MikroTik

biomesh

Then I suggest you contact them for their config. Most likely they are not using a firewall(or a very minimal one) and are not using PPPOE. I also suggest looking at https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading#L3HardwareOffloading-L3HWFeatureSupport for limits of l3hw offloadin...

biomesh

The CRS326-24G-2S+ (listed on the mikrotik website as a "Switch") has the following performance results listed: https://mikrotik.com/product/CRS326-24G-2SplusRM#fndtn-testresults The device is primarily a switch with some limited routing features. For anything outside of this, including PP...

biomesh

I would see if a local repair shop could repair or at least diagnose the issue.

If you don't want to go that route, at least you have spare parts.

biomesh

Have you tried to get a packet capture on sfp+1 on the rb5009 while running the iperf?(Ideally connected to the router via another interface)

Looking at the interface statistics can help some, but a packet capture is the best to see if there really is any traffic being passed.

biomesh

If you want to verify if it is the firewall, reset the counters before an iperf test and/or configure logging for different rules, to see what is being triggered.

biomesh

While I don't think that these may be the issue they are areas of concern:

- No stp/rstp protocol on the bridge
- the sfp+ port has an mtu of 9000, does that match your switch and other devices?

biomesh

Just to have everyone verify I would also post the crs config.

biomesh

The cpus on these crs112 switches is very weak. Certain menus in winbox (normally interface stats) will cause the high CPU. If you do try to connect via ssh and still see this, make sure nothing else is connected to the switch monitoring it.

biomesh

Some of the lower end mips cpus on switches will have this issue - the arm based devices don't.

Just something to be aware of when you are looking at hardware options.

biomesh

My guess is on having BFD enabled. If using winbox, close all windows and open a terminal and see if the /tool/profile output is any different. hi bfd works with routing protocols ? we not running routing protocols on this switch. tools profile in terminal via ssh and no winbox open still shows hig...

biomesh

My guess is on having BFD enabled.

If using winbox, close all windows and open a terminal and see if the /tool/profile output is any different.

biomesh

What is "supported" - i.e. software updates for security fixes or software updates for new features and security fixes?

biomesh

A CRS318-16P+2S-IN or a CRS310-8P+2S-IN would be awesome - as long as they have more than 16MB flash.

biomesh

It won't be automatic address assignment, but this can be done. Add an address to the wireguard interface on the router i.e fd00:12::1/64 Add and address to the wireguard client (remote device) and on the peer (allowed addresses) i e fd00:12::2/128 If you have your ipv6 routes configured correctly o...

biomesh

Could the "memory leak" be due to 0 disk space available?

biomesh

I have one that powers an AP (grandstream gwn7664) and a sip phone. The AP pulls about 8-11W and the phone around 3W during normal operation. My other 5 APs(same as above) are powered by a crs318 (netpower 16).

I have not seen any reboot issues.

biomesh

Upgraded ccr2004-16g-2s+, rb5009, crs318, crs317, cap ac, crs112 and chr with no real issue. This is from a mixture of 7.13 and 7.14rc versions. I did see the odd firmware version text display issue I saw with a previous rc to release version on the ccr, but it just seems to be cosmetic. Everything ...

biomesh

Take a look at this thread

viewtopic.php?t=203659

Different options depending on use case

biomesh

The configuration depends on if you have mid split enabled or not. It looks like you do not have mid split enabled yet (yours looks like my old config for the default route). Once mid split was enabled in my subdivision, I had to set the default gateway to the interface name. This is most likely tie...

biomesh

All of the CCR1xxx series have been discontinued. Since they are not an active product any more, I doubt any development time will be spent on new features for that platform. They will be supported (according to Mikrotik) for at least 5 years from date of purchase. These updates do not guarantee new...

biomesh

I will! What do you recommend that can get me 2 gigabit internet performance without a doubt? I got recommendations from the one poster in the other less used sub forum but am looking for confirmation or other suggestions. Also, the CRS310 can work as a managed switch at 10 gigabit throughput, righ...

biomesh

Looks like you got the same answer as before(by different people).

viewtopic.php?t=204099

I would suggest making sure to do some research before buying your next piece of hardware.

biomesh

This is a switch with some routing capabilities. https://mikrotik.com/product/crs310_8g_2s_in#testresults The routing performance is on par with what you have seen. It supports some basic hardware offloading for routing, but not for nat/fasttrack. You should get a router to pair with your switch. An...

biomesh

For someone with a CCR2004-16G-2S+ and a single bridge between both switch chips and one of the SFP+ ports, the hardware offloading does work as long as the same vlan to vlan traffic is on the same switch chip. So the winner is mkx! :D inter-asic traffic is punted via CPU, stop purporting fake info...

biomesh

For someone with a CCR2004-16G-2S+ and a single bridge between both switch chips and one of the SFP+ ports, the hardware offloading does work as long as the same vlan to vlan traffic is on the same switch chip.

