MikroTik

Mplsguy

I'm having issues with routes injected from the controller - are those supported yet? The injected route below (10.255.128.0/19) is inactive. I've set allow global and this works on other non-MikroTik ZT endpoints. Any ideas? You are right, this is already fixed an will be available in next release.

Mplsguy

No. In order to obtain any PMKID attacker must get to key handshake phase that happens only after successful 802.11 association. If client is not in access-list, it is refused 802.11 association and AP does not even go to key handshake phase. So in this scenario attacker won't be able to obtain any...

Mplsguy

So in this scenario: "default-authentication=no" is set for access point corresponding "/interface wireless security-profiles" has wpa-pre-shared-key and wpa2-pre-shared-key set to some value (e.g. "wpa-pre-shared-key=Password123 wpa2-pre-shared-key=Password123") "...

Mplsguy

Are there any benefits for sending PMKID for non-EAP networks ( some people claim that there aren't)? Well, there are no benefits, because using PMKID allows to skip authentication stage, which is non-existent when PSK is used anyway. The only reason to include PMKID when PSK is used is because 802...

Mplsguy

Basically, is it OK to understand Routerboard with AP function as target? If you are using the CAPsMAN function with Rotuerboard without AP function, is this Routerboard also applicable? Actually it is station mode device that is primary target and needs to be fixed. RouterOS APs in AP mode (either...

Mplsguy

AP does not "check" the passphrase, because client never sends it to AP. AP uses known passphrase in calculations and by means of those checks if client knows the same passphrase. Basically 802.11 PSK is an algorithm that allows both parties to confirm that other party (and this applies to...

Mplsguy

If the route to the TE endpoint is via the TE tunnel then surely the TE will would never be established as the route to the TE endpoint would be unreachable? Not necessarily - like I said, if you use at least partially specified path for TE tunnel, any router in path does not need to have route to ...

Mplsguy

Well, targeted LDP will use whatever transport to remote peer is available - routed or LSP. For VPLS to use TE, VPLS endpoint address must match that of TE endpoint. For targeted LDP to also use TE tunnel you would need VPLS endpoint address to which targeted LDP session will be established be route...

Mplsguy

No, this is not necessary, endpoints will happily use TCP/UDP over regular IP for LDP session.

Mplsguy

LDP uses UDP as its transport. There are 2 modes for LDP - regular, where LDP speaker sends multicast hellos on its interfaces and establishes sessions with directly attached neighbors, and targeted LDP - where LDP speaker sends hellos to specific IP address and establishes session with LDP speaker ...

Mplsguy

VPLS uses LSP to remote address. It can either be matching TE tunnel (with same address) or LSP established by LDP - gateway from most specific route to remote address has advertised label. So the answer to your question is - yes, remote address of VPLS must match that of TE tunnel for VPLS to use t...

Mplsguy

No, you just enable LDP, without interfaces. Adding LDP interfaces means that router will start sending multicast hellos on that interface. VPLS uses targeted LDP - it sends hellos to specific IP address.

Mplsguy

You are correct - the rest of network wont see or care about VPLS, but tunnel endpoints need to exchange labels, so that each knows what label other uses for particular tunnel, so if you use LDP for VPLS signalling, LDP must be enabled only on endpoints not on all routers in path.

Mplsguy

Unfortunately VPLS needs a way to exchange tunnel labels with remote peer. The only more simple way would be to manage labels manually - allocate label for VPLS interface on each router and enter it in remote peer manually. If there is serious enough reason why you need such a feature, we can consid...

Mplsguy

Indeed you can have VPLS tunnel working over LSP established by TE. The thing is that for "simple" VPLS tunnel you need LDP (it works in "targeted" mode, no need to add interfaces) to establish VPLS itself. If you do BGP based VPLS you can work w/o LDP.

Mplsguy

Unfortunately importing CA certificate with ability to sign certificates was not possible, like you explain. This was disabled deliberately so that user does not start signing certificates with CA on multiple devices that would produce conflicting sequence numbers. This has been relaxed so that you ...

Mplsguy

With default configuration LDP does not distribute binding for default route, so if you do not have more specific to your VPLS endpoint, it will not work - I suspect this is the problem in the original report. Note that using default route for reaching VPLS endpoint and distributing binding for defa...

Mplsguy

As far as I understand, labels are correct. Pay attention to 'G' in appropriate local binding on CCR2 - it says that this is binding for "gateway route": 5 ADG 2.2.2.0/29 19 41.79.23.1:0 Route to 2.2.2.0/29 has gateway: /ip route add dst-address=2.2.2.0/29 gateway=1.1.1.2 So CCR2 can actua...

Mplsguy

Auto-generated CA certificate on CAPsMAN is quick and dirty way to get you up and running with certificates. It would be better to implement more advanced PKI for devices in your authority, e.g: - generate root CA certificate, keep it somewhere safe, not on any CAPsMAN - issue CA certificate signed ...

Mplsguy

Just forget about padding and fragmentation, the capture you see has nothing to do with this (even more - according to TZSP spec any tagged fields, including padding, can NOT follow TAG_END). Everything is really simple, please study relevant specs carefully - TZSP, Ethernet, IP. You can use Wiresha...

Mplsguy

As you see from TZSP header, encapsulation type is ethernet (0x00 0x01), so what follows TZSP header is ethernet packet that starts with ethernet header. These 0s are ethernet source and destination addresses. This can happen (ethernet source and destination set to all 0s) when sniffing on all inter...

Mplsguy

nv2-cell-radius setting does not affect what distance is detected for every particular client, therefore it is completely normal that detected distance (as reported on client and also in AP registration table for every connected client) stays the same no matter what this setting is set to. This sett...

Mplsguy

Just to clarify - ht-ampdu-priorities setting only specifies frame priorities for which AMPDU usage will get negotiated, it does not itself enable any assigning of priorities (classifying) and does not make interface act in different way on packets with different priorities, just as explained in: ht...

Mplsguy

Probably MPLS LSP is "broken" on area border router. There is no limitation for VPLS to work between routers in different areas - actually MPLS (and therefore VPLS) does not care what IGP is used to exchange routes. What matters is that there must be "complete" MPLS LSP between V...

