MikroTik

xxiii

RouterOS v7 has a "bgp-network" attribute that can be checked, so between that and "protocol connected,static", hopefully I can get rid of checking incomplete, which was actually the workaround (along with "Locally Originated BGP") I was using from RouterOS v6, since v6...

xxiii

I mean: routes that are being advertised by BGP because "redistribute connected" and "redistribute static" options have been enabled, are not being marked "incomplete", instead they are being marked as "IGP". Routes redistributed because they appear in "o...

xxiii

I'm trying to filter certain redistributed routes, but the filter does not match if I check for bgp-origin incomplete. looking at the routes being received from a router it peers with, it appears these routes are being marked as origin igp, rather than incomplete, even though they come from redistri...

xxiii

While I agree there are more important issues to be addressed, dark mode should be very quick to implement (as the wine workaround shows how little you actually have to do). Probably the hardest part would be adjusting any of the menu icons that don't look good against dark. This is a quality of lif...

xxiii

Our dude also locks up generally at least once a day. and winbox doesn't work. However, webfig does. It locked up a few minutes ago, and I was able to webfig in, do a profile, and make a supout, which I'm sending to support and referencing this thread. There are 2762 items listed when I look at &quo...

xxiii

wiki page for /ipv6 dhcp-relay still missing.

xxiii

Since there is no response, I'll assume its not possible for now; I hope it will be resolved eventually. A related issue I ran into while working with the 60G stuff is the need to add stations to multiple "/interface bridge vlan" entries. With the 60G stuff, a persistent station interface ...

xxiii

Short version:

How do I set the PVID of a dynamic WDS interface when it is added to a VLAN-aware bridge?

xxiii

There is an option to have a WDS instance add itself to a bridge, but if one is using the new vlan aware bridge, how does one set the PVID of the WDS port? It seems to always be 1, no matter what. I've tried adding the parent virtual AP to the bridge vlan, as well as setting the vlan in both the wir...

xxiii

Experiencing the same problem here, currently on version 6.42.6.

xxiii

Just ran into this issue today. Can't establish peering with a neighbor because of: 10:57:39 route,bgp,error Remote RouterId is not a valid unicast address: 247.255.0.240 ros 6.42.7 rfc 6286 - AS-wide Unique BGP Identifier for BGP-4 support for routerOS BGP. it relaxes some strict definitions: route...

xxiii

Can someone explain the LA-bit bug briefly? Is it related to ospfv3 not importing LSAs with the LA-bit set?? i.e. /128 loopbacks from other vendors? If so, what are you doing in the meantime? /127s or redistributing connected? Yes. sadly, static routes, sometimes multiple ones with check-gateway wi...

xxiii

Will the (related) OSPFv3 /128/LA-Bit bug also be fixed?

xxiii

00:05:11 route,bgp,error Received notification
00:05:11 route,bgp,error OPEN error: bad remote-as

It does appear the remote side has misconfigured your AS,
(assuming your AS is 55044)

xxiii

I would also like to see filters for OSPFv3.

xxiii

This is becoming an increasingly serious problem.

xxiii

I'd just like to add my plea that this get fixed, soon. I just recently emailed support about this, being unaware of this forum thread, and got the (apparently common) "known issue, will be fixed in the future" response. I need to know if this is going to be near future, or far future, as ...

xxiii

Ah. I thought network = remote end IP, but that makes sense, esp as the internal is 192.168.20.0. So even though it's working now, I could safely change it to 46.x.x.68? Thanks! On point to point links (like PPPoE) you may see the remote end IP show up as the network IP, but this should not normall...

xxiii

We had a router that was set to reboot every day at 3am. We came in one morning and found the router had shutdown but not restarted, and it had to be power cycled. Its graphs all went right up to 3am, and stopped. We are no longer letting it reboot itself, (we had found another workaround for the pr...

xxiii

Also, earlier you showed:

1 ;;; VSAT static IP
46.xxx.xxx.70/30 46.xxx.xxx.69 46.xxx.xxx.71 Internet-VSAT

Normally the network portion of that would be 46.xxx.xxx.68 (and since you're .70 the remote end's IP would remain .69).

xxiii

This is the only info I've got: http://wiki.mikrotik.com/wiki/Two_gateways_failover but it looks to easy to work...I expect more stuff to be configured What this example means (and you would have to change the IP addresses to match the remote ends on your wan1/wan2 ports) is that you set up a defau...

xxiii

Perhaps routerOS is not taking the source mac address into account and directing received PPPoE packets to the wrong client; the PPPoE client software may not be prepared to deal with more than one client connection on the same interface.

xxiii

Customizing your data rates (and if using N all-around completely turning off all b/g rates, and customizing the HT rates) can get you better performance, fewer disconnects, and higher average CCQ, but its very dependent on the environment you are in (with respect to interference and noise). Basical...

xxiii

We are doing IPv4 and IPv6, with both eBGP and iBGP. We generally connect our iBGP peers/reflectors together with IPv6, and the one peering session handles both IPv4 and IPv6 (and VPLS, but we aren't using it at the moment). In iBGP, there is an issue with IPv6 link-local addresses and recursive loo...

xxiii

I understand Desensitization now. Where are you getting your facts? Where can I read about this? I would like to learn more about what your talking about. Some of it comes from familiarity with another vendor's system, and their documentation. Here is an article about desensitization: http://en.wik...

xxiii

Each access point takes turns using the same frequency. This enables the WISP to make use of the frequency more efficiently. Actually, it makes all access points transmit at the same time, and listen at the same time. This keeps them from desensitizing each other. It also allows access points with ...

