MikroTik

robertpenz

@sid5632: thx, changed it to your version

robertpenz

no, the CHR is on our own ESX in our datacenter.

robertpenz

I'm seeing on our firewalls that our test CHR is trying to connect to IP 169.254.169.254 with HTTP every few seconds (= over 250.000 connections attempts in 12h) . Google showed some old posts from 2015 where it was described as bug that will be fixed. As we're running 6.41.4, so it seems not. I did...

robertpenz

so its not possible to get from a guest down to the host?

robertpenz

What about Meta-Router feature? And Spectre is not Intel only, also ARM. https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html These vulnerabilities affect many CPUs, including those from AMD, ARM, and Intel, as well as the devices and operating systems running on them.

robertpenz

Hi! Is RouterOS (and if yes which versions) affected by the CVE-2017-14491, CVE-2017-14492, CVE-2017-14493, CVE-2017-14494, CVE-2017-14495, CVE-2017-14496, CVE-2017-13704 which where released by Google? https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html I'm asking as I fo...

robertpenz

I've reported that problem in ticket 2017020822000589, and Sergejs has acknowledged a bug with handling tagged packets and they will fix it.

robertpenz

I see the same problem with 6.37.4. It seems to be a problem on interfaces which have tagged vlans. As I see the same problem on multiple routers which are not on the same subnet it can't be a damaged NIC or wrong configured client. We've also activated reverse path filtering so its not possible tha...

robertpenz

Hi!

What is the purpose of the mode button/switch next to the USB port as seen on this image. Could not find an answer searching.

robertpenz

With userspace I meant that there is no kernel patching needed as the mikrotik kernel is heavily modified so that would be tricky to apply. A user space program with only a few dependencies should be much easier to integrate.

robertpenz

The popular German enterprise IT magazine iX did a big article about WAN optimization in their last issue (2/2016). Part of the article was testing Open Source solutions. The clear winner is SoloWAN (https://github.com/centeropenmiddleware/solowan). They did tests for cifs, nfs, https and http traff...

robertpenz

Hi! I don't understand why Mikrotik keeps DSA, its insecure (yes, also the 2048bit version), and does not support RSA. Anyway yesterday OpenSSH 7.0 has been released and DSA is not longer supported. So please move to RSA and ECC now - Thx! see also: http://it.slashdot.org/story/15/08/11/2340247/open...

robertpenz

RSA would be great for yubi keys to have two factor authentication (ssh key on the yubi key)

robertpenz

Please make it possible to push certain clients from 2,4 to 5ghz if the same SSID is configured (which should the default mode on shipping). Some devices stay on 2,4 even if they support 5, and the air time in the 2,4 space is valuable.

robertpenz

Answer is per router: * how many peers; 10 * how many routes in routing table; /ip route print count-only 1978010 /ipv6 route print count-only 43565 * is there also OSPF,MPLS, VPLS, RIP etc running on the router; OSPF * what are the hardware specs; CCR1036-8G-2S+ * are there routing filters; yes * a...

robertpenz

Hi, We've implemented an OSFP ECMP setup with 5.x and for each tcp connection / flow it has been decided which route it takes. For us it seams that this has been changed with 6.x that the same dst-address (of the flow) of multiple clients stay on the same interface. Is this correct? and how can we c...

robertpenz

Using 6.18 with snmpv3 and aes for some weeks now ... no problems. it is stable even if queried a lot.

robertpenz

Following text http://wiki.mikrotik.com/index.php?title=Manual:License&curid=1634&diff=26596&oldid=26595 RouterOS upgrade capabilities are not limited by time, but by version, and this depends on the RouterOS license level. For example if you are running RouterOS v5, your license could restrict the ...

robertpenz

+1 also

robertpenz

Is it possible that this are aggregated AS?

robertpenz

I've found AS paths with { } entries ... does someone know what that means? Here a screenshot

robertpenz

I replaced 2 Vyatta Routers with Mikrotik ones, the setup is the basis for this blog post: http://robert.penz.name/779/howto-setup ... k-routers/

robertpenz

What I want to know is, if only the administration (HTTPS, Winbox) is vulnerable, which would be not big problem as we're using dedicated management networks, or production service also external user can reach.

robertpenz

ok only 6.x gets an security update. so switch services are vulnerable? I need this to compare the the security impact against the time and money the update from 5.x costs.

robertpenz

With my routers running 6.x thats easy. But we've many 5.x still and a upgrade to 6.14 is not that fast done. So I would like to know which services/protocols are affected. If I don't use them I don't need to upgrade. Or will there be a 5.x security release.