Mplsguy

Please explain your setup in more detail and post config of devices (addresses, routes, routing protocol config) and traceroute results. In classic VPNv4 setup CE devices do not need VRFs (VRF is necessary only on PE routers), CE devices only need "main" routing table where routes are adde...

Mplsguy

Would this now mean that if I set my client to NV2 only this message dissapears and at the same time the scanning process for the protocols is skipped and client has an even faster change to connect to NV2 AP? (After all, AP is both with SSID and mac in the ´connect-to´ list, freq. scans is set for...

Mplsguy

What does the “ MT: no ” mean? This is cosmetic, it will say "yes" only for 802.11&nstreme routeros APs. Why “ uses TDMA, skip ”? Off course the AP uses TDAM (=NV2), so why “skip”? This is more tricky. I guess you have "wireless-protocol=nv2-nstreme-802.11" on client. Here i...

Mplsguy

If LDP adjacency is maintained fine with targeted hellos, I would say that your link is having trouble forwarding multicast packets (LDP hellos). You can check that with sniffer.

Mplsguy

Ok, thanks. Never too old to learn. So for hardening the connection it is no use. Is there any difference in choosing either the SSID classifier or the mac address in the ´connect-to´ lists? Maybe a wise idea to use both the classifiers in one ´connect-to´ rule? Pro's and con's of each of these 3 o...

Mplsguy

I set for each AP a ´connect-to´ rule with in one its SSID and the other the mac address. So for 2 AP's you'll get 4 rules. Reason: If you use mac address only and you need to change the radio of the AP (because it is broken), clients won't connect to new radio. You'll have to visit each of them. (...

Mplsguy

Well, all kinds of VPLS work over TE tunnels. Actually VPLS tunnels prefer LSP established with TE over LSP established with LDP. In your situation most likely the problem is that in order to do VPLS tunnel label exchange for Cisco BGP VPLS and static VPLS, you actually need LDP, but not for establi...

Mplsguy

From terminology standpoint ACK in 802.11 is also ARQ mechanism. In every protocol ARQ is used to achieve reliable data transmission, so the purpose is the same. The main difference between ARQ mechanism in nstreme/nv2 and 802.11 is that 802.11 basically uses Stop-and-wait ARQ , while nstreme/nv2 us...

Mplsguy

tdma-timing-offset is proportional to distance, so there is no "ideal" reading - it is approximately two times the propagation delay. AP measures this so that it can tell clients what offset to use for their transmissions - clients then subtract this offset from their target transmission t...

Mplsguy

5.x version supports station-bridge mode also for 802.11 & nstreme protocols. So you can transition in really simple way: - upgrade all devices to 5.x - on AP enable "bridge-mode", set wireless-protocol=802.11 (assuming you use 802.11) - on all clients set mode=station-bridge and wirel...

Mplsguy

Well, I can agree that RouterOS usage of term VPLS might be confusing, especially if looking from cisco perspective. In RouterOS "VPLS interface" (entity appearing in "/interface vpls" that you can use as any other network interface in your router) is what is known as "pseud...

Mplsguy

With basic rates AP says what rates every device in network must support, it simply does not accept clients that do not support all basic rates. supported rates - rates at which particular device can transmit/receive. Actual rate set used between two devices contains all rates that are in common in ...

Mplsguy

cisco-bgp-vpls implementation was indeed tested with cisco 7609. Unluckily that does not mean that it will interoperate with particular cisco router and/or IOS version. I suggest you: - enable more mpls/ldp/l2vpn debugs on cisco to help diagnose the problem - send souput file to support, made after ...

Mplsguy

You can configure k-factor and refresh-time in "/mpls traffic-eng interface" menu. Basically these parameters control how often RSVP Path and Resv messages are sent out the particular interface. You can think of it as of hello interval for OSPF. The basic idea is - refresh-time specifies h...

Mplsguy

There are no explicit limits for scan-list length, but still it is better to keep it shorter - the shorter it is, the faster full scan will complete. Indeed there is a problem with nv2 and long scan-lists that will be fixed in next version. Take into account that scan for nv2 networks takes approxim...

Mplsguy

By "managed to get it more stable" do you mean that neighbor is not "flapping" any more? This seems to be issue somehow related to OSPF. It would be very handy if you sent a few supout files to support, made with some time interval, e.g. 5min (so that some number of flaps would h...

Mplsguy

nv2 is not compatible with Airmax. nv2 is supported for all Atheros cards, except old AR5211 based, so in order to try it out it is not required to have 11n cards - just upgrade, set wireless-protocol=any on station (this will enable station to look for whatever protocol AP that is available with ap...

Mplsguy

Please contact support (refer to this topic) with info on what type of RBs you use and what ROS version, hopefully you will get testing package in the nearest future (today or tomorrow).

Mplsguy

Your help will be most handy when these features get implemented - you will be welcome to test them :). As to the interoperability testing - there has been plenty of testing with Cisco equipment, different models. I must say that there were also number of problems that had to be addressed, especiall...

Mplsguy

I am sorry to say that, but this particular "problem" has not been fixed yet due to scarce resources - it is noted and on TODO list for next batch of MPLS improvements. Probably loud and clear demand for this feature may boost its priority, but anyway - thanks for the reports. Any other re...

Mplsguy

Like I said - you have to take into account l2mtus of links that are involved in MPLS network - links over which MPLS packets are sent, no matter what MPLS application you are using, be it "simple" MPLS forwarding of IP packets or VPLS. If you intend to forward MPLS traffic (with VPLS insi...

Mplsguy

If you have your VPLS tunnel going only over wireless link (which is the case in wiki example), you do not have to worry about ethernet l2mtu - only l2mtu-s you care about are for interfaces that are involved in actual VPLS tunnel. And wireless has big enough l2mtu by default. Wiki example actually ...

Mplsguy

Does this flapping happen constantly or only occasionally? Anyway, I suggest you send supout files of both - AP and client to support with reference to this topic.

Mplsguy

From your config I understand that you are trying to establish 2 vpls tunnels, one between station1 and AP and second between station2 and AP. Is that correct? In this case please post VPLS config on AP also. Additionally - there are no any LDP bindings on station 2. This tells that most likely you ...

