MikroTik

Ok, I have no time to test everything before each update. Updates must be run automatically. MT suggests to do all updates. What is the best practice how to do automatic updates? Not. Or better, not the day a new release comes out. Plenty of scripts available which can wait x days or unless a certa...

Sure, and Microsoft never goofs up either.
Look at what they did with their last Win-10 Bitlocker bug ...

Rule of thumb
Don't auto upgrade.
Never upgrade the first days after a release.
And test first in a lab environment if you are really talking about hundreds of devices

Daredevil ! 8) My understanding is/was that upgrading to 7.19 is without any risk (well, not more then usual...) as long as you didn't poke around with these bootloader-images found in the articles mentioned. So simple upgrades through Winbox from RouterOS + "Routerboard Firmware" towards...

Daredevil !

See above... You need to run this on all of them: /certificate/set trusted=yes [ find where trusted=yes ]; Gibt es da vielleicht irgenwelche python-scripts, denen man eine text datei mit user, passwort und ip-adressen geben kann, und die das dann machen? Translated Are there any Python scripts that...

I think netinstall is the only option.
Make sure to get full export and backup of your config away from your device.

A couple of things ... 1- Quickset is ONLY to be used on a pristine new device (or after reset) and normally never again after that. It can cause troubles when used on an already configured device. 2- most likely some firewall rules are blocking you. Export your config and then post here for review....

Everyone reporting this:
DO make sure to create a support ticket. Each and every one of you.

The more who make noise about this, the sooner they will look into it and fix it (or at least make sure it doesn't happen again).

And I will gently hold off from upgrading my RB5009's ...

Looks like trust state for some certificates is not stored properly, though displayed correctly. I think this helps once and for all:
Code: Select all
/certificate/set trusted=yes [ find where trusted=yes ];

Which is why I mentioned it to you earlier this might apply...

Maybe this applies ? For people upgrading from older versions who want to use the built-in CA certificates (for use cases such as Verify DoH Certificate or /tool/fetch check-certificate=yes ), don't forget to set /certificate/settings/set builtin-trust-anchors=trusted after the upgrade. In case you ...

How do you know for sure it's invalid and not simply wrong reading ?

Already used x3 zoom on your smartphone ?
Tried combinations of zero and capital O ?
Uppercase i and 1 ?
Things like that ...

FWIW you're not the first having problems and I'm sure you will not be the last.

Normally it should be "update" but I think there is no harm when it's simply loaded on the device itself.

Up til now no MT devices have esim built in.
You need to use a physical esim card.

That's how I understand that table.

Adding:

These modems do not have eSIM built in. Requires an external eSIM chip. For example, a physical eSIM card (eSIM in a standard SIM form factor).

My advice then: export your current config using show-sensitive Also make a binary backup (from Files, just in case) Move both files away from your device ! Verify users are correct with how you think it should be. If not, clean up. Reset to default config, keeping users (just make sure not to do th...

Added comments: layer-7 blocking of Whatsapp simply eats away CPU power and is (for most cases) rather useless. But most importantly ... I hope those 2 other routers in front of this RB2011 router are acting as decent firewall because right now this RB2011 is pretty much wide open to the outside wor...

Depending on the used device and ROS license level, you might not even reach 200 ..
To get over 500, you need level 6 license.

https://help.mikrotik.com/docs/spaces/R ... cense+keys

I am sure you have reviewed all possible config topics and still it doesn't work ... Wouldn't it be easier to actually SHOW your config then ? If not, nobody will be able to help. /export file=anynameyouwish Move file to your PC. Remove any sensitive info (public IP, serial, passwds, ...) Post conte...

What if you remove the guest bridge and use proper VLAN instead ? You can also do that for old capsman and also there, only caps mode is needed on those caps (unless you have some other local config present). Link to old wiki explaining how to use vlan for previous capsman https://wiki.mikrotik.com/...

Local forwarding does not exist anymore for wave2 capsman. From Help pages: WiFi CAPsMAN only passes wireless configuration to the CAP, all forwarding decisions are left to the CAP itself - there is no CAPsMAN forwarding mode. And just for the record: what you are referring to as capsman v1 is actua...

Yes. The original posted config (which you removed ! Not nice ...) was also using VLANs so what's the problem ? If you use VLAN on your main router, it's easier to also use it for GUEST wifi. If your MAIN wifi does not use VLAN (or native VLAN, since there ALWAYS is a VLAN, even when not shown), sim...

Datapath settings and correct provisioning of config on controller. It's shown in the example I linked to. /interface wifi datapath add bridge=br name=MAIN vlan-id=10 add bridge=br name=GUEST vlan-id=20 /interface wifi configuration add datapath=MAIN name=MAIN security=Security_MAIN ssid=MAIN_Networ...

It's called "getting experience".

