MikroTik

azzurro

bump

azzurro

Hi I'm trying to configure my Chateau LTE12 so it passes through lte1 to ether1 and so that I have a VLAN interface (ID 1128 in my case) for management, also on ether1. The following config seems to work just fine, I just wanted to have it sanity checked whether there are any obvious mistakes or no-...

azzurro

at least, that's the message that they are sending. kind of. because not many home users or small businesses will need a 40G switch. especially when considering that the 40G train is kind of dead, since 10/25/100/400G emerged.

azzurro

i don't know, honestly. but their level of ignorance drove me away from mikrotik for anything edge-firewall which needs to do VPN stuff.

azzurro

just move to a different vendor. mikrotik only supporting policy based ipsec vpn has shown to stay beyond ridiculousness.

azzurro

how are things going with V036? I'm running V034 and not intending to upgrade, since everything is working rock-solid for me.
Just being curious.

azzurro

update: i was on 7.11.2, which had a bug where fasttrack wouldn't work anymore properly, with L3 HW.
updated to 7.12.1 and now fasttrack is working and cpu load has dropped significantly.

azzurro

If you want traffic from a port to be manipulated, disable offloading on that port. Enable fasttrack rules with hwoffload=yes to match already classified traffic and take advantage of some acceleration. Little followup to this topic. Until now, just not offloading anything that exits ether1 worked ...

azzurro

IPSEC improvement is here, its called wireguard ;-P

yea, sure

azzurro

as I said, I do not care anymore. that amount of ignorance won't drive just me away. MT is now switches for me and that's it (maybe L3 switches). certainly no firewall and certainly no ipsec endpoint. both is hilariously cumbersome if one has ever worked with any kind of even entry level enterprise ...

azzurro

unsubscribing, since I do not even care anymore. moved back to fortigates because of this crap.

azzurro

ok, this is it people, no plans but they'll "consider it". bye bye for good for any edge routers, mikrotik... Hello, Thank you for contacting MikroTik Support. At the moment there are no plans to change IPSEC functionality, thanks for your request we will consider such implementation. Best...

azzurro

sure, that's why I bought the RB5009 in the first place. but it turned out that different features were more important than like having an SFP+ port. also, I bought mine used for EUR 350. Also, you can get a 40F which is still as powerful (if not more powerful) as a RB5009 and that is obtainable wel...

azzurro

yeah well, I've just switched back to a Fortigate 60F from my RB5009 and I'm not looking back. Very sad but I was just fed up of the IPSEC implementation in ROS. Route based IPSEC is such a charm to work with! I'm not considering putting ROS routers anywhere in the near future where I need IPSEC, no...

azzurro

as I have mostly interop inconveniences with fortigates, I can't resort to ip-ip or gre, as these often can't be hw offloaded on the smaller fortigate models, whereas IPSEC VTI can.

azzurro

wait, I never said VTI would have a higher demand/forum thread count than OpenVPN or Wireguard. We were talking about IPSEC in general, which you downplayed. Again, I do not want to accept VTI being referred to as "granting/responding to every request". That always sound to me like people ...

azzurro

so, if IPSEC is that exotic, please tell me why there is so many threads about it and why is mikrotik working hard on supporting hw-acceleration for IPSEC wherever possible and why is mikrotik improving their ipsec implementation all the time? how do you know, what types of vpn are being requested b...

azzurro

true, but dude, please don't refer to VTI as "every type of VPN" like it is some exotic thing. i don't know any other serious vendor these days who doesn't implement VTI. to be honest, mikrotiks are versatile AF and implement like every piece of whatnot but VTI of all things still doesn't ...

azzurro

the issue is interoperability with other endpoints. for example once i wanted to build gre over ipsec with a fortigate but the fortigate had a hard time and struggled with GRE, it made tons of CPU load on it, while pure IPSEC would have been hw-accelerated and lightning fast. and you can't always ju...

azzurro

Hi - Chateau LTE12, one interface removed from the bridge - LTE passthrough configured to that one interface - IP address and default route to my router configured on bridge to allow management of the Chateau + Internet access for the Chateau for NTP, firmware upgrades, ... Does the default route in...

azzurro

open a ticket with MT support. i had this issue with the LTE12 modem and while it was never officially confirmed, Mikrotik worked with quectel and i went through one or two modem beta firmwares and workarounds and now with the latest firmware the issue has been resolved. be aware though, that it to...

azzurro

open a ticket with MT support. i had this issue with the LTE12 modem and while it was never officially confirmed, Mikrotik worked with quectel and i went through one or two modem beta firmwares and workarounds and now with the latest firmware the issue has been resolved. be aware though, that it too...

azzurro

ok thanks for confirming that.