Mplsguy

I guess you should create as many VPLS tunnels as necessary and then use bonding for load sharing/balancing - instead of bridging ethernet with VPLS tunnel, bridge ethernet with bonding interface. Then add VPLS tunnels that traverse different paths as slaves to bonding interface.

Mplsguy

please post output of the following commands on all involved devices:

/ip address print
/ip route print
/mpls local-bindings print
/mpls remote-bindings print
/interface vpls print

Mplsguy

If you have a number of core and provider edge routers with multiple customers at each PE is it possible to specify which TE tunnel for an individual VPLS tunnel to traverse over? I'll attach a graphic to better explain my question... You can add multiple "loopback" addresses to each rout...

Mplsguy

but if use following scenario no issue host a --ether--router a--->wlan----wlan<---routerb---ether--host b It seems you do not have proper MPLS LSP established between VPLS endpoints (I guess so because it works when endpoints are directly attached). Make sure that you have LDP or TE properly confi...

Mplsguy

Any particular reason why you do not create "QinQ VLAN" directly on VPLS interface?
Kind of:

   / vlan1 - bridge(vlan1) - vlan1 \
eth- vlan2 - bridge(vlan2) - vlan2 - QinQvlan - VPLS
   \ vlan3 - bridge(vlan3) - vlan3 /

Mplsguy

Actually from RouterOS point of view there is no difference in operation for these modes (except specifying appropriate mode during PW establishment), because VLAN tagging/untagging actions described in RFC 4448 must be configured manually using bridges and VLANs. Tagged mode was added because there...

Mplsguy

There is no support for such feature currently. But this feature can be added to TODO list if there is enough demand. Please post references to any standards and other product documentation that explains this feature.

Mplsguy

From your config I understand that your VPLS endpoints are not on the same subnet (are not directly connected). In order for such a tunnel to work you need MPLS LSP between both endpoints that would transport VPLS packets. There clearly is no such LSP in your setup, because the only LDP neighbour yo...

Mplsguy

I suggest you send supout.rif file, made while you experience this issue, to support@mikrotik.com.

Mplsguy

WirelessRudy, lets do some math. Consider perfect point to point 11a link (using 54Mb rate all the time) of length zero (to factor out any issues caused by propagation delay, and yes - although it is near speed of light it still is a factor, more on this later). 1500 byte IP packet becomes 1536 byte...

Mplsguy

hello every one is there problem when don't using dynamic routing protocol when trying to setup mpls/vpls i have network with all routes configured statically and i tried to configure a vpls tunnel , for now the vpls tunnel is running but nothing forwarded throw the tunnel , I checked in the wiki a...

Mplsguy

I am looking for a guideline on what the max. real life user data throughput can be for wireless link. For normal mode (20Mhz channel) balanced link (both directions same connection rate) and no loss of packages (CCQ 100%) 50% of connection rate can be used as estimating max. total user data throug...

Mplsguy

WDS in RouterOS does indeed use 4 address frame format. But this does not mean that 2 devices will properly interoperate. The thing is that different implementations can implement establishing of connection in different ways. There is no standard for this and this is where incompatibility is possibl...

Mplsguy

OK, that can well be true. But in seeking more info and explanation we all tend to read white papers and visit MUM's to see how the guru's think it works. If they talk (and this is written down) that both are the same who am I to question? If I can't take info given in whitepapers or MT presentatio...

Mplsguy

Why status in peer still shows "a/n" while radio is in "Only-N" mode was also my question but is not cleared in this. A software bug? only-n is not really a special hardware mode. It is the same as a/n, except it does not accept legacy clients. When station connects to AP it is ...

Mplsguy

each channel is used exclusively in one direction. I understand that with Nstreme protocol we can disable CSMA and specially the ACK that sends the receiver to the transmitter. Is this true?. If the receiver ACK can't be disabled, from a legal point of view, the channel is being used as TDD (time d...

Mplsguy

I don't know what you mean by "restrict per port" (what is "port" here?), but perhaps you should look at this:
http://wiki.mikrotik.com/wiki/TE_tunnel_auto_bandwidth

Mplsguy

Sequencing is not the only purpose of control word. It can also be used for fragmentation and reassembly, and this is the main reason why RouterOS uses it. And this can hardly be considered "proprietary", because fragmentation and reassembly in RouterOS is implemented according to RFC 4623...

Mplsguy

RFC 4761 does not specify that ID block offset 0 should be considered as invalid. What VPLS NLRI says is: originator advertises that sites with IDs in range blockoffset->blockoffset+blocksize-1 should use labels labelbase->labelbase+blocksize-1. So if receiver ID fits in this range he knows what lab...

Mplsguy

VPLS tunnel uses LSP that is established with the other end of tunnel. If TE LSP is available, it is preferred. As soon as TE tunnel goes down, VPLS tunnel may select other LSP to the other end. So the key point is to ensure that there is no other LSP available. Assuming that that "other" ...

Mplsguy

So what is your opinion? How much will the load increase if the AC has 100 VPLS tunnels instead of 10? There has been some discussion on which router to make PE in this thread (though probably it does not directly apply to your case): http://forum.mikrotik.com/viewtopic.php?f=14&t=33851&p=1...

Mplsguy

A multihomed VPLS solution in general: Facility to terminate to VPLS tunnels into the same bridge without loop problems. We are planning: VPLS Customer with 2 Routers terminating same VPLS instance via 2 different last mile connections to achieve router and last mile redundancy So basically a rstp ...

Mplsguy

Do you mean some "standard" implementation for VPLS multihoming (like draft-ietf-l2vpn-vpls-multihoming) or a multihomed VPLS solution in general? Please describe your planned setup. You can set up multihomed site with redundant VPLS tunnels, but some means must be used to avoid forwarding...

Mplsguy

Thanks..As a rule of thumb, should I enable "Use explicit NULL" on all my egress routers? Only if it is necessary to receive EXP bits at the egress router (meaning - you use this information on egress router in some way). Otherwise it is not necessary and actually having penultimate hop p...

Mplsguy

Another 2 quickies: 1) Regarding "Use explicit NULL" When would I use it? Correct me if i'm wrong, would I enable "Use explicit NULL" on router R3? Assuming I want to preserve CoS http://www.doyleassociates.net/Blog/Labels/Figure2.gif In this setup you should enable it on R4 - t...

