MikroTik

PhilipLykov

I made a rule in NAT with the same parameters as in Filter. But packet rate in NAT rule is almost not moving the total is also in thousands times less than in filter and in out interface in general. It seems that NAT counter is not count packets from established connections. Is it true? I use 6.43.4...

PhilipLykov

PhilipLykov hi,

Could you please explain how do you solve the problem?
I have the same problem when I clear crypto ipsec peer, ASA torn down the tunnel but MK keep the SPI and DPD is not working.

Sorry, but it still doesn't work fine.
Mikrotik has too much bugs and very bad support.

PhilipLykov

And we have no methods to exclude a network from the blackhole rule because we cannot create a new routing rule without GW address (what GW on IPSec tunnel?). Use your default GW in your new routing rules (to exclude specific ranges from the blackhole). Any GW that will direct packets out of the in...

PhilipLykov

It should not, based on your vision of it.

How to manage our situation? How to make an exclusion from the routing table for IPSec policy?

PhilipLykov

Network A: 192.168.20.0/24 Network B: 192.168.30.0/24 Network C: 192.168.40.0/30 Network A <-> Router A (192.168.40.1) <-> (192.168.40.2) Router B <-> Network B On both routers we have an RFC required blackhole for private addresses (including 192.168.0.0/16) with metric 100, and default GW with met...

PhilipLykov

After upgrade to 6.6 version all PPTP settings was cleared. This is a huge problem for me today.

Mikrotik: you will lose all your clients if you will not invest in quality assurance of your software.

PhilipLykov

After upgrade to 6.2 on my RB751U-2HnD all WiFi troubles come back. I have two macbook pro, two iPads and two iPhones. At least two iPads experience the problem: every few minutes WiFi is freezing on it, it appears as connected but no replies from MKTK goes back to iPad. Preamble is Long and Cipher...

PhilipLykov

After upgrade to 6.2 on my RB751U-2HnD all WiFi troubles come back. I have two macbook pro, two iPads and two iPhones. At least two iPads experience the problem: every few minutes WiFi is freezing on it, it appears as connected but no replies from MKTK goes back to iPad. Preamble is Long and Cipher ...

PhilipLykov

need more details, IPSec did not receive any changes that would brake that. try to enable debug logs on RouterOS and see what is happening. IPSec logs or debug? debug ipsec logs. "ipsec,debug" is what you have to add. above shows incorrect configuration and is not supposed to work. Why is...

PhilipLykov

Logging doesn't work also! [admin@ITSC_MKTK] > system logging print Flags: X - disabled, I - invalid, * - default # TOPICS ACTION PREFIX 0 * info disk 1 * error disk 2 * warning disk 3 * critical echo 4 firewall disk 5 ipsec disk IPSEC_ 6 debug disk DEBUG_ No new records in the log... I find out th...

PhilipLykov

Logging doesn't work also! [admin@ITSC_MKTK] > system logging print Flags: X - disabled, I - invalid, * - default # TOPICS ACTION PREFIX 0 * info disk 1 * error disk 2 * warning disk 3 * critical echo 4 firewall disk 5 ipsec disk IPSEC_ 6 debug disk DEBUG_ No new records in the log...

PhilipLykov

need more details, IPSec did not receive any changes that would brake that.

try to enable debug logs on RouterOS and see what is happening.

IPSec logs or debug?

PhilipLykov

URGENT!
Where to take 6.0 in order to downgrade?
We have upgraded RB1100AHx2.

PhilipLykov

IPSec Cisco - Mikrotik stopped working after upgrade from 6.0 to 6.1.
Guys, are you really don't test your firmwares?

PhilipLykov

Hm, I believe that RC is not supported. Am I wrong?

PhilipLykov

Hey guys! It's a real problem. So nobody else has this problem?

PhilipLykov

Before upgrade to 6.0 RC (we done it on rc9) everything was fine with this mangles and SMTP traffic.

PhilipLykov

Additional information: It can be MSS Adjustment trouble or Clear DF trouble. We have MSS Adjustment which change MSS to 1400 where TCP with SYN flag and which has current MSS other than 0-1400. Also we have Clear DF for this tunnels (IP Tunnel over IP Sec to Cisco router). When both rules enabled S...

PhilipLykov

It seems that Clear DF settings doesn't work on RouterOS 6.0 rc 11.

PhilipLykov

RESOLVED: "We cannot ping host, then we make ARP ping, then we can ping that host for some time." The source of problem is DHCP-snooping on HP ProCurve switch. Why does it work in such manner I don't know, because there is no ip source-lockdown enabled and DHCP snooping should be passive. ...

PhilipLykov

I checked: there are all right.
I find another problem: when I ping from ip address of Mikrotik - there is no answer, but when I ping from other IP (client behind Mikrotik on other IP network) - everything works fine. May be there is a problem with ARP answers from Mikrotik.

PhilipLykov

I suppose that problem may be in switch, but we have HP ProCurve switches with limited management functionality. All what I can see there is mac address table, and there are nothing wrong.

PhilipLykov

Then it works. Also mikrotik reboot helps. But why?

