MikroTik

loloski

Hi fischerdouglas,

Let see how it will pan out in the end I hope the solution will not be half baked

loloski

That's one of the purpose of VLAN to segregate some subnet like your management VLAN where's the problem? don't put a router that will do inter-vlan routing for that subnet or better yet make a dedicated VRF for your management VLAN, I'm sorry if i failed to see your point

loloski

while we are on the subject of making winbox more mondern and useful how about also bringing back proper routing filters to streamline the process and still leave the current behavior/design for some power/advance users?, just my 0.2$

loloski

and also the set of icons is very fresh and professional I hope the skins is also align and haven't tried it yet :)

loloski

return back my esc :) and the tab vs dropdown should be user configurable and the rest is history, the UI is gorgeous eeehhheeh finally i say something good with MT

loloski

The application and the device that has to be manage was separated by wireguard vpn, L3 connection from ubuntu console where this application was installed to the device needs to be manage is workiing properly like ping and ssh but on the GUI of this application using scanner the device won't show u...

loloski

This is the broadstroke of what you want to accomplish at least on the side of mikrotik /interface/vlan/add interface=ether2 vlan-id=2 name=TRUNK-VLAN-2 /ip/address/add address=192.168.2.2/30 interface=TRUNK-VLAN-2 Just open winbox and launch terminal then copy and paste this will be a lot faster th...

loloski

Since MT won't confirm or deny if they are working on it, I presume this won't see the light and day I for one also hoping this will become reality because we have a lot of CPE (hapac2) will surely benefit from this but I'm slowly starting to accept that this won't happen and started to lose hope

loloski

Configure VLAN in switch menu since this is not CRS3XX series to utilize switch chip

loloski

You need a single vlan aware bridge to take advantage the switch chip and activate L3 hardware offload if you need intervlan routing, remember CRS is geared toward a switch with limited routing capability This is a great guide https://www.youtube.com/watch?v=c2sAA6jMjCY Mikrotik is very verbose comp...

loloski

After we recall this switch from production, we were able to identify what cause the reboot but we don't know how to reproduce this at will, the culprit is L3 hardware offload if we turn it off the switch is performing well In the lab this switch is for days now running without incident, we believed...

loloski

Use this video from network berg very straightforward 
https://www.youtube.com/watch?v=uVag_e475zc

loloski

There's no built-in support for reverse proxy, If your device has sufficient resource like RB4011 / RB5009 install container package and pull image like nginx or haproxy

loloski

VyOS CLI is pretty much the same with Juniper so I don't have problems with it, I just commissioned a box yesterday doing OSPF + NAT and it's working as expected with light load around 1G, what I'm really interested and want to see how does it perform with VyOS + VPP

loloski

Did you test VyoS 1.5 rolling + VPP addons how is it? anyway there's no excuse for me now to create a test environment since VPP addons is now available for testing

loloski

@ Tom I hope if you don't mind asking this question do you have current test setup at least with FRR + VPP how's the performance and any gotcha? I don't mind getting my hands dirty again to rollout pure linux solution as long as they are worth it. I'm also eyeing for VyOS but as far as i know they a...

loloski

Actually I don't think they can't do it, they just have a miss opportunity to hire good engineering talent because they require the developer to know their language as prerequisite I don't think it's a bad thing for them, but that will surely impact the hiring process. Honestly you are right they ar...

loloski

They can do it for sure they have R & D and programming team that can work hand in hand if they have incentive to do it as a business entity. This is just business decision after all if they gonna do it or not, just my 0.2$

loloski

They are going to be slave on fixing does you mentioned issues indefinitely if MT continue on their journey for what appears of not giving much attention to unit testing and somehow luck of leader / visionary for much of the codebase instead they just let the individual programmer to be the king of ...

loloski

priceless

interesting perfect!!

loloski

I don't think that feature is available in ROS today, you can kinda sort of emulate that via ros api whenever you are provisioning another BRAS but is clunky at least for my personal taste

loloski

How do you measure performance bandwidth test inside MT device or using iperf? how about distance and weather condition? i'm not pretending to be expert in wireless but that's the common theme usually ask by the expert here in wireless so that someone can point you in right direction

loloski

ROS is not possible to run on your QNAP device, if you truly want to experience ROS download CHR and buy a desired license for your use case and install it on your preferred virtualization platform like Proxmox,HyperV, and Vmware. Just wondering why you want to run ROS in your storage device though

loloski

I haven't notice anything unusual here...

loloski

@Tom, I do agree with you I hope whoever decides on the other side of the aisle also think the same way as you do, but evidently this is not the case here I think and firmly believed they have their own winning formula that they believed to make them thrived and Service Provider oriented product is ...