You seem to be mixing up some things ... Start with this example and work from there. https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample: Typically on cap device there is nothing to be done except put it in caps mode. All the rest is done on contr...

Now I'm rummaging through the documentation and can't get my head around it. Is it not possible to operate the current WLAN APs on the current routers? The router can only use the ancient CAPsMAN, which is apparently from 2010, and the CAP ax can only use the rudimentary WiFiwave2, which can do pre...

What I am curious about here ... Why would anyone use packages from box.mikrotik.com with a very crafted URL unless instructed to do so by support ? That's some dev-environment, I think. Normal URLs are download.mikrotik.com. I mean, we normal users can never now the exact URL for a certain package ...

Yeah, time difference can play havoc on you ... I remember a couple of years ago some PCs not getting a DHCP lease from a Cisco router due to a similar issue. Time difference on those PCs was really years of for some odd reason. I had to manually set them to something close enough, then things start...

wave2 device only have local forwarding.
One of the capsman things which got lost moving to ax devices ...

You can think out a complex scheme with EOIP or VLAN or any other tunneling protocol to controller but why bother ?

CRS yes but mostly due to your way of testing. If you do bandwidth test from CRS112 to RB4011 and want to have relevant results, you are doing it wrong. Bandwidth test (If we're talking about tools - bandwidth test) is VERY resource intensive. Resources which CRS112 does not have. RB4011 will have a...

No, it is quite normal to have a management vlan and then a separate one for client devices.

Only provision config with datapath for pvid 10 and nothing else.
Also, don't feed the other vlans into the trunk towards that AP.

I have both ac2 and cap ac (exact same HW except for ether ports) running with wifi-qcom-ac for almost a year (I think ?) with little to no issues. But I keep both on 7.17.1 now. There was a time when I had to schedule a nightly reboot on that cap ac due to memory issues but never on that ac2. Both ...

Depends on the used font.

I've seen MT passwd stickers with over 30% white space.
It would have been better if it was close to zero with a larger font.

anav, have you ever used capsman ?
It can also be setup in 15 minutes when you know what you do.

Seamless switching between APs, requires capsman.
Limiting wifi transfer is a separate thing which has little to do with capsman. You could use queues for that on each AP.

See here for a bit more info on what's needed and how to get it:

viewtopic.php?t=203686#p1051720

No problem: been there, done that.
That's why I mentioned it

Capsman can not handle local radios. You need to configure those local radios manually or via provisioning. You need to set local radios to be managed locally. Then there are 2 options: 1- assign configuration manually to your radio, the same configs you have made for your capsman controlled radios....

Why wifi-1 works properly and wifi-2 clients has problem get the IP is mysterious, cause I checked all what is possible

From your other post I conclude the problem was a misconfiguration on your switch.
viewtopic.php?p=1143392#p1143392

hAP lite is a device which is best to be kept on ROS6. Minimum requirement for ROS7 is 64Mb, which hAP lite does not have. And then it also only has 16Mb storage ... which makes things worse with latest versions of ROS7. Netinstall is your only option to be sure no remnants are left in memory eating...

Happy to hear suggestions on what to do... PS: this is not my first Mikrotik device, and yes, I know how to read passwods And still ... you are 100% sure there are no ambiguous characters in that password on the label which can be interpreted in another way ? 1 / I O / 0 Stuff like that. I use came...

I'm using x3 zoom since the first " new" label I saw ... and sometimes even then you need to guess multiple times.

Since somewhere last year it's a bit better, though.

It is already functioning as capsman for legacy access points ? Upgrade to 7.13 or later, add wireless package if not already done by upgrade process and it can still work as capsman for legacy devices. To be configured via wireless/ capsman menu. Hooks for capsman for AX devices are present by defa...

Looks like you missed some instructions/interpretations. BTW the correct link is this: https://help.mikrotik.com/docs/spaces/ROS/pages/137986075/CAPsMAN+with+VLANs Since your device has 2 radios, you also need to add wlan2 to that bridge. Why do you assign 2 IP addresses in different subnets on the ...

How are your wifi settings ?

I have GoodWE inverter connected to AX Lite via capsman just fine.
Just make sure not to use WPA3 on the SSID it connects to.

To be sure: any Wifi6-capable device is suitable for my desired extension of current CAPsMAN, correct? So we are speaking also: - SXTsq 5 ax - wAP ax First one is not really for indoor use :lol: Second one, sure. I have one right here next to me on my desk. As for encapsulation etc, why bother ? Th...

Capsman is to be configured on the controller. I assume that will be RB4011 ? Under the wifi menu, you do all the setup. There is no separate capsman part as it used to be in the past. It's all integrated with wifi setup. But since you mention wireless ... is that RB4011 a version with wifi ? AX Lit...

