MikroTik

lz1dsb

I was able to actually trace down the issue. It's the IP Firewall. In the new configuration I've used the default IP Firewall settings with Interface lists. So I've used a LAN list which includes only the local LAN bridge interface. And at the end of the ruleset on the I've put to deny everything wh...

lz1dsb

Could you share a configuration from both ends to check it out?

lz1dsb

Here's the situation: 1. I'm using IPIP tunnels between my routers which are encrypted with IPsec. 2. I'm doing this with the IPsec password option on the IPIP tunnel configuration and the default IPsec policies. 3. This works fine, and it has been working for years. 4. Recently I've changed the har...

lz1dsb

Looks like your default backbone area on the Router OS is being disabled:
/routing ospf area
set [ find default=yes ] disabled=yes
add area-id=172.16.117.0 name=area1

Could your try to enable it?

lz1dsb

I checked in my older attempts to make GRE/IPsec work over NAT, and I see that I never got IPsec transport over NAT to work. I'm not even sure it is possible. As a workaround I used GRE over IPsec tunnel, and it worked. But you tried that already. It is correct that you need to specify the local ad...

lz1dsb

I tried to change the policy on the RouterOS like this: /ip ipsec policy add comment=dup-001-router-1 dst-address=192.168.0.0/24 proposal=dup-001-router-1 protocol=ipsec-esp sa-dst-address=213.149.143.84 sa-src-address=77.70.67.28 src-address=77.70.67.28/32 tunnel=yes but still int he ipsec debugs i...

lz1dsb

So after changing both sides to tunnel mode, I've found the following into the RouterOS debug: 20:01:20 ipsec,debug proposal #1: 1 transform 20:01:20 ipsec,debug got the local address from ID payload 77.70.67.28[0] prefixlen=32 ul_proto=4 20:01:20 ipsec,debug got the peer address from ID payload 192...

lz1dsb

It turned out it's working, but I have issues with the end hosts. The reason I need Multicast routing is for DLNA. It turned out though some DLNA clients use different ports in requesting content. That's the reason why it was not working. So I have to figure out a way now to change the end client be...

lz1dsb

I have been struggling for the past couple of days with a reletively simple setup. It didn't work, so I have decided to emulate it in GNS3. Sure enough I've got the same result like in the real network. So here's the situation 1. A Cisco router behind a NAT device 2. A Mikrotik router (emulated with...

lz1dsb

Any ideas on how to further troubleshoot that?

Regards,
Boyan

lz1dsb

An update: Both routers see each other as PIM neighbors: [bsotirov@Mikrotik1] > routing pim neighbors print ADDRESS INTERFACE PRIORITY TIMEOUT 10.82.79.2 Tunel-rtsf79 [bsotirov@Mikrotik2] > routing pim neighbors print ADDRESS INTERFACE PRIORITY TIMEOUT 10.82.79.1 Tunnel-rtsf82 I have also allowed IG...

lz1dsb

I'm puzzled by a relatively straight forward setup. (Multicast client)192.168.82.50 -----------------192.168.82.1MikrotikRouter10.82.79.1--------------IPIP Tunnel---------------10.82.79.2MikrotikRouter2192.168.79.2---------------192.168.79.1 Multicast source So, I've got PIM enabled on the local bri...

lz1dsb

So here's how I was able to solve this. As I saw in several guides and videos, the bridge interface that's associated with the CAPs Manager should have STP disabled. I did the same with the CAP bridge interface. After doing that I was able to get it working. So I guess it might have been the STP tha...

lz1dsb

I have recently configured a CAPsMAN setup. I've got it going, my CAP is provisioned correctly with both wireless interfaces managed by the CAPsMAN. But the thing is... whey I try to register with a wireless client, I'm able to, the wireless registration succeeds, but the client does not get an IP a...

lz1dsb

I upgraded all of my Routerboard devices from 6.36.3 to 6.37.1 with no issues, no additional restart was necessary. Here are the models:
RB951G, RB951Ui, hAP ac, wAP, wAP ac

Boyan

lz1dsb

Yes Lakis, I agree. That's the reason why basing your security policies only on MAC address information is not a good idea, as it could be overcame easily :) But if the author of this thread would like to apply that for a network with a bulk of clients, most of them non-managed, this is a way of doi...

lz1dsb

I don't think you need to write elaborate scripts to achieve that. The menu /interface bridge filter has the option to configure filter based on source and destination MAC address and you also have a mask option, so you should be able to filter specific OUIs, and hence filter the source Ethernet fra...

lz1dsb

Any ideas... Either I'm missing something, or this is not possible with RouterOS, which would be quite surprising...