loloski

Isn't it counterintuitive for MT to push their hardware sales rather than CHR + VPP that's why it appears they are not interested to make this happen? I hope this is not the case I think most of the SP guys here including us is willing to pay for a reasonable price just to make this happen anyone ca...

loloski

Yes 200% because it's a regen site so network engineer was station there in any shape or form the roving guard stay outside the premises, I have no choice we have to replace the switch this weekend and continue triaging this issue in the sidelines, thanks for your time looking into I just hope there...

loloski

Potential problem with power supply ? Any chance to have that replaced by a spare (you should have a spare if it's critical equipment) ? Well that's next in my TODO list yes this is critical i'm going to send someone in the DC I just hate the ton of paperwork just to pull this out and replace :) Th...

loloski

The switch was indeed had been rebooted it was confirm with our NMS and the actual logs from the switch, the switch is running fine the traffic is around 4gb+ during the outage as per the zabbix graph and we have around 2 dozens of this switch in the field running 24x7 having almost the same traffic...

loloski

# 2024-07-29 13:12:15 by RouterOS 7.15.1 # software id = 1ZQI-INIS # # model = CRS310-1G-5S-4S+ # serial number = HDF0860Q6TP /interface bridge add add-dhcp-option82=yes admin-mac=18:FD:74:FE:43:7C auto-mac=no \ dhcp-snooping=yes frame-types=admit-only-vlan-tagged mvrp=yes name=\ DISTRIBUTION vlan-...

loloski

3Gbps traffic it usually sits about 75% CPU CCR1009-7G-1C-1S+ this is pretty much the max of this device and yes connection tracking will disable NAT/Masquerade CRS-326 is a switch with limited routing capability so it won't benefit you use CCR2116 instead the difference is night and day you can st...

loloski

This is the setup I use at home: hex S / RB760iGS as CAPsMAN + UserManager 3 cAP ax as access points controlled by CAPsMAN This setup only uses wifi-qcom and dynamic vlans using usermanager are absolutely working as intended. One SSID is wpa3-eap only using peap with dynamic vlans and I have two ad...

loloski

so what's with my avatar? it has nothing to do with you and it's there since day one, my opinion is mine alone I don't represent MT on any way shape or form and i'm not the only one using that kind of avatar

loloski

as per the above post this is not encouraging my hopes already sunk, 802.1x + 802.1q is pretty much standard in the campus/enterprise, I'm not a native english speaker so please bare with me with the question 802.1x + 802.1q + radius (usermanager/freeradius) with wifi-qcom-ac/wifi-qcom latest and gr...

loloski

wifi-qcom-ac? No, no dynamic VLAN assignment

ouch another mishap and potential savings is already lost, we got the speed we need at the expense of loosing another non optional important feature sigh...

Thanks for your reply anyway greatly appreciate it!!!

loloski

Does capsman + wifi-qcom-ac/wifi-qcom works with radius + 802.1x and VLAN?, aruba is so expensive for our needs but it works for us over the years, the project is few months away and it so small (10 x WIFI6 AP) and worth to take a risk and I do have enough time to do experimentation. Please could so...

loloski

This is really a sad affair only MT know what they are cooking behind the scene and release the code to the mass and hope it stick, you are the unlucky ones if the code they are messing up with broke your environment, honestly starting from 7.13 to 7.15.3 you have to have a separate semi production ...

loloski

However some years old x86 Xeon motherboards with VPP enabled Linux are sustaining 100-Gig network routing throughputs ( measured and verified ).

are you referring to FRR + VPP or something else care to elaborate more please?

loloski

- PfSense currently have a VPP software router ( TNSR on a Linux kernel ). I have heard that it is near 100-Gig wire-speed on good/modern x86 bare-metal hardware with newer PCIe # 100-Gig network interfaces. - Linux already has VPP options you can package install. - VyOS already has VPP options you...

loloski

@ OP / Tom We are in the same boat as you we are growing but in a much slowly pace as a side effect I think we can still wait at least a few more years to wait for VYoS or Bison Router to mature, any chance you can share other cost and effective solution you are looking into?, I hate to ask this sin...

loloski

I have a lot of deployment with more than 10 (1G individual connection) on a single CCR2116 with policy based routing but not with PCC since I don't have a use case for it and I hate that i can't predict where the customer traffic is being routed / natted from. In my opinion this PCC won't scale in ...