So the winner is mkx!

biomesh

If safe mode is not enabled, it is usually due to low disk space on the device.

biomesh

I have had to refresh a few times for it to work. Perhaps a cdn or some other issue.

biomesh

My guess is the crap ton of firewall rules you have. You are probably hitting multiple forward rules on the intra vlan traffic. You should check your rules and add criteria for in-interface={your-wan-interface} where appropriate.

biomesh

When updating the firmware on a CCR2004-16G-2S+ the "upgrade firmware" string is different than the version shown under "current firmware" once applied. It looks like there is an extra carriage return in the string - so there always seems to be an update available (even if it has...

biomesh

That same question could be said about an RB450G which definitely could not route 1Gbit/s. Gigabit ports are needed to route more than 100MB/s so while the port can negotiate at 1Gbit, routing speed is another matter.

biomesh

Almost sounds like there is an issue with RSTP unless you have logs from the CCR to show otherwise.

Having a secondary capsman controller is always a good idea (is much easier to implement if just using local forwarding).

Posting your config(export) and version info would be useful as well.

biomesh

The L009 is a replacement for the RB2011, not the RB4011. If you look at the routing specs, what you see is what is expected. You can post your config to have someone look at it and see if there are any tweaks, but I doubt it will perform as well as the 4011. You should keep the 4011 and use the L00...

biomesh

There is no current wifi 6E device from Mikrotik. You will need to pick from the slim choices from another vendor.

biomesh

This has happened before on other switches - Mikrotik just needs to remove the option for swos for that switch in an updated version as swos is not a supported option for that switch.

https://mikrotik.com/product/crs310_8g_2s_in

biomesh

Opened SUP-134289 for an issue on CCR2004-16G-2S+ where I could not communicate with any device on the gigabit ports (this includes the CCR2004 and other devices on the same vlan on different devices crs317 etc)

Revert to 7.12 and it works correctly.

biomesh

Have you run an iperf between two devices on the same vlan? (pc and nas if possible)

biomesh

If the 10GBit connection is saturating the link it can cause lots of retries as 10gbit worth of data won't make it through a 2.5 gbit ink. By having the switch limit it on the interface side, it can help mitigate the retries. I got around this by just moving everything to 10Gbit - problem solved :)

biomesh

The best way to test is using iperf on both ends. As long as the machines on both ends are powerful enough to generate/receive 10Gbit worth of traffic, you won't hit any other bottlenecks like disk IO etc.

biomesh

This is actually already fixed in 7.13 which is coming soon. Deprecate message will not be sent if actual prefix is re-used.

Thanks - I have a workaround (mentioned before), so I'm good for now.

biomesh

Why is that a problem? That is intended behaviour at the moment. Well you get a non working config: prefix 2601:2c3:xxxx:dc32::/64 { AdvValidLifetime 7200; AdvPreferredLifetime 7200; AdvOnLink on; AdvAutonomous on; AdvRouterAddr off; }; # End of prefix definition prefix 2601:2c3:xxxx:dc32::/64 { Ad...

biomesh

Does it work correctly if you use 10Gbit on both connections? (or do you only have asymmetric connections). Sometimes flow control helps but you might need to go to the switch port settings and set an ingress/egress rate limit to see if you can get closer to the actual hardware line rate. One way to...

biomesh

Opened SUP-133893 where RA deprecate messages for an active RA are sent at the same time as the active RA.

Workaround: toggle "use interface duid" to temporarily get a new PD then it reverts back to the actual PD and the RA will be correct.

biomesh

For my opinion of why it costs more:

More overall materials needed (product, box, shipping costs, etc)
More complicated antenna design means a more complicated build (albiet slight increase)
Not made in scale as compared to the ax2 thus costs more (just a guess)

biomesh

I'd say that legacy capsman controller on a crs326 depends on use case. Do you use capsman forwarding? If yes, then the crs326 would not be a good choice. Otherwise the crs326 would be primarily for provisioning and should work fine. I had multiple capsman controllers and one was a crs326 and it wor...

biomesh

You don't specify a bonding mode, and the old docs state that the default bonding mode is not one of the supported bonding modes. (the current docs don't state the default mode). I would set it to 802.3ad or balance-xor manually (whatever the qnap supports) and then monitor the bond to see the statu...

biomesh

Sounds almost like the bond is not being hardware offloaded. Can you export your config so we know what your config is?

biomesh

Definitely not the crs as that is a switch with basic routing capabilities. If you need 2 sfp+ ports you are looking at a ccr2004 or a ccr2116 to start. I don't do anything with pppoe, so someone else will have to provide their feedback on that. Just remember: good, fast, and cheap - pick any two.

biomesh

Put the address in brackets:

[fd00:1234::4321]

biomesh

There are always positives and negatives with any solution. Mikrotik positives: relatively inexpensive, flexible, no ongoing licensing costs, support lifecycle is fairly long (hardware will work for a long time) Mikrotik negatives: Can be a steep learning curve compared to other vendors (changes on ...

biomesh

The device barely has enough power to display stats in winbox for interfaces. This is definitely a switch only - while it does have some router features available, the cpu (400MHz mipsbe) can't handle it.