Mplsguy

Well, normally you do not need to use it. The main intention of loop detection in MPLS architecture is to have some means to survive loops when hardware is not able to do TTL decrement on forwarding (some ATM switches, perhaps). Other than that - you may want to use loop detection if you are using s...

Mplsguy

You can create static local and remote label bindings (/mpls local-bindings and /mpls remote-bindings). Static bindings "work" the same way as LDP learned ones. That is - local binding specifies the label that will be accepted and remote binding specifies the label that will be used for ou...

Mplsguy

If you want to transparently forward everything (including VLAN tagged packets) over VPLS link, you do not have to create any VLAN interfaces - simply bridge ethernet with VPLS interface.

Mplsguy

headstrong, affinity stuff has nothing to do with metrics. You can think of affinity stuff as of color labels you give to links (each bit in value telling if link has particular color label or not). Then you can make tunnel such that it only uses links that have e.g. red label ("include" p...

Mplsguy

2. Include-any This test accepts a link if the link carries any of the attributes in the set. (include-any == 0) | ((link-attr & include-any) != 0) What is the syntax for the link attributes? I do not know what to type after the below?? These settings are unsigned 32 bit numbers, so any number ...

Mplsguy

Please could you explain the 3 affinity settings: affinity-include, affinity-exclude, affinity-any? I tried searching but found no material on it. See RFC 3209, section 4.7.4. "Resource Affinity Procedures" - it explains how these settings are matched against tunnel setting. I have left t...

Mplsguy

Thanks again I have a wierd situation regarding a TE tunnel between two sites. VPLS works, so does BGP peering, aswell as IP routing between the loopback ips. But I cannot get the TE tunnel to come up with "use-cspf=no" and also tried "use-cspf=yes" Would this be an OSPF issue? ...

Mplsguy

Problem with CSPF has been confirmed and will be fixed in next release. Thanks for pointing out!

Mplsguy

Two first traceroutes suggest that regular routing in your setup is somehow going asymmetrically. Please post routing tables of R3,R4 and R5.

Mplsguy

Would configuring a static secondary path improve the time taken to bring the TE tunnel back up should the dynamic primary path become impossible? Upon failure of primary-path (and this does not exactly mean data forwarding disruption, but failure of RSVP tunnel, which takes time to detect), primar...

Mplsguy

It is not necessary, because primary path is fine - tunnel establishes using it. The purpose of secondary paths is to provide alternative for tunnel if establishing tunnel using primary path is impossible.

Mplsguy

We migrate our network from OSPF/EOIP to a MPLS/VPLS solution seeking for a better QOS management. The issue it’s not on ingress routers. The proper set on EXP field it’s done at the bridge filters. We set the exp 7 for voice and 0 for the other traffic. That set is forward to the core router but I...

Mplsguy

This is how it should be - it is mandatory for VPLS to work to have complete, "uninterrupted" LSP between VPLS endpoints, because only VPLS endpoints know how to interpret VPLS label (second label in label stack). LDP establishes LSP for each specific prefix, so LSP reaches to the last hop...

Mplsguy

I created a TE tunnel and did a ping over the TE interface but the traffic did not come back over the same TE interface...ie it was sending over the TE tunnel but not receiving TE tunnels are not bidirectional. Pay attention to first paragraph of http://wiki.mikrotik.com/wiki/MPLS_TE_Tunnels#Forwar...

Mplsguy

I suppose that could work to a certain degree but certainly not effective enough for a large network... I have an idea: Lets say I have a routed network that carries both VOIP and DATA traffic What about creating a pptp tunnel between each highsite with the IP range 10.0.0.1/24 I then run OSPF over...

Mplsguy

So if link is saturated and multiple ACs have packets waiting for transmit, AC that has higher probability to transmit will in the end get more bandwidth (provided that packet sizes in ACs are the same). Thanks again for the info, could you please alloborate at what you mean by "provided that ...

Mplsguy

hmmm ok thanks for clearing that up... With WMM, doesn't it just give the higher priority traffic "better" access category? So if the link is saturated then WMM doesn't really make much of a benefit?? or am I wrong? It does put traffic in better access category. "Better" for AC ...

Mplsguy

One of my PCI Gigabit NICs reports 1600 L2 MTU. I don't know the chipset, but the card is D-Link DGE-528T H/W Ver: A2. I guess it is RealTek 8169S. Sorry, I misinterpreted hedeles question. It is Intel cards that definitely do not "support" l2mtu. L2 MTU is supported for RTL 8169 and VIA ...

Mplsguy

Hmmm so you saying that traffic needs to be limited at ingress....So there is absolutely no way that a MPLS router, that just acts a switching hop, can limit speeds for MPLS traffic? or give higher bandwidth to a specific tunnel? There must be a way somehow You are correct - there is no way for a &...

Mplsguy

Thanks for the info mplsguy!

Can you name any gigabit ethernet cards which report L2 MTU and are supported by ROS 4.2 x86?

I am afraid only gigabit chipsets used on routerboards do report L2 MTU. So I guess the best you can do at this time is increase IP MTU.

Mplsguy

It is best to think of TE tunnels as of "accounting" feature, not rate limiting feature. When traffic is switched across tunnel, no limits are applied. In order to have "guarantee" you must properly configure you network. The rule of thumb - configure TE on core routers with prop...

Mplsguy

Basic rule is that cards not showing l2mtu can be considered having l2mtu the same as configured IP MTU (/interface set mtu=x). It is common for cards to actually "run" with l2mtu=IP MTU + 4 (for single VLAN encapsulation) or even a little bigger value. But this can not be safely assumed o...

Mplsguy

Lets say I have a wireless network and all the highsites are doing mpls packet switching ( no VPLS ), am I able to setup queues for qos? ie with mangle rules in firewall MPLS switching bypasses any firewall rules, therefore you can not use mangle. It actually is not even possible, because MPLS swit...

Mplsguy

Hi, MPLS requires at least 8 bytes overhead for the encapsulation, so that would be the minimum required for MPLS to be able to forward 1500 mtu frames. Depends on what you mean by forwarding - single label takes 4 bytes, therefore simplest MPLS forwarding requires as much of additional space as VL...