loloski

what you are asking for this little device is unreasonable, even if you made it to work this will surely crawl and grinding to halt

loloski

First and foremost CRS309-1G-8S+ is a switch with limited routing capability you will be disappointed that it won't hit your 1G mark, just my 0.2$

loloski

Well we are lucky because we are the ISP

, if you are a customer just get metro-e services from your upstream and be done with it

they will be happy to oblige whatever you need

loloski

our simple use case is just like this and we haven't gotten really far due to the said limitation apart from simple tag stacking we also need double tag stacking since we are offering last mile service https://help.mikrotik.com/docs/display/ROS/Bridging+and+Switching#BridgingandSwitching-VLANTunneli...

loloski

I don't know if this makes difference but can you replace your fasttrack rules with this

/ip/firewall/filter add chain=forward action=fasttrack-connection connection-state=established,related
/ip/firewall/filter add chain=forward action=accept connection-state=established,related

loloski

This is possible we have done this in the past but the performance isn't great specially if your intentions is to link your DC, all processing is done in CPU we used CRS317 before and we gave up so we are force to used Juniper instead just my 0.2$, this is another wish list from us that we don't kno...

loloski

Be sure you have ROA records so that you can be certain you were able to announce your prefix successfully, check for HE looking glass so that you can traceroute your PI address from various location and also if you are multi home make it sure that no one will use your link to become transit from ot...

loloski

if I entered a wrong password, instead of giving me an error of wrong password, it gives out Radius server not responding. It would have been nice if it gives the correct error message of invalid username and password. Is this normal or am I missing something? That's by design at least in ROS v6, I...

loloski

In as much as we want it too it's dead on the water already, DAI was closely tied up in DHCP snooping database and the customer will surely not going to do any manual task on this even though it's possible in Cisco and also as an Integrator you want a proper solution in the long run I'm just barely ...

loloski

I think the problem is you are using this on lower end device that's why the list won't populated try this on RB5009 it should work

loloski

Yeah, we lost the sales already and I can even look in the eyes of the customer, their CTO are willing to wait if only Mikrotik can/will commit a timeline but that's all a dream now they don't even reply to my support ticket with regards to this issue, sad it's hard to push them in the right directi...

loloski

No problem

loloski

Assumption ether1 is the port towards your ISP modem/media converter and vlan 735 is your assignment and the service handover to you is via a tagged/port, if you are having a hard time I suggest ask them to handover to you the service via access port so you just simply assign the IP to your interfac...

loloski

Indeed, this feature is not optional and MT should implement this feature soon most major brand support these

loloski

This is really scary whenever someone from the dev enhancing the DNS code base one way or another they always broke the dns resolver, can you just adapt other code base like tinydns/dnscache from djb or any reputable alternatives so that you can concentrate on more pressing issues and do what you do...

loloski

@MT Last week we are in the middle of presentation for a potential big customers and we stumble a requirement that caught us off guard, the potential customer want to migrate their ageing cisco catalyst gear to Mikrotik they are almost sold to the extent the purchase order is about to sign but the ...

loloski

@Apachez are you the same Apachez on VYOS forum, if you are I'm glad you are here too

loloski

 
 *) dns - added support for mDNS proxy (CLI only);
 *) ipv6 - fixed "no-dad" functionality;

finally we can test anycast now and mDNS proxy this is awesome any docs?

loloski

[adam@gw01] /interface/bridge> /interface/bridge print Flags: X - disabled, R - running 0 R name="bridge1" mtu=auto actual-mtu=1500 l2mtu=1584 arp=enabled arp-timeout=auto mac-address=D4:01:C3:0E:BC:7E protocol-mode=none fast-forward=yes igmp-snooping=no auto-mac=yes ageing-time=5m vlan-f...

loloski

On this beta the switch menu is present in CHR please hide it just like with the previous CHR version

loloski

We need both stability and new feature focus specially on service provider just my humbly opinion

loloski

*) bgp - fixed cluster-list and originator-id;

Cisco peer will now be happy

loloski

Am i kidding hell no! we are not a hobby shop and we need real stability on ROS I know money is hard to come by these days that's why we are lock into their ecosystem if we can motivate them by giving some premium or extra why not? a lot of small and medium size business depends on ROS whether we li...

loloski

@normis Don't you think it's about time to charge extra premium to ROS I know a lot of people is willing to shell out money us included and the money you gather on this can fund ROS even further to improve not only the software stack but to improved the product overall?, I hate to admit that sometim...

loloski

it's a network route the /29 that you hand over to them via PPPoE should be assign on their CPE as LAN IP and the /29 that you assign to your customer should be advertise going to your edge with your IGP of choice to make a proper routing /29 Public IP (X.X.Y.Y) WWW -> EDGE -> BRAS -> CPE 100.64.X.X...