A couple of things are contradicting here ... Your wifi signal is bad yet you want to use a WIRELESS link to improve the situation ? And how would that help then ? It will most likely not help. Secondly, you refer to capsman but your one device is AX-based, the other one is legacy wifi. No match. Th...

As indicated by itimo01, cap lite can not be managed by wifi capsman. You can use the 2 different capsman controllers on the same device (provided the controller on itself does not have wifi radios, or you would loose functionality on those). But it's not practical and it will not result in roaming ...

There's also a native Linux version of Winbox

Remember, the roaming will only work with all APs managed by capsman. Actually it will also work with 1 AP using 2.4Ghz and 5GHz radio. Capsman on itself is not a must. The key is that it works for all radios controlled under the same ROS instance. Can be 2 local radios on 1 AP. Or several APs/Radi...

You need to provide A LOT more info in order for anyone to be able to help you ...

HOW did you upgrade ? Real upgrade or netinstall ? To which version ? What device ? As of 7.13 you need to make sure wifi drivers are loaded as well. Normal upgrade does take care of that. Netinstall not. You need to add the needed packages yourself. Old wifi: wireless package AX device: wifi-qcom p...

What Ros version does RB4011 use ?
Should be preferably at least 7.13, best even 7.18.2.
Do you have capsman configured via wifi menu ? Not wireless capsman... should be via wifi.

Sure. Remove DHCP server from cap. Add static IP or via DHCP client on cap with static lease on router Add all ports to bridge You can also remove all firewall rules, since they will not be needed anymore. And that should be it. Some added things can be done to make it more clean but that should be ...

Might be helpful to describe a bit more why you want this and how your network conceptually looks like.

Educated guess:

You did NOT upgrade
You used netinstall.

But you forgot wireless package which also needs to be present as of 7.13.

Sounds right ?

Do the math. Max POE out (assuming you use 57V supply) is 400mA. That's 22.5W. If you use 48V adapter, that goes down to 19.2W. Some power loss to be accounted as well for the next feeding line. Cap AX uses between 11W and 36W (max max, rarely the case) so I would think you can only daisy-chain 2 de...

Definitely AX Lite, it can even be powered with a power bank (I once tested it with a 10.000mAh powerbank and got over 8h, battery wasn't dead yet. Simply that my work day was over at the time I stopped :lol: ). As for range, it depends on the wall material, obviously. I have one right now in my bas...

My original idea was to replace the wap ac with a wap ac lte kit, as that would be the least amount of hassle, but I was not sure if the LTE interface in the wap ac lte kit would be something I could route traffic to from the CAPSMAN if I continue to manage the wifi the same way I do today. As indi...

Isn't it easier then to use DHCP - static only ?

address-pool (string | static-only; Default: static-only) IP pool, from which to take IP addresses for the clients. If set to static-only, then only the clients that have a static lease (added in the lease submenu) will be allowed.

Performance wise wAP AX is better. That's why I suggested it as first alternative after AX Lite. It can use 160MHz wide channels, something AX2 can not do. But if the environment you are going to use this AP in OR your client devices don't support 160MHz wide channels, then it doesn't make any diffe...

Cheapest: cap AC and use the square case. My personal preference on that device :) But personally: you can still use arm-based AC device with wifi-qcom-ac but it will complicate things further when you want to use VLANs etc. With AX devices it's a lot more straightforward. Just set them to CAPS mode...

Not only roaming.
IMHO general wifi experience is a lot better: more stable and more throughput.

2. Why interfaces wifi1 and wifi2 do not connected to CAPsMAN? By default, local wifi intercases can't be provisioned. Two options: set config on wifi1 and wifi2 or use the provision button on the Radios tab (after selecting the local interfaces). Actually ... they don't connect to capsman but you ...

Then you did something wrong.

See example, name used on datapath setting clearly is the one from capsman (which makes sense, it's that bridge which needs to handle the VLAN stuff)
https://help.mikrotik.com/docs/spaces/R ... iFiCAPsMAN

On capsman.

Cap gets config from capsman.

No.
Wireless is for old capsman.

But given the devices shown, that's what is needed.

I am not at all familiar with your devices and capsman, but there is the possibility that you need two capsman (the "old" and "new" one). RB760 on it's own does not need wifi-com or whatever. It hasn't got a radio. Basic hooks for wave2-capsman are already present as of 7.13 as ...

Hard to tell without seeing config on both ends ...

Routing can use fasttrack path.
VLAN with 100% passing CPU does have quite a performance hit.

I already did some tests in the past using it as a managed switch

viewtopic.php?p=1113096#p1113096

You might be interested to follow this discussion as well:
viewtopic.php?p=1141907#p1141907

Upgrade all devices to at least 7.18.2. (if you go via netinstall process, make sure to add corresponding wifi-qcom as well on cap AX) Then reset cap AX to CAPS mode. On RB5009 you configure everything under wifi menu, no need to install additional packages. All basic hooks are present since 7.13 fo...