Configured as just a managed switch, it works very well.

biomesh

Can you guys clarify the use case of 2.5G ports but with PoE output? I thought this kind of switch was great for high end PC's, not for plugging in more routers? I have access points that are ax 4x4 that have both 1g and 2.5g ports that allow for poe in on both ports. I only have one drop run to ea...

biomesh

The css610 outputs more power than that. I would hope the specs would take into account that devices with 2.5 gbe ports use more power.

biomesh

I would buy at least two of the CRS310-8P+2S+IN if those were released.

biomesh

Not sure if the iphone app has a 'discover' option, but if so, you should be able to connect via the mac address of the switch.

biomesh

Without your layout it's hard to tell - I have a feeling that there is a vlan issue with your switch where sfpplus1 is connected to.

Like was mentioned before, there is no reason to put sfpplus1 into a bridge for one interface.

biomesh

If you think you need more power, just get a 24HPOW - it's 24V/2.5A. Most people will not max out the power of the device. There are other devices that also have a similar situation - hap ac2, rb951u, etc. There is a cost balance, especially on the lower end consumer devices (under $150 USD) vs the ...

biomesh

If you take sfp2 out of the bridge on the ccr2116 the issue should "disappear". This would prove the loop issue as well. By removing sfp2 out of the bridge you would also lose L3HW offloading, but the routing should work if you are using vlan interfaces and assign vlan100 to sfp2 (this wou...

biomesh

The only reason I mentioned ROS is that is what I test on. I think the power/reboot functionality would have to do more with the hardware(and warm/hard reboot) and not ROS as it is rebooting anyway.

biomesh

They also have to write that to update the software you need to turn on the device?

The comment you are referring to is actually relevant as on a crs318 at least, most ROS updates do not cause power interruption to the POE devices.

biomesh

I have my CRS112 updated to v7 and it works fine as a switch. Via ssh the cpu runs at ~10%, but with winbox with an interface menu open (with couters) the CPU jumps to 30%. It has always been this way for the switch. You might get slightly better performance on v6, but not much. This is definitely a...

biomesh

You also don't need to buy separate injectors as the cap acs come with them (and a power supply)

biomesh

These devices (crs112) have weak CPUs so you will get high utilization in v7 or V6 when using winbox with certain menus open. To get a better idea of the normal load use an ssh session to the switch and monitor it that way. That said, if you are using these for more than a switch, I would not recomm...

biomesh

Finally had a chance to rebuild my nextdns container and the ipv6 support (in my case dual stack) for veth interfaces is working perfectly.

biomesh

My comment was for dynamic allocations from an ISP. @DarkNate I can see that your config will work for a static allocation, but not for a dynamic one. I am using Comcast, so not a small ISP by any means. What are you asking lol, if the PD is dynamic, then it will always change. How's this a RouterO...

biomesh

My comment was for dynamic allocations from an ISP. @DarkNate I can see that your config will work for a static allocation, but not for a dynamic one. I am using Comcast, so not a small ISP by any means.

biomesh

@DarkNate this can happen. Lets say you get a /60 from your isp from a dhcp client and put it in a pool of /64s. You assign 3 /64 prefixes from a pool to different vlan interfaces. Even if you reboot, the pool assignments are not stored on disk and not saved to disk. These are resident in memory, so...

biomesh

The u6 ships with a 48v/.5a injector while the 5009 would provide 48v/.42a max. The u6 states the max power consumption would be 22w, which is more than what the 5009 with the default power supply can provide. You should probably look for a 57v/2a power supply (a 53v/2a might work) to power your 500...

biomesh

I do get that error message on a container restart but my container works and the address assignment is valid (I added commands in the container CMD to print the ipv6 addresses and routes)

The upcoming changes to ROS mean I can revert my changes to my container soon.

biomesh

The rfc states that option 42 needs to be a list of ip addresses. (not dns records)

https://www.rfc-editor.org/rfc/rfc2132

If you want to use a dns record you will most likely need to schedule a script that resolves the dns record and updates the dhcp options.

biomesh

I added IPv6 to my CHR container running a nextdns client. I had to add support for both options 1 and 2 into my docker container (these are using ULA): Dockerfile FROM debian:bullseye-slim RUN apt-get update && apt-get install -y apt-transport-https curl && \ curl -o /usr/share/keyr...

biomesh

Here is a simplified and sanitized version of my ipv6 config that I have been using with comcast for close to 10 years (basically when it was added to ROS). /ipv6 address add disabled=no from-pool=comcast_ipv6 interface=internal /ipv6 dhcp-client add add-default-route=yes interface=wan pool-name=com...

