MikroTik

noradtux

Though one cannot explicitely define PTR records, it will generate suiting PTRs from A- and AAAA-records. Good enough? Not really. While true DNS does return a PTR to a "in-addr.arpa" query automatically. You cannot add a PTR explicitly. These are needed to resolve mDNS/DNS-SD per RFC-675...

noradtux

I just wish they'd add the missing PTR record to /ip/dns/static BEFORE adding new features like adlist — without PTR records Mikrotik DNS is largely unusable for me, as PTR records are needed for DNS-SD/mDNS. Though one cannot explicitely define PTR records, it will generate suiting PTRs from A- an...

noradtux

Anyone else having issues with 10GBaseT SFP+ on CRS317? Mine stops working after update to 7.14. Like, link is up, but cannot reach other side. (SUP-144396)

Solution:
Had the affected bridge port set to edge=no. Setting it to edge=auto makes it work again. Mikrotik support was quick to help :)

noradtux

Change log says: *) defconf - use "fq_codel" queue as default interface queue for wired ports on LTE devices; They failed to add BQL: https://forum.mikrotik.com/viewtopic.php?p=1046881&hilit=bql#p1046881 Did you open a feature request for that? This forum is not the right place to do ...

noradtux

+1
I opened a feature request ticket, lets see if they accept this a a valid request.

noradtux

I actually welcome the removal of SMB from the default image. I always considered it quite useless ¯\_(ツ)_/¯

noradtux

still no ed25519 private key for ssh?

For login? That has been added with 7.12.

noradtux

Sometimes RouterOS looks&feels like stuck in the 90s. It’s 2023 and … how is anything not IPv6-only by default? Just a few RouterOS versions ago one still had to enable an “IPv6” module to get half-baked IPv6 awareness. :( (Not the case any more, fortunately.) The documentation is full of legac...

noradtux

Great news

noradtux

So I've been having issues with IPv6 over Wireguard on wAP (arm) from ROS 7.10 ongoing. In "allowed-networks" I had /48 networks. I got this to work again by replacing those with /64's. Issue is ongoing, SUP-120497.

noradtux

I've been running a CCR2216 with three full tables with L3HW disabled (because of issues regarding BFD and L3HW). These seem to be fixed on 7.11beta4. I just installed a second CCR2216. So I am pretty happy with the 2216.

noradtux

With 7.10 I have been seeing unstable BFD sessions on CCR2216 with L3HW enabled. With 7.11beta4 this seems to be fixed :)

noradtux

*) wireguard - fixed IPv6 traffic processing with multiple peers; Doesn't seem like it. The issue remains if the allowed-address set on the router is an ipv6 /64. It works but only if that peer is the most recently enabled. If another peer is enabled, the 1st will stop working on ipv6. If the allow...

noradtux

How stable is BFD for those testing it? I see random interruptions between CCR2216 and Cisco ASR 1001-X as well as FortiGate 60E and 900D. Still trying to figure that one out.

After some tinkering:
Looks like it somehow interacts with L3HW-Offloading. I disabled it, now BFD seems to be stable.

noradtux

Hi, I need to connect a CCR2216 to a Cisco switch using a WSP-Q40GLR4L (QSFP+ 40G SM). Mikrotik doesn't seem to have any 40G SM modules, the closest match to the Cisco module seems to be the XQ+31LC02D (wavelengths and power matching etc.). That is a 100G module, though. Could I run that at 40G?

noradtux

BFD for OSPF does not appear to actually run within the vrf. I opened SUP-117843 1 I ;;; BFD forbidden for interface multihop=no vrf=main remote-address=172.16.0.162%vlan3020 local-address=172.16.0.161%vlan3020@vrf1 desired-tx-interval=0ms required-min-rx=0ms multiplier=0 You need to allow BFD on t...

noradtux

Finally got around to test BGP with BFD. Session between CCR 2216 and FortiGate came up easily (after configuring properly) and seems to be working fine. (If your BGP session happens to kind of establish and then break down, check that BFD is actually enabled on the involved interfaces ;) )

noradtux

BFD support would be nice

It's in 7.10beta. So the wait is almost over :)

noradtux

https://mikrotik.social/@mikrotik/110389938433147844

noradtux

Yay :)
Shall follow immediately

noradtux

Upgraded CRS317, RB5009, Chateau 5g ax and CCR2216 without apparent issues (solved some I had on 7.8). Features used involve IPv6, Wireguard, OSPFv2 and v3, BGP and IPSec

noradtux

From my still rather limited experience RouterOS is (in a very simplified way of thinking) a frontend to the routing engine of the Linux kernel. At least it mostly behaves like that.