robertpenz

Which services / protocols on the RouterOS are vulnerable?

robertpenz

Because I post in my blog not only Mikrotik stuff (in reality it is only a small part) and I want one central place for all my stuff.

robertpenz

I've written a howto on combining Suricata and RouterOs (/tool sniffer) for a SOHO setup as IDS (Intrusion detection system). I link it here, as I've read multiple times people asking for it and today I got some time to write everything down. So here is it: http://robert.penz.name/849/howto-setup-a-...

robertpenz

Is nobody running a Layer 3 hotspot network?

robertpenz

For authenticating users to login via ssh access onto the router or something like this you're correct. But for authentication devices for network access via 802.1x RADIUS is the only game in town. And the encryption of data is not so important there as EAP-TLS is mostly used (If security is a conce...

robertpenz

I have following setup in my lab to reproduce the problem: The Mikrotik has the Internet connection and is running a DHCP Server and Hotspot Server. A layer 3 switch which connects the clients and also provides a DHCP Relay. e.g.: Internet -- Hotspot Mikrotik - (10.0.0.0/24)- Layer3 Switch - (10.0.1...

robertpenz

What has TACACS (Terminal Access Controller Access-Control System) to do with authenticating network devices? As far as I know TACACS is only used for authenticating users that want to access the router (= the admins) .. it has nothing to do with network security or I'm mistaken?

robertpenz

Zorro: I believe you misunderstood my feature request. If you use the DHCP Server on the Mikrotik it is possible to add the MAC address of the client which got the lease to the ARP table of the router. If you now disabled ARP learning only Clients with DHCP can talk over the router and ARP spoofing ...

robertpenz

Does this mean 6.x have the vulnerability and 5.x don't?

robertpenz

plus 1

robertpenz

Hi! I wanted to write this howto for a long time, but never had the time. But now it happened, a howto called "Howto setup a redundant and secure BGP (full table) Internet connection with Mikrotik Routers" and here is the link: http://robert.penz.name/779/howto-setup-a-redundant-and-secure-bgp-full-...

robertpenz

Big Thx for this script!

robertpenz

+1 SNMP Monitoring of BGP

robertpenz

Hi! I would love following features specially for the CRS. - Wired MAC Authentication against Radius with dynamic VLAN assignment via Radius - Wired 802.1x Authentication against Radius with dynamic VLAN assignment via Radius - Wired Dual (MAC and 802.1x) Authentication against Radius Following for ...

robertpenz

These 3 would be also my favorites .

robertpenz

Still no answer? I've also sent a mail to the mikrotik support but also no answer there either ....do I need to consider the ipsec part to be brocken for the future?

robertpenz

We are working on a new manual, here is a start http://wiki.mikrotik.com/wiki/Manual:CRS_examples The new CRS looks good from the hardware and cost perspective! But if you want to get also in the small remote offices (currently one needs a router, a switch and access point - with CRS only one devic...

robertpenz

No answer?

robertpenz

Some weeks ago a bug in the random function get_cycles() of the Linux kernel for MIPS processors was discovered. e.g. https://lists.openwrt.org/pipermail/openwrt-devel/2013-September/021318.html And 10 days ago a fix was provided for this: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.g...

robertpenz

Ok, Thx for your help.

robertpenz

Hi! I've following queues for my WAN interfaces on both routers and it works as excepted. Now I want to add PCQ to make sure that not one session is filling up the connection if there are other sessions. Where to I need to add the PCQ? with each /queue or is it enough if I set it for the parent? Do ...

robertpenz

I've a question about the fan in a RB1100AHx2. Normally the output looks like this: /system health print fan-mode: auto use-fan: main active-fan: main voltage: 12.3V current: 757mA fan-speed: 1952RPM temperature: 25C cpu-temperature: 35C power-consumption: 9.3W But I've one Router which look like th...

robertpenz

+1 for the post from SwissWISP ... that and a paid support subscription are the only parts holding us back in using Mikrotiks more and in more critical areas.

robertpenz

It would be nice to buy the CCR with 2 PSUs in the first place. With the CCR you're moving into the data centers where this is standard.

robertpenz

Yeah, I would also use only one area for this small setup. Remove the complexity!! >500 routers in one area is no problem today ... Use areas to separate devices with bad ospf implementations from the rest. E.g. loadbalancers or mainframes Or for security reasons ( you want all traffic over some spe...

Search found 79 matches