lz1dsb

I'm puzzled with the following setup. Currently I have a router that's connected via two ISPs. One of them is primary, the second one is backup. Over the primary ISP I have a static public IP address and I have built an IPsec tunnel to my main router. I would like to have a second tunnel (something ...

lz1dsb

A few days passed and here are the lessons learned: 1. If you apply an existing configuration, it's better to use an export to a file. Than work with the file that RouterOS generates. 2. Test your configs with the import function. I found that RouterOS will implement the configurations up to an erro...

lz1dsb

I'm trying to use the Flashfig program to upload a configuration to a RB962 (hAP ac) router. This feature is quite interesting but I've got the following issues so far: 1. I used an export from the router to copy the configuration I would like to upload. It's a production router I would like to clon...

lz1dsb

I can now confirm that this was caused from an interference from other channels in the 2.4GHz band. It's solved.

lz1dsb

This seems to be a problem not on the hAP itself but with the radio spectrum. I changed the channel and the performance is not back to normal. I'll monitor it in the next couple of days. Man 2.4GHz band is just so crowded these days...

lz1dsb

I recently upgraded my hAP ac router to RouterOS version 6.36. I had some issues with it though, but I solved them: http://forum.mikrotik.com/viewtopic.php?f=2&t=110702&p=550035#p550035 Now I notice a terribly low performance on my 2.4Ghz interface. Fortunately I still have the 5Ghz link run...

lz1dsb

Yes,
I did that and I was able to upgrade the router. I t broke though, so I had to recover it via MAC WinBox.
Long story short, it works now, but I notice terribly low performance on my 2.4G interface. I'll open another thread for that.

lz1dsb

[root@router] > system package update install channel: current current-version: 6.35.4 latest-version: 6.36 status: ERROR: missing wireless-fp-6.36-mipsbe.npk I tried to upgrade today my ...

lz1dsb

Yes, that is correct.
So does that mean I have to disable all the other rules in the forward chain?
I read about IP Accounting feature in Router OS, but it seems to me it's not very granular. I cannot set it to just count particular traffic...

lz1dsb

/ip firewall filter add chain=forward comment="!!!!ICMP Tests!!!!" dst-address=<dst-address> protocol=icmp src-address=<src-address> This is the particular rule in question. I would like to count the ICMP packets through the Mikrotik router. So I start an ICMP session with 10 pings, only...

lz1dsb

I noticed recently that when I use the following command:

ip firewall filter print stats

it counts only the first packet (and bytes) in the session. Is that an expected behavior?
I'm running RouterOS 6.35.1

lz1dsb

Thank you for clarifying this.
Are there any references who describe the firmware features in greater details?

Regards,
Boyan

lz1dsb

Is there a way to mark this thread as closed? The interface has changed recently...

lz1dsb

Cha0s that's a spot on!
I mistakenly used telnet (which is disabled on the device) but I've put the correct port that is used for the SSH service. So normally this is what I get, that the port is opened.
So that's it, problem solved. Thank you so much!

lz1dsb

Normis,
I've just checked it from my Linux machine...
bsotirov@NUC-desktop:~$ uname -r
3.13.0-88-generic

It woks fine. So it's definitely dependent on the source where the SSH is initiated from...

lz1dsb

I'm not sure exactly what happened to it I'm the original poster (forgot about this account actually). Here's some info, it appears it's part of the 802.11e QOS standard. https://en.m.wikipedia.org/wiki/IEEE_802.11e-2005 That is interesting. It is interesting that the AP could control the multi...

lz1dsb

Connecting from what kind of OS ?

I connect from RouterOS version 6.35.2

lz1dsb

I was wondering... how many spatial streams are supported on hAP ac?
The brochure says it's a triple chain:
http://routerboard.com/RB962UiGS-5HacT2HnT

But is it capable of supporting 3 spatial streams? Otherwise the gain from an additional chain would be marginal...

lz1dsb

Recently I discovered that I have the following strange behaviour on one of mine RB951 routers. When I tried to connect via SSH, I've got the following output: Trying XXX.XXX.XX.X... Connected to XXX.XXX.XX.X. Escape character is '^]'. SSH-2.0-ROSSSH Connection closed by foreign host. Welcome back! ...

lz1dsb

I recently got into discussion with a colleague about the MikroTik firmware. I realized that I know very few about the firmware. So far I had usually upgraded the firmware after a RouterOS upgrade. But..what are the functions implemented in the firmware? Is it just a boot environment to boot and tes...

lz1dsb

That's a pretty old post. I'm going through a classic book on wireless "802.11 Wireless Networks: The Definitive Guide, 2nd Edition" and I read about this function. I didn't even know that such an option exists. Though the book is old, I don't know what happened with the PCF eventually... ...