Mplsguy

You should see MPLS packets in torch - ethernet protocol used by MPLS is 0x8847. Of course, torch will not interpret packets any further (will not look for e.g. IP headers and such).

Mplsguy

Thanks for the clarity, however, I am running VPLS over LDP with an l2mtu of 1522 and the VPLS tunnels still work. Does it by default drop the PPPOE MTU to 1476? EDIT: I just did a ping test, over the pppoe over the VPLS without fragmentation, with a size of 1480 get I reply I don't know to what ex...

Mplsguy

I have wireless and ethernet links as part of my MPLS cloud but I do not have VLAN tags, so l2mtu of 1522 should be fine right? I do run pppoe over the VPLS tho Doe MPLS TE tunnels add more overhead than the 2*4= 8 mpls bytes? Like I said, you need l2mtu 1526 for VPLS forwarding 1514 byte (1500 byt...

Mplsguy

Thanks mpls guy. I have just noticed that I am using RB433 and some sites are joined via ether2 which has a max MTU 1522 compared to 1526 of ether1....I have 3x RB433 linked at some site, hence why ether2 is used Would it be advantages for me to rather use RB600's? Would I see an improvement? It de...

Mplsguy

I assume you want to avoid fragmentation. Then mpls-mtu of outgoing interface (the one over which VPLS encapsulated frames will get sent) should be set to: 1514(ethernet frame)+4(vpls control word)+8(2 labels)=1526. Note that all routers in MPLS cloud should be configured with the same mpls-mtu. Als...

Mplsguy

802.11N or MIMO technology actually takes advantage of multipath to increase throughput as well as range. So one antenna will prohibit you from engaging the full potential. Your system will effectively behave like an 802.11a system... This is not completely true - 11n has other advantages besides m...

Mplsguy

You can do it in IP firewall before PPPoE encap or in bridge firewall (by telling bridge firewall to use IP firewall for PPPoE packets) before entering VPLS tunnel. I would do it before PPPoE encap, because bridge firewall is not able to inspect encrypted PPPoE packets and that would also keep your ...

Mplsguy

Whichever you prefer/is best for your config, I guess. Probably postrouting, before packets get PPPoE encapsulated. The only requirement is that you do it before packet enters VPLS tunnel.

Mplsguy

Currently there is no feature that would display what labels are attached when packets are sent using some route. It is on TODO list. In your case - you can be pretty sure that MPLS is used if your P router does not have your VPN routes and therefore would not be able to forward traffic without MPLS.

Mplsguy

We use NStreme on all our AP's so can't utilise WMM. Any other options? Well, if you insist on doing QoS on AP (that is - QoS on ingress router is not enough), then I guess you should have your AP as PE router and use queues. Currently RouterOS does not have queue type that would prioritize based o...

Mplsguy

Depends on what QoS feature you want to implement - if you want to use WMM, then setup is rather simple - MPLS switching automatically sets up packet priority (that is later used by WMM to select access category) based on label EXP field value, see http://wiki.mikrotik.com/wiki/EXP_bit_behaviour. Yo...

Mplsguy

Thanks again mplsguy I tried the WDS setup before and it gave me issues with nstreme so I'm going to try the CPE being part of the MPLS cloud..... You must use station-wds mode on client in order to have WDS links in nstreme network. All our CPE's are mikrotik and we have control, so am I correct i...

Mplsguy

In general you are right - this setting controls if LDP distributes label binding for default route. Wether you should enable it, depends of how your routing is configured and what you use MPLS for. But you have to be careful with this setting: once label switching path is established across your ne...

Mplsguy

It is mandatory to have separate CE-PE interface in order to use multiple VRFs. There are multiple ways to achieve this (though none of them will probably be as easy as you would like) - VLANs (like you suggest), separate WDS interface for every customer (in case you use RouterOS on client side as w...

Mplsguy

No guys, in the lab everything is working perfect. Something in teh production envirnonment must be wrong. @mplsguy: l2MTU of the vpls interface should only affect when full frames are sent but not with pings. In that case the packet will never reach the mtu size limit. Ok, then I guess you simply ...

Mplsguy

hmmm... what about fragmentation?..

What about it? RouterOS VPLS pseudowires support frame fragmentation/reassembly according RFC 4623. This means, that if l2mtu of VPLS will exceed outgoing link MPLS MTU plus any space needed for VPLS+MPLS encapsulation, frame will get fragmented.

Mplsguy

You can use OSPF or you can use static routing - depends on what are the requirements and your preferences. If your policy is to allow your customer to introduce new networks and distribute routes across your core to other sites of that customer, then I guess you should use OSPF so you do not have t...

Mplsguy

use-service-tag simply changes protocol that is used for VLAN encap. In case you want to bridge VLAN tagged packets you do not need any VLAN interface at all. Most likely cause of VLAN encapsulated packets to not get bridged is l2mtu issues - e.g. VPLS interface l2mtu is only 1500 (so it can take &q...

Mplsguy

Can I use OSPF between the all the MPLS routers to distribute the LDP's and then BGP between just the PE routers for specific vrfs? or must I choose BGP or OSPF? To clarify: you must use some IGP (RIP, OSPF or even static routing) to ensure end-to-end connectivity between PE routers. Then LDP distr...

Mplsguy

If you mean distributing routes installed in VFRs between PE routers, then yes, you must use BGP.

Mplsguy

Please post relevant parts of edge router configuration - bridge, vpls, vlan. Make sure that l2mtu of VPLS interface supports sending packet with VLAN tag.

Mplsguy

After working a while I think I will not be able to transfer the customer VLAN with tag over the VPLS-tunnel because the L2MTU of RB433AH (in MPLS router mode) is to low. Is that right? Yes. L2MTU of 433 is not big enough to be able to forward VPLS frames w/o fragmentation. Is there another way to ...

Mplsguy

Yes, you are correct, in order to limit unnecessary broadcasting you should use either split horizon feature or bridge firewall.

Mplsguy

In general yes, as long as packet loss will not cause connections to get terminated, but that is only one part of the story - you also have to add PPPoE server on bridge interface and add VPLS interfaces ("the other ends" so to say) as ports to it, so that PPPoE server does not terminate c...