loloski

+1 on this, I hope they won't forgot this important feature

loloski

if you have OSPF and assign some local address like 10.255.255.1/32 on loopback (lo) interface this is connected route is this allowed or not? or just the hardcoded (127.0.0.1) is not allowed?

loloski

use netmap instead of src-nat it will work

loloski

GR is not supported atm no one knows where this could be implemented

loloski

I believed if you are passing traffic less than 1G i think you are safe, I think someone test this on CCR2004 if my memory serves correctly they were able to get 1G speed, you can certainly try this on your environment before going live

loloski

even if it remotely possible don't do it because macsec and vxlan encapsulation/decapsulation is process by CPU for now, some of the marvel hardware is capable but the codebase of mikrotik does not support it that's what I'm reading here in the forum all the time look at what post https://forum.mikr...

loloski

Nope, can't reproduce your issue, did you try to remove your cache and try again?

loloski

I'm just genuinely curious can someone from MT camp/support can tell us why they are having a hard time to implement this very important feature for SOHO markets, if they can do it in IPV4 why not in IPV6 been using other gears for the last 5 to 6 years and never seen this is an issue, Is this purel...

loloski

you have private IP and it's being natted in the ISP router

loloski

Please check your main site

loloski

Indeed I agree with pe1chl, I once hit this limit 1000 customers with individual /32 learned route from OSPF because of a misconfigured BNG router i believed the router can handle more load if only this connection tracking is settable, not some magic dynamic hard limit based on free memory from the ...

loloski

that's how NAT works, it's a return packet from 8.8.8.8 going to LAN host that's why it's outgoing interface is ether1 which is your WAN interface isn't it?

loloski

@Infabo This is not a routing filter issue because the syntax is working fine, the issue that I want to raise is clear, if you apply that rule in in-filter-chain in OSPF instance, the adjacency between neighbor will teardown what MT should do is don't allow the user to set "gw-check bfd" s...

loloski

Thanks for the heads up, but it doesn't warrant why the adjacency between ospf neighbor will teardown for me it's a bug. I think the bug here is set gw-check bfd; when you just accept everything Adjacency formed and stable I file a support ticket for this https://help.mikrotik.com/servicedesk/servic...

loloski

I hope they don’t in this RC OSPF adjacency is tearing down if bfd is enabled and you have in-filter-chain in your ospf instance with this rule chain=ospf-in rule=“if(protocol ospf && dst==0.0.0.0/0) { set gw-check bfd; } accept;” I try latest 7.14 stable same thing in my understanding BFD f...

loloski

make a REST services/api that will post process the data after receiving from your MT devices, problem solved

loloski

Is that PPP accounting radius issue is not covered with unit testing so that you can catch that early and minimize releasing software that has birth defects? hahaha just kidding, I'm just curious

loloski

If this is in a corporate settings, talk to HR and help them craft a policy that watching youtube or doing anything outside the scope of work is subject for expulsion, we've done this and it works 100% of time sometimes technology is not answer for a modern tech world, just my 0.2$

loloski

Just read the manual mate, make a lab and learn it it's hard to config something without a real context

loloski

This is just pure routing then let your L7 load balancer handle the routing to your apps problem solved you don't have to worry the IP or NAT issues if that what's worries you, just my 0.2$

loloski

/routing/filter/rule/add chain=BGP-IN rule="if(dst==0.0.0.0/0) { accept; } else { reject; }"

loloski

@mkx

Thanks i don't know what i'm thinking i download the wrong extra package :)

loloski

In prolexic we got a 2 byte AS number and established a bgp peer with them if there's an attack they are going to notify you and ask for confirmation since this is a manage service they are going to annouce your prefix to them and they are going to mitigate DDoS in their scrubbing center and pass yo...

loloski

Where did wifi-qcom-ac package go? can't seems to find in extra package and why?

loloski

#### Put your prefix here that you want to announce /ip/firewall/address-list/add list=MYSUBNET address=122.23.0.0/24 ### this is just a sample #### i assume that you have point to point connection to your peer so this is not a multihop host and address families is IP #### assumption your peer addr...

loloski

Did it work in previous version rosv6?, I'm also interested into this at least in a lab setting because our network is not as big as yours, we don't need it today

loloski

routing/bgp/session/refresh 0 address-family=ip

found it at least it doesn't tear down the whole connection

loloski

[user@DCCJ-POP1-R1-EDGESW] > /interface/bridge/port export # 2024-04-24 03:36:24 by RouterOS 7.14.1 # software id = 12DQ-9QUD # # model = CRS326-24G-2S+ # serial number = HCQXXXXX /interface bridge port add bridge=DISTRIBUTION frame-types=admit-only-untagged-and-priority-tagged \ interface=ether1 p...