I don't know how Fortigate with its FortiOS is doing it but there it was working perfectly, having different phase 1 settings in this scenario.
anyways, it is what it is and I'm happy it is working now at least the way it is.

azzurro

Yes, I understand that, sorry. I thought too much of the config could be confusing since it is quite extensive. I think that should be all, regarding IPSEC. Order of which rules do you mean? Of course, I have firewall filter rules in place but they simply allow udp 500, 4500 and protocol 50 ipsec-es...

azzurro

Hi I have a Chateau LTE12 router and since a few weeks I am experiencing weird, random and frequent issues with my internet connection like frequent packet loss, despite good signal strength and quality. My cellular provider told me that there are absolutely no issues in their network and I also do ...

azzurro

I have identities, sorry for not posting them earlier. /ip/ipsec/identity peer=IKE2-Dialup auth-method=eap-radius mode-config=roadwarrior certificate=certificate-request.cer_0 generate-policy=port-strict policy-template-group=roadwarrior peer=IKE2-Dialup auth-method=pre-shared-key remote-id=fqdn:sit...

azzurro

Hi /ip/ipsec/profile name="roadwarrior" hash-algorithm=sha384 prf-algorithm=sha384 enc-algorithm=aes-256 dh-group=modp2048 lifetime=1d proposal-check=strict nat-traversal=no dpd-interval=1m dpd-maximum-failures=5 name="site1" hash-algorithm=sha384 enc-algorithm=aes-256 dh-group=m...

azzurro

by the way I ended up getting rid of aggressive mode completely and reconfigured the peers to main mode and IKE2.

azzurro

Hi i had massive issues with TCP retransmits, out of order and dup ACK via all of my site to site VPN tunnels so I created the following rules on the one router which had the issues (ether7 is wan): chain=forward action=change-mss new-mss=900 passthrough=yes tcp-flags=syn protocol=tcp in-interface=e...

azzurro

Ahh so is this a case of trying to stuff a square peg of current and secure RoS into a round hole of old and unsecured VPN Protocols. One could say it looks like your up shits creek without a paddle. Hypothetically speaking of course, someone needs the powers to be to know that that the other boxes...

azzurro

unfortunately one doesn't always have control over all peer sites and devices. so replacing the remote devices unfortunately is not an option here. replacing the mikrotik with a different solution like pfsense, opnsense or sophos xg is an option though. however, i'd favor to achieve the goal with th...

azzurro

Hi, I'm having a hard time replacing a Fortigate firewall which is acting mainly as a VPN gateway with a RB5009. Remote peers are consisting of various devices, which all have different requirements: Fortigate with static IP Fortigate with dynamic IP behind NAT (NAT-T req'd) Mikrotik wAP ac LTE kit ...

azzurro

They're saying this in the footer: - All tests are done with Xena Networks specialized test equipment (XenaBay),and done according to RFC2544 (Xena2544) - Max throughput is determined with 30+ second attempts with 0,1% packet loss tolerance in 64, 512, 1400 byte packet sizes - Test results show devi...

azzurro

I've enabled nat-t now on both sides but still no luck, unfortunately. Do I need any route on the Mikrotik side for 192.168.99.5/32 to go into the tunnel? Do I need a srcnat allow rule on the MT side? I have a feeling that I'm missing something on the MT side and I wasn't able to pinpoint it. Not ev...

azzurro

Hi, what output do you mean? Also I don't know about these Cisco commands. Here's the configs though: The IPSEC tunnel is up btw, the MT just can't initiate a GRE tunnel to the Fortigate, but the other direction works just fine. I mostly want to understand why the MT can't initiate the GRE tunnel. M...

azzurro

Hi so I have IKEv2 + GRE working between a CHR and a Fortigate in tunnel mode and from the Fortigate I can ping the IP of the loopback bridge which was created on the Mikrotik but vice versa, from the Mikrotik I can't ping the corresponding IP of the tunnel interface of the Fortigate. Pings are allo...

azzurro

Hi so I've been working in my lab on configuring a site to site IKEv2 VPN with GRE between two Mikrotiks, where both peers have static IPs, so no dynamic policies either. Also, I wanted basic NAT Router and firewall rules to be in place. I had to adapt the example from the documentation a bit and ev...

azzurro

oh boy. I have the Chateau LTE12 and only with the very latest modem firmware EG12EAPAR01A13M4G these issues (interface resets, modem crashes, LTE interruption until I reset the interface, ...) have stopped. I was hoping to upgrade to the Chateau LTE18 ax soon but now I'm in doubt if I'll maybe face...

azzurro

Nice writeup, thank you! It would also be interesting to see dynamic VLANs without CAPsMAN, i.e. only with one router and its integrated WiFi capabilities. I wonder how much that would differ from this tutorial.

azzurro

MT could at least let us know/update us whether it is on some kind of roadmap...