xxiii

I don't see any glaring problems. I would suggest trying to connect from one of the client networks to somewhere, then go look in the firewall connection tab find the relevant entry, and double-click it (to get a detailed view) and verify that the NAT is established with the correct addresses. After...

xxiii

sorry, missed the bit about no lights. is that the case on all the ports? does whatever you're plugging it into light up?

xxiii

fire up netinstall and see if it sees it.

xxiii

7> Allow for DNS names to be entered into fields where a IP address is required (this might already be implemented) Won't happen, what will you do if it resolves to 20 addresses? or what will you do if the address changes? You would need to resolve the DNS name again. So how often will you do that?...

xxiii

Have you verified that there isn't some unexpected configuration somewhere, such as which ports are in a switchgroup, and did you put Your ips or anthing else relevant on the master port of the switchgroup rather than one of the slaves? Also already existing firewall or NAT rules, or dhcp client and...

xxiii

On ours we also had to reduce the keepalive times in SIP to 30 seconds. I forget why, but I think it was or is because the router connection tracking information isn't kept for very long for UDP packets (which SIP uses, and which can be an issue if you are packet forwarding or NATing). Also, echoing...

xxiii

A star with each remote talking directly to the AP should be faster. The speed question is someone complex and its been a while since I looked into the details of WDS but if i'm remembering correctly, each packet has to be recieved and then restransmitted to the next node towards the exit. Each hop ...

xxiii

leave the address pool in hotspot blank or none, then you have to add two bypass entries (in ip bindings): 0.0.0.0-10.10.0.255 bypass 10.10.2.0-255.255.255.255 bypass and a dhcp server, if you want to hand out dhcp to any clients that request dhcp. You could actually probably finetune those bypass e...

xxiii

As mentioned, you can run pppoe and hotspot. Also, you can get the hotspot to not nat (I think you just leave its address pool set to none, but there may be more to it), and add the ip addresses (or ranges) you don't want hotspotted to its bypass list. The hotspot will try to grab all IP traffic (pp...

xxiii

I would think you wouldn't need mesh then, especially if all your "wds stations" directly see the main "ap" (if there are multiple exits, or multiple hops and paths to an exit, then mesh becomes more useful) If you use different ssids, then you can tell people to just connect to ...

xxiii

Thanks for trying it out. Which routerOS version were you running? ... Do you have any mangle rules at all? Are you natted? It went through an x86 router with 5.0beta4 doing NAT, and then an x86 router with 4.13 and then an x86 router with 4.10. Windows vista pc with private ip -> x86 routeros 5.0b...

xxiii

http://en.wikipedia.org/wiki/IEEE_802.11 You can look through there and linked articles. In particular, it contains the statement: "802.11g hardware is fully backwards compatible with 802.11b hardware and therefore is encumbered with legacy issues that reduce throughput when compared to 802.11a...

xxiii

It would actually be 1), except that it will be somewhat slower than if there were no B or G clients, as the AP has to transmit B and G compatible frames to tell those clients its busy.

xxiii

I tried it, got the timeout message right at the beginning, started a new session browsed around fine for 21 minutes, then let it sit for about 12 minutes, then continued browsing around, then went to lunch. After coming back to lunch, the browser was on some home page of the site. There was a frequ...

xxiii

can't remember if slc drives need 'defrag' or not. Do not defragment SSD drives. With wear-leveling, even if it presents itself as defragmented, it won't really be. In any case, with an effective seek time of 0, defragmenting doesn't buy you anything, except a new ssd sooner than you would have oth...

xxiii

Try meshing on the virtual APs with WDS (using the same SSID on the virtual APs), and have the clients connect to the "real" APs (possibly with different SSIDs). If there is only one exit point to the internet, you may not need to mesh. Also, beware, RVs make nice Faraday cages and reflect...

xxiii

You've hit the nail on the head and I hope it DOESN'T change, Why dont earth would you use someone like MT to handle 10+GB of traffic? As someone who remembers paying many thousands of dollars to get a router that could handle 45mbits properly, including a card with special chips that could handle ...

xxiii

dynamically added address-list entries have timeout set by firewall rule. static entries does not have that parameter. I realize that, but I still want to see the time remaining (and possibly the original total time, if its easy to do) for the dynamic entries. The static entries can just have blank...

xxiii

Since they are all bridged and in the same network, you don't need OSPF. However, you will want to make sure all your bridges are set to rstp.

xxiii

Added to existing features:

Add timeout field to firewall address list entries so one can see how much time is remaining before an entry expires.

xxiii

So you have the rb411 connected to one port of the 7404, and your pc connected to another port of the 7404 (and these ports are presumably bridged together)? If the 7404 supports it, you need to make a vlan on the rb411, with your 10.x.x.x network, and make that a tagged vlan on the 7404, then the p...

xxiii

If the above is not the issue, does it still appear if you close and re-open winbox?

xxiii

Can you try the scan from the terminal? I suspect winbox sometimes gets confused. I've occasionally seen it come up with that bad ID thing on various things that involve a list (such as torch). Usually it works if you close and reopen it (either the window in question, or sometimes winbox itself). I...

xxiii

CM9 is am older but still popular low power 802.11a/b/g card made by Wistron. It does not cover 900MHz.