Mplsguy

PPPoE sessions will not necessarily go down (provided that you do not add your PPPoE server and client interfaces directly to VPLS interfaces that will go down, but instead add PPPoE to bridge) - during "reroute" you will simply experience packet loss. It depends on your PPPoE config if th...

Mplsguy

WMM does not look into frames itself (e.g. at DSCP field). In order for WMM to prioritize packets, you must set priority of packet before it enters WMM enabled wireless link, as discussed here: http://wiki.mikrotik.com/wiki/WMM#How_to_set_priority Note that VPLS terminating router does not automatic...

Mplsguy

There definitely are performance benefits, you can see migration from EoIP to VPLS example with comparison (showing 60% improvement) here: http://mum.mikrotik.com/presentations/CZ09/MPLS.pdf In order to tunnel PPPoE to central AC, you have to establish VPLS connections between APs and AC. It does no...

Mplsguy

First of all - you must make sure that your hardware does support changing l2mtu and that it supports the value you intend to set. '/interface mtu' is IP MTU. It affects IP routed packets. If you want to route jumbo frames at MPLS ingress router, then you should increase it (because packet initially...

Mplsguy

On which hop do you masquerade? And how is propagate-ttl configured on your LSRs?

Mplsguy

http://wiki.mikrotik.com/wiki/MPLSVPLS#Penultimate_hop_popping_and_traceroute_source_address is talking about missing traceroute reply from first hop. The reason discussed there should not cause any further hop replies to be lost (assuming that everything is set up properly and operational). So this...

Mplsguy

You do not have to concat everything in one string to do md5 - you can update hash part by part. Note that challenge, when converted to binary may also contain 0x0, so reffer to it by length you already know (16 bytes)! // password - null terminated password string // challenge - challenge received ...

Mplsguy

By adjusting WMM parameters you could only improve "background" traffic at the expense of higher latency and smaller throughput for your VOIP. The impact of VOIP on overall throughput of AP is caused by the fact, that VOIP uses small packets and 802.11 networks are very inefficent in handl...

Mplsguy

It is mandatory to use "loopback" address as update-source, otherwise remote router will not use proper label mapping to deliver frames to this router - it will use mapping of wrong route that may cause penultimate hop popping to happen at the wrong hop. If BGP does not establish between l...

Mplsguy

You should set your lobridge interface as BGP peer update-source so that BGP next hop is correct for VPNv4 routes. Also - you do not need multiple BGP instances, you should add all BGP peers to one instance.

Mplsguy

What exact version and packages are you using? Which routerboards and which ports are used in your setup? What is mpls-mtu setup on all routers? When you use BGP AF l2vpn-cisco, BGP distributes NLRIs created by /interface cisco-bgp-vpls, when you use BGP AF l2vpn, BGP distributes NLRIs created by /i...

Mplsguy

This particular page is a little out of date. 'vpls-id' got replaced with separate import/export-route-targets to provide more flexibility and to make MT VPLS implementation more similar to other vendors. Instead of specifying vpls-id=1:2 you now specify both - mport-route-targets=1:2 and export-rou...

Mplsguy

Currently there is no way to do that. Is there any particular reason why you need this feature?

Mplsguy

Yes, I can confirm this - this is a problem in nstreme2 interface MTU handling. Going to be fixed in one of the next releases.

Mplsguy

You can expect multiple MTU related improvements and fixes in one of future releases. Bridge interface MTU applies only to packets that are sent over bridge interface (routed over it). Normally you do not want to change that. All that currently affects max size of bridged packets is /interface MTU o...

Mplsguy

It depends on what MPLS features and applications are used. Compatibility with cisco routers gets improved all the time, so eventually you should be able to replace.

Mplsguy

The MTU for each interface is in effect when non-mpls packets are received on an interface, and the MPLS MTU is used for MPLS packets, correct? The MTU is actually about transmitting packets over interface. "/interface" MTU is for layer 3 (IP) packets - IP protocol will not send IP packet...

Mplsguy

Will setting the MPLS MTU under MPLS Interface override the MTU settings under the general tab (winbox) for the individual interfaces? They do not override each other - these are different settings and each is used for different purposes. In order to control the size of MPLS frame you only have to ...

Mplsguy

The short answer is - yes. There are multiple methods on how to implement point-to-point pseudowires (and VPLS as well). RouterOS implementation has been tested with catalyst 6500 (using RFC 4447 type 0x80 FEC). In routeros you have to add static vpls interface and specify "cisco-style=yes"...

Mplsguy

You should post your routes and LDP bindings for both B&A - most likely routing in the non-working direction is set up differently - e.g. B can only reach A over default route and you are not distributing bindings for that, or something else with route from B to A.

Mplsguy

The only thing you have to change is /mpls interface mtu (in your case - most likely to 1504, if you are not using also VLANs). VPLS will fragment packets according to it.

Mplsguy

Most likely this happens because adding VPLS interface to OSPF makes it shortest path (just one hop) to remote endpoint - therefore VPLS tunnel sends data over itself, you can confirm this by monitoring route changes. TE tunnel works because VPLS tunnel prefers TE tunnel path over path according to ...

Mplsguy

Make sure that your setup fits in MTU limits of your hardware, see http://wiki.mikrotik.com/wiki/Maximum_Transmission_Unit_on_RouterBoards Default mpls-mtu is 1508, also for VLAN interface. If packet gets labelled with 1 MPLS label and 1 VLAN tag, your hardware (routers and switches) must be able to...

Mplsguy

If you use eBGP as IGP protocol (meaning - you run it on all routers in network and do not have any other IGP protocol operating), you will not have any benefits from enabling MPLS due to how BGP learned routes are handled: 1) LDP router does not distribute labels for BGP learned routes 2) for BGP r...

Mplsguy

What do you mean by "LDP does not work through it"? LDP is completely separate protocol and although it is pretty common to use IGP routing protocols in MPLS network, it is not a requirement, you can even run LDP in statically routed network. I do not understand exactly how you use eBGP in...