lz1dsb

In no small part, thanks to your posts in the forums :) The wiki needs a TON of work. I could even help - with my limited knowlege - because a lot of it is simply poor grammar and/or careless typos. But - against the whole point of a wiki - it isn't open to editing. I could understand your frustrat...

lz1dsb

Out of curiosity, why not just use the network statement to originate the prefix properly? Because the summarization function of BGP didn't work for me and I created an unreachable static route, which than I advertise via "redistribute static". It's crazy I know, but this is the only opti...

lz1dsb

v7 has been expected for more than an year as far as I could remember

lz1dsb

That's a nice presentation put up very well.
But still the connection tracking is missing as a feature in RouterOS, which means that if you do NAT, you're not able to synchronize the active sessions and in case of fail over to continue without a disruption.

Regards,
Boyan

lz1dsb

I'm a bit confused now. Wasn't the thread about multiple DHCP servers?
From what you described, I don't think you need that. You could always match traffic based on a source IP address, mark it and put it in an outbound queue.

lz1dsb

Whether it's bridge or a physical interface, it does not matter. For each individual DHCP server you have to assign an interface. A bridge in the sense of Router OS is a logical interface that runs RSTP (by default) and is interconnected logically (L2) to other ports (whether ethernet or wlan, it do...

lz1dsb

You can have multiple DHCP servers.
In order to use them simultaneously though, you need to bind them to different interfaces, in your case bridges.
If you could share a sample config and a drawing of what you're trying to achieve, we would be able to be more helpful.

lz1dsb

I was using a Qemu image for quite some time now but I decided to start using the CHR images, which are not available from Mikrotik. So I downloaded a .vdi image and prepared a virtual machine in VirtualBox. Than I added it to a GNS3 topology, but than... I found I'm not able to start the console! H...

lz1dsb

No, there is no option to set origin in filters. You can only force 'igp' by adding bgp network or set specific origin on static routes. Thank you for confirming this. I was expecting it. I have done this in the past with a static route where the BGP origin is specified. I guess, this is not someth...

lz1dsb

Has anybody found a way to set the BGP origin attribute in RouterOS via routing filter? I don't see an option to do that. The only way I was able to that is via a static route where I have an option to set the origin attribute, but such option is not available in a routing filter. It's not that that...

lz1dsb

shaoranrch has summarized it pretty well. This is exactly the type of connectivity I would use. It's pity RouterOS does not support inter chassis redundancy mechanism though. For such High Availability scenario it's handy to be able to synchronize the NAT sessions for example.

Boyan

lz1dsb

And why do you need VRF?
Who advertises the public network? If it's not you and it's the ISP doing it on your behalf, your options are limited. I'm a bit puzzled what you're trying to achieve. Could you prepare a small drawing and elaborate a little bit...

lz1dsb

MPLS stands for Multi Protocol Label Switching. It's technology originally crafted for the Service Provider. It provides a lot of efficiency and flexibility, which is the reason why it's widely used in the Service Provider networks. Nowadays MPLS is also being deployed in Enterprise and even small n...

lz1dsb

im using 6.29 on rb951Ui and rb 951G without issues

maybe specific problem on rb2011??

I'm using 6.29.1 on both RB951Ui and RB951G - no issues at all. It must be a something specific...

lz1dsb

Which address do you ping? Is it an address of the router itself? If you ping an address of the router, your should be checking the Input chain. Forward chain is for packets passing through the router...

lz1dsb

Hi I have a hosted centos 6 server. I cannot install routeros via KVM or ISO. How do i install it? tx You can run RouterOS as a QUEMU image. I use to do it regularly in the past, it's nothing special. You install the RouterOS image, and then you could just run it. The sweet thing is that you could ...

lz1dsb

We recently had an issue with an old SFP on a CCR1036 router. According to the output from RouterOS, the SFP was manufactured in 2004. So this SFP was replaced, but again with the same model from the same batch, i.e. it's again manufactured in 2004. The exact model is: SFP-1.25G-1310 And I was think...

lz1dsb

But how do you define "random hosts"... You can block the ICMP traffic, you can also limit it. In your case you could probably work with ranges of IP addresses. But again, what would be a "random host"...

lz1dsb

That's interesting. I've done this several time on CCR1036 and on RB915, no issues. On the CCR I've done it only through the command line interface, I don't know if it makes any difference.

lz1dsb

It's a long post... Anyway the first thing I would do is to capture the traffic from the IP phone. Try to understand how the phone establishes the connection to the Softswitch. I also have a company IP phone at my home, it is behind a MikroTik router which does NAT and Firewall. I didn't have to do ...