I mis-remembered the part number (must be that 9), SR9 are the ones we actually have.

xxiii

Is this specifically when PPPoE logins are failing?

xxiii

The switch chip is mainly geared to layer-2 stuff, and has pretty limited capabilities compared to the regular routerOS rules. If they (mikrotik) approached the underlying implementation correctly (I don't know, but I would assume/hope so) since your forwards rely on IP address as well as the port, ...

xxiii

What is the maximum MTU (jumbo frames?) and how do the capacitors look?

xxiii

Somewhat confused. radius reply packets can include a session time limit, and this would be part of the authentication process. This would usually be based on the username used to authenticate with. Its then up to the radius client to disconnect the session when the time arrives. Radius authenticati...

xxiii

We have a number of 493ah's as PPPoE servers. We also use some RB600 for PPPoE (and some x86). 100 clients on 493ah would probably be fine, unless you have complicated firewall rules (in which case, the total data rate is probably more important than the number of clients).

xxiii

I would think it would be hardware, along with whether or not RouterOS currently supports that card or 10g at all.

xxiii

Since you're using N cards, you may want to set up both chains, which should help those residents who also have N (and may even help the others as well, if you put the two chains far enough apart to get around an intervening microwave for instance.) Basically, use whatever channel has the least inte...

xxiii

The 32 rules is specifically for the switch chip (in some of the routerboard models) on-board rules. If you use the regular RouterOS rules, you're probably only limited by the memory and cpu and how efficiently you write the rules.

xxiii

We saw a problem on an rb600+rb816, except it was constant rebooting (would stay up less than a minute) unless nearly all ethernets unplugged. Sent the autosupouts to support and reverted to an earlier version and all was fine.

xxiii

I've read somewhere that the atheros chips don't give enough control to enable synchronization (one must be able to tell it exactly when it is allowed to transmit), but I don't know if this is actually true. Given that no one seems to have come up with a synchronization solution involving them it wo...

xxiii

We've seen a problem on one of our links where in NV2, it would occasionally stall and either stop passing traffic or have very high latency, over the link even though it was still associated. This would occur approximately every 14 minutes (but not exactly the same each time). In 802.11 mode it was...

xxiii

I assume there has been no recent changes, such as firmware/routeros upgrade? My prime suspect would probably be the power supply, especially if it was a just barely adequate one to begin with (they tend to degrade over time). With four cards in there, its probably a bit demanding on power. Also, pe...

xxiii

Hi, sorry about late reply. Since you still have the one bridge in the middle, you may want to create an "A" VLAN and a "B" VLAN for the two subnets, which will eliminate broadcast processing on the "wrong" subnet (assuming the bridge in the middle will carry VLANs). Al...

xxiii

Are you using 5mhz channels?

I think it means you're getting 54mbps rate, except its divided by 4 because of channel size, so you're actually getting 13.5 mbps, but using the same signalling mode that "54 mbps" mode uses.

xxiii

You can bridge a vlan and a non-vlan interface together though, to add/strip tags between the two interfaces. Or bridge vlans from different interfaces together to change a vlan tag. (i.e. inbound packet with tag 10 on ether1 can leave ether2 untagged, or with tag 11). You could set up ether1 with a...

xxiii

We run RouterOS BGP to external AS with full tables. That router currently has an uptime of 80 days, on 4.10. However, we've pretty much isolated it from the rest of our network, and use static routes on it to the IGP routers. We would prefer that it would be a full participant in our bgp/ospf setup...

xxiii

You can also change it by editing the relevent route (0.0.0.0/0 for instance) and explicitly setting the Pref. Source. This can also be set using a routing filter for dynamic routes. It is a good idea for the router to have a loopback, and use the loopback's IP, for this sort of thing.

xxiii

Rather than disabling the interfaces, I was wondering if it became active when disabling the other routes (and if they all had to be disabled or only some of them). When checking the above you may want to add a logging rule for topic=route and see if there are any messages pertaining to when/why the...

xxiii

This is in the case of the USA, I don't know about other regions:

lower 900 contains a small unlicensed band, which is where the mentioned cards operate. I don't think there is any unlicensed spectrum in 800. 800 contains a lot of public safety and other licensed stuff.

xxiii

No, even BGP based VPLS still needs LDP

Is this still the case if using OSPF MPLS-TE?

xxiii

Does it go active if you disable 0, 1, and 2, and can you verify that you can actually reach 10.80.0.1, in spite of what it says? You may also want to look into putting all four of those routes in as one route with multiple gateways instead, not sure if that's how 3.30 works though (unless you are d...

xxiii

We had trouble getting this to work too. We were experiencing some other routing issues and weren't sure what the cause was so we backed out of MPLS, and we haven't gotten back to it, but I remember having lots of problems unless we enabled LDP.

xxiii

In the USA and probably other places you can use part of the lower 900mhz band, and there are very few channels, and I think the card part number is CM9, but I'm not sure who makes it at the moment. 900 can sometimes have too much interference to be useful (partly because it tends to penetrate thing...

xxiii

in what cases does your link speed change without unplugging the cable? is it really so often that you need special log entry? Not often, but handy to know when customer is calling you asking about bad link performance :) We have some sites that are very noisy RF environments, and they occasionally...

xxiii

netbios can work across routers that do not forward broadcasts: http://articles.techrepublic.com.com/5100-10878_11-5034239.html In particular, from the referenced URL: This is effective within a local network but is ineffective across routers, which do not forward broadcast packets. This means that ...

xxiii

I suppose next would be to try ftp or some other file transfer method, and see what speeds it gets.

xxiii

You might want to test it anyway to see if that is the issue. 400ms is quite a lot of latency. I'm making an assumption that its just getting backed up waiting for acks and the window isn't big enough to handle the delay. Does the latency change a lot (have high jitter)? that can mess up window size...

xxiii

You might be able to get away with that but I wouldn't recommend it and its not operating the cards (especially N cards) in the way they were designed to be operated. You would be better off using two cards, one 2.4 and one 5.8 and 4 omni-directional antennas, spaced physically as far apart as you c...