Mplsguy

The problem here is that route on edge1: 0 ADC dst-address=10.10.1.0/29 pref-src=10.10.1.2 gateway=ether2.500 distance=0 scope=10 routing-mark=customer1 becomes: 0 ADb dst-address=10.10.1.0/32 gateway=198.18.255.2 recursive via 198.18.10.5 ether1 distance=200 scope=40 target-scope=30 routing-mark=cu...

Mplsguy

Please post also your routing table and bgp instance configuration. Most likely this is because you have not configured your BGP instance to redistribute-connected. In RouterOS when BGP distributes OSPF routes, local connected route, although redistributed by OSPF, is not considered OSPF route.

Mplsguy

Do you mean with "bridge between RB's" that router B in your setup is bridge (not MPLS switching router)? Please post for _all_ involved routers output of: /ip address print /ip route print /mpls ldp interface print /mpls ldp neighbor print /mpls local-binding print /mpls remote-binding pr...

Mplsguy

what is the output of: /tool traceroute 172.20.5.100 src-address=172.17.100.1 when run on 172.17.100.1? and /tool traceroute 172.17.100.1 src-address=172.20.5.100 when run on 172.20.5.100 Do you get IP connectivity over VPLS tunnel when you configure IP address for the bridges that VPLS tunnels are ...

Mplsguy

dingsingo, describe your network diagram and exact configuration - the information you provided is not enough to diagnose the problem. - Are you using LDP? - Are labels properly distributed for routes? - Is there MPLS end-to-end connectivity between VPLS tunnel endpoints? - Assuming you use static V...

Mplsguy

Most likely this is caused by bug in how CSPF interprets remaining bandwidth values in OSPF TE LSAs. This is going to be fixed in next version. Thanks for your report anyway.

Mplsguy

This problem is caused by RouterOS not supporting LDP graceful restart feature and improperly refusing to complete LDP session initialization with Juniper router reporting this feature. This problem will be fixed in next release of mpls-test. LDP graceful restart feature is on MPLS todo list.

Mplsguy

bofh,
It would be great if you could capture adjacency establishment packet exchange and send to support@mikrotik.com.

Mplsguy

anybody help here?
it's only my problem, or anybody have this problem with ROS 3.18+

This is known (old) problem. Make sure you use latest routing-test & mpls-test.

Mplsguy

So with TE tunnels I can control bandwidth reservation when more tunnels are sharing some links, but the effective traffic shaping must be done within the nodes. Is that right? TE makes sure that over any link you do not setup tunnels such that their total bandwidth (configured) exceeds link bandwi...

Mplsguy

Luca, bandwidth settings are used purely as path setup constraints - TE tunnels do not limit traffic to the specified bandwidth. It is responsibility of administrator to apply any limitations on traffic flow at ingress point, if necessary. From http://wiki.mikrotik.com/wiki/MPLS_TE_Tunnels: Note tha...

Mplsguy

If all your client devices are running RouterOS, you can use management frame protection available in wireless-test:
http://wiki.mikrotik.com/wiki/Wireless_ ... protection

Or you can use WPA and assign different preshared key for every customer.

Mplsguy

You can not establish nstreme AP-to-AP links, you have to use station-wds on one side in order to do WDS in nstreme network.

Mplsguy

Just take into account that station-pseudobridge will work for you only as long as you use IP protocol. As soon as you will start using e.g. PPPoE it will not work, because station-pseudobridge can only bridge non-IP traffic from only one mac address (only one of your clients). The proper setup woul...

Mplsguy

ropebih, you should try with latest wireless-test package as that includes improvements discussed here: http://forum.mikrotik.com/viewtopic.php?f=7&t=27302 this could help latency issue. Anyway you should be ready for latencies higher than with regular non-nstreme mode and potential jitter. Caus...

Mplsguy

One potential issue that may affect OSPF in noisy point-to-multipoint environments is the way multicasts are transmitted (OSPF hellos in this case) - when AP transmits multicast (or broadcast), it is transmitted as radio multicast without retries - if that single transmission attempt is lost, frame ...

Mplsguy

Create appropriate VLAN interface on ethernet interface where your trunk port is connected and bridge it with appropriate VPLS interface - in general the same as in wiki VPLS examples, just instead of ether used as CE-PE link, use VLAN.

Mplsguy

You sure can do frequency-monitor and scan from API. API "commands" are based on console commands, e.g. "frequency-monitor" does not have "once" parameter, therefore you have to start it and stop it over API: <<< /interface/wireless/print <<< >>> !re >>> =.id=*3 >>> =co...

Mplsguy

You only need conntrack if you wish to use any of functions that require it - NAT, matching according to connection state, and such. In the rest of cases you do not need conntrack and can disable it e.g. for performance reasons, this will not cause fragmented packets to get dropped.

Mplsguy

Hammy, it is highly possible that your problem is caused by some link in your setup not supporting the MPLS MTU that is configured (default value is 1508), can you elaborate on what type of hardware you have in path between host connecting with winbox and router? You notice this with winbox because ...

Mplsguy

Is it then safe to assume that there is no technical difference between selecting default forward on or off if using wds/bridge for interfaces? Not sure of one is slightly more efficient than the other depending on the internal path difference of the packets within MT. I've seen no difference from ...

Mplsguy

I'm not sure I understand your question completely, perhaps you could explain it with an example. In general - if your parent class is not limited, it will behave as if it was limited to full link bandwidth (because of hardware flow control - underlying network hardware will simply not take from que...

Mplsguy

The "problem" you describe is actually not a problem, but the way 802.11 devices work - CPE can only send out data with its own source mac address, therefore simple bridging at CPE will not work - sending packet out CPE wireless interface will overwrite original source mac address. There a...

Mplsguy

Order of queues applies only to process in which traffic is matched to be put in particular queue - so logically queue consists of 2 parts - "matching" part - this is where order matters, and "scheduling" part that specifies how traffic will be scheduled for transmission from que...

Mplsguy

nightstar, if sole purpose of WDS link is connecting to remote AP, it is more efficient to use station-wds, e.g. because it does not send out beacon frames like any AP mode interface does. Use wds-slave only when you also require AP functionality for interface that will be forming WDS link. As far a...

Mplsguy

The short answer is - yes, it is possible, using either technology. And probably in some other ways as well, e.g. simply by using bridging.

