MikroTik

dang21000

Hi,

If created in static mode.... when (re)provisionning OR reboot the caps, do they will be removed/flushed and replaced by new like expected by provisionning rules ?
The idea os to avoid having lot of unused interfaces...

dang21000

Just upgraded the lab to rc7 (2x 5009, + 4x ax3 + 1x crs310)... and still working :)

dang21000

I prefer use a 5009 for lab and staging.
More interfaces, sfp+ and more power.

dang21000

i've choose and other way... replace all AC by AX and sell the AC.

dang21000

Hi, i've also replaced all my CRS310 fan by the noctua 4pin.
And set in system heath the minimum speed at 50% to increase airflow.

dang21000

export your config ...

maybe output fw 4/6 rule, maybe dns resolv

dang21000

Hi,

Yes, there lot of problems with the forum access...

dang21000

Read the doc : https://help.mikrotik.com/docs/spaces/ROS/pages/24805498/Reset+Button A thing missing in the doc, is the default configuration for each device... this can be awesome to get them easily. Because this page https://help.mikrotik.com/docs/spaces/ROS/pages/167706788/Default+configurations ...

dang21000

I've read that this switch is equiped with 2 glued heatsinks and they can also get out due too bad glue and not correct heat dissipation. Can you open the unit and check the heatsink state ? I've few units runnings and this will be the first thing i'll check, mines are all racked, so they don't phys...

dang21000

Hi, The goal is simple : totally shutdown wireless AND wired network access when not working hours ; with a easier way to enable/disable wireless AND wired "parts" when needed. For the wired, it's easier , i shut the access port on distribution switches (not mikoritk here). But wireless is...

dang21000

Hi, I use, like lot of person, capsman to purpose wireless networks. For security reasons I'm asked to stop them at closed hours. And the policy is different for each ssid. I planned to create scripts, scheduled and run on capsman to disable or enable the wifi config. Is it a good idea? Is it the be...

dang21000

It's just a visual separator...

dang21000

maybe you can use netwatch tool... ? and launch script by the netwatch ?
I had some SFP problem with CRS326 switches, solved by upgrades and by SFP replacment.

dang21000

I've a site with 4 hap ax3 under capsman running wap2/wap3 psk without problem on 2.4 and 5GHz bands.
With AX devices, i've resolved all my issues by settings channels with do 20/40MHz...

dang21000

Hi, With lot of AX devices, i've found (capsman mode) a way to have a fully working without any random disconnect. The way is simple, create a master hidden ssid with channel config and a long passkey and have all others ssid as slaves. ## CHANNEL CFG /interface wifi channel add disabled=no name=mas...

dang21000

Hi,

I've set my country to France.
And the radio info for wifi2 of the ax3 say :

2GHz G:20MHz
2GHz N:20MHz 20/40MHz
2GHz AX:20MHz 20/40MHz

So no B here.... i think the product spec must be updated.

dang21000

Hi, Yes for sure, the legacy network will be on separated slave interface, not on master. But nothing found by theses devices. Because it's a temporary setup, i've get 2 linksys wrt54g able to create B only network with poor WEP/WPA sec. And i'm sure HAP ax3 is not B compatible (understandable) beca...

dang21000

I think it's better, expensive yes, but more powerfull to add a crs310 connected by sfp+ between rb/crs

dang21000

Hi, For use very very very very old devices, i need to create a wireless network on band 2.4G but with B standard (11Mbits/s). But, i've a problem to select the correct band, there only the old G standard. Like documented in the specs of HAP ax3... https://mikrotik.com/product/hap_ax3 it's say it's ...

dang21000

I've more than 20/25 ac3 still running in 7.16.2.
All are configured as standalone, not capsman here.

i've check 5 devices, and all the wifi master int (wifi1@2g/wifi2@5g) are all in RMB.

dang21000

Tu as quelle freebox ?
configurée en routeur ou pas ?
Si routeur, as tu mis en œuvre la délégation des prefix ipv6?