xxiii

I suppose there would be some bandwidth "lost" due to layer-3 ack packets having to come back the other direction, but its a pretty small amount, certainly much less than 50%. 802.11 does not reserve bandwidth, so if you have no traffic in one direction, you should be able to get full spee...

xxiii

I'll have to take a look at those, I saw discussion elsewhere in these forums about IPv6 DNS responses potentially not fitting in 512, and people upping the value, for instance to 4096, which means either that its really datagram, or they have increased their (or its assuming larger) MTUs. Occasiona...

xxiii

To clarify a bit, even though UDP broadcast packets are layer-3 packets, they are usually concerned with layer-2 information. For instance, an ARP packet requests information about what layer-2 address goes with a particular layer-3 address, and such a request would be useless beyond the router for ...

xxiii

I note that the configuration at the top of this thread shows both router ids are 0.0.0.0. Its possible that 0.0.0.0 for the router id really means "pick one of my existing IP addresses, and use that as the router-id", but i'm not sure if thats what happens with routeros or not; I always e...

xxiii

Are you routing between the interfaces, or bridging? Broadcasts (and some multicasts) generally only concern layer-2 issues (ARP packets for instance) and do not need to go beyond the nearest router. However, they should transition any bridged interfaces, and layer-2 transparent tunnels, unless they...

xxiii

I am assuming that in the DNS settings, the Max UDP packet size parameter really means datagram (which can be made up of more than one packet).

Can anyone confirm or deny this?

xxiii

While there apparently are some radios that can do that, I don't think this one can. The two antenna jacks are so you can run in 802.11N 2x1 or 2x2 mode. Ridiculusly flawed analogy: With two eyes, you can see depth that you can't see with only one eye. With 802.11n and two antennas, you can "se...

xxiii

Welcome to the wonderful world of 802.11 and marketing. Basically the 65 mbit is the raw low-level speed, before overhead has been taken into account, and 802.11 has significant overhead. This is why some alternative technologies seem slower, because those technologies quote the actual speed you wil...

xxiii

You may need to increase the TCP window size, google (or search engine of your choice): linux tcp window size

xxiii

I now have a theory. If the response comes from the radgroupreply table it adds it to the address-list. If it comes from the radreply table it doesn't. That doesn't seem to be correct behavior. radgroupreply and radreply are freeradius concepts. The radius client (the router) just receives a list o...

xxiii

One would hope that it contained the OSPF fix.

xxiii

Hm, interesting. It appears the current wiki documentation and the previously available documentation differ significantly in how to set it up. I think I understand why both methods work, but I shall study further. When doing it the "old" way, private IPs should be sufficient for the manag...

xxiii

Its sounding like MTU again, except it apparently works fine with the router's proxy, so router to the internet and router to your PC seems to be fine, but PC through router to internet is not. Make sure change TCP-MSS is enabled in your PPPoE client profile. I think you had the MTUs on your PPPoE c...

xxiii

Here is what I just created under existing features: Add configuration options to ping-watchdog to specify how many pings should be performed and how far apart before triggering a reboot. This can help avoid false positives when another node along the route reboots and doesn't get routing back up in...

xxiii

Try page 40 of this document:

http://www.fcc.gov/oet/spectrum/table/fcctable.pdf

xxiii

Oh, there is an extrememly narrow band starting at 3.65 for the usage I quoted. I'm not sure off hand what the licensing requirements are on either side of that band.

Have you checked at fcc.gov?

xxiii

Is there some reason you want them in the same network? I don't think it was meant to work that way.

There is the network(s) that are being redundantly served by vrrp, and then there is the management network that vrrp uses for its own housekeeping.

xxiii

In a VRRP test environment we have it set up like this (except with different IPs): ex: router1 ether1 vrrp common-switch router2 ether1 vrrp common-switch router1 ether1 192.168.10.1/30 router2 ether1 192.168.10.2/30 router1 vrrp 192.168.1.1/24 router2 vrrp 192.168.1.1/24 And router1 and router2 ha...

xxiii

Where are you? In the United States of America you need to get a license from the FCC, which will be non-exclusive and general purpose, and cover all your 3.65 links, then you can use it. I think you are supposed to declare the coordinates, and possibly the power level, of all your links also, and w...

xxiii

Could you be more specific about what you mean by confused? Regular tcp packets can have the ack flag and carry data as well. Perhaps this is causing the "confusion"?

xxiii

Sorry, typo, in unix land its a -s. I remember verifying that it was -l, but I forgot to actually fix it in the post. The windows firewall is great at protecting the rest of the internet from you (but not from any viruses you may have) :D I think the windows 7 (and vista) firewall by default does no...

xxiii

Where are those yin and yan IPs actually assigned? did you put them on the underlying interface, or on the vrrp-interface itself?