That's because a certain fire spitting Llama removed quite a bit of earlier made user instruction articles (as author, he had the right to do so). Fortunately (or unfortunately, depending on who looks at it), there exists something like web.archive.org https://web.archive.org/web/20230324115929/http...

Personal comments: when adding/replacing equipment to an installation, never plan all available ports to be used or you're stuck again in future. Foresee some spare ports. You never know why you may need them but you will be very happy when you have them ready. It might even be for some temporary re...

AFAIK 2 places where this is to be done. IP / DNS set primary and secondary DNS That's for your router. IP / DHCP server settings There you can specify which DNS server your client devices need to use. I use the router IP there (so it in return uses the settings which have been set in IP / DNS). But...

You can always downgrade (down to factory version, you can not go lower).

Isn't there anything visible about these drops in log files ?

When you try to create such a pool, there is an error message showing, right ? So there's your answer why it can not be done. Use valid ip addresses when creating a pool. Whatever addresses. There are plenty of options to choose a dummy range from, just not 0.0.0.0-0.0.0.0. And I am highly surprised...

... I also have many clients using WireGuard and for those Clients THEY ALL are extremely pleased with WireGuard. Can you elaborate on details pls ? - what device is used as client, what as central hub ? - how many concurrent connections in parallel ? - how much is single and accumulated bandwidth ?

Tag is what your file should be when creating. I've done this plenty of times, name of the container doesn't matter as long as it uses the same folders as the previous container. As a matter of fact, when you want to upgrade a container, you need to do something similar when doing it manually. Throw...

OK, if you are sure that folder is 100% correct. Another thing to try: Open container so you have all settings in front of you. Create a new container in a second dialog box with the exact same settings, don't save yet (I do so with copy-paste between 2 dialog boxes). Throw away the first container....

What device is this ? Are you sure the CORRECT folder exists ? Reason for asking: there is a long standing bug with RB5009 in combination with certain USB sticks where after reboot USB3 stick is not properly recognized and gets mounted as USB2 but ... with another drive name. So you may still see th...

First place I would look is forward rules.
You only allow forward from BASE to WAN ?
Why not allow BASE to VLAN as well ?

I know the hAP ax lite ace is only 2.4Ghz, ...

Just as a FYI, when the client wifi radio permits it, that AX Lite can push up to 400Mbps over wifi.

I had a wAP AC on outside porch, replaced it end of last year with wAP AX.
They can/could get wet when wind is "right" yet both devices continue functioning just fine.

Just make sure it's installed in the right way (connections towards the bottom).

No.
Map and 2011 require wireless drivers and can only use legacy capsman controller.
If you load wifi-qcom-ac drivers on cap ac, it is not compatible anymore with legacy wireless. So it can not be used as capsman controller for the 2 others.

Stick to wireless package for all devices in this case.

That's correct.
As already explained in my first response.

Correct when you look at it that way.

Not really IMHO. You always have to look to these end-to-end connections as point-to-point. If you try to squeeze a lot more in the pipe then the other end can pull out, you get a bottle neck. So the throughput will settle on the lowest value capable by all ends. If your central router can blast thr...

What configurations/guides have you been looking at ?? Your conclusions are wrong and you have clearly been looking at guides not relevant for this device. /capsman menu tree is for legacy wifi, as already indicated (legacy as in: pre-AX wifi devices). You once again did not follow the Help pages I ...

Did you even look at the Help pages I provided ?
The info is there...

Capsman for AX devices:
https://help.mikrotik.com/docs/spaces/R ... iFiCAPsMAN

When I was still having it in my lab setup, I used it as an access port for a printer.
But certainly not as trunk port (it 100% passes CPU without any HW offload possible).

Capsman as a separate menu item is part of wireless package, legacy wifi. That package is normally NOT on AX devices. You can mix old and new capsman (as two different controllers but on the same device) on any mikrotik device but ... when doing so on an AX device, it means letting go of the wifi ra...

There used to be a quite good post (and other topics too) from a certain fire-spitting llama until he decided to remove all those posts for some obscure reason ... Just saying the bar has been raised pretty high as far as quality of such instruction post is concerned (on the other hand, there is not...

Yes and no. Even with the odd ether-1 setup, it's faster then old Hex when used as a normal router. As a switch however, that's another story. I'm sure they made it in accordance to what's needed for majority of their customers. We only see a fraction of that population here (and only the most savvy...

Ah, that's another thing indeed.
Looks like you route all your traffic first to Proton VPN ?
Also local traffic.

Your "problem" is with this firewall rule: add action=drop chain=input comment="defconf: drop all not coming from LAN" \ in-interface-list=!LAN Or better said ... the fact you do not allow traffic coming from wireguard right before this drop rule. There is nothing accepting input...