lz1dsb

Hi all, Currently I'm using RB2011UiAS-IN for different tasks: Router, NAT, Firewall, Web Proxy, VPN Server (PPTP) for now about 30 PPTP connections, Two WAN (100Mbps) Load Balancing, some Mangle rules. The router behaves well but very soon, in about 3 weeks the PPTP connections will grow to about ...

lz1dsb

Your /ip firewall nat rules look correct to me: /ip firewall nat add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway add action=dst-nat chain=dstnat dst-port=3389 in-interface=ether1-gateway log=yes protocol=tcp to-addresses=\ 192.168.1.30 to-por...

lz1dsb

Hi! The example is not the same - in this example you have 3 tagged vlans going into - and no default untagged vlan (like in my example - vlan 1). I would like to know how can I be 100% shure that everything is isolated completely - for example I would like to force Access ports to be only for unta...

lz1dsb

This is not a big deal I think. Mikrotik is very stable and can run years but what advantage does it have? I have learned it is bad to have such a long uptime. It means your router is not updated and running old software. So vulnarabilities are not solved. Long uptime is to me... an impressive achi...

lz1dsb

Looks good.
Do you have a command output? I find it easier to have configuration excerpt...
Here and example for the CRS configuration:
http://wiki.mikrotik.com/wiki/Manual:CRS_examples#VLAN

lz1dsb

That's cool. I'm glad we've fixed it

lz1dsb

Wow, this thread has gotten quite long...
What is the situation right now? Did you get it working?

lz1dsb

Hm... that's strange, could you post an excerpt from the EoIP and the related configs?

lz1dsb

Yes, I did post your config. I was just wondering what the goal is. Now it is more clear. Ok, so you can create another VLAN with vlan-id let's say 7. Attach that VLAN to the port you want it to be trunk. Than add this new VLAN to your LAN bridge. This is how your traffic from the LAN will be also r...

lz1dsb

So you use the embedded switch chip: /interface ethernet set [ find default-name=ether1 ] comment=WAN set [ find default-name=ether2 ] comment=LAN name=ether2-master-LAN set [ find default-name=ether3 ] master-port=ether2-master-LAN set [ find default-name=ether4 ] master-port=ether2-master-LAN set ...

lz1dsb

OSPF is a routing protocol which in general distributes IP Layer 3 information in your routing domain i.e. reachability information for all of the subnetworks you have in your network. How to use it? - just enable the process and advertise all of the subnetworks that you want to distribute, even the...

lz1dsb

With a simple topology like this, I would start with static routes. You only need to add two routes at each site. The WAN IP Address is DHCP (i.e. Non-Static) on both LAN 1 and LAN 3. So you set up your server at LAN2 and the routers at LAN1 and LAN3 will act as clients, establishing secure connect...

lz1dsb

How do you make the routing... First you select the routing protocol. Second you enable the routing process. Third you enable it on the interfaces you want it to run. Fourth you select the local networks you would like to advertise. If you give me more details (interfaces and networks) I could be mo...

lz1dsb

The setup on a CCR would be a bit different. You'll need to create the vlans, assign them to the interfaces and bridge the tagged and untagged ports.

lz1dsb

A way to expand your wireless coverage is to use WDS - Wireless Distribution System. Basically you could configure your AP to associate as a client to an SSID, and connect other clients to itsef using the link to the main AP as a backhole. The thing with WDS is that it's not standardized. I've used ...

lz1dsb

I don't know what do you mean by "bridging". As per your description, you use different IP subnets in the three LANs, so in that case if you "bridge" them (this is a Layer 2 operation), the hosts in the three sites will not be able to communicate, as they're configured in a three...

lz1dsb

"24/7 is no problem for these units as long as your bandwidth expectations are reasonable." I especially liked this comment. That's important with WiFi p2p links as the weather conditions could seriously deteriorate. For p2p links you could also use the Mikrotik wireless protocols, they sh...

lz1dsb

Could you also export your config?
Just run export in the CLI. It will generate a text file, which is much more compact and easier to work with. You can remove any sensitive information from the export before posting it off course.

lz1dsb

"My ISP provides me with internet (untagged VLAN1) and IPTV (untagged VLAN6). Update: Got on call with ISP - could be untagged VLAN1 for Internet and IPTV (untagged VLAN6), but dude is not certain." You cannot have both VLANS as untagged. Untagged means plain Ethernet frames, if there's no...

lz1dsb

Apparently, this is how you could do it...
http://wiki.mikrotik.com/wiki/Manual:Sw ... Vlan_Table

The configuration does not look hard though. In theory, it should be more efficient as all the switching is done in the Switch chip.

lz1dsb

I also forgot to mention that if your device has a switch chip and you will have large amount of traffic - it would be more efficient to use the switch chip. The sample configuration I gave you, will certainly be less efficient. For small amount of traffic over the vlans, most likely it will not mat...