biomesh

/ipv6 address
add address=2a0d:2787:1b:482::a advertise=no 
/ipv6 route
add disabled=no dst-address=::/0 gateway=2a0d:2787:1b::1e10
/ip dns
servers=2a0e:2000::2000,2a11:b244::244

biomesh

The pool is just an address allocation. You already have the range with the /48, so you can't add it a second time. If you create an ipv6 dhcp server to hand out /60 prefixes to another router in your network you could, and then have it hand out /64 prefixes from the /60 it obtained from the /48 pre...

biomesh

Yes, but the address range would be whatever subnet range you want inside of fd00::/8. Ideally this would be a /64. If you use vlans, I would break the ipv6 /64 allocations to match your vlans. Here is a snippet from one of my routers: /ipv6 address add address=fd00:5::1 interface=vlan500 add addres...

biomesh

I suggest using ULA (fd00::/8 range) on your router and push this to clients via ND(dns config). https://en.m.wikipedia.org/wiki/Unique_local_address You would assign a static address (/64) to the router then make are the advertise flag is set on the address. The ND settings need to have your static...

biomesh

Have you tried to disable flow control on the ports?

biomesh

I have only seen this on an older IP camera. I am sure there is a bug in the dhcp client or networking stack on the camera that causes this. Setting the device to a static IP avoids this issue for me.

biomesh

Is it slow just on startup?

I have seen issues with rokus and RSTP. If you are using RSTP, or RSTP is enabled on your device/bridge, set the bridge port that the roku is on to edge=yes

/interface/bridge/port/set edge=yes interface=etherX

biomesh

My crs317 with 7.8 works fine with inter and intra vlan traffic on the same or different interfaces.

biomesh

Upgraded the following with no issues (been running over 34 hours)

ccr2004-16g-2s+, crs317, crs326-24g, crs112, cap ac, chr, crs318

biomesh

Flashfig is still listed as an option on the support website

https://help.mikrotik.com/docs/display/ROS/Flashfig

biomesh

The reset button puts it into reset config mode, caps mode or netinstall mode. Choose which one works best for you.

You might need to have it be a cap temporarily so you can reset it the way you want it to.

biomesh

/system/reset-configuration caps-mode=no

biomesh

Are you out of space on your disk/flash?

biomesh

Do you get full speed if you test from a device with only a 1 gig nic?

biomesh

My l3hw offload for ipv6 on a crs317 works with no issues. Here is my ipv6 specific config: /interface ethernet switch set 0 l3-hw-offloading=yes /interface ethernet switch l3hw-settings set ipv6-hw=yes /ipv6 address add address=fd00:70::1 interface=vlan70 add address=fd00::2 advertise=no interface=...

biomesh

@Larin my ccr2004-16G has factory firmware 7.4.1 and factory software of 7.3.1, so not out of the ordinary it seems. What does seem concerning is that you had so many writes during your uptime of less than 5 hours.

Are you doing any work with containers or a lot of graphing?

biomesh

Why do you quote whole preceding post? Does it help answering? Do you repeat what your interlocutor says when you discuss?

For a CHR instance without an active license

biomesh

If any device needs 48v, you need to have a 48v power supply attached. The switch can have both a 24v and 48v adapter connected to power different devices connected to the switch at the same time.

biomesh

Actually market is full of other brand AX AP's for half of that.
The cheapest competitor in the US would be UniF--k AP lite. Which is $100.

I would not say it is full of $50 AX APs but you can find a Zyxel wifi 6 AP on amazon for $75 USD. Its not what I would buy, but there are options.

biomesh

Under /ip settings you have ip-forward=no. If you want the router to route packets between networks that needs to be set to yes.

biomesh

The 12S+ had some issues initially with reboots (related to the port extender in the block diagram). I have not heard of issues with current versions, 7.5+, but they did exist. Be sure to check the test results and block diagram to see what the router can really do. The 2004-16G versions don't have ...

biomesh

To get the full logging, you would need to have the nextdns client installed on the devices or install it somewhere (docker, raspi, etc) in router mode (setup-router true). Depending on the mikrotik device used, this can definitely be run as a docker container.

biomesh

Also if you use the nextdns client (on a raspi, server, or in a docker container) you can specify different mac addresses to point to different configs. This is what I use to apply extra security to devices my kids use.

biomesh

I use the pro for myself and my parents - for the last 30 days we have had 1.5 mil queries with the bulk of them coming from my home network.

biomesh

If its a small charity, why not just use the "pro" nextdns plan which is $20 USD a year?

biomesh

Use a command similar to

/interface/bridge/port set bridge=bridge-wan interface=ether1 hw=no

Repeat for all interfaces in the wan bridge.

biomesh

You can only hardware offload on one bridge at a time. Remove the wan bridge, as it is not a bridged interface by default.

biomesh

Since you won't share an export, there is only so much others on the forum can do to help.