noradtux

Well, for such a feature you usually don't need many developers but one which is dedicated to do it. I hope this delay means that they try to implement it on hardware (i.e. the switch chip), where it belongs if done properly.

noradtux

PPPoE scan is now broken, it used to be working on version 7.7. It looks like there is a bug in version 7.8 I am using hAP ac^3 version 7.7: [admin@Router] > interface pppoe-client/scan interface="W1 WAN" duration=20s Columns: MAC-ADDRESS, AC-NAME MAC-ADDRESS AC-NAME DC:77:4C:XX:XX:XX FBG...

noradtux

Hi, I found that IGMP snooping on the CRS317 is dropping OSPFv3 traffic. Support thinks this is normal .... Well, I found a workaround to make this work: I added a switch rule that copies all traffic to ff02::5 to the CPU. /interface ethernet switch rule add copy-to-cpu=yes dst-address6=ff02::5/128 ...

noradtux

So it seems I was wrong. On latest firmware RB4011 starts randomly, sometimes it boots normally, sometimes it hangs. I bought serial cable ... just to see what is happening during boot. (if you are lucky... RB4011 in netinstall shows "READY" and clicking install just shows "Sending o...

noradtux

As intriguing I find that WiFi routing topic, can we please stick to the topic of this thread?

noradtux

I had one SSD used as container storage with the label "ssd", but after upgrading to 7.8, it got renamed to usb1-part1 and it broke my containers. not sure if is the same issue as here in this topic Does it change its name if you replug it? I just tried this with an UAS capable SSD-adapte...

noradtux

Support says this issue is known and being worked on.

noradtux

I also just found another report of this, so I don't seem to be the only one experiencing this. supout incoming ...
viewtopic.php?t=192427&start=300#p982228

noradtux

Thank you very much. Just an update. Using CRS317, ip address configured on a vlan (vlan belongs to a bridge with L3 HW enabled), currently after turning off IGMP Snooping for the bridge, ospfv3 works fine. The problem is whether IGMP Snooping is blocking some packets of ipv6 I had a ticket (SUP-10...

noradtux

Hi, I have an USB3 drive attached to my RB5009 (on ROS 7.8 ). It works fine and I can use it as usb2-part1 for container storage. But when I reboot the router it comes back up as usb1-part1 (preventing my containers to start). Now if I unplug the drive and replug it becomes usb2-part1 again. It look...

noradtux

how did you get ospf3? I'm testing on two CRS317 which converge fine in ospf2, but never using IP6

At least on CRS317 you need to disable IGMP snooping on the bridge to get OSPFv3 working. And yes, support says this is normal ....

noradtux

That is not something a generic router can do. You need to buy a special box that has a maintenance contract to provide you with the dynamic information required for that. :) And yet most of ASRs & ISRs of the biggest router vendor support it... search for "SD-WAN Application Intelligence ...

noradtux

Then it seems like it would make sense to put all advertised routes in /routing/route/advertisements and use existing flags to identify what protocol is advertising the route. That would match the behavior of /routing/route since it already knows about all learned routes I like that idea, that is o...

noradtux

Would love to see LtAP/LtAP mini with 5GHz ac

noradtux

tun/tap support will be added in next release. Anything else to consider adding before stable release?

I'd like to see IPv6 support. Or is there a way to get v6 communication with a container? Most of my VPNs are v6-only nowadays, so I can't really use containers as is.

noradtux

Any RB5009 owners updated?

Yep, running fine so far.

noradtux

*) wireguard - fixed IPv6 traffic processing with multiple peers; IPv6 traffic processing with multiple peers is not fixed, broken since 7.1rc4. Have to reenter allowed address to allow IPv6 but only for one peer. SUP-78547. Are you sure your config is correct? This was broken before for me aswell....

noradtux

*) ipv6 - fixed VLAN tagged PPPoE packet receiving on RB5009;

Confirmed, this is finally working again :)

noradtux

7.1.3 indeed fixes this issue for me

noradtux

*) wireguard - fixed IPv6 traffic processing with multiple peers;

Fix confirmed, my issue is gone :)

noradtux

Still has the IPv6 over Wireguard issue as described in viewtopic.php?p=908865

noradtux

Issue persists on 7.2rc2

noradtux

So, just to complete this: /delay 30 did not help (not even /delay 60), so I daresay something is profoundly broken with the run-after-reset-scripts. Anyway, this just means that I need to manually import the config and be good, so it's not a big deal. At least now I know that it wasn't me doing an...