dang21000

Yes hacked system, for sure. At this time I've no problem identified. Always have a script that can with ssh/scp do export (with sensitive content) AND backup regularly. backup for easier restore and export for manual line by line restore/troubleshooting. This has save me since fews years ago. I've ...

dang21000

Benchmark is impossible and complicated In this case, RB5009 act as routing with lot of differents operators/ISP and speeds. The 10G connection between RB/CRS is just here to avoid losing eth@1gig and because i had a lot of 10GB sfp. All theses remotes sites are connected with a WG site2site between...

dang21000

I've the same setup in personnal usage. Both are behind a french ISP box, acting as router with 1 ipv4 addr and allow 8 ipv6 subnet to be "prefix delegation". For ipv4, "dmz" is set to the "wan" mkt addr and, it's a classic setup with nat masquerade, etc..., it's just F...

dang21000

I think, it's better to have separated roles.... RB must only be wired router.
CRS for wired switching and HAP for wireless.

Maybe a newer RB with all ports @ 2.5G and a second SFP insteed useless USB.

And a real standard POE IN @ 48v

dang21000

I use CRS310 8G connected with fiber SFP+@10G in small remote sites, and for biggers, i use CRS326.

dang21000

Hi,

Or just, the config profile applied, as a "%" var for naming....
That hard to debug, cross info between capsman and few caps... ouch !

I don't understand why, on capsman are named with provisionning naming patterns and this name is not used on caps. There no sense

dang21000

Like logs, see vlans ports members are hard ; long line content must be more readable.

dang21000

HI, For this main reason about the ridiculous 16MB flash, i avoid theses. And for backup config, i always theses two commands and after, trough scp, i get theses files : [*] /system/backup/save dont-encrypt=yes name=xxx.backup [*] /export show-sensitive file=xxx.rsc This allow with the .backup to re...

dang21000

And logs are still unreadable due to the online format

Why theme don't simple use the OS default interface ...? like all apps

dang21000

After few hours of use this b12 to manage multiples devices at the same time on a laptop (14p full hd), the right-bar lost lot of display content/space compared to 3.4x. And its worst when comparing two dev by puting 2 winbox side2side. And if toggling theses 2 winbox up/down mode, its hard with lon...

dang21000

Yes, this can a real good product/idea/serie.
I've already deployed in some far sites, one rb5009 and a crs310 both on a shelf on the small rack.
An other good idea, is a PSU with this format with multiple output, like 4/6 outputs 24V/48V @ 2A each

dang21000

Hi,

Juts on question, why create more than one bridge ?

dang21000

Is it normal on RB5009 to have this value as no ?

                                 
[admmikrotik@router70a] > /system/device-mode/print 
                 mode: advanced     
           ......
          routerboard: no

dang21000

WebUI is nice.
Dark mode is pleanned ?

/graphs need a relooking too.

dang21000

Thank you, for your answer, i've still not choose furthers switches, i don't know if i'll buy mkt or other brand dev.

dang21000

Thank you for your answer.... so it's less expansive to use dedicated non-poe switches for mkt devices and poe for the other devs

dang21000

I'use theses commands to bootstrap every rb5009 i deploy ; the goal is to remove everything and have a dedicated outofband eth for mgmt (and this one is securised after). And now, i lost a time with the fuc___g default password. After that, i use the newly created outofband mgmt port and inject the ...

dang21000

Hi,

I've to replace some distribution switches with connected AX2/AX3/AC2/AC3 from their eth1 (poe-in@24V capable).
At this time, all theses HAP are powered by external PSU.

What happen if they are connected to switches that deliver poe-out@48V (standard).... ?
They'll burn in fire ?

dang21000

try clean contact with alcohol... but maybe it's time to change

dang21000

Theses menus are too big... we have to move too much for same thing than in v3x...

dang21000

I've similar setup in multiples sites : RB5009 as main router and AX3/AX2 and/or AC3/AC2.