I would start by checking fasttrack requirements

https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack

And then open a ticket with support.

biomesh

More chains do help wrt MU-MIMO.

The cpu/ram would also need to be adjusted to handle the extra load.

biomesh

At least it is better than the sdcard slot on the ccr1009 and ROS7 where it just does not work anymore. Clearly defined expectations/features are better than empty promises.

biomesh

The crs112 is a switch with very basic routing capacity.

https://mikrotik.com/product/CRS112-8G- ... estresults

Depending on your config ~30Mbps is probably to be expected.

The device only has a 400MHz Mips cpu, so it won't be able to do much on the routing side.

biomesh

Do you get full speeds using a 1G port on your lan / 5009 instead of the 2.5G port?

biomesh

You admit you made a risky decision, and yet now want 'fairness'.

Either quietly email support and see if they can help, or buy a new license, or get rid of the device.

There isn't anything else to discuss anymore.

biomesh

Check https://mikrotik.com/buy/

but it looks suspicious to me if the manufacturing third party (or whoever this is) would be trying to sell items outside of the normal distribution channels.

biomesh

Just FYI my CCR1009 was running 7.5 for over a month without issues. I replaced it with a CCR2004, so the 1009 is not currently in use. The only issues I had with 7.x and the CCR1009 were/are: - sd card no longer works - in earlier 7.x version there was a bug with l2tp/ipsec where it would go into h...

biomesh

You might want to netinstall the device to make sure there isn't an issue with the flash or the os install. I would also check the capacitors to make sure none are failing. If you have a backup power supply, I would also test that as well.

biomesh

I also create a vlan interface assigned to the bridge which will have the management IP. /interface vlan add interface=bridge1 name=vlan88 vlan-id=88 /ip address add address=192.168.88.1/24 comment=defconf interface=vlan88 network=\ 192.168.88.0 /interface bridge vlan add bridge=bridge tagged=bridge...

biomesh

Here is a snippet - not going into the actual enabling of l3hw as that is in the manual/wiki. This should be most of it to understand how I use it. CRS317 /ip address add address=192.168.6.1/23 interface=vlan600 network=192.168.6.0 add address=192.168.5.1/24 interface=vlan500 network=192.168.5.0 add...

biomesh

For soho, if you only have one subnet and you are not using the switch as your main router, then there really is no benefit. If you have multiple subnets/vlans on your network but use a separate router, then yes there is a definite benefit. If you use your crs device as a router, it might be better ...

biomesh

On a CCR2004-16G-2S+ I get ~4.6 Gbps single threaded iperf with no wireguard both directions. With wireguard, I get 1.17Gbps (without -R) and 833Mbps (with -R). All tests single threaded. You might want to check your wireguard config on the computer or firewall/antivirus, etc.

biomesh

I'm pretty sure you are hitting the max that this device can provide, considering you are using PPPOE and multi-wan (with the associated rules). The performance tests for 6.x show for a 512 packet size of 385.4 Mbps speed, which will be higher than 7.x due to the removal of the Linux route cache in ...

biomesh

I have bought a lot of mikrotik devices and I don't think I have ever seen a power supply "made" by them. I am sure they buy power supplies from different vendors as needs or supply levels change.

biomesh

The crs3xx series (many of them) have arm cpus. Many of the cpus have multiple cores, but with the older kernel could only use one with ros 6. With ros 7, these extra cores were enabled due to the newer Linux kernel. The crs328 is the only device so far that has had the extra core disabled in ros7.

biomesh

I have not had any reboot issues with a ccr2004-16G-2S+.

It shipped with 7.3.1, but upgraded it to 7.4 and subsequently to 7.5 and 7.6 with no issues.

It was an easy upgrade from my 1009.

biomesh

How about removing

client-mac-limit=0

from your dhcp server.

biomesh

Those two changelog entries don't mention anything about WinBox, from which you provided the screenshots. Look for them in CLI. These work via winbox on all of the devices that I upgraded. crs317, crs318, crs326, ccr2004, crs112, cap ac. For the cap ac and crs112 obviously the l3hw options are not ...

biomesh

Some models, like CCRs don't come with an extensive default config as they are not designed for inexperienced users. https://wiki.mikrotik.com/wiki/Manual:Default_Configurations Start with the forums or help website and build the config (disconnected from the Internet) https://help.mikrotik.com/docs...

biomesh

If it broke everyone's voip, I'm sure there would be more than just a handful of people reporting an issue. I am currently using 7.5 and have been regularly updating ROS with no issues on my voip services. I use asterisk connecting to multiple providers. You could post your config or revert and open...

biomesh

I finally decided to test ipv6 l3hw offloading on my crs317 with l3hw ipv4 already enabled. It was a few quick changes and now I get full 10gbps ipv6 on my internal vlans.

biomesh

No, only devices listed with voltage/current/temperature/fan sensors will have health data. The ~$25 device has none of those.

https://mikrotik.com/product/RB941-2nD

biomesh

Yes, look at the different docs for CRS318-16P-2S+. That is the full model number.

biomesh

Basic config dhcp client on the wan interface saving pd to a pool /ipv6 dhcp-client add add-default-route=yes interface=wan pool-name=comcast_ipv6 \ prefix-hint=::/60 request=address,prefix use-peer-dns=no ip address/prefix (::/64) assigned from the pd pool /ipv6 address add from-pool=comcast_ipv6 i...

biomesh

I don't know how popular these were. They were discontinued in 2018 I believe.