loloski

Change of Authority is half bake in RouterOS afaict, I'm happy to be corrected by anyone, I haven't seen anyone claim that it's working without a quirk

loloski

What that program does you can communicate to your Mikrotik device from telegram in the form of chat / bot and you can execute any script stored in your MT just want to set the expectation

loloski

You can always go back to v7.14.X DHCP snooping is working as expected on this version

loloski

I think this is the closes you can get and for me at least it works great!

https://github.com/eworm-de/routeros-scripts/blob/main/doc/telegram-chat.md

loloski

Hi All, Good day, Just want to ask if I use As Override on both PE1 or PE2 the effect is instantaneous both loopback address was learned and installed on each CE's rib, while Allow-As-In if you set in to 1 on CE side the effect is not immediate you have to disable and tear down the peer connection b...

loloski

Hi MT,

May we ask if any of this feature will be on the pipeline?, care to share if you do have some crazy workaround?

2.png

loloski

@strods

like i said this is on GNS3 but on real device i haven't seen this issue, will send the file momentarily

edit: done SUP-150754

loloski

Thanks for heads up

loloski

*) queue - improved system stability (introduced in v7.6);

Can someone elaborate on this please?, thanks

loloski

using this RC in GNS3 you can't login via winbox it just simply saying logging even ssh connection it's not working :(, never seen this before

2.png

edit: webfig works

1.png

loloski

no-export will be passed to the peer in new routing version. But for v6, most likely it will stay as it is.

May we ask for the progress on this?

loloski

i'm afraid you have to netinstall and be it on site

loloski

Yeah it's working fine with cisco in GNS3

2.png

1.png

loloski

add bridge=main tagged=qsfpplus1-1,combo4 untagged=\ ether1,ether2,ether3,ether4,ether5,ether7,ether14,ether15,ether16,ether17 \ vlan-ids=1 for some vlans your ether1 is a tagged port but for vlan-ids=1 it's an access port for can you disabled this first and try again? not unless this is hybrid por...

loloski

I don't think if this will help you or not, but can you make a single vlan aware bridge and remove a bridge dedicated for the management?

loloski

that is expected PNET/GNS3 is just for lab/simulation only what do you expect? and even it can route properly, CHR is limited to 1MB only if you don't have a valid license, you can obtain a demo P1 license and try again if you are that persistent

loloski

I have higher chance of doing netinstall in linux VS windows 10/11 but if your hands are tied make it sure that you disable all lan adapters in windows except for the wired LAN and disable windows firewall to make it sure, ether1 is the port you are going to use for netinstall, In my experience you ...

loloski

I really love MT for what is worth and the value it bring to a lot of company startup whether it's big and small, but this wireless radio/driver issues and capsman drama makes a lot of users look elsewhere, luckily for us we don't have use case for wireless other than out of band management connecti...

loloski

I don't think check-gateway = bfd is already implemented

https://help.mikrotik.com/docs/display/ ... l+Overview

loloski

if this is the subnet behind cisco (10.0.0.0/24) via ether1 you are trying to reach? i would suggest make a point to point connection /30 between mikrotik and cisco like e.g 10.100.10.1/30 on ether1 and 10.100.10.2/30 on cisco and route the LAN subnet 10.0.0.0/24 to 10.100.10.2 ip route add dst-addr...

loloski

Please don't double post, I believed the issue here is the same with your other post which i reply as well It is common issue with new user is that they don't RTFM i believed it was mentioned in the docs that you should enumerate your WAN and LAN interface in the interface list , so that you are not...

loloski

you don't need NAT for them to reach each other make sure both raspberry pi and the pc has their appropriate default gateway and you are set, In the Router see to it the firewall rules (filter) in FORWARD chain should allows this two subnet 10.10.1.0/24 and 10.10.5.0/24 to traverse, if you do have a...

loloski

to be honest it would be better if you ship the logs to a remote syslog server and parse it from there like a small VM perhaps, you have full blown scripting language at your disposal when it's outside MT device, even it's possible you have to store it somehow the previously stored e-mail for post p...

loloski

I redo this using eBGP approach between PE BGP is up OSPF is up VPLS is up and still can't ping

, i'll attach all configs except for CE1 and CE2 because they are just static IP

1.png

loloski

Hard to say without full config dumps, but yes, the P router should just do two things: ospf underlay to learn/export loopbacks of each PE loopback and LDP/MPLS enabled on both interfaces facing each PE. Then eBGP signalling from PE to PE with AS900 and AS901 should work. I just tested this again i...