PhilipLykov

I have all described problems with ARP on RC9:
http://forum.mikrotik.com/viewtopic.php?f=2&t=69748

PhilipLykov

It seems that I'm not alone:
http://forum.mikrotik.com/viewtopic.php?f=2&t=69748

PhilipLykov

I found that Mikrotik work inadequate with ARP: there is ARP enabled in the interface settings, we ping from Mikrotik another device, ARP record creates on Mikrotik, ping doesn't work, we send ARP ping -> first packed without reply, second and all other with normal reply, then all communication work...

PhilipLykov

We have interface with ARP reply-only, DHCP server which issue static-only addresses. Also we have static ARP records for these addresses. But this combination doesn't work as expected: after restart of Mikrotik no ping to devices, but when we delete static record, change ARP type to enable on inter...

PhilipLykov

MAC based access control is not a solution because MAC address can be easily changed.

PhilipLykov

I use only AES from the beginning and these trouble was with iOS 4, 5 and 6 for all Apple devices (MacBookPro, iPad 2, iPhone 3Gs/4). So it's not a problem within iOS 6 or iPhone 6 at me. But this problem appears at long WiFi usage only. In my scenario - iPad 90% of the day connected to AP and use W...

PhilipLykov

Hi,
Actually no workarounds was mentioned. And my iPads 2 and iPhones 4 still lost connection every few minutes.

PhilipLykov

Sorry, but the problem still persist for at least two my iPads and one iPhone. You write about a bug in the MacOS but I don't have that problem with WPA black password. Is there any way to discover what is going on in the WiFi in that time when all my devices believe they are connected but it's no so?

PhilipLykov

Now it works fine. Thank you!

PhilipLykov

I enabled both WPA and WPA2. The situation is a same. After few hours of IDLE one of my iPads see connection but cannot even answer to ARP request. I see that Mikrotik update his last-activity timer for this item, I saw an ARP request in that time which ask who has 192.168.111.253. I see that Mikrot...

PhilipLykov

You are right. It happens on small network outages only, 1-5 seconds. I have only one policy for this host so I suppose that "unique" level is unnecessary. I will post logs in few hours.

PhilipLykov

Here is my config: ------------------------- [root@mktk] > /export compact # oct/07/2012 16:14:19 by RouterOS 5.20 # software id = * # /interface wireless set 0 arp=reply-only band=2ghz-b/g/n default-authentication=no default-forwarding=no dfs-mode=no-radar-detect disabled=no disconnect-timeout=10s ...

PhilipLykov

I have 5 Mikrotik devices and all of them should connect with IPSEC to Cisco 2811. Everything work fine but when the network connection between these devices disappear for few seconds they cannot automatically reconnect IPSEC. It seems that MIkrotik or Cisco made a new SPI but the second device try ...

PhilipLykov

Now I use 5.20. So you believe that older RouterOS version is better, isn't it?

PhilipLykov

I have 2 iPhones, 2 iPads, 2 MacBookPro in my home and one PC. I tried to use TP-Link, Linksys and now Mikrotik devices as WiFi AP and always have the following problem: After some time of work every Apple device lost connection with AP on IP level and there is no such problem with PC at all. The co...

PhilipLykov

Yes, I know, but it seems that Established Connections rule should be beyond the Connection Limit because it cannot calculate all established connections then. In any case there is should be some kind of advanced documentation which will describe such things.

PhilipLykov

Hello,

I cannot understand well the principle of work the "Connection Limit" rule in the Firewall/Filter. Should it be placed above or beyond the rule which allow all already established connections?

PhilipLykov

Hello, In my scenario all workstations use DHCP from Mikrotik and there is ARP for Leases. But a few devices has static address or address where I made ARP static on Mikrotik. In this case when I switch ARP mode on interface (VLAN) from "enabled" to "reply only" mikrotik cannot p...

PhilipLykov

Hello, What is the right way to make one 10 ports switch from RB1100? I think to include ports 5 and 10 in the bridge. Some ports should be multi VLANs (trunk port) and some should be single VLAN (access port). And I have to connect L2 part to L3 part on every VLAN. Questions: 1. Will it work? 2. Ar...

PhilipLykov

Hello, I changed allowed IP address for user and forget to change allowed address for client connection within server bindings. So now when I connect from one address I receive an error that this user is not allowed from this address and when I use allowed address I receive an error Connection Close...

PhilipLykov

I really can't understand the logic why probes stop graphs when Error function gives anything. For example: I have OID which gives me the average DB query execution time and when it get above 1000ms I have to inform technical specialist but in any case the engineer should know to which level this ti...

PhilipLykov

Thank you Lebowsky!

PhilipLykov

We have OID which gives us: "chain=2,call=0" where 2 and 0 are variables. How can we take this values (2 and 0) in order to use for graphing from this OID?

PhilipLykov

Hello! I have to monitor few different linux systems with Yate and Asterisk on them. I need to make charts of the used VoIP channels. Unfortunately Asterisk has very limited SNMP functionality (it can give only total number of calls, but I need to know the external calls) and Yate don't have SNMP at...

PhilipLykov

Hello!
This function works for the whole word in the value only. We need to find the strings which contain some word (but the whole string is longer) and count the quontity of such strings. Can we use any wildcards or maybe you know another functions which can do it?

Search found 48 matches