Please!

azzurro

I'd rather like to see IPSEC VTI in ROS. Shouldn't be too much of an issue since it is possible with the Kernel currently used in ROS 7...

azzurro

See https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading . Enable hardware offloading on the switch (Interface/Ethernet/Switch) Disable offloading on the Internet-facing port(s) (Interface/Ethernet/Switch/Port) Enable offloading on LAN-facing ports (Interface/Ethernet/Switch/Port) You ...

azzurro

Thanks, makes absolutely sense. Is there a way to direct certain traffic through the CPU or the other way round to only offload traffic between certain networks or interfaces? basically any traffic that goes to the internet, doesn't really need to be offloaded, because of limited internet speed. L3H...

azzurro

got anyone an idea? or am I completely on the wrong track and mangle should work with L3HW enabled? I am not even sure about that.

thanks!

azzurro

Hi Currently, with L3HW enabled on my CRS309-1G-8S+, it seems that Mange Rules are not applied to traffic. Is there a way to make mangle rules work selectively or would I have to disable L3HW all together? The goal of my mangle rules is, that I route my LAN traffic to the internet through an L7 fire...

azzurro

ok that makes sense, thanks! but you're saying it yourself in some way: who says, the CRS309 doesn't maintain one entry per WAN destination IP? something like this (where AA:BB:CC:DD:11:22 is the NAT firewall's MAC): 37.2.1.1 / 255.255.255.255 / AA:BB:CC:DD:11:22 37.2.1.2 / 255.255.255.255 / AA:BB:C...

azzurro

... and by 16K - 30K routes you mean connected (dynamic) and manual (static) routes? I don't think I'll ever hit that limit... All types of routes (type doesn't matter for HW offload engine). And the number is not that large, there's a gotcha: if there's a connected network, then every active host ...

azzurro

Hi, you almost have the same config as I have, except I have a trunk between my FW and my CRS309. It works extremely well in this setup, but I'm not using L3offloading on the switch. The routing is done by the FW. The biggest problem I have are the MT 10G Cu SFPs, which are getting extremely hot. I...

azzurro

you are right, CRS is not doing NAT so no need for fast-track your router firewall doing nat supports many gigabits of NAT? which device is ? ah yes, makes sense, no nat, no connection tracking :D my nat firewall is a fortigate 60D, it can do at least wirespeed NAT with its ASICs (1Gbps that is). i...

azzurro

yeah well that's the same as /ip firewall connection print count-only so i guess there's not much going on with 30-60 connections. I'd have to create firewall rules for fast-tracking, I guess? it doesn't seem those non-fast-tracked connections are bothering the CPU in any kind of way, haven't seen i...

azzurro

check if this terminal command works:
Code: Select all
/ip firewall connection print count-only where fasttrack=yes

that shows 0.
but /ip firewall connection print count-only shows 60...

azzurro

nice setup As long as you consciously stay within the limits of this device, you'll be fine: 16K - 30K Routes 4.5K Fast-track Connections 1024 ACL Rules and i think you must stay below 100kpps /1gbps of traffic procesed by CPU thanks! How can I check how many fast-track connections I'm currently us...

azzurro

Hi I have configured my CRS309 to be my lab inter-VLAN router with L3 HW offloading. So far, everything seems to work great and I wanted to check back on your opinions as I'm not sure how good of an idea this is. All the NAT lifting, site to site VPNs and so on is done by a separate hardware, as I g...

azzurro

Routing metrics were done before L3HW was implemented. So those on product pages show software routing stats. Regarding hardware routing, if the traffic can be offloaded, it gets near-to-wire-speed performance on any MikroTik device that supports L3HW. Roughly, hardware routing speed = wire-speed -...

azzurro

Hey I was just wondering, since many L3 switches like the CRS309-1G-8S+IN or the CRS326-24G-2S+RM now should support quite some L3 HW accelleration, aren't the routing metrics on the product pages now outdated? Shouldn't they reach kind of wire speed now, when routing? Of course taking into account...

azzurro

7.3beta33 has a fix for this, i have confirmed with my device that the issue has gone away!

azzurro

Hello azzurro, Did you open a ticket regarding this? I think We are facing same problem. When you configure routes they became up, but after reboot they started as I nactive. Disable and reenable the route made them to work again (other routes are removed from output): [] > ip/route/print Flags: D ...