For ram it should show the correct amount. For disk, It could have been partitioned.

biomesh

First off the crs series - especially the 1xx and 2xx versions are primarily switches. You won't get great routing performance off of these devices. Second, running a speed test on a device itself is not the correct way to test as the device will use a lot of the CPU to just run the bandwidth test i...

biomesh

The original gesp looked like this

https://www.streakwave.com/mikrotik-ges ... -protector

The docs probably refer to the newer model.

Do you have the older or newer model?

biomesh

Wow a level 6 license.

biomesh

See what features can be hardware offloaded on a CRS317 https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading?src=contextnavpagetreemode If this is all you need now and in the future, go with a CRS317. If you need more than this or expect you will need more in the future get a CCR (or bo...

biomesh

I would make sure you test iperf going from the server to the client (either using -d or -R option). The output you show is the "upload" on your ISP test. If that shows 1Gbps, then the switch is working properly - it doesn't do anything special for out of your local subnet traffic unless y...

biomesh

If iperf both ways between switches work (with and without the -R option) then the issue would be at the firewall.

Check to see what the load is on the firewall and also check to see if you have enabled jumbo frames elsewhere in your network that is possibly being fragmented at the firewall.

biomesh

There is no automated way integrated that will sync capsman config between devices. You could script syncing changes or use the rest api to make changes on multiple servers at the same time.

biomesh

You can leave the router/gateway address the way it is, but set the network to 192.168.0.0 on the interface that has 192.168.1.1 assigned.

biomesh

Capsman also has the ability to set multiple capsman managers: When the list of available CAPsMANs is built, CAP selects a CAPsMAN based on the following rules: if caps-man-names parameter specifies allowed manager names (/system identity of CAPsMAN), CAP will prefer the CAPsMAN that is earlier in t...

biomesh

ccr1009
crs318
crs317
crs326-24G
crs112-8G
cap-ac

All upgraded with no issues- upgraded from 7.3.

biomesh

That switch supports passive poe in (10-30V) according to the docs. This is only used to power the switch itself and not other connected devices.

https://mikrotik.com/product/CRS326-24G-2SplusRM

biomesh

I suggest using a CHR version of routeros. It is a vm based install and you can choose the version based on max speed on the interfaces used. There is a 60 day trial license that can be used to verify functionality before spending any money on a license. The CHR licenses can be transferred between V...

biomesh

I would not start over - here is a sample config for reference: /interface bridge add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no name=bridge1 priority=0x2000 \ pvid=75 vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] l2mtu=9080 mtu=9000 set [ find default-name=ether2 ] l2mtu=9080...

biomesh

- you don't need vlan interfaces on a switch unless you are going to implement l3hw offloading (and perform routing) or want to assign an ip address for management to one of the vlans going through/to the switch (this vlan would be assigned to the bridge) - your ip address is assigned to ether2 and ...

biomesh

Did you enable l3hw offloading? This is primarily a switch and while there are some layer 3 routing features offloaded to the switch chip, the CPU is not going to be able to handle much routing outside of the functionality in the l3hw offloading specs. https://help.mikrotik.com/docs/display/ROS/L3+H...

biomesh

You don't have any firewall rules (only nat) and that also includes fasttrack. Perhaps look at enabling fasttrack to see if that helps.

biomesh

A bridge is only necessary if you have to extend a network across multiple interfaces. If you only use one lan port (even with multiple vlan interfaces) you don't need to use a bridge.

I was just mentioning it as something to consider testing.

biomesh

For the OP, you are only using two ports (wan and lan) so the bridge is not really necessary. I know on a ccr1009 the routing speed and cpu doesn't really differ with or without a bridge, but it might on your device. Are you using iperf for some of these tests btw? That would be the best way to test.

biomesh

zerotier is only available for arm devices.

biomesh

Any chance you might share some stats regarding mem and disk usage for some of the containers? So far I am only using a container I built for nextdns that is based on a small debian image. The tar file is 110MB and I still have the tar file on my disk and using ~300MB disk (I have other files on th...

biomesh

Did you install the container package from the "all packages" zip file?

biomesh

Updated my containers from the 7.0x beta and was redeploy it on my CHR with no issues.

biomesh

Just use vlans, and make sure it is properly configured. There is no reason why it can't work, but it does take more effort to configure than basic configs.

biomesh

If you see it on both, I would just skip capsman on 7.x for now.

biomesh

Since it is reporting out of memory conditions on the hap lite (which has 32MB RAM) you should probably move the capsman server to the cap lite since it has 64 MB RAM and let the hap lite be a capsman client. If you only have two APs, you could also just skip capsman and configure them separately. T...

biomesh

I see that your 192.168.1.x pool includes 192.168.1.1 which is already assigned to the router itself. It would not cause reboots, but should be fixed. The CCR devices do not come with a default firewall and so you must add one. I only see one firewall rule so you should work on that https://help.mik...

biomesh

Can you export and post your config so others can see what is configured on the device?

biomesh

The crs112 also has this issue. Reading the interface stats will increase the cpu load quite a bit.