loloski

This works for me, it worked but not really great because you still have ros v6 at play

1.png

loloski

I have a similar post to you, as per some folks here they said v7 has still some bug in VPLS even though everything seems right the VPLS tunnel is up IGP is up and BGP sessildons is all up it still won't work... If you really want to make VPLS work make the P router as Route Reflector with v6.49.X i...

loloski

If you are behind a CGNAT you are mostly out of luck, there are few ways to overcome this with various degree of hassle / difficulty on your part option A first get a business line and ask your ISP to provide you /30 or /29 V4 address or even better get IPV6 address allocation option B pop a VM to a...

loloski

This is mikrotik forum, you can instantly google it if you need to

loloski

Draw a diagram or find a way to better explain your issue so that others might be able to help you

loloski

it's either use static routing or use IGP like OSPF so that each router will learn each router's loopback address and also you don't need a separate bridge to emulate loopback interface lo is now exposed by default on 7.14.2

loloski

Yeah you are both right it's unrelated i follow what clambert suggest i change the "P" address to something else the passive flag is gone and still not working

, thanks mrz for the confirmation

loloski

Thanks a lot for the post at least i have a workaround for now running the "P" router in ros v6. I can now finally rest literally

and replicate this combo in production, I hope this VPLS issue will get the right attention it deserved and finally put to end

loloski

I recently learnt there are folks who opt for eBGP based networks and played with it, in my lab, I ran BGP signalled VPLS with eBGP and no route reflectors, loopback IPs for BGP peer with OSPF underlay. And it works fine, no problems. I redo the lab and try your approach it doesn't work because the...

loloski

@Darknate

Thanks will try that approach, I think mikrotik knows this that's why they don't want to create an LTS release yet because v7 still not feature parity with V6

loloski

I think this is an LDP issue after all because with v6.49.14 all LDP interface in P1 is in DO (Dynamic,Operational) state while in v7.15b9 it's in DOp (Dynamic,Operational,Passive) I already file a bug report SUP-149275 I think i'm one on a few if not many encounter this issue, this is really a sad ...

loloski

I redo the whole thing and change P1 to v6.49.14 and it work, my conclusion is v7 BGP RR + v7 BGP signal VPLS is not working, but v7 route reflector alone is working as advertise.

@ MT could someone from your end confirm this behavior?

1.png

2.png

loloski

your diagram/networks It's fine as it is but really depends on what you are doing and trying to achieve, but i will do it differently because public ip is very scarce i will conserve it if i have to as much as possible, if some servers or workstation can be behind a NAT i'll do it.

1.png

loloski

This is really red herring I’m just going in circles, could someone please confirm if BGP signal VPLS with rosv7 route reflector still not supported till this day? Just a hint will do thanks

loloski

There are many ways how to make a VLAN in mikrotik, even if it works it doesn't mean it's correct because if you are doing that on non CRS 3xx series it will consume CPU, so be careful

loloski

You need a trunk port on both router and proxmox, this is how you are going to do it if your equipment is a CRS 3xx switch this is device specific , this is just a bare minimum and assume that your tagged port is ether1 [admin@RT] > export # 2024-04-04 22:01:36 by RouterOS 7.15beta9 # software id = ...

loloski

Please check if you are blocking OSPF incorporate this rule with your existing firewall

ip firewall filter add action=accept chain=input protocol=ospf

loloski

Good day to all, i want to migrate our small production MPLS/VPLS setup to v7 but before we do that we want to lab it first with GNS3 but I hit a snag, all bgp session is up and VPLS interface is all up but can't seems to pass tagged vlan100 from CE1 to CE2, all mtu on all participating LDP interfac...

loloski

Yes 2216 and 2116 is a different beast :) I hope MT support would be able to help you out along the way

loloski

We don't do NAT. Everything is routed, there's one forward chain FW rule to deal with private addresses. Sure there are ~1000 queues, but it is, as you say, a big box! (for our heavier traffic we've moved In our experience 1072 is more suitable as edge router doing BGP and OSPF only and disable con...

loloski

+1
+100 for EVPN/VXLAN

We can dream on

loloski

Please create a different thread so that others might be able to help you and by the looks of it is this a one big box doing everything how about NAT? if yes you might rethink your strategy

loloski

Please check if this is not a cable issue (check for negotiated speed on port) or You need better device like RB4011 or RB5009 if you need SFP interface, otherwise you can opt to choose hapac2 at least for less pricey option