Mplsguy

What version and what packages are you using?

Mplsguy

Hammy, MPLS as such does not directly affect any application - be it winbox, telnet or anything else. The information you have provided about your network is not enough to figure out where the problem could be - you should start by figuring out if winbox connection gets to the router, whether respon...

Mplsguy

Issue has been identified (and hopefully fixed) with 2 or more links between the same LDP neighbors. mpls-test packages for 3.17 are available for download from location normis posted (use updated routing-test as well).

Mplsguy

zaltec, it would be great if you could send similar report as previous one to support when using these packages.

Mplsguy

zaltec, thank you for your detailed report, it was very helpful - some problems have been identified in OSPF and MPLS. Please remember that most up to date MPLS implementation is available in mpls-test and routing-test, therefore you should always be using these packages (actually "regular"...

Mplsguy

zaltec, please send supout files that are made when you experience any problems (e.g. 100% cpu usage, no traffic passing) to support.

Mplsguy

correction, i was not aware that the propagate-ttl=no is nogotiated from the ingress router downstream to all LSR's in the LSP. Actually propagate-ttl is not negotiated in any way - to have consistent behaviour across your network you have to set it up the same on all routers in MPLS cloud. At leas...

Mplsguy

You should: /interface wireless set wlan1 mode=station default-authentication=no disabled=no /interface wireless connect-list add interface=wlan1 connect=yes mac-address=<mac_of_AP> If this does not work, enable wireless,debug logs (both on AP and client) and see what is the reason of not connecting.

Mplsguy

You should use connect-list for that.

Mplsguy

You can start here: http://en.wikipedia.org/wiki/Wireless_Multimedia_Extensions http://wiki.mikrotik.com/wiki/WMM In order to have WMM "do something", you have to: 1. configure it such that WMM enabled interface can divide traffic in classes (set priority). 2. have support for WMM in clien...

Mplsguy

zaltec, when you say you can crash router with large ICMP packets do you mean fragmented (sender has MTU of e.g. 1500 and framents big ping in 2 or more packets) or in one piece (you have changed MTU on sender to be above 1500)? And which ethernet card/routerboard did you observe this on? As to issu...

Mplsguy

Please send supout.rif files from routers where you experience instability (made during instability or e.g. after unexpected reboots) to support to help track problems down faster. When configuring MPLS, there is no need to change interface MTU, because interface MTU only specifies max size of Layer...

Mplsguy

It is wrong to put station mode wireless interface in bridge (station interface will never send out data with source mac address that differs from its own). Most likely your 2.9 setup "worked" because bridge was using mac address of wlan1 as its mac address (unless specified otherwise, bri...

Mplsguy

Please explain the problem some more - what exactly do you want to achieve, current network diagram, where users are connected, where is NAT taking place.

Mplsguy

Unluckily this will not help, because this way problem will only be moved from switch to that new routerboard, as it will behave exactly the same way as switch.

Mplsguy

Even if you could create such route your setup would not work anyway, because traffic coming back from squid box (it would have destination address of client if I understand you correctly) would be routed back to squid box due to that "high priority" route. I guess you can try to make this...

Mplsguy

Yes, you can connect APs over wireless with WDS, but take into account that e.g. when sending frame from switch to client that is connected to AP3 (in setup switch-AP1-AP2-AP3) it will be sent over the same wireless channel 3 times and therefore max throughput will be 3 times lower. If that is fine,...

Mplsguy

There are several solutions that might help, but each comes with its drawbacks so you should seriously consider if its worth it - wether ability to ping client really matters, because as soon as client will start using network everything will work as expected. 1. When client roams (pings start faili...

Mplsguy

I do not think WDS is the way to go in your case, because WDS is a way how to wirelessly connect one AP with another, but this is not necessary in your case because all APs are connected over Ethernet. You should give more information about APs setup, but I assume that on APs ethernet interface is b...

Mplsguy

ForePoint, I did read the posts. And yes - your guess is right - I do have "inside knowledge on the inner workings" and my comments are based exactly on that, unluckily I do not think "exactly how it works" is going to be disclosed. I am sorry if my comments make you feel your te...

Mplsguy

Please explain what exactly do you mean by "use Class of Service". If you wonder how RouterOS MPLS implementation carries/handles priority info in MPLS frames, see: http://wiki.mikrotik.com/wiki/EXP_bit_behaviour This priority information can then be used by WMM when MPLS packets are switc...

Mplsguy

ForePoint, like I said - max-station-count really only limits number of clients that can register. If in your setup this limit is not reached, there definitely is something else that causes this. You can test it by simply disabling/enabling wireless interface - this would effectively be the same as ...

Mplsguy

gustkiller, as TE tunnels are interfaces, you can forward traffic onto them using routing (or policy routing). For this you will have to add IP address to head end of tunnel (just to enable it to be used for IP routing) and then use "gateway=<TE tunnel>" setting for route.

Mplsguy

gustkiller, I do not fully understand your problem. Are you saying that you get inconsistent traceroute results? If you are tracerouting from device connected to ingress LSR (and this device is not connected to interface forming MPLS cloud) like this: device -- R1 -- R2 -- R3 -- R4 -- R5 I can not t...

Mplsguy

gustkiller, you are right - currently there is no way to achieve this with RouterOS MPLS. If you feel this feature is important for you, submit a feature request. As to incrementing TTL before entering your MPLS cloud - always be very carefull when increasing TTL so that routing loop (even transient...

Mplsguy

ForePoint, max-station-count affects only amount of clients that are allowed to register, nothing more. So probably differences you have observed are caused by something else - number of clients registered at the moment you "tested" latency or what they were doing at that time as it all ca...

Mplsguy

HellMInd, Provided that you have properly configured host part of interface (configured host in a way that guest should have network interface - this is described step-by-step in wiki virtualization page), you should look for solution in CentOS (make sure it detects new device/loads appropriate driv...

Mplsguy

Polling algorithm has been adjusted to be more suitable for large numbers of clients and for most common traffic patterns (bursty traffic with rather low average rate). As polling is controlled entirely by AP and protocols are backwards compatible, only AP is required to be upgraded. There are two r...

Search found 227 matches