Capsman but you need to look on the right place:

https://help.mikrotik.com/docs/spaces/R ... iFiCAPsMAN

E50UG = Hex Refresh.
Comes with ROS 7 out of factory.

No way to go back to ROS6 on this one.

Speed over powerline is usually not the best you can have, but recent devices are actually quite fast. The only real problem I have personally encountered using powerline adapters is when there is also a solar convertor system on the same phase. The block wave harmonics used to create AC-sine wave ...

Make sure to create a bug report with support or it probably never be fixed.

2 concrete walls over 3 meters ? That's a wifi killer ... forget about using wireless backhaul too then. It will not be reliable enough. If cable is not an option, already considered PLC devices (powerline) to act as network cable ? Only possible if both sides are on the same phase of your power net...

In order of asking: 1- Yes but see further down 2- Yes and also here with a twist 3- Because default it is not present on Hex Refresh Now the long story :lol: Somewhere early ROS7 Mikrotik made Wave2 drivers for their AX-line of devices. Those were to be loaded as a separate package since legacy wir...

Best approach: create a ticket and please let us know the response.
I doubt us simple users are going to be able to answer that one

As a router, ISP should be on ether1 since normally that port is not to be HW offloaded. Unless you have an ISP connection going way above 500Mbs or so... As a switch, you need to see what you want to connect to that port then. Preferably something with low traffic needs. Reset: When accessing the d...

Look at the block diagram and then you should see what the potential issue is with port1.

It's not connected to switch chip, only to CPU.
Depending on your config and how you use that port, it may or may not become a bottleneck.

Wave2 does not exist in ROS V6.
So there's your answer.

As a pure switch, I think the original RB750Gr3 is better than the hEX refresh. On the other hand, if it is being used as a router with one port connected to the internet source and the other 4 ports as a switch for the LAN side, then the hEX refresh may be better. If you are going to use the hEX r...

It might even be simply the best option to start with netinstall.
So you´re sure nothing is left behind eating precious space.

Check power supply.
See if you can use another one with the required range for RB5009 (24V-57V).
You can also try PoE In as power source.

AC2: as indicated flash space on that device is limited, only 16Mb. ROS7 + wifiwave2 drivers really pushes it to the limit up to the point where you can not even do simple things anymore, not even upgrade. Netinstall should always be possible. UNII-3: higher channels are not available for quite a bi...

Don't use AC2 with wave 2 drivers unless you want to risk having to netinstall each new version. Flash space on that device is really too tight. +1 on using 5GHz radios, much easier for planning your channels though you may want to stay away from UNII-3 bands since there are still a lot of client de...

Additional thing to take into account
S+RJ10 can not be controlled which speed it uses.
It adapts to what's on the other side.

So if there is something advertising 10gbps on the other end, it will also use 10 gbps.
And then it gets hot...

Repeat

Rule #4 applies...

Thread moved...

This might be a dumb question, but do you mean that I would configure the switch in the AP as described earlier, and modify the routing to use VLAN10 as WAN and VLAN20 as LAN instead of the physical interfaces that came with the default config? I'm new with Mikrotik products, so I'm not familiar wi...

How can you eat an apple but keep it intact ? You can not. I disagree, a whale can swallow it whole....... and then regurgitate it back whole. I would think a whale eating an apple is really close to shore and will most likely end up being grounded :lol: My underlying meaning with my response was t...

I use a similar setup at home with RB5009 exposing via trunk some ports further down on L009 directly to WAN side of things (mainly for IPSEC connection to Azure and testing stuff). Just look at it as another managed switch. Define VLAN-WAN, setup your router functions on that interface instead of t...

Starting 802.11n multiple chains can be used on the same radio.
Look at it as parallel connections.
More chains = more throughput.

Using wider bandwidth will also yield more throughput (if air spectrum is not too polluted).

Block diagram clearly shows those chains.

2025-04-18_13-28-48.png

How can you eat an apple but keep it intact ?

You can not.

Thanks for the replies. I did manage to activate the wifi interface and set a MAC addess+IP binding in the Huawei router. Apparently the RouterOS version I upgraded to doesn't come with the wireless drivers, so I had to download the 'wifi-qcom' package and upload it with Netinstall. At least that's...

It has two chains, and thus thought the default would include wifi1 andw ifi2 so at least the op could provide coverage for two freqs.....oh well.

Nope.
Only 2.4Ghz radio so only wifi1. 2 chains does not mean 2 radios.

Looks like a quickset problem.
When changing to dual AP, did you start again from default config ?
Quickset is typically only to be used ONCE after default config, then never again (until starting again from def config).

That's not going to happen, I would think.