And are they a /30, a /24, or what?

xxiii

Another possiblity is to get your layer-2 provider to actually provide you with two bridges, an A bridge, and a B bridge. Then at every site one of your DSL modems and corresponding router interface are in the A bridge, and the other dsl modem and ethernet port are in the B bridge, and you use 192.1...

xxiii

Have you tried this yet? I believe stp/rstp should be able to handle the loss of connection with the ethernets to the dsl modems still being up, but stp may take upwards of 2 minutes to notice/correct.

xxiii

You've rebooted the router? Anything in the log? You could turn on pppoe logging and see if it says anything at the point of transition. You may actually need to use topic=pppoe,!debug,!raw or there will be flood of messages, but you may need debug to see whats going on, if it shows up in the log at...

xxiii

You should move the queue to the interface that is facing the clients. If you have: internet -> ether1 routeros ether2 -> clients then you should attach the queue to ether2 (or global-out). You can attach corresponding queues with their own limits to ether1 to limit traffic in the other direction. (...

xxiii

I've been trying to approach this from what could be different between your VMs, and unless there is a difference between the VMs handling of ethernet somehow, I don't see how it could be MTU. So on the packet sniff, are there any large packets, and which side was the first to not reply? Were there ...

xxiii

Of free ones, OpenNMS, nice graphing, auto-discovery, supports multiple snmp communities Nagios, hate the config file, but we can get it to fire triggers automatically (after much customizing) The Dude, nice maps, and real-time visibililty into routeros devices. This seems like 2 too many, but they ...

xxiii

Alternatively you could add a second antenna to each side for the second chain. Or two antennas on one side and a dual-polarity rocketdish on the other.

xxiii

It could be an MTU issue (which is usually the case when things seem to work except for websites, especially https websites), but that shouldn't change between the two VMs. Since your telnet test seemed to work from the router, but not the PC, it sounds like its either not NATting correctly, or not ...

xxiii

If there is an instantaneous demand for more than 100% (or 400% depending on how you look at it) cpu it could be a momentary problem that wouldn't necessarily show up as high cpu usage in general (perhaps the interface was operating at 400,000 packets a second, for 100th of a second). Is routeros co...

xxiii

stp/rstp might notice its down (via probe type packets), but I'm not sure. Its past my playtime so I can't look into it right now.

xxiii

Can you ping using larger packet sizes and see what happens? Sorry not sure how to do this but considering i have another 4.11 setup exactly the same not sure how this would be different between the 2. Happy to test if you can give me the command. /ping a.b.c.d size=1400 How much memory are you giv...

xxiii

I've just been reading up on vlans, and it appears vlan-0 really means not a vlan, but still tagged (according to the 802.1q standards); so this becomes a bit harder problem. You could bridge vlan-10 to the switch, but then we have to figure out how to only get the untagged packets injected into vla...

xxiii

Also, when you're testing, failover may take anywhere from a few seconds to upwards of a minute to occur at layer-2 (it should be quite fast if you use rstp rather than stp). If ospf then goes down as a result of that, there will be an additional delay while ospf comes back up. you can play with the...

xxiii

ospf can load-balance if the costs are the same, but since this isn't the case, load-balancing would be a bit more difficult to get set up. I suggest for now you just try the bridging suggestion and see how it works: On each routerboard, create a bridge with stp or rstp, put ether1 and ether2 into t...

xxiii

In rule tab under Switch, you can add a rule with Match, vlan, vlan header not present, which should then only apply the action to packets which don't have a vlan header. Additionally, I think if you set the new vlan id to 0, that means strip. You can kludge the input/output thing by using the Src a...

xxiii

If I understand whats going on correctly (the middle piece is your provider, who is transparently bridging together all of your DSL links at layer 2, and they are providing no layer-3 service in that bridge? the 192.168.0.0/24 is purely your construction? And your OSPF is only between your routerboa...

xxiii

In queue tree, make three queues, A parent queue for the outgoing interface (whose parent will be the interface, or possibly the global one), with limit matching the bandwidth of the interface, then one for him, and one for everyone else, that both specify the first queue as their parent. Use the pr...

xxiii

I would echo that you should try to do this with routing, but in the PPPoE profiles, you will see that you can in fact add the PPPoE interface to a bridge dynamically (not that you should, usually). One of PPPoE's features, unless you're only using it for authorization, is to create an isolated poin...

xxiii

Sorry, I got distracted several times while composing that last response, I see you already posted some of what I asked for, and I didn't read your problem carefully enough. So ping to the internet works, but not web pages, and this is the case with both 4.11 and 5.0rc1 on your notworking vm? Can yo...

xxiii

You have this line in your notworking one that isn't present in the working one, but it doesn't appear it should be making a difference (unless you're using 192.168.88 somewhere else) add address=192.168.88.1/24 broadcast=192.168.88.255 comment=\ "default configuration" disabled=no interfa...

xxiii

Your line that says: add action=remote disabled=no prefix=inxwrlsap- topics=\ info,critical,error,warning Means to log only events that have all four of those topics. You need to put four separate rules. It is occasionally handy to be able to select multiple topics, for instance if I only want to se...

xxiii

I'm guessing packets are being received faster than the device/router can process them. 337 Mbps / 50,000+ pps is nothing to sneeze at, especially if you have firewall rules. Also do you have any queing going on? What type of device/processor is it? If the RX dropped is a very small percentage of th...

xxiii

Generally speaking, bonding happens at a lower level and can potentially more smoothly load-balance. It should generally also guarantee in-order packet delivery. Bonding can load-balance at a sub-packet level and increase throughput for a single stream of data. Bonded interfaces appear as one higher...

xxiii

Rumaging around in one of our routerboards that has the switch chip, It appears that it can assign untagged to a specific vlan.

xxiii

Have you tried bridging the underlying interface somewhere and then using a bridge firewall rule to strip off all tagged traffic? Just a thought, I haven't extensively looked at the bridge filters to see if they can be easily convinced to do this. You might be able to do someting in conjunction with...

xxiii

To your earlier question, yes PPPoE (in Mikrotik routers) can do rate limits. PPPoE may help with the different gateway situation, but thats a complicated discussion. General Hint though, create as many IP pools as gateways, and using sufficient radius server, assign each customer to be allocated fr...

xxiii

Observation suggests that the ip pools work by always assigning the last free IP in the pool. If a client disconnects and rapidly reconnects, Its probable that the IP they just freed will happen to be the next available IP when they reconnect. If this isn't acceptable/desirable, you could possibly d...

xxiii

Are you sure the real traffic is steady and not bursty? What happens when you look at the graphs for the other side(s) of the link? (ethernet side and/or radio side?) Is this from the ETH interface of the bullet, or the ETH interface of whatever the bullet is plugged into? If its plugged into a rout...

xxiii

Keep in mind the ethernet ports on the 433 are only capable of 100mbit each way.