Please see MT test result page

1.png

loloski

IS-IS is available for v4 and v6 as early as 7.13.3 if my memory serves correctly in CLI not winbox though

loloski

just use zerotier + romon is much simpler and use routing if you need to reach LAN subnet, just my 0.2$

loloski

I hope this 7.15 release once become "battle tested" in the field will become the LTS release this is long time coming and badly needed

loloski

MVRP appear to work correctly on my initial test :) I can't hold my excitement the vlan is withdrawn automatically in the other switch if for some reason a specific vlanids is no longer in-use :)

loloski

Any progress in this front please or we just keep on dreaming?

loloski

well first look for the obvious, check your disk space

loloski

try this first

https://help.mikrotik.com/docs/display/ROS/PIM-SM

loloski

Will try that in the future

loloski

Today we are monitoring this in our NMS periodically via SSH is there any plans that active-ports and inactive-ports will be available via SNMP? [user@POP1-R2-CORESW] > /interface/bonding/monitor numbers: 0 mode: 802.3ad active-ports: sfp-sfpplus1,sfp-sfpplus2 inactive-ports: lacp-system-id: 78:9A:1...

loloski

Thanks I hope the workaround is soon to be implemented

loloski

I've seen in Normis post since they are not using their in-house Wi-Fi driver anymore they can jump on the wifi7 band wagon with ease, I guess the demand will only be the limiting factor here time will tell of course

loloski

Shameless plug, I personally use e-worm collection for this purpose https://github.com/eworm-de/routeros-sc ... reboot.rsc

loloski

It is not possible to leak "main" connected routes and be able to reach local addresses.

May i ask if it is fixable in the future or it is what it is?

loloski

I attach the config from "P - Router" to wrap your head around on it. a friendly tip read the routing table entries per VRF for you to grasp the concept, feel free to ask if you have question

loloski

Actually this easy a few routing rules and routing adjustment to your environment it's done, People think this is hard because they don't know how routing works there are two ways to achieved this in RouterOS by using routing rules or mangle for a start you should watch this video to get the concept...

loloski

I found a way through trial and error and I don't think i know enough how VRF works in MT in low level because there's no documentation at all just config snippets

1.png

loloski

The protocol is intended to be compatible with other vendors, but it is still undergoing testing to ensure compatibility. Let us know if you have any feedback. Will going to test this thoroughly if it's working properly with CHR, I don't have a spare equipment at the moment to lab this up in actual...

loloski

It seems the limitation is real you can't reach a subnet subnet if the flag is not "DAC" / directly connected even though it is reachable in Main Routing Table. What a bummer, in other platform this is well supported I hope this limitation has a fix in sight :(, This is really unfortunate ...

loloski

I slightly modify the topology and have a loopback address 10.0.0.1/32 on R1 so in theory I should be able to reach 192.168.50.1 and 10.0.0.1/32 from C1 and C2 if this this route leaking feature was really working as advertise

1.png

loloski

I don't think that's the case look carefully the VRF and the routing table of main evidently 192.168.50.0/24 on ether4 is on main routing table and it's working properly

1.png

loloski

+1 on this, this is game changer for wISP

loloski

@MT quick question if MVRP implementation is working properly in the next few beta/rc, is it compatible with other implementation like Juniper or it will never be?

loloski

Yes RouterOS lite it is and allow big files like drivers (wifi-qcom/wifi-qcom-ac) or any extra package to be loaded in external place like USB if present in the device. /* Dream On */

loloski

Substitute to your real subnet 1.png [admin@R1] > export # 2024-03-26 10:18:18 by RouterOS 7.14.1 # software id = # /interface vlan add interface=ether1 name=VLAN1530 vlan-id=1530 /port set 0 name=serial0 /ip address add address=117.1.1.218/29 interface=VLAN1530 network=117.1.1.216 add address=117.2...

loloski

Hooraahh... i made it to work the routing entries for subnet 192.168.50.0/24 the gateway should be the ether4@main

1.png

loloski

I believed there were similar request in the past that rp_filter can be turned on/off per interface but nothing come up to a fruition from MT camp

loloski

I now add a routing entries to each VRF that I think might solve the issue but still is not working, the C2 router can reach internet and VRF_CUSTOMER-A and VRF_CUSTOMER-B but not 192.168.50.0/24 subnet in the main routing table of the Provider Router

1.png

2.png

3.png

loloski

1.png 2.png This is how far I go from R1 192.168.50.1 using this routing rules above I was able to reach 192.168.0.1 and 192.168.1.1 but not the whole subnet I know I'm missing a routing entries for 192.168.50.0/24 subnet in both vrf_cusotmer_a and vrf_customer_b routing table to make this work I j...