MT Team doesn't read all posts here nor do they reveal their HW road map.

So either ask sales (who will most likely not respond since you are not a distributor, I think ?) or support (who will not respond either since it's not a problem).

No time right now but you really should search this forum yourself.
This has been discussed several times not too long ago.

Did you also change using device mode setting for routerboard to yes ??
I assume you did but since you did not mention it, I'm just checking.

Logically it should have been changed before you can do other routerboard changes.

Couple of comments from my side (maybe repeat but that's what you get when doing 3 to 4 things in parallel when replying ...) 1- your device is a CRS354 which means it is at first a SWITCH (a big one), not a router. You can use it as a router but performance will suffer. 2- most of your config also ...

Day before yesterday we finalized an install in a shop which is being completely restyled. I had 3 wap AX foreseen there as APs. The technician commented he liked the cap AC form factor we used in some other shops a lot more since it is much more discrete (I always change the round case for the squa...

Hello, I have the same issue with the RB760iGS (Hex S). After updating to version 7.18.2, I get a kernel failure, kernel panic, and the router continuously reboots. I tried downgrading to versions 7.15.2 and 7.16.2; the kernel failure no longer persists, but 1-2 times a week, the router freezes and...

Check with support again. They should be able to tell you when the corrected version will be available or they can put it themselves on your device (you may have to give them remote access to that device). Or they should provide a workaround for your setup circumventing this problem. Crazy this is a...

In my view ?
Generally yes.
I will make an exception for additional switch ports on a router or access point

Mikrotik doesn't make a habit out of announcing their roadmap. You simply have to wait and see what comes. Currently what you are looking for, does not exist in 1 single device. As for adding wifi to RB5009, I hope they never do that. Let a router be a router, let an access point be an access point....

What does /interface wifi print show ?

Both on capsman controller and cap device using that 5GHz configuration.

Forgot
That map I mentioned, also runs wireguard to central rb5009 and eoip on top for romon.
Works just fine.

I have mAP Lite lying right next to me running ROS 7.17.1 just fine.
It has about 3.5Mb free storage.

I have a mAP2nd (same platform as mAP Lite) running with a customer as main router (small shop) with IPSEC to Azure.
Also running 7.17.1, no problems.

2 other things to check, added to my previous post.

It still is possible your ISP is blocking things but ICMP would be strange.
Can you use incoming connections on that device using that public IP ?

If you are behind CGNAT, that's a logical consequence. What are the first 2 octets of your supposedly public IP ? If 100.64.x.y to 100.127.x.y, bingo. Also check WAN IP as reported by your device and whatsmyip.com. If values differ, you are most likely behind CGNAT as well. Use from terminal on that...

I have once again log full or red "cache full, not storing" DNS Adlist related messages. My cache size is raised to 8192 KiB and Adlist size was something over the 2000 KiB. I definitely removed the functionality from the router. Ok but why do you use such a tiny amount of storage for the...

It's just a theoretical question, for Capsman v2 It's AFAIK for the theoretical case someone wants to use several bridges on such a cap device, to choose which bridge to use for capsman controlled interfaces (but I wonder: why would you use multiple bridges on CAP, especially if you can use VLAN ??...

Main site Mikrotik, tab Support - contact support
Register and create a ticket.

Guntis, with all due respect but this has been reported already some times by users in various release threads. I know it should not be needed but from what I can read, it is done by most using capsman because one can otherwise not be sure the config has been changed. I'm happy to provide you supout...

Just leave it like it is, come back when you see the need.

Hoping for the best.

Or in Winbox, go to Wifi , then Radios or Remote Cap tab.
Select line(s) which you want to handle and hit the button Provision.

@mkx, I applaud your patience here ... 2. It's my experience as well that some changes in configuration on CAPsMAN don't get applied to CAP. My way forward is to remove the dynamic entry for that particular remote radio in wifi/ ... CAP gets reprovisioned with new settings imediately afterwards. Acc...

No again. This is not the official Mikrotik website. This is a user forum (hosted by Mikrotik). THIS is the official Mikrotik website: https://mikrotik.com/ There is a tab Support on top And then you can see a HUGE button labeled "Contact Support" You have to create an account and then you...

He doesn't know either, does he ? To give you some context: this is a user forum about users helping other users. If someone sees this post and knows about it, I'm sure they will come in and share their findings. But if not, you really need to ask support. Mikrotik staff does frequent this place fro...

"Searched and thou shall finded"

https://help.mikrotik.com/docs/spaces/R ... eripherals

Did any of you 2 bother to create a support ticket so they can look into it ?
If not, it can be a long wait ...

To be honest, I never had the problems with wifi like some others (at least not in the amount some reported).
Even on AX3 I could easily work all day long with a connection to Azure Remote Desktop (which is VERY picky about disconnects etc).