azzurro

Hey I was just wondering, since many L3 switches like the CRS309-1G-8S+IN or the CRS326-24G-2S+RM now should support quite some L3 HW accelleration, aren't the routing metrics on the product pages now outdated? Shouldn't they reach kind of wire speed now, when routing? Of course taking into account ...

azzurro

add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.31.62@mgmt pref-src=192.168.31.61 routing-table=mgmt suppress-hw-offload=no vrf-interface=ether5 Could you try disable the check-gateway=ping on this route to see if it makes a difference to the route showing red on...

azzurro

*bump*
got nobody an idea? i still wasn't able to solve this issue. is this more likely a bug or more likely a misconfiguration?
is this even the way VRFs were meant to be used? basically I wanted to have a completely separated management interface, that's all...

azzurro

Hi, the route for the management VRF on a separated interface gets red/invalid after every reboot, making it impossible for me to manage the device unless I NAT myself in and deconfigure the narrowed down IP allow lists for all the management services. Disabling and re-enabling the route fixes it an...

azzurro

Its designed for heavy routing like through ISPs to servers etc.... If you want a lab network of devices for heavy transfer of data between devices on a network, then get a high powered switch. where I am coming from, a device called "router" can do inter-vlan-routing with wire speed. at ...

azzurro

Just not aware of any ISPs much beyond 1gig.............

I am using it for what it is advertised: The ultimate home lab router. So I have multiple VLANs and happend to have to route between two of them. Would've been nice if I had gotten 10 Gb/s.

azzurro

you mean once RouterOS has support for hw-offloading on the 5009? Because I wasn't able to enable L3HW on it when I tried... Yes, exactly. Once hw-offload is enabled in ROS, I would expect IPv4 unicast at a minimum to be offloaded for static routes, directly connected routes and RIP, OSPF, BGP with...

azzurro

L3HW routing is better used for cases like inter-VLAN routing, That's what I'm trying to do here. the 10 Gb/s advertised throughput That's conditional . Are you doing full-size packets with no firewall rules and no queues? afaik, iperf is sending as large packets as possible, so yes, full-size pack...

azzurro

it seems that I'm failing to understand the concepts. I want to let the router route (RB5009). Aren't routing decisions possible with L3 HW offloading? How are the 10 Gb/s advertised throughput achievable with a RB5009? I'm only getting around 1,5 Gb/s to around 5 Gb/s between two VLANs, depending o...

azzurro

Hi this may be related to my other post regarding the RB5009 and HW L3 offloading but I may as well be on the wrong track there, so I'm asking another question: How is the advertised throughput of around 9 Gb/s achievable on the RB5009? I have the 10 Gb interface connected to a server with two VLANs...

azzurro

Hi, i was wondering whether the RB5009 will get HW offloading support for L3 at some point. It is a bit funny imho, that I'm thinking about moving L3 to my CRS326 while having "The ultimate heavy-duty home lab router" just to get 10G wire speed. Well, at least that's going to save me one 1...

azzurro

i did some tests with 7.1.1 and achieved more than 800 Mbit/s with pretty high encryption algorithms.
https://sleepytechbloke.wordpress.com/2 ... g-support/

azzurro

Hi @azzurro, Thank you for your contribution. For our purpose, since we'll be using ospf, we will need a tunneled interface with IP's on each side of the tunnel for the routers to communicate. What would be the correct configuration for such a set up? Hi in that case you'll have to go with GRE over...

azzurro

Hi this may be very specific but I think it may be useful when dealing with reverse proxies. I would like to see MikroTiks to support the PROXY protocol of HAproxy (which is a popular open source reverse proxy): https://github.com/haproxy/haproxy/blob/master/doc/proxy-protocol.txt The proxy protocol...

azzurro

What i would do is, configure VLANs on the interfaces connecting the Router and the LTE device... Those VLAN interfaces would be used for management purposes of the LTE and for communication with the Router. Then i would use the interface ( not the VLAN one ) for the passthrough. You will also need...

azzurro

Hi, I've just now replaced some generic Huawei LTE router with the Chateau LTE12 and configured it for passthrough mode. For management, I have removed ether5 from the bridge and assigned an IP address to it. ether5 is connected to my hardware firewall to a DMZ interface so that there is no way for ...

azzurro

ok thanks, people! if this ever occurs again, I'll know what to try.

azzurro

Hi I have written two blog posts exactly about this topic and I believe you should find there what you're looking for. https://sleepytechbloke.wordpress.com/2022/01/30/mikrotik-ipsec-vpn-vendor-interoperability/ https://sleepytechbloke.wordpress.com/2022/01/31/ipsec-site-to-site-vpn-between-fortigat...