But no capsman at this time due to AC doesn't support vlan from datapath since v7.14 ; so it's more easier to handle manual cfg for all ap models manualy, AC replacment is planned for next year.

dang21000

Hi, I've a similar setup. 5G/1G fiber connection, with a operator box (freebox pop in france) with 2.5G interface, so directly on the eth1. My lan's are on the other rb5009 ports, AP are trunked and access mode for the other legaxy parts. I'm plannng to upgrade the operator by upgrading my offer and...

dang21000

Yes, tabs are the best than lot of collapse

dang21000

just download it from mkt website, unzip and run the binary.

dang21000

For me, USB port for storage is useless, it's not necessary for mkt devices, it's a feature like a box in recycled stuff. Not necessary for most uses cases. Good routing/firewall performance with wan at more than 2/3 GBits/s for dual stack ipv4/ipv6, use the RB5009. If you plan to use more internals...

dang21000

The main problem is not the new advanced/enterprise device mode.
But the change confirmation by button press/power lost.

Security reason ? remotely we can change/break everything else... but not that ?

dang21000

Hi,

I've just tested the beta 2 of 7.17, it work like a charm on a lab hapax3.
It's easy to identified the auth method used by stations.

I'll planned wpa2-psk "progressive kill" fews weeks after 7.17 release.

Thank you every one.

dang21000

You're right, i've not see this part in doc ; but read in the next section : List of available properties (table) "container, fetch, scheduler, traffic-gen, ipsec, pptp, smb, l2tp, proxy, sniffer, zerotier, bandwidth-test, email, hotspot, romon, socks, partitions, downgrade, bootloader. (yes | ...

dang21000

Bug with device-mode and switch between partitions. Like expected in doc (https://help.mikrotik.com/docs/display/ROS/Device-mode) advanced mode should have partition to yes. [admmikrotik@ap70a] > /partitions/activate part0 failure: not allowed by device-mode [admmikrotik@ap70a] > /partitions/print F...

dang21000

Does the vlan interface list assignment in bridge can help the new behavior with qcomac driver that doesn't support vlan in data path..?

dang21000

It's for this reason i'm search the stations count per auth method.

dang21000

Yes, it's necessary to have a count usage of wpa2 to ensure i'll not lost clients... removing wpa2 must be done with clients, communication, planned date, etc...

dang21000

bridge - added interface-list support for VLAN : the best features!!!!

This will simplify VLAN tables!thank you mikrotik.

dang21000

Hi, Thank you for all your replies. I Don't want drugs... You're stupid or what? I manage lot of ap and ssid with thousands maybe more stations. wpa2 is used for legacy and I just want to identify an count during a month more/less the amount of clients still using wpa2. The goal is to to only use wp...

dang21000

I've ordered 2 units of CRS310 8G 2S. I also replaced by SFP+ BaseT adapter for SFP+ SR, heat is reduced in theses switches and for RB5009.

And yes, the integrated fan isn't quiet. I've replaced theses by noctua NF-A4x20 PWM for less tha 15€/fan.
Fater that, noise is really reduced for few euros.

dang21000

Hi, I've setup my security profile for use passphrase. I enable both wpa2 and wpa3 psk like this : /interface wifi security set .... authentication-types=wpa2-psk,wpa3-psk passphrase="Bienvenue" I If i see registered clients in the "/interface/wifi/registration-table", how to kno...

dang21000

I think it's a good idea to set "/system routerboard settings set auto-upgrade=yes" for more automation on upgrade process.

dang21000

Feature request : add connection to the device status... and don't close immediately winbox when connection is lost between winbox and device.

dang21000

Linux is not a problem for stability.
But systems must be often tested to ensure their working like expected ; Each months i switchover/switchback or following case, takeover/getback systems. This prevent bad surprise when a real problem appear.

dang21000

Hi, I use 2 RB5009 units for WG site2site and roadwarrior. I have to put this tu prevent wg traffic be not fastracked... and now i've about 200/300 Mbits/s between both sites. example only for one side : /ip firewall raw add action=accept chain=prerouting comment="remote prevent fasttrack"...

dang21000

I never get too long uptime, because i've manually scheduled systems reboot and switch between master/slave units to ensure everything is working like expected.