Reading ... oh man ... what are the YT, TT and other platforms for? "Do not want to read!, I WANT TO WATCH AND LISTEN TO!" I truly and profoundly HATE youtube instruction videos. Total waste of time in most cases. I can read faster then they can explain it in a video. Even in English. And...

Hello just wanted to share I’m limited to 200-300 Mbps on Ether1 vs Ether 2-5 (switch chip) when using the port as a WAN interface. I can confirm I have the same issue on TWO separate E50UG. And if you had a 3th, 4th, ... they will all display the same behavior. Logical. They are the same design, e...

Make sure you stay in IPSec HW accel land. AX Lite doesnt support that: https://help.mikrotik.com/docs/spaces/ROS/pages/11993097/IPsec#IPsec-Hardwareacceleration Oh, but it does already for quite a while. Since 7.10beta5. I even tested it (AX Lite towards RB5009). https://forum.mikrotik.com/viewtop...

Security setting is not tied to master interface.
Can be different on each slave interface.

I have IOT ssids not using wpa3 whereas the master ssid does.

And yet I have a wAP AC running 7.18.1 without any problems, incl. wave2 drivers.
Only 300K left on storage but it hasn't experienced unexpected reboots yet.

I retyped the RoMon secrets in the devices in case that's it, but still missing some devices. Since I'm running Winbox64 v4 I thought it might be a bug, but V3 shows them missing as well. What connections or devices are between the ones you do see and the ones you don't ? Most likely there is somet...

Use ROMON. But I think you are mixing 2 things together here. How I understand it all works: In Winbox those Neighbors are not ROMON discoveries. Winbox Neighbors uses Cisco Discovery Protocol so you might even see devices there which are not Mikrotik. Or they are Mikrotik but not ROS, like SWOS dev...

If you hover over it, what does it say ?

A quick search here tells me it has always been there for ups and it probably means nothing.
viewtopic.php?p=604798#p604798

You simply don't combine a 24 port switch with wireless.
... 24-port switches are never on those spots.

Exactly.
And usually mounted in a nice rack too, oh yeah, made of metal. Bye bye wireless signal ...

Adding: The only thing which you can opt to retain when doing reset are user accounts. All the rest is gone. You have 3 reset options by selecting/unselecting some of the options (unless I missed something): - no config -> clean sheet, nothing in it, not even a bridge - default config -> =factory re...

Did you ?

If several are reporting it but nobody reports it to support...

Nope.
Reset is reset
Also vlan config.

Reset to caps mode.
Apply vlan settings for mgmt vlan.

That's the order

What will happen with 16MB devices? It's very hard to install updates. This means is the end of these devices?
No as they released new devices with 16MB
And the 5 year claim still applies, no?

Which would mean they will have to do something about current bloating of ROS base package.

And you updated how ?? Most likely not the correct way. The name already hints at it ... this is an AX device. You need wifi-qcom package, not wireless. And yes, interfaces will then be wifi1 and wifi2. Setup of those interfaces will also be a bit different then what you used to know with old wifi. ...

Personally, given the setup is to be managed remotely, I would not use passthrough mode. But that's me.
Factory reset etc to get updates done .. ??

I never had a problem using SXT in normal router mode. And I could update ROS and/or modem FW even from 930km away.

Also take into account a single true 1Gb network connection typically only goes to about 950Mbps. Never 1000 and certainly not 1024 Mbps.

Add this: /interface list member add interface=pppoe-out1 list=WAN And change this /ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" \ ipsec-policy=out,none out-interface-list=WAN to-addresses=82.*.*.57 back to /ip firewall nat add action=masquerade chain=sr...

Without seeing full config, hard to tell.
Some might have some guesses but it is a lot more efficient with config available.

I believe there is a slight misconception here in your thinking that allocated memory should be freed directly when you stop watching movies. That's generally not how an OS works. The OS needs to make sure unallocated memory is made available when someone else needs it. If that doesn't happen, then ...

I'm maybe not following ... I have for years used SXT LTE with wireguard to my home network (it was the main reason why I upgraded that SXT to ROS7 at that time, to be able to use wireguard). You just need on one end a public reachable IP address. It doesn't even have to be static (but it makes it e...

Create a backup before doing Netinstall. Yes, Backup , not Export. Best to upload it to Mikrotik cloud. In case something goes wrong - you can restore fast and with ease. I do understand why but be aware when you restore that backup, you will simply bring the problems back. Hence my focus on NOT us...

Why apply a beta version on your main router ?
If you can not afford the downtime, don't use beta/rc versions.

I guess one way to make it better is to use wireless-qcom instead of wireless-qcom-ac (I only care about wpa3, wireless-qcom-ac doesn't give me that much of a speed boost (which I don't need anyway)). This will not work. wifi-QCOM is only for AX devices. Any tips? Thank you Netinstall. Sometimes pi...