What do you get when you run a UDP bandwidth test directly from one router to the other? (receive, send, and both)

xxiii

I just found in my email a response from Mikrotik (I should have finished going through my email before posting; I've been off for a couple days), that they've been able to reproduce what we've been seeing, and it should hopefully be fixed in 5.0rc2 (or possibly the version after that).

xxiii

http://forum.mikrotik.com/viewtopic.php?f=14&t=43677 To amend what I said in that post, we've now seen issues in various 4.x versions as well. As far as we can tell, (echoing the response you posted) an OSPF state change occurs somewhere in the network, and this causes various other routers to c...

xxiii

You have a number of these sort of networks: /routing ospf network> add network=10.100.101.0/32 area=backbone Where I suspect you meant either /30 or /24 depending on how you've divided up your address space. It appears you're using a /30 out of those blocks as your transit links? Depending on what ...

xxiii

You could pre-generate a bunch of vouchers and just hand them out with the receipt, or on request, when the customer buys something. (unless you're specifically trying to collect email addresses).

xxiii

You should have the antennas physically separated, at least several inches, up to several feet depending on how far away your clients are going to be. There is not an exact distance required/necessary.

xxiii

If your point to multi-point equipment will pass vlans, then yes, you can use vlans.

In winbox, just open interfaces, then click on VLAN tab. After you create a vlan it will appear as an interface, and you can assign IP to it, or pppoe client or whatever.

xxiii

If I understand what you're asking, open wireless settings, click on advanced mode, go to wireless, set band to one of the Only-N modes, go to data rates, change to configured, turn off everything, go to HT tab, make sure extension channel is enabled, go to HT MCS tab, make sure the ones you want ar...

xxiii

/interface ethernet

Unfortunately, this particular option is in the form of a double-negative.

xxiii

See if you can netinstall it. It sounds like the flash might be corrupted or erased.

xxiii

Assuming neighbor discovery is enabled on the relevant interface, it sounds hung and probably needs power-cycled. After that, you could enable the watchdog, and possibly the ping watchdog (there are two watchdogs), and hope that is able to recover it if it happens again. What version is it running, ...

xxiii

You've enabled both chains, on both sides, with two antennas or a dual-polarity antenna (is this what that "duplex" antenna you mentioned is?), and you're using the extension channel with 20mhz width? Look at the tx/rx datarates and see if they are at the max. what are you using to speed t...

xxiii

Instead of running hotspot on each access point, you can have a master hotspot controller that all the access points go through.

xxiii

Is there packetloss between the 450 and the client? How many entries are in your ARP table when it starts having problems? If you only reboot the 450 and nothing else, do the problems go away for awhile? Is it a consistent amount of time before the problems start up again, and how many devices are a...

xxiii

Its a layer-2 retransmission, as opposed to layer-3.

xxiii

http://www.mikrotik.com/testdocs/ros/2. ... ontent.php

Its supposed to be at the below URL, but currently isn't, so use the above link and read the stuff and example about policy routing.

http://wiki.mikrotik.com/wiki/Policy_routing

xxiii

Its basically a matter of routing, and whether or not you are using NAT, and do both ADSL routers go to the same place, (and do you control that place). Assuming the DSL routers each have their own public IP out to the internet, and you're using NAT, and not using BGP/OSPF, you need to change/add yo...

xxiii

Or send the logs to a remote syslog, which is handy if you have several routers and you want to see all the logs in a central place. (although any log entries sent if/while the remote syslog is unreachable will be lost).

xxiii

If I understood you correctly, it sounds like you just want to bridge ports 1 and 5 together? In which case, do so; you will need to create another bridge. (and you should move any configuration on port 1 to be on that bridge instead).

xxiii

Any possibility of getting more specific error messages?

xxiii

I just took a quick look at some accounting records for PPPoE and they seem to be starting over from 0 for each connection just fine, from a 5.0beta6 router. Are these from PPPoE connections or some other type? Also, it appears you're using freeradius. Double-check to make sure its not configured to...

xxiii

I'm guessing the issue is that you (and abeggled) probably need a policy route to send traffic out the correct interface based on the source-ip, or ingress interface. You probably have a 0.0.0.0 route that goes out one of your WANs? For testing, you could just add a temporary static route to whereve...

xxiii

Set it to 20mhz, then go to the HT tab and enable the extension channel.

xxiii

Your upstream should be willing to give you as many IPs as you can justify, in this case you should be able to get a full /24. But anyway, there might be a way to get NAT to use more than one IP in a round robin fashion, otherwise, depending on how your customers are connected, you could do somethin...

xxiii

Regarding the ping issue, I noticed you used a 10ms interval, which in the case of routeros means any replies that take longer than 10ms will be counted as loss. (and will also not show up in the max column, which I notice was 8, so its possible that 12% of the packets had a longer than 10ms respons...

xxiii

Are you doing NAT then? You should probably start assigning each customer their own public IP; either statically, via PPPoE, or via DHCP, and let the customer router or CPE do the NAT.

xxiii

I should mention that some protocols don't get along well with NAT, such as SIP and Windows file sharing, although they'd likely still have problems if you only had one WAN. And, some external sites (SMTP servers for instance) may not like it if DNS/reverse-DNS doesn't match up (you could create cor...

xxiii

so: (with made-up ip addresses) all in the same router, 1.0.0.0/24 -> ether1 metric 2 2.0.0.0/24 -> ether4 metric 1 192.168.200.1/24 -> ether2 -> your servers and clients You dstnat to your servers and masquerade/srcnat your clients? And connection tracking is on? If you setup the rules right, nat s...

xxiii

If you are going to be using OSPF or BGP then it will come in handy. It also provides an IP address that belongs to the router, rather than one of its specific interfaces, and will always be "up" as long as the router is up; which lets you (or BGP, for instance) reach the router through an...

xxiii

So one session goes 2mbit, but 20 gets 22mbit over the same link in the same direction?

