PS. Later on the switch doesn't power up at all. There is nothing in documentation that I noticed regarding this. Have I made a...

atomicduck

Thanks. I gave it some thought. Generally, firewalling works with more or less the same priciple on both input and forward. 1. allow established,related 2. block invalid 3. filtering-blocking 4. allows 5. blocks 6. drop all I have reworked my firewall, partly on your comments; 1. on input i specific...

atomicduck

I actually never checked it myself, but I am surprised re wAP ac reqs. I always counted it as 10-15W AP, but it seems taht realistically it is much lower. Just checked on one of my PoE switches: RBcAPL-2nD - 1.4 W RBcAP-2D - 1.0 W RBwAPr-2nD - 1.8W These are idling, and go to 2-3W occasionally, whic...

atomicduck

I am building a simple firewall using this tutorial: https://help.mikrotik.com/docs/display/ROS/Building+Your+First+Firewall I am happy, but I have few Q for more knowledgable ones. I usually put ether1-WAN in INTERNET bridge and then filter that bridge in rules. The reason is simply not to get conf...

atomicduck

Thank you very much!

So, it is 260mA or 1.3W or under reasonable load, which is about 50% for USB 2.0 standard of max 500 mA. With light load it is 0,8W which is truly amazing.

Swell and thanks again!

atomicduck

0.14A - 0.16A measured when connected to laptop

mAP_power.jpg

!!

Thank you very much! Could you share what was the load / Tx power setting?

I presume this is idling power drain?

atomicduck

The power adapter provided is specified at 1A / 5W max. Might be required sometimes when REALLY taxing the little bugger :lol: Yes, you are right, I just checked :-) I bought this one as a toy, and I configured it as a bridge AP so I can dig into wired LANs easily... On it have WEYLAND-YUTANI SSID ...

atomicduck

I can use it without any problems with a micro-USB connection, so should be max 500mA since that's what a standard USB port should provide.

From experience I know that many devices have problems supplying even 500mA on 5v USB output, especially in long term applications.

atomicduck

Unless I missed it, not that I know.

Thanks. Do you maybe happen to have real world info on power draw? Website says 700 mA (3.5W) max..

atomicduck

Is there a command that will show voltage and current draw of mAP lite device?

I wonder how much it draws, not to overload USB ports, as they usually can reliably provide much less than than 500mA standard describes.

Thanks

atomicduck

Thank you very much for your reply.

Will do as suggested.

EDIT: Only thing I left on and that was suggested to turn off is the Cloud time update. I see not much harm from that, so I left it on. Thanks again.

atomicduck

Thank you. Does ip-forward matters at all, given all interfaces are in one bridge? Really curious about this one. ** I just checked and there are no visible setting in the /ip cloud. Time updated only when I turned on SNTP client, so do I need to explicitly state that one? ** Re www 80, simplest is ...

atomicduck

I am configuring some CRS325 as switches on ROS LT branch. Setup is very simple, and the switch is inside a LAN, connected to the main router. All packages except DHCP and SYTEM are disabled, and I've put firewall on input chain, and the rest should be fine? In essence, I am trying to cut all down t...

atomicduck

You have to be aware that CAPsMAN forwarding is CPU intensive for both CAP devices as well as (or mainly) for CAPsMAN device. Traffic between CAP and CAPsMAN is ciphered and encapsulated into normal IP packets. Both ciphering/deciphering and fragmentation/defragmentation can be pretty CPU intensive...

atomicduck

tl;dr: VLANs are like having multiple bridges, except the traffic for all the bridges can be carried between devices over a single Ethernet port. You are completely right - I am using CapsMan with local-forwarding off. From your (Very clear!! Thank you!) explanation it is clear that I don't need VL...

atomicduck

Thanks.

Re MT new WiFi standards... I decided to go with MT devices as I usually use those for installations. They are not the fastest, but they are fast enough and price is more than acceptable. Usually 2-3x cheaper than other options.

I am also very much looking forward new MT WiFi models.

atomicduck

Why, if your setup is working for you? Stick what works and you understand. I find capsman, datapath etc etc. far too complicated. Vlans is easy as pie to implement. I am trying to improve. Trying to understand if there is a better way to do stuff than I am currently using. I find it very simple to...

atomicduck

I am trying to wrap my head around VLANs and the need for them for my setups. (Just read https://forum.mikrotik.com/viewtopic.php?f=13&t=143620 ) My general setyup is: 1. central router 2. a number of switches 3. a number of APs Router hosts and controls everything. WAN port is for Intenret acce...

atomicduck

Thank you, appreciated.

I will order the switch + 48POW.

atomicduck

Thanks guys. I will have situation similar to @rextended: with three higher power devices (cameras, 18w) and five smaller ones (CAP ac at 13W). As the PoE output is input passthrough, I presume the proposed standard 48POW will be adequate to split it between the PoE and PoE+ devices, otherwise I wou...

atomicduck

Hello, I have a practical question about PoE device power consumption. The general CRS112-8P-4S-IN comes with 95W adapter. That leaves about 80-85W for devices. I will have 8 PoE devices with total consumption of some 149 W nominally, which is at the max output for the Switch. There are two Power Ad...

atomicduck

I mean, 20-30 mbps is more than enough for browsing, terminals, even video calls, etc. Higher speeds are great, but the reality is that most companies have relatively small uplinks. Do not get confused...Wireless speed and LAN/wired should be compared by a factor of 10. So this is a 60Mbps Lan/Wan ...

atomicduck

Wow. Amazing. No can do in MikroTik, altho to be fair MikroTik is routing company primarily + they try to be the cheapest and most flexible option. So I guess their logic is that if you want ultimate speed you can get it, but for basic access and "normal" speeds, they are more than enough....

atomicduck

I now switchzed to wifiwave2 drivers and see double performance (around 550-600Mbps on 5G, compared to 240-280Mbps with default wireless drivers - tested with a samsung S20FE). note that a wap ac or cap ac cannot move to wifiwave2 drivers. I am amater that you see such an improvement. Whats with ca...

atomicduck

The wAP AC doesn't look bad when wall mounted and provides excellent coverage. With brick walls, I would plan on 3 per floor just to insure 5ghz coverage. https://mikrotik.com/product/RBwAPG-5HacT2HnD Thanks. Does MikroTik publish antenna beam coverage? wAP AC has a metal backplate, so I presume co...

Search found 253 matches