Something doesn't add up here. You can not get 1Gb over wifi on AX3 ? I can (almost) on wAP AX but that one is able to use 160MHz wide channels which AX3 can not do (80MHz max). Are you sure the frequency which has been selected after upgrading to 7.18.1 is usable by all your computers and it is int...

You configured old capsman on rb4011 while cap is ax device so it needs wave2 capsman.
Remove that config and start again under wifi menu.

As it turns out, the size of wifi-qcom-ac is shown as 2680 kb, even larger than the 1924 kb the wireless package takes up today. What would be helpful is if I could ditch the wireless package completely if that is not required on my CRS for CAPsMAN with cAP AC units. As indicated before, you can. ....

First step: apply 7.18.1 on that device.

When issue still occurs, export config for review.

Quite well possible.
Easiest solution would be wireguard, it's the fastest option.

DDNS is possible using Mikrotik's Cloud services but when using Wireguard, you only need 1 side to have a fixed IP.

It's in the documentation I referred to if one is willing to read. I use it quite often myself. Simply check which AP you need to have. Go in to it using Winbox (IP or MAC). Toggle all LEDS on/off. No need to make it more complex. If you really want, use a script to do this during some minutes with ...

More important question to ask: are all clients you plan to connect to those APs able to use full potential of 6E or 7 ?
Is your backbone network able to handle it ?
if not, why bother ?

Sure.
On the device itself you can control the leds.

https://help.mikrotik.com/docs/spaces/R ... 92859/LEDs

And this is where you really shine ...

Hmmm .. all those LTE/5G devices have eSIM, I see ..

Just saying:
Also don't forget to completely clear firewall connections table when messing with firewall rules.
Or reboot.
Otherwise it can take a bit of time before the changes get applied.

But I trust you already know this

Well there is your problem, using capsman LOL. Its not even a wifi device........... geesh seems like holvoe has infected everyone with his love for capsman. ;-) Tss tss tss ... Hex Refresh (and even original Hex) is perfect for capsman controller function. As you should very well know, even a mAP ...

I think even Winbox is fetching from "crafted" url: https://download.mikrotik.com/routeros/<version>/CHANGELOG It actually is. Good find !! https://download.mikrotik.com/routeros/7.18.1/CHANGELOG What's new in 7.18.1 (2025-Feb-28 13:31): *) bridge - improved stability in case of configura...

Sorry but did you look into that thread ?
The exact commands to implement it are there.

On Mikrotik you can also simply stop the service or VPN interface or ... whatever is applicable. For IPSEC, once you disable peer and then kill all active connections, it's done. For Wireguard, disable peer or interface and done. If I look at that thread: - create routing table - create firewall man...

Not a stupid question at all. My (high-level and first impression) view: With old capsman and capsman forwarding, this was to be applied on the controller since all AP traffic passes there. When capsman forwarding is not used (not available for new capsman), it needs to be done on each individual AP...

Is there an autosupout.rif file available you can retrieve ?
If so, get it off that device and make ticket to support sending the file with it.

Netinstall will be the next step then...

I don't use it myself but I read left and right you need to implement a killswitch mechanism via mangle rules when using IPSEC as VPN.

See here for an example
viewtopic.php?t=182042

As requested
What other packages ?
Any partitions ?

Old problem without fix for the moment. It only seems to happen with certain brands of USB sticks (and I believe Sandisk was one of them). The current workaround is to have a script which runs at reboot which switches USB power off for some seconds (5 to 10) and then enable it again. After that it s...

Take a look at Hex Refresh.
And let it handle VPN too.

Main problem is that your device only has 16Mb of storage. So you need to choose: uninstall packages and move their function elsewhere or face the consequences of low memory. There is no other sure way to free up memory. Netinstall might help clearing out possible leftovers from previous config (pro...

Other questions: why do you have VLAN filtering activate on bridge but no further VLAN config on that device ? When you see the poor performance on your PC, can you run /tools/profile - all to see if one or all cores are at maximum performance ? Also, how do you define "poor performance" ?...

My personal view: Depends on the attitude that person presents when asking and how he/she is asking it. You can find plenty of examples here where total noobs literally have been taken by the hand step by step to learn how to do something. And yes, some members can be very harsh with their responses...

If all ports at once go down to 10Mb ?
Doesn't sound like a cable problem then.

Unless we are missing some info...

Are you sure the used cable between PC and switch is at least CAT6 ? Can you try another one ? What port do you use for connecting your PC ? Which one goes towards you ISP modem ? Have you also tried to manually set the port on the switch connecting to your PC to 2.5Gbps ? What does that give ? Some...

In that case, see if you can create supout.rif (or of reboot happens, autosupout.rif should be there) and create ticket to support.

Search found 7765 matches