Are there any queues or firewall rules? Or a rate limit in the wireless profiles?

Are you FTPing directly to the routerboard or to something behind it?

xxiii

You probably need to rethink how the IP addresses are assigned, or you need a more specific route that overrides the DAC one for the PPtP server, or use a vlan, or run PPtP on both failover routers (depending on how you set up the failover).

xxiii

Kinda depends on how they're blocking it. You could use change the ports (or use nat rules to change the ports) to something they're not blocking, or create an IPIP tunnel, then create the vpn through the tunnel, or some other type of tunnel. You may have to combine these, depending on how they're b...

xxiii

For simple cases, you can use the distance value in the routing table to control which routes have preference for outbound. As for the rest its hard to tell what the issue is without knowing more about your situation, for instance do you have your own IP addresses, or do you have different public ad...

xxiii

The TCP test has trouble reaching full throughput unless you use several sessions, especially on devices with wimpier CPUs. You may notice the CPU usage on one or both sides go to 100% while its running. We have a hard time fully trusting it as a result. The UDP test will probably give you a good id...

xxiii

I would suggest you create a loopback interface (see the wiki) with a valid IP, and use that as your local address. The local address should be a valid IP for the router, but no, it does not need to be in the same network. Depending on what you're doing with the router, the loopback IP can be used f...

xxiii

Is there anything between your pc and the router that might be blocking ICMP? and/or not jumbo capable? Assuming its not a bug, either the packets are being discarded by something that is not jumbo capable (or enabled for jumbo) and/or something has a lower MTU and its ICMP too large responses are n...

xxiii

Yes. See my posts in

http://forum.mikrotik.com/viewtopic.php?f=2&t=45185

And make sure you enable both hotspot and ppp in radius, and in their respective authentication sections.

xxiii

And did you configure DNS on either the router (/ip dns) or in the PPP profile?

xxiii

The CCQ in the other direction isn't necessarily 100%. If the client you're using supports reporting the values back to the AP, (which apparently it doesn't in this case), the CCQ box would show something like 100/100, one of which would be the CCQ from the AP to the client, and the other would be t...

xxiii

Just the confirmation I wanted. So when the PPPoE user authenticates the don't get the hotspot login in page right? Right, PPPoE users have no idea there is a hotspot. At least the way we set it up, which is we give the router a loopback address and use that for the local address in the PPPoE profi...

xxiii

See if there are supouts or autosupouts on any of the routers.

Also, if you're using OSPF have you noticed if your OSPF sessions are dropping or resetting? (check the adjacency time in the ospf neighbors).

xxiii

Upon re-reading this thread more carefully: how can I access the hotspot html page if login using pppoE? We don't do this, as we prefer hotspot OR PPPoE, but you could try making a bridge, adding the hotspot interface to the bridge (and run the hotspot on the bridge), then in PPP profile, specify th...

xxiii

We have a couple places where we run PPPoE server and hotspot on the same interface at the same time, and it works. As far as the interface/hotspot are concerned, PPPoE server is a layer 2 thing, while hotspot operates at layer3 for the most part. Why would we want to do this? because in this situat...

xxiii

We are have lockup up problems on RB532 and related boards We tried nv2 on an rb532 and didn't work very well. Wouldn't stay associated for more than a few seconds if I recall properly. I'm not sure if it was the 532 or the wireless card (probably an r52 or r2). Its since been replaced with an 433A...

xxiii

We've had a number of 750 routers fail in various ways, (I think it was usually ethernet port problems), enough that we're avoiding them now, I don't have the details off hand, or whether they were all G models or not.

xxiii

I was going to suggest you downgrade it if you can't get the license updated in time, but from that screenshot it appears it has no license at all.

xxiii

WatchDog Timer will trigger if an IP address is specified, even though enabled is unchecked. There are actually two watchdogs, which isn't entirely clear from the winbox interface. One, controlled by the enabled checkbox, which monitors the router itself, and the ping watchdog, which monitors an IP...

xxiii

In terms of specific requests, we need:

BGP recursive lookup to work correctly when link-local addresses are involved.

ipv6 pool functionality for pppoe. Specifically, I'd like the ability to say something like "here is a /56, hand out /64s from it".

xxiii

I would suggest avoiding /128 (and the /126) and using /64 instead, even for loopbacks. ipv6 isn't really designed or meant for the lower /64 to be subnetted any further. Note however if you do use /64's cisco has an opposite problem (I presume because of backwards compatibility with their implement...

xxiii

Ok, been running it for a couple of weeks, and so far I love it, when it works. It has higher throughput with more stability, However, under heavy traffic the client radio seems to lock up. Wirelessly, everything appears to be fine, but my bgp peer dies, and no traffic seems to pass. I can see the A...

xxiii

Can you try assigning an administrative mac address to bridge1, and see what happens (particularly if DAC entry(s) appears for your vlans in /ip route)

xxiii

Last I heard, you also need to disable SNMP when doing large BGP (or possibly even small) tables.