azzurro

if you need interfaces, you want to go with IPIP or GRE or something like that. e.g. if you want to use OSPF.

azzurro

Exactly...
So the reset and restore had nothing to do with fixing the problem or not...
Does everything still work if you lets say reboot both devices ?

i did not reset nor restore! that you must have misinterpreted.
i still have to try the reboot (and will do)

azzurro

If i read correctly, your problem was "fixed" as soon as you applied the config again and before the Reset/Restore procedure... So there must be something else... it was fixed when i disabled - bridge fast-forward - allow fast path - hw offload on the affected interfaces (server uplink an...

azzurro

Backup creates binary blob, possinby taking corrupt binary config. Do it's not clear if reset/restore wold clear this kind of problem.

what about (verbose) export? i guess that should work...

azzurro

There have been some (rare) cases where correct setup didn't work as expected. Reboot did not help. Re-doing the same config again made things work. So it seems that sometimes some wrong configuration lingers somewhere and after re-doing the same config it finally gets overwritten. I'd attribute yo...

azzurro

Update: now things are getting spooky. i have set all settings back to their original state, when things weren't working as expected but now everything still works. ARP messages are getting delivered properly and now even in /interface/ethernet/switch/host/print the ARP entries in question are shown...

azzurro

Hi thanks for your response! Out of curiosity I now disabled the following things: - bridge fast-forward - allow fast path - hw offload on the affected interfaces (server uplink and firewall uplink where the ARP traffic should come from/go to) - limit broadcasts on the affected interfaces Now the is...

azzurro

Hi i am on current long term 6.48.6 with this switch and i have a weird ARP issue in combination with VLANs. VLANs are configured on the bridge, all tagged, only L2 (switching), no interfaces apart from management, no routing. On one of the switchports, i have directly(!) connected a Fortigate 60D f...

azzurro

Hi PPTP/L2TP/SSTP servers and more don't seem to be listening in anything else than the main VRF. I just wanted to build an SSTP server within a separated VRF where it has interfaces and routes towards WAN and LAN through another L7 firewall, but failed because the SSTP server just wasn't listening ...

azzurro

I recommend you with any vendor to only look at what they offer TODAY and not at what is being demanded in the forums or even what is being promised by the vendor. It does not matter what is being asked for, there is always something else on demand. That's what I'm doing. MikroTik have paid attenti...

azzurro

the lack of VTI support is a major showstopper and we would have the opportunity for hundreds of customers buying mikrotik, but now they have to go to cisco or fortinet. Are you sure that when VTI is implemented, you will not come back with "VTI is nice, now we need to have NHRP"? yes, be...

azzurro

yes, thanks! major bummer, that mikrotik still hasn't implemented that.

azzurro

It's natural, new things are invented, they are useful, competitors have them, people see it there and want them too, it will never end. It's not possible to add everything, but once something evolves into "everyone else has it", you can't ignore it forever. yes but VTI is not "every...

azzurro

+1 for VTI!
On Fortigates I've been doing that for 10 years!
i gotta return my hEX and RB5009 as they can't interoperate with my Fortigates which are doing VTI. And even if they could, not having tunnel interfaces when connectes to my Fortigates is a huge PITA, due to routing.

azzurro

Hi first of all, I'm coming from the Fortigate world and so I am a newcomer to MikroTiks. Recently a VPN scenario with Hub and Spoke topology (all branch offices are connected to the headquarter and they all communicate with each other through the headquarter) gave me headaches with the MikroTiks. W...

azzurro

turns out, i am a complete moron. i had a 100 Mbit connection between the two endpoints because the cable i used appearently wasn't capable of Gbit. Best thing is that I knew that and wanted to swap it out later. Well, I guess I had forgotten about that. lol. Anyway, now I get around 310 Mbit/s with...

azzurro

Hi, how much bandwidth am I supposed to get through a hEX (RB750Gr3)? I currently only get around 100 Mbit/s with iperf3, 1-4 parallel streams, no additional parameters, no difference if 1 or 4 streams. My IPSEC site to site connection has the following properties: IKEv2 AES256-CBC SHA256 MODP2048 V...

azzurro

Hi i have written an article about how to use your MikroTik router as a SSTP VPN server for Windows Always On VPN clients. The guide incorporates a dedicated hardware firewall to lift the weight of firewalling off the MikroTik router so it can do its single purpose thing (in this scenario). https://...

azzurro

Hi! I would like my SSTP server to be in a separate VRF. Current issue is, that during the connection process, packets get sent to the client through the default route of the main routing table but the VRF which is supposed to be there for the SSTP clients, has a separate default route. Is that poss...

Search found 94 matches