noradtux

Yesterday I got basically the same reply to my ongoing ticket. So they are working on it

noradtux

This has been driving me mad trying to get wireguard to work with IPv6. I could get it to work with one peer but as soon as I added a second peer IPv6 stopped working. I can see that the release notes for 7.2rc1 says "wireguard - fixed IPv6 LL address generation" so does this not fix the ...

noradtux

eMail to support@mikrotik.com

noradtux

I also see this issue after upgrading from rc4 to rc5. I have one wg interface on my rb5009 with two Linux systems as peers. Sniffing on both peers and pinging both from the router I see echo-requests for both peers arriving on the peer that established its wireguard tunnel last.

noradtux

The Wireguard IPv6 peer bug is also still present on this version. What is the "Wireguard IPv6 peer bug" you are referring to? I have SUP-65906 open where I have one wireguard interface on my rb5009 with two Linux systems as peers. Since 7.1rc5 I can only ever get one of those peers to wo...

noradtux

I noticed the following when trying to log in using ssh key: 1. copy id_rsa.pub file to ROS 2. /user/ssh-keys/import public-key-file=id_rsa.pub user=admin 3. try to log in via key => still asks for password Turns out that current OpenSSH client needs PubkeyAcceptedKeyTypes=+ssh-rsa set. Then it works.

noradtux

I think I am seeing something similar. I have a wireguard interface with two peers defined on it. I seems like only one of them will work at any given time. This setup was fine with rc4 on my rb5009. Currently I created a second interface to handle the second peer, which works for now. Server side,...

noradtux

hap ac2, after upgrading to rc5 from rc4 wireguard peers lost ability to connect with ipv6, local clients can use ipv6 as before after downgrading to rc4 with the same config everything run as it should be I think I am seeing something similar. I have a wireguard interface with two peers defined on...

noradtux

I have the same issue (viewtopic.php?f=1&t=177984&p=875621#p875621).
It only happens when running pppoe over a tagged vlan. It works on an untagged link.

noradtux

Hi, my setup is as follows: ISP fiberlink (media converter) <(1G Copper SFP)> CRS317 <(SFP+ AOC)> RB5009 (was RB4011) The ISP expects pppoe on VL1002, so I configured the CRS317 to have VL1002 tagged on both links, towards ISP and the Router). Now the strange issue: IPv4 does work through the pppoe ...

noradtux

I had a go with auto-ingress on rc1. My observation is that it slowly increases the allowed throughput until it hits the maximum throughput of the connection. My guess is that this is recognized by increasing latency. To avoid latency spikes they need to ramp up, if needs to be that slow is an other...

noradtux

So far all is working fine on my CRS317, RB4011 and LtAP-Mini (+R11e-LTE6). Noteworthy features in use are IPv6 to Internet, IPv6 over Wireguard (multiple tunnels), CAKE using queue tree. Lets see how stable it is ... Where are you targeting the CAKE queue? At the LTE connection? Has it been stable...

noradtux

So far all is working fine on my CRS317, RB4011 and LtAP-Mini (+R11e-LTE6). Noteworthy features in use are IPv6 to Internet, IPv6 over Wireguard (multiple tunnels), CAKE using queue tree. Lets see how stable it is ...

noradtux

A firewall product I use can supposedly use wildcards in its ruleset by reading DNS queries that pass it and populate those wildcard entries with the info it captured from those DNS responses.

noradtux

No, I was not aware of that default. I'll give that a try.

EDIT:
Yes, changing the default entry works, thanks :)
It would be nice to be able to adjust that per pool, though. For dynamic pools doing that through the settings of the dhcpv6-client might be convenient.

noradtux

Hi, I get a dynamic IPv6 prefix from my provider through DHCPv6-PD. This prefix is changing every 24 hours. It is announced with "Valid Lifetime 30d 00:00:00" and "Preferred Lifetime 7d 00:00:00" though. I'd like to adjust that, or at least have the lifetime follow the expiry inf...

noradtux

Strange, works fine for me. What hw platform are you using or is it CHR? I use an RB4011. I have found an issue with v6 on my system, though. After reboot it seems I cannot get data forwarded through my wireguard interfaces. Doing an export of /ipv6/firewall/filter, removing all entries and then re...

noradtux

Strange, works fine for me.

noradtux

+1 for IPv6 Fasttrack

noradtux

[admin@RB4011] > /ip/dhcp-client/print                                  

[admin@RB4011] >

noradtux

Hi, on my (ISC-)DHCP-server I see DHCPDISCOVER pakets coming from my RB4011 every second. The thing is, there is no DHCP(v4) client configured on the router, so it should not be doing DHCP requests at all. There is just a DHCPv6-client for my Internet connection, which is on PPPoE tunnel on a differ...

Search found 66 matches