We are finding this extremely inconvenient.

xxiii

What are the states of the vlan interfaces and the ip addresses when its not working? does anything show invalid (have an i in the leftmost column in winbox, or possibly be colored red)?

What about the bridge?

Can you ping the 10.10.10.29 address from the routerboard itself?

xxiii

We are seeing numerous routing lockups in 5.0b4 and b5, and I'm wondering if anyone else is? The routers in question are running BGP with ipv4/ipv6/l2vpn protocols distributed over an ipv6 peer link. The routers are also running OSPFv2 and OSPFv3. OSPF is handling loopbacks and links, BGP is handlin...

xxiii

We too are seeing a constant rise in memory consumption on an x86 dual-core router taking full ipv4 and ipv6 routes from one peer in another AS. It is also the sawtooth pattern with a general rising trend. It seems to be losing around 3 or megabytes per day. This router is running BGP with ipv4 in o...

xxiii

Most people so far seem to be looking at this from a throughput point of view; I'm more interested in the reliability point of view: Here is a too brief ping test I performed just now: NV2: Ping statistics for 10.23.22.1: Packets: Sent = 100, Received = 99, Lost = 1 (1% loss), Approximate round trip...

xxiii

Just tried a little experiment: Two 4.9 routers, each rb433AH: ping to self (loopback bridge): xx.xx.xx.68 64 byte ping: ttl=64 time=2 ms xx.xx.xx.68 64 byte ping: ttl=64 time=9 ms xx.xx.xx.68 64 byte ping: ttl=64 time=1 ms xx.xx.xx.68 64 byte ping: ttl=64 time=9 ms xx.xx.xx.68 64 byte ping: ttl=64 ...

xxiii

I think your dreaming if you think any company can release fully bug free software every go? But a company can have a battery of tests that they run every new release against to ensure nothing broke. Every time an issue is reported you add it to the test battery. After a while you have a huge numbe...

xxiii

xxiii: this is because a small random jitter is subtracted from protocol timers, to avoid accidental unneeded synchronisation. For future reference, more info (anyone who sees this thread and is curious): http://tools.ietf.org/id/draft-ietf-bfd-base-11.txt sections 6.8.7 and 6.8.9 I'm cautiously re...

xxiii

I added a tcp bandwidth test to my little test setup and left it running all night, which claims to have the CPU on both sides at 100%. On the receiving side we have: Flags: U - up 0 U state=up address=192.168.101.51 interface=ether1 protocols=bgp multihop=no state-changes=1 uptime=4d3h26m50s desire...

xxiii

I've had a 450g and a 433ah on my desk running a bgp, and a bfd all weekend, and they've been fine: 0 U state=up address=192.168.101.50 interface=ether1 protocols=bgp multihop=no state-changes=2 uptime=3d5h16m58s desired-tx-interval=0.2sec actual-tx-interval=0.2sec required-min-rx=0.2sec remote-min-...

xxiii

You could try adding a logging category of route,debug and see if anything shows up in the log.

xxiii

So router2 was pingable from router1, but router1 said that router2 was unreachable in the routing table entries (until you rebooted router1?)

Was the check gateway thing set to arp, ping, or not enabled?

xxiii

We experimented with this between x86 based routers and had OSPF and/or BGP sessions bouncing up and down constantly. turn off BFD, and everything stabalizes. This was over short fast ethernet links with 0 packet loss. So, we've concluded its just not ready yet. Alternatlivey, perhaps 0.2 seconds is...

xxiii

Are you using OSPF, RIP, static routes, or what?

xxiii

I also had to do a similar procedure to fix the missing/invalid oids, using the Mib Nodes entry on the left, and the files tab of the resulting dialog, and all the contents of: "c:\Program Files\dude\data\files\mibs" (In particular, you want mikrotik.txt if you're using The Dude with Route...

xxiii

Here is what worked for me to restore the fonts: Open Dude client. In the tree on the left side, find files, menu-click on it (typically the right mouse button), and select "Open Separately". In the new dialog that appears, click on + sign. In the file requester, navigate to dude font loca...

xxiii

I'll second that. At least on my x86 based test machine, enabling routing-test results in the failure of ospf-v2, and lots of "action timed out" messages in the terminal when trying to look at anything related to ospf-v2, or when doing an /ip route print. This is the case in 3.13, and 3.14...

xxiii

Ok, I'm confused, as you said: i used 3 routers, 2 as my pppoe clients, and one router that does load balancing. The Mikrotik PPPoE client can also generate broken rules, and SSL and anything trying to use full sized packets (P2P) are where you would be likely to see the problem. 2 questions: If you...

xxiii

Have a router with the following route table entry: 3 ADo dst-address=0.0.0.0/0 pref-src=xx.yy.zz.50 gateway=xx.yy.zz.65,xx.yy.zz.93 interface=1-dsl,2-dsl gateway-state=reachable,reachable distance=110 scope=255 target-scope=10 route-tag=0 However, the router is sending ALL traffic out only the 1-ds...

xxiii

I see you are using PPPoE. This is possibly the actual culprit. See "PPPoE dynamic mangle rules are broken" http://forum.mikrotik.com/viewtopic.php?f=2&t=17362&start=0&st=0&sk=t&sd=a for a discussion of the issue and a workaround/fix. SSL connections in particular are v...

xxiii

Just wondering if any progress on this? The situation is the following: A router receives an snmp request on ether1, and should send the response out ether2. According to the packet sniffer on said router, it receives the request and generates a response. According to a log rule in the firewall outp...

Search found 234 matches