I reported this issue, but I don't think there is much priority to look at or fix this on the mipsbe devices.

biomesh

The only other suggestion I would make is to check the power supply. A bad or failing PS can have many different symptoms.

biomesh

This whole topic seems odd to me - just opening the case does not void the warranty, at least in the US. What you do once the case is open, makes more of a difference. If you have a model that takes nvme/ssd/ram and you add or replace a user controlled component, then I would say the warranty is sti...

biomesh

You have the wifiwave2 package installed which does not work with capsman.

biomesh

Are both of the devices using the same ISP? I see your results from your work server is fine.

I was just wondering if they are on the same ISP since there could be an issue with bandwidth limits on peering points between networks along the way if they are not on the same ISP.

biomesh

He is at site 1 downloading from site 2, from what I understand.

biomesh

The device can run on either voltage to power the device. The device will use the highest voltage connected to it to power itself though.

biomesh

If it's under warranty, I would rma it. if not, perhaps someone else can give you things to check on the board itself for repairs.

biomesh

The wording is a bit off - he is downloading (100 mbps) from the second site (600mbps), so ideally it would be close to 100mbps in ideal/perfect situations.

Have you tried iperf3 between sites?

biomesh

It should not matter. I would try with one power supply at a time, if you have different ones, try those.

From your description, this is the poe version of the switch, if it was not then you could also try to power via poe in.

biomesh

For the slower ports/interfaces try and set the ingress / egress port speed (switch interface) to close to what the interface can actually support. In the past when I used a 2.5 gb sfp+ adapter I had to set the rate to 2400 to get basically no retries and full speed (basically when sending traffic t...

biomesh

Make sure you reference

https://wiki.mikrotik.com/wiki/MikroTik ... patibility

Also note that 10gbaseT sfp+ devices can generate a lot of heat

https://wiki.mikrotik.com/wiki/S%2BRJ10 ... l_guidance

biomesh

Are the same type of sfp/sfp+ modules installed in both devices?

The temp reading (not cpu temp) on a number of switch models comes from the sfp/sfp+ modules themselves.

biomesh

I think it is hilarious that gdanov thinks software companies will always provide full details of fixed bugs. I have worked for a global software company for over 20 years in a support role and found that while customers might think they are owed detailed answers on bugs/defects, it really depends o...

biomesh

Is
*) ipsec - fixed IPsec IRQ initialization on startup on TILE;

Related to random high cpu seen on startup on TILE that shows as "networking" when using profile?

biomesh

I would disable wpa2-eap and set the group key update to at least an hour (maybe more)

biomesh

You are better off posting an export of your config.

biomesh

Well, you can mention to her .. usually she's the one doing flushing :-P Well clearly she doesnt want to go to bed next to someone with soap in their hair!!. Out of curiosity, how many flushes does it take to get all the shampoo out?? I used to joke with my kids about using the "toilet twirl&q...

biomesh

Think of it this way:

How bad is it to clean your dishes/laundry in your toilet?

Can you do it - yes
Should you do it - no

biomesh

If you do actually use capsman on such a slow device as a crs112, I world suggest not using capsman forwarding.

biomesh

Get a supout and submit it to support. I have seen this a few times, but I can't reproduce the issue at will.

biomesh

Post an export of your config so that members can see what needs to be fixed.

biomesh

The SMIPS devices are for very light use / lab / toy use. Don't expect it to do much, especially with 32MB RAM.

biomesh

But I think the OP wants to build a network for 200 people for $25 USD. Isn't the cheapest way the best way?

biomesh

They key question here: HOW did you get to that 7.2rc7 version ? Coming from ROS6 OR ROS7 <7.1 and then upgrade upgrade upgrade ? Or netinstall from a version >=7.1 and then moving on to 7.2rc7 ?? I am going to assume the first option. And then it DOES apply, if I understood it well. Strods did not...

biomesh

Since this is a dns, web server or reverse proxy configuration issue, I would open a ticket to get someone internally to fix.

biomesh

If you are running the bandwidth tests on the devices themselves that is the issue. This is primarily a switch and the cpu will get overloaded from generating the traffic. Normally you will setup two devices (destop, laptop, etc) to run bandwidth test and have the switch "between" the two ...