lz1dsb

There are two ways to configure VLANS in RouterOS. One way is specific to the device, i.e. the switch chip that it uses - I'm not very familiar with it. Other way is to manually configure bridges and assign vlan interfaces, this is what I have used. Below an example: 2 Vlans are created, both of the...

lz1dsb

Strange. I have the same device and I recently updated it to version 6.27. I haven't noticed any degradation as you describe it. I do not use any PPPoE though...
Were you able to make any additional traces? RouterOS has a very good built in capture which is very useful.

lz1dsb

It is either a wrong URL, or I completely do not understand...

lz1dsb

I've got a situation yesterday where I had to create a firewall rule to block particular traffic. I've put a timeout of 10 minutes. The address lists were created correctly, and the rule worked. What I noticed though is that the dynamic address lists are still visible, even though the timeout is sho...

lz1dsb

That is because you use "masquarade" option. Masquarade menas to "mask" all sessions from inside to outside network using the outbound IP address. In order to change that, use "src-nat", this should fix it.

lz1dsb

This could be the case. I'm using version 6.20 on both CCRs at that location.
Is there a document by Mikrotik stating that vulnerability?

lz1dsb

Yesterday I've got a strange behaviour on one of our routers. It's and edge router having a BGP session with one of our ISPs. Anyway long story short - the device was unresponsive from its public IP address. I was able to ssh into the router from an internal server and immediately realized that ther...

lz1dsb

As far as the configuration goes, it does not matter whether it's an ethernet port a vlan interface or a bridge, or whatever. In the NAT rule you just have to reference the correct IP address, the IP address which is assigned for the proper vlan in your example.

lz1dsb

I also do use RouterOS in GNS3 with Cisco IOSes for exactly the same purpose as you. I assume it's an issue with licenses. Looking at the license page http://wiki.mikrotik.com/wiki/Manual:License it seems to me that the demo license does not allow normal OSPF operation. In my setup I use RouterOS in...

lz1dsb

That's an interesting thread, as I also use RB951 devices in my network. I'm not quite sure, but when you use mangle rules, this makes the system process each packet and unfortunatelly RB951 is not the fastest Mikrotik router out there. I guess you're hitting the hardware limit. You could try profil...

lz1dsb

It is very likely that you have some misconfiguration either in your local system or on the remote BGP peer.
Could you post a configuration /bgp router export would do it...

lz1dsb

If all areas are connected to the Backbone area, you do not need virtual links.

lz1dsb

I also noticed that in a long run, the OVPN connection breaks down...

lz1dsb

That's an old post but anyway. I haven't figured out a convenient way to monitor the threads.
I've also started using static interfaces on OVPN, it's how I can control the settings of the routing protocol I run over that link. It's quite useful, before I didn't know about that option.

lz1dsb

What do you mean by "not writeable"?

lz1dsb

Well, than it's a different scenario. It could be a faulty radio module.

lz1dsb

I did. But I think there's probably something not entirely correct with the way I build the topology in GNS3. I read somewhere that there's an additional option ot set, in order to have the configuration saved for the QUEMU hosts. Hopefully I'll find the time these days to play around with it. It's ...

lz1dsb

Have you by any chance looked at the spectrum? Nowadays the 2.4Ghz spectrum is just too crowded! Fortunatelly you have a very convenient option - WiFi Analysier Android App. With it, you can scan the spectrum and analyse where it's less crowded. Than you'll just have to move the channel. This is wha...

lz1dsb

I haven't mentioned one thing though... I still haven't found a way to overcome it. Each time I start the topology - I have to manually enter the configuration, it's not saved in GNS3.

lz1dsb

Sorry guys, I've just seen that you've replied... several months later :D Well, I'm using a single license. It's exactly like this, I have created one QUEMU HDD and I've generated a license for it. The first time I've even put the wrong system ID, so I had to generate the license once again. Anyway ...

lz1dsb

I have to give it another try than... If I get 50% utilization of the link, it would be great.

mulțumesc

lz1dsb

I will certainly try that. One question though. Wouldn't using a strictly 20MHz channel limit the performance? As theory goes, the wider the band, the higher the achieveable speed... I guess in my case I do not get too much of an improvement, as the nearby channels are already quite congested. Also,...

lz1dsb

I'm a bit confused now... Are my ports controlled by the switch chip or not? Basically I've put the master port in a bridge - in order to have an IP address there and to be able to have L2 connectivity with the Wireless port... interface ethernet switch port print Flags: I - invalid # NAME SWITCH VL...

lz1dsb

Just a quick update on this. Last night I did a more extensive troubleshooting on this. I used the WiFi Analyser application on my phone to check how the channels are used, and boy, it's quite crowded! I changed the channel several times with very little improvement of the overal packet drops, so I ...

lz1dsb

uldis, I'm not sure that I'll catch the exact time when the drop happens to generate the suppout file. 1. It is sporadic 2. It briefly happens. So when I start continious pings to the router from the clients, I've got 3-4 pings lost here and there. 3. I'm also wirelesslly connected to the router, so...

lz1dsb

Thank you babbage, I've just seen your post. That presentation looks quite interesting indeed.

lz1dsb

Well, actually I did that - and this is the default configuration: [bsotirov@router82.sotirov-bg.net] > interface ethernet export # jan/08/2015 16:48:08 by RouterOS 6.24 # software id = 2DWW-HXRL # /interface ethernet set [ find default-name=ether1 ] comment="Outbound Interface" name=ether...

lz1dsb

And one thing that strikes me is that in the parallel tests I run constantly, whenever there's are packets lost/unserviced/or whatever the reason, it all happens simultaineasly on both clients! Is this normal to have such a behaviour in situations like this?

lz1dsb

I forgot, here are the current settings: /interface wireless set [ find default-name=wlan1 ] band=2ghz-onlyn channel-width=20/40mhz-ht-below comment=LAN country=bulgaria disabled=no \ distance=indoors frequency=2462 l2mtu=2290 mode=ap-bridge ssid=prostor wds-default-bridge=bridge-local wireless-prot...

lz1dsb

Yes, I didn't notice such drops in version 6.23.
I tried both suggestions, no luck. It's the same, the drop rate is around 16-17%
No I do not use WDS at the moment, it's a residual configuration, that I used in the past. I disabled WDS.

lz1dsb

Thank you for your quick responce udilis. 1. I update regularly, so the previous version of the RouterOS was 6.23 2. I use just the regular wireless package. 3. Regarding the settings, I didn't really messed with them when I first installed the router. I set it to 802.11n, set SSID and a password. H...

lz1dsb

I forgot to mention that the ping reply times are horible too! The jitter is way beyond 30ms! The response times are between 0 and 80ms. For a small, not utilized WiFi network I believe this is pretty high. And again, it's only the WiFi interface that is showing this problem. Everyhing else is worki...

lz1dsb

I've noticed that after an upgrade to 6.24 I've got a pretty annying packet loss in the WiFi network. They reach up to 20% percent! I'm testing in parallel from a Linux machine and from another Mikrotik router, connected to the Access Point (RB951G-2HnD). In the log I see that both wireless clients ...

lz1dsb

It would be great to have this, it's a must for a high availability scenarios. I imagine it could be tied with VRRP and all routers running in one VRRP group could synchronize their NAT translation tables.
For such powerful devices like the CCR, it's a shame we do not have such a feature.

lz1dsb

I tested 951G with 411GL and with 2*2 MIMO that was capable of 200 Mbit/sec tcp speed with Ubuntu Proftp server. CPU was around 60%. I think this is a very nice performance. If this is a speed you get over WiFi - it's more than nice. In my case though, I'm mainly concerned with the speed I could po...

lz1dsb

What was limiting the speed?

In general there was no limiting factor, so I'm a bit puzzled. I didn't expect though to get 100% utilization, maybe 60-70%...

lz1dsb

Hello i have simple network infrastructure one CCR1016 (alpha) with 3 x eBGP sessions and another (beta) with 1 x eBGP session and both combined to iBGP with public ASN alpha and beta load full prefixes from eBGP peers beta get all prefixes from alpha when alpha getting some prefixes sometimes 30-5...

lz1dsb

It has to be G version and you have to set switch mode. Maybe in bridge with fastpath also. Of course it will not route/nat 1gbit.

I finally got the chance to test it. So, two RB951G, two hosts connected on the Ethernet ports - the speed that I was able to achieve was around 250Mbps ...

lz1dsb

You could write a script and use the traffic monitor as the trigger, but no, there is not a simple way to do it.

I guess I would be able to mangle the excess traffic then and route only excess to the secondary outbound interface. That's a nice idea. Thank you.

lz1dsb

This is the area of RouterOS configurations where I would say I'm not very proficient. So the question is:
Is there a way to configure a routing policy in RouterOS so that, when an upper bound of the bandwidth is reached - the excess traffic is routed over another outbound interface?

lz1dsb

It seems that mac clonning feature is broken somehow. Report it to mikrotik anyway, maybe they will find something and correct it for the future. I was thinking the same thing but while I was testing, i was using the sniffer embedded in the RouterOS. It was always showing that the MikroTik router w...

lz1dsb

I have been told by support that this will be improved in RouterOS v7

A lot of interesting features and improvements are expected in v7... I wonder when it will be released...

lz1dsb

Today I've noticed the following issue, the Link Local IPv6 address in RouterOS for L2TP tunnels is chosen somehow strange. Here's what the situation is on the L2TP server: [router82] > ipv6 address print Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local # ADDRESS FROM-POOL I...

lz1dsb

I configured a RB951G-2nHD at my brother's apartment half an year ago. Up until recently I've had similar issue. Though in my case, the outbound connection was dying once the device hits high load. It took me a while to figure it out, but I realized that the problem was that the RB was loosing it's ...

lz1dsb

Hi guys, I've a network that is currently full NATed, we want to move it to use public IP address to the hosts within the network and I don't want to use NAT 1:1 in all devices, cause I've many routers involved. We've our own AS number and public IP range (190.113.X.0/22) granted by LACNIC, so, we'...

lz1dsb

Exactly. Connect computers that are able to generate the traffic behind and then measure the throughput.

But still... Are the RB951 boxes able to handle 1Gbps traffic. I really can't imagine this to be possible. Not that I complain about it though..
I'll test it with machines behind the routers....

lz1dsb

What devices are you using to generate the traffic?

I use the BTest Server and Client on both Routerboards... I guess running the test on the boards themselves influences the results...

lz1dsb

That's disturbing. I have two CCR1036s in one of the centers and they are exchanging full BGP table with two upstream ISPs. I've just checked the uptime - 7 weeks. I've had some flapping BGP sessions during these 7 weeks, but it was always a L2 device in between that was breaking the connection. Wha...

lz1dsb

So the situation is like this. I have two RB951G connected over around 50m of FTP cable. The link is established as 1Gbps Ethernet. Starting a bandwidth test between them, over UDP I've got around 250 Mbps, over TCP I've got around 120-130 Mbps. I guess this is the maximum capacity of the routerboar...

lz1dsb

Do you have a keepalive-timeout set?

No, but I noticed that there is such a parameter. I can only see it on the sstp-client though. How should I set it on the server, or this keepalive is just a client function?

lz1dsb

I have had some very bad experiences using SSTP (tunnels staying up when they shouldn't be and massive packet loss). I would strongly recommend that you avoid SSTP like the plague if at all possible. I think I'm having exactly the same issue here. The SSTP client does not detect that the SSTP serve...

lz1dsb

I started using SSTP few days ago between three locations. One of them is the SSTP server where all of the tunnels are terminated, the other two - dial in. I've started it with password authentication only for the moment, just to test how it works. Over the tunnels I use OSPF to advertise the networ...

lz1dsb

Thank God I found this!
I didn't even know that this OVPN server option ever exists....

lz1dsb

you should be able to see it in
/interface wireless registration-table print

lz1dsb

Do you get anything in /interface wireless registration-table print If you get any registrations, check also whether the dhcp server allocates IP addresses /ip dhcp-server lease print That is what I am NOT getting. I also cannot renew and release....... So what is the state of the DHCP server than?...

lz1dsb

Do you get anything in /interface wireless registration-table print
If you get any registrations, check also whether the dhcp server allocates IP addresses /ip dhcp-server lease print

lz1dsb

What I meant above was that if you have /ip address add interface=ehter1 address=10.10.10.30/24 add interface=ether2 address=10.200.200.40/24 add interface=ether3 address=192.168.0.1/24 comment="LOCAL" /ip route add dst-address=0.0.0.0/0 distance=1 gateway=10.10.10.1 add dst-address=0.0.0...

lz1dsb

Can I do a source based PBR in RouterOS where the action once the traffic is matched is to change the next-hop ip address, i.e. the gateway? I found many solutions to this where source based PBR is implemented, but they use an additional route which is added to the routing table. Can I do it only by...

lz1dsb

I know that there's a way to filter the print output of a command and I use this regularly in the /ip route print output. But why it doesn't work on /ip firewall nat? For example when I try to filter out only the connections from a particular source address - it does not work, I've got empty output...

lz1dsb

Is my understanding correct? A masquarade is considered a source NAT, which means that according to the packet flow diagram http://wiki.mikrotik.com/images/2/24/Packetflowv6.png the NAT-ing should happen in the Postrouting phase, after the packet has already been routed, correct? If this is so, tha...

lz1dsb

Glad to see this thread has been useful...i've seen it linked in multiple other forum posts. @Mikrotik - what is the status on balancing BGP across multiple cores? That's something I would like to see too! This is something that bothers me, because it turns out that as far as routing is concerned -...

lz1dsb

Is my understanding correct? A masquarade is considered a source NAT, which means that according to the packet flow diagram http://wiki.mikrotik.com/images/2/24/Packetflowv6.png the NAT-ing should happen in the Postrouting phase, after the packet has already been routed, correct? If this is so, than...

lz1dsb

I know that there's a way to filter the print output of a command and I use this regularly in the /ip route print output. But why it doesn't work on /ip firewall nat? For example when I try to filter out only the connections from a particular source address - it does not work, I've got empty output....

lz1dsb

You'll need to load balance across different servers...
I'm not aware of such a function directly available in the RouterOS.
It should be possible though with PCC - Per Connection Classifier in the ip firewall.

lz1dsb

+1
That would be nice to have...

lz1dsb

We use CCR's in the scenario you describe. The main issue is that CCR'S will not currently do more than 1Gbit/s on a single TCP session. Multiple sessions will go over, but a single one is limited by only being able to run across a single core. What is the aggregate traffic throughput which we coul...

lz1dsb

1) What kind CCR (s) are you using in your network two CCR-1036-12G 2) How many BGP feeds / Routes are you taking in above 500k. One of the routers has 4 BGP peering sessions, the other has 5. At the moment we're peering with 2 ISPs, in the next month another two ISP peering sessions are planned. 3)...

lz1dsb

Customer were complaining about download speeds being terrible. Mostly around 1-1.5Mbps. No matter what their queues are set to. I have a computer at the a tower site so I was easily able to verify this. Also AirControl tests to CPEs confirmed. I think this is related to 6.18 as I upgraded over the...

lz1dsb

From few weeks I have installed router Mikrotik RB201. To one port of this router is connected server of terminals. Now I have blocked all route from this port do Internet except one IP address, where I set in menu IP - firewall src. address: x.x.x.x dst. address: (IP adres in Internet) src. port: ...

lz1dsb

anybody ? may be easy with diag attached.

Could you export the ospf config on the hub router and on one of the spoke routers?

In general OSPF should work just fine in that setup...

lz1dsb

Hello! I am working on a Project to implement a second transitt provider to get conectivity to the "world" I already have an MPLS cloud, using confederation and an internal ospf Routing table to distribute loopback for bgp peering to other routers to distribute my internal vrf - internet....

lz1dsb

Thank you for your reply. Yes, I created null route.

Have you tried to trace the traffic to the /21 network with traceroute from an outside network?
You do advertise the /24 network to the upstream BGP router, correct?

lz1dsb

Hi there, I am wondering if it is possible to have multiple configuration files which can be selected and loaded via the touch screen interface protected via pin code prior to switching ? If not is it possible to use a physical serial-controlled button or relay to achieve a similar outcome? As far ...

lz1dsb

How can I filter the output of any print command in RouterOS? for example: ip route print - how can I get only the connected, static, etc... it does have embedded filter for BGP and OSPf though - it works. But how can I flexibly define what I want to be displayed? I'm running full table BGP now and...

lz1dsb

I don't know if this is the right place to put this... How can I filter the output of any print command in RouterOS? for example: ip route print - how can I get only the connected, static, etc... it does have embedded filter for BGP and OSPf though - it works. But how can I flexibly define what I wa...

lz1dsb

I use OVPN connection (RB951 on both sites). On server site I manually created interface named ovpn-client1. Typically, when client makes connection, interface on server site become active and all is OK. But sometimes server automatically creates interface called <ovpn-client1> (with brackets) and ...

lz1dsb

Upgrade did the trick. Thanks~ I've had a situation with RouterOS v6.17 where almost all of my bridge interfaces were lost. A reboot of the device solved it, for now. It's kind of strange though, as some of the traffic was still flowing through the device. So I wonder... whether it will happen agai...

lz1dsb

Yes is normal, not worry. The first ip appear because the TTL end at the router, The second is equal because the TTL end on the device BUT the device by nat has the same ip of the router... That explains it. But why than the Cisco IOS reacts in a different way in such a scenario? I've just tested i...

lz1dsb

I've noticed the following phenomenon. When a static 1:1 NAT is configured on a MikroTik router (source and destination NAT), after I start a traceroute to the Global IP address that is being translated to a private Local IP address, I always see the last hop being doubled! it seems like the router ...

lz1dsb

Anyone... I'm wondering whether this kind of a setup is supported at all...

lz1dsb

Is that possible?
Me, personally, I haven't so far been able to find if this is a possible setup with RouterOS.
Has anybody been able to find anything about that?

lz1dsb

My guess is its because the two halfs of your /25 are not in your routing table. Its only going to aggregate routes that fully exist. Good point. It's interesting if it's really the case. I'll test it tonight if I have time. But strange though... I don't recall reading for such a requirement in the...

lz1dsb

You need to find out which ports those cameras use.
mmm ok my dear if i found what