loloski

In Ros v7.14.1 Route leaking between VRF is so easy I just follow the Simple VRF Setup in the mikrotik documents and it works like a charm, however the docs never mentioned or give a snippet config on how to leak between the VRF network with the Main routing table on the Provider Router https://help...

loloski

Draw a basic network diagram including vlan assignment so that we can easily help you, I just interpret what you said

loloski

You need reverse proxy for that like nginx or haproxy, you can do port forwarding on port 80 to a local reverse proxy from there handle the routing logic

loloski

-- The problem is, that on ports ether46, ether47, ether48 I'm not seeing any traffic that goes into corresponding ports ether6, ether5, ether7. /interface/bridge/port add bridge=bridge comment="Bistro in" frame-types=admit-only-untagged-and-priority-tagged interface=ether5 pvid=119 add br...

loloski

if qsfpplus1-1 is your trunk port

/interface/bridge/vlan/add vlan-ids=111 tagged=bridge,qsfpplus1-1 untagged=ether7,ether48 bridge=bridge

loloski

try this and adapt to your situation you missed where the bridge should be tagged as well /interface/bridge/add pvid=4094 frame-types=admit-only-vlan-tagged name=bridge # Best practice don't set pvid=1 /interface/bridge/port add interface=ether7 frame-types=admit-only-untagged-and-priority-tagged pv...

loloski

Do you have at least initial draft document for MVRP?

loloski

:put [/system/resource/get uptime
11w2d15:59:17
]

loloski

Please don't do it CRS112 is geared toward as a switch not a router it has very weak CPU, what you can do put router upfront then Make a Queue in the router

loloski

+1 please

loloski

For us we learned the hardway, We are only using 1072 for EDGE routing purposes BGP/OSPF no NAT/Firewall and Queues they are fine, for Access Concentrators we stick for a dozen of 1036 with rule of thumb of 950 customers per 1036 doing NAT and Queue, For some of our PoP with premium customers which ...

loloski

check your switch chip 98DX226S if bonding is ever supported

https://help.mikrotik.com/docs/display/ ... Offloading

loloski

discard is not supported in v7

loloski

please use iperf it was a known fact that bandwidth test inside mikrotik will eat your CPU

loloski

On beta 8
*) bgp - allow to leak routes between local VRFs;

If you are looking for proper implementation through RD i don't think it will happen today :(

loloski

CRS310 is geared toward as a switch not much of a router

Screenshot 2024-02-08 060857.png

loloski

it would be best, if they allow the package to be stored and install via external USB or make a ROS lite package as suggested by others here, our HAPAC2 CPE fleet would surely welcome this change if this happen :)

loloski

By the way forgot to say thanks in advance for the people who could chime in

loloski

In our quest to ditch PPPoE in our network we decided to give it a whim and put a LAB generally it was ok, the client computer can authenticate it's MAC in user-manager via radius but I found it odd that you can authenticate the same mac address at the same time this is a no go for ISP setup, well h...

loloski

wait is over, I was able to activate the license just an hour ago

loloski

this cause us trouble because we have a scheduled deployment yesterday and send me 2 people in the DC doing nothing in the middle of the night in the end we pull out the server and will try again somewhere next week not really a big deal but a nuisance indeed

loloski

I already contact them via Support Ticket and no one is responding and even in discord this was reported as well on #CHR channel and I'm not alone

loloski

MT,

Please take a look into this we can't activate CHR license, there was a bad http response when you try to login your account in the renewal license dialog, thanks!!!!

loloski

Established VPN of your choice, then use mangle or routing rules to route your internal subnet to the other side of the tunnel then use srcnat NAT

loloski

you can use this as a starting point and also discard is no longer available please read the document

https://help.mikrotik.com/docs/display/ ... h+examples
https://help.mikrotik.com/docs/display/ ... nd+Filters

loloski

This was tested on 7.12, though i seldom open ssh from external but this needs to be look into

ss.png

loloski

We have a situation where our 2 edge router is both originating default route in OSPF domain we want to match the gateway and set appropriate distance just like i shown below is this possible? it was not clear in the documentation how to use the "gw" or can it be used in OSPF context, than...

loloski

Download and import this cert if you are using cloudflare DNS it should work
https://cacerts.digicert.com/DigiCertGl ... G2.crt.pem

loloski

https://stubarea51.net/2016/01/21/put-5 ... r-testing/

This is life saver luckily I was able to save the VM, the tool is not downable anymore :) I hope kevin will re-upload this again

loloski

I think you are right :), I stand corrected this design flaw is really a punch in the gut they should fix this, we are going to do some more pre-flight test otherwise we are going to call off again the deployment :( if you have single peer you can get away with it but multiple peer this will blow ou...

Search found 538 matches