biomesh

Option 66 is tftp server name not tftp server address(option 150). Using that option decodes correctly in wireshark when using a URL. You can use 'https://192.168.1.1:8090' s'https://192.168.1.1:8090' I would use the packet sniffer from the router to make sure it is being sent. If wireshark decodes ...

biomesh

Why are you using a http url for a tftp address? RFC5859 states this needs to be an IP address (or multiple IP addresses) not a URL. You need to convert each octet of the IP address to HEX and then set the option. For instance if I have two tftp servers: 192.168.6.1 and 10.1.1.1 it would be: 0xC0A80...

biomesh

Looking at the block diagram, eth1-eth5 has access to both cpus. You have a module in sfp1 (looing at the comments on the interface at least) which means sfp1 and eth6-eth10 only have access to one cpu core. You could try to move the interfaces around to see if that helps performance. You don't stat...

biomesh

The crs305 is primarily a switch with some l3 features. With version 7 you can get some l3 hardware offloading of the routing, but that device does not support offloading of fasttrack or nat. Due to this limitation, your speeds, if you plan on using a firewall would be pretty low. You could try a cr...

biomesh

Here are the relevant snippets: /interface bridge add admin-mac=AA:BB:CC:DD:EE:FF auto-mac=no name=bridge1 priority=0x2000 \ pvid=75 vlan-filtering=yes /interface bridge vlan add bridge=bridge1 tagged=sfp-sfpplus1 untagged=ether24,bridge1 vlan-ids=75 /ip dhcp-client add interface=bridge1 On this dev...

biomesh

I have used the dhcp client/bridge combo for quite some time on crs3xx switches. It worked flawlessly in the 6.x and 7.x versions until 7.2rc2/3. I reported the issue with support and in my report pointed out that switching to tagged/vlan interface config did indeed work. Both methods have their use...

biomesh

Post your config if you want good feedback and not guesses.

biomesh

I would try local forwarding as you aren't using a super powerful device as a capsman server.
This would be in your data path config.

biomesh

Learning the hard way.... Post Mortem analysis: Press any key within 2 seconds to enter setup.. loading kernel... OK setting up elf image... OK jumping to kernel code Could not mount ubifs/yaffs filesystem: No such device This just means you need to netinstall. This is a random issue seen at least ...

biomesh

When you see Could not mount ubifs/yaffs filesystem This means you need to netinstall. I had this happen on my ccr1009 during one of the 7.x updates - the rest of the 7.x updates were fine. Imo, it looks like something is corrupting the partition/partition table. In my case it was 7.2rc2 to 7.2rc3. ...

biomesh

Does it run correctly without using sudo? It runs fine on a Linux VM in my lab using root.

biomesh

The netinstall binary is compiled for intel architectures (i686/x86_64) and won't run on arm devices, like a Raspberry PI.

biomesh

Had an issue with the upgrade ccr1009 - the nand /filesystem was corrupt and had to netinstall. I also was able to duplicate the issue with high utilization on the ccr1009 with regards to l2tp/ipsec. I had no issues with the netinstall/reimport with the exception of the certs, which is to be expecte...

biomesh

On my crs3xx devices seems to have broken access to my management interfaces (dhcp client on the bridge). The switches work but I can't manage them except through a console cable. ccr1009, cap ac, crs112, and chr working fine. I think this has to do with some of the changes to vlan filtering. **mayb...

biomesh

Have you tried a different power supply (swap the one with the bad device with one of the good ones) or maybe netinstalled the device?

It could be some sort of nand/flash issue and that it why I mentioned netinstall.

biomesh

An insecure router can remain that way until it is compromised.

If load has not changed going to or through the server, outside of a hardware failure(which this does not seem too be the case) then you should really start to closely look at the config.

biomesh

If you can't post the export you should deal with mikrotik support only. Since this is a user forum we can only help if we have actual examples/exports to look at.

biomesh

Using iperf3 and my ccr1009 and wireguard I average 450Mbps at ~50% cpu. This is on 7.2rc1.

biomesh

Those with dual core support were a different chipset 98dx82xx series vs 98dx3236.

My guess is that kernel support for the 98dx3236 was not complete with the old kernel in 6x

biomesh

According to the following PDF, they are dual core. I am guessing the updated kernel in v7 allowed for the use of both cores vs the v6 kernel.

https://wifimag.ro/pdf/Prestera_98DX3336_pb.pdf

biomesh

16M of flash is really too small no matter what. I was trying to point out that the smips devices have more issues than the rest due to limited flash and memory. Outside of the smips devices I have not had issues upgrading 6.x. Going to 7.x I had issues but that is because I used separate packages. ...

biomesh

While I think the minimum amount of flash should be higher 64M or 128M and Ram should start at 128M, this would increase the cost of the devices. In your case you reference the hap light which is basically the cheapest device mt sells (along with the hap mini) at $20 usd. It only has 16M of flash - ...

Search found 614 matches