dang21000

Features Request : In interfaces window : * add one tab per interfaces type, at this time there only a limited type, no ipipv6, no gre6, no eoip6 tab * separate interfaces lists in a separate window, like done with switch content now splitted in 4 menus/4window * separate detect-internet feature in ...

dang21000

You can use every Mikrotik product running RouterOS. interfaces speed ? interface type ? vlan usage ? routing protocols ? routing speed required ? nat speed required ? poe, no poe ? wifi integrated, no wifi integrated ? want lot of firewalling rules ? handle ipv4 and/or ipv6 ? vpn site2site ? vpn ro...

dang21000

Hi, Yes i agree, it's not acceptable to ask customer press a fu... buttton to manage device. It's a pseudo/fake security reason from mikrotik. Imagine with the new device mode coming in 7.17 if a feature must be toggle state for get all needed function like before this future upgrade. So, i have ena...

dang21000

This is a fu__ng function the need to press a button to manage device mode features.
It's very fun with remote site at fews hundreds/thousands kilometers.

How this new device mode will be handled with upgrade/downgrade OR partitions switch with differents versions ?

dang21000

Features request : make log message display as a "textarea" instead a long, very long line...

dang21000

Is it planned to manage multiple devices on the same window with tabs (one dev per tab, like firefox) ?

dang21000

Never trust, yes!
like ip dns adlist

You should mirror check everytime

dang21000

And interface can have multiple tagged vlan and ONLY ONE untagged vlan.

dang21000

An other most problematic between AC and AX is there order for wifi interface 2 znd 5 ghz.

I must maintain 2 bootstraps conf for both generations AC and AX devices.

dang21000

If you use CAPsMAN, the main difference is the datapath config.
AC3/2 don't support VLANID from datapath
AX3/2 support VLANID from datapath

I'm planned to replace all my AC devices with AX for easier config management.

dang21000

Hi,
I've already setup AC3 with SMA extension cable, but not 3m, juste 1m. No problem since few years now.

dang21000

Very nice ! Design is beautiful.

Can you add :
* the escape key behavior like v3x
* more options from right click
* confirmation for delete with the bottom button on the list, like the one at the left of a element box
* a way to enable only when necessary the drag/drop to prevent wrong actions

dang21000

@dang21000:
viewtopic.php?t=207040

Thank you

dang21000

Hi, Strange thing on 7.15.3 with user active and logout. Here, user "promtheus" via unknow must be "rest-api" ; display well on 7.16rc2. But no way to request logout with always this error. [admmikrotik@router50] > /user/active/print Columns: WHEN, NAME, ADDRESS, VIA # WHEN NAME ...

dang21000

Maybe because you kill icmp traffic... and without icmp, nothing work.

dang21000

The most complicated is identify and maintain a list of destination for gaming. Technicaly, it's Rules Routing (PBR) and routeros has no problem to do that. An other approach can be use the desination port 80/443tcp to mark-route them and add a routing rules that call a specific routing tables to us...

dang21000

Hi,

Try to regenerate your SSH host keys in rsa/2k.

I've had some strangers behaviors on a hap ac3 with rsa/4k and with rsa/8k on RB5009.
But at this time i was running 7.10, maybe 7.11... i don't remember.

At this time, i've switched to ed25519 since 7.15 and don't see any problem.

dang21000

Hi, I've create the following script used to populate DNS server with DHCPv4 leases, it's very simple and work well. It simple remove all previous DNS entries (identified by a comment) and for each leases, create one type A with ipaddr. DHCPv4 server instance is configured with this command in the s...

dang21000

Take the time to read and understand the doc about bridging and spanning tree. I've just do this few days ago because, like you i don't understood what's happened too. After reading everything, i've set STP like recommanded for my setup, bridge priority, set few bridge port's parameters and enable M...

dang21000

Hi,

I only use my HAPax3 device as AP, not router.
Since 2/3 weeks, i've removed wpa3 (before wap2 and wp3 were allowed) from security profiles, no more problems.

dang21000

Disabling a entry in /ip/dns/addlist don't freeup dns cache size. I'm running rc1 on two rb5009. [admmikrotik@router70] /ip/dns> adlist/print Flags: X - disabled 0 url="https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts" ssl-verify=no match-count=317 name-count=161549 [admmik...

dang21000

Hi, I've the same setup. But i've fixed IPv4/IPv6 addresses everywhere. That's not a problem with dyndns (script) or /ip cloud function by mikrotik (it's a dyndns like). I've setup fews wireguard tunnels between each sites like : 1<-->2 2<-->3 3<-->1 So each site has two tunnel and has route for acc...

dang21000

use an old cable cat 3... ? and connect only 2 pairs

dang21000

Hi, I have similar situation. Mains routers are RB5009 and AP are AX3 and AC3. At this time, no more money to buy mkt switches with a good poe backend. So i use POE injecter (foolow link here) designed to provide 24V and gigabit. This is possible because my trunk links for AP are ETH1 with allow POE...

dang21000

Hi

Does your fritzbox allow prefix delegation ?

dang21000

Maybe a server like an R430/R440 with 10GBE cards ? and a mkt licence...

dang21000

For me, the worst features isn't a random default password, only used for device first init and can be stored in a CMDB.

I HATE the device mode settings why need to press a fucking button... can't be done remotely and easy !!!

dang21000

Disabling wpa3-psk and use only wpa2-psk is an interesting idea. Let's go and wait fews days....

dang21000

Create a static dns entry that catch all fb/yt dns name and return 127.0.0.1 I do block dns from lans to wan. Only resolvers is mkt. the only way to bypass is for client use it's own hosts file with real ip. So i added forward deny rules with dst address list that contains identified dns names. I've...

dang21000

With Linux and wine, there is a trick for create a fake dark mode.
and yes.... Winbox is less ergonomic than windows 95

dang21000

Endpoint port configured on client isnt the same in the wireguard1 interface and input filter rule.
And put conf in CODE, it's more easy to read.

dang21000

Hi, same behavior about reselect interval

dang21000

Hi, I use 4 HAP devices running 7.15.2 as single (no capsman) access-point ; 2 HAP AX3 and 2 HAP AC3. All use the same config except interface order AND bands. At this time no performances issue with HAP AC3 devices. Under HAP AX3 devices, sometimes wireless disconnect and reconnect after less than ...

dang21000

With a hotgun soldering station, it can be easy to replace the chip

dang21000

A quick example /ip firewall filter # first knock on 61910/tcp add action=add-src-to-address-list address-list=mgmt_knocking_1 address-list-timeout=1m chain=input comment="mark remote admin port knocking 1" dst-port=61910 in-interface-list=wan limit=\ 1,1:packet log=yes log-prefix=P_KNOCK_...

dang21000

Hi, I use the same thing for remote and emergency access only since many years. And love to have an easier way.... but not a problem and i also use knoking for emergency access not only from wan, but on guests subnets.... i also place rules on special chains to easy manage them instead input. You ca...

dang21000

I use it on hap ax3 with USB key inside. I use cli for everything and I don't download image from the router. I pull from my pc, save it as img file and send it to the USB key through scp. After I create a new container without start it. It take few minutes to be ready. When everything is fine, I st...

dang21000

Hi,

Yes that's a dream to have dark mode on winbox.

dang21000

Hi,

I think you should try wireguard instead ovpn. I've no tuto and don't find my old cfg because I ve switched since 2years or more.

Performances are for my usage better than before in site2site with fiber connection.

dang21000

7.9rc2 working on ax2 without any issue

Hi.

For me, FastTrack counters stay at zero on hap_ax3. Since 7.8.
On a rb2011 everything is OK with a similar config.

dang21000

Hi,

Repartition from 1 to 2 still not work if there container and usbkey (hap ax3).

dang21000

Hi, I have 2 HAP AX3 devices running router OS 7.8 and container & wifiwave2 packages. - one partition (128MB) with 35% used space so more than 90MB free - container enabled mode - one USB key in ext4 for container content : /container mounts add dst=/etc/pihole name=pihole_etc src=/usb1-part1/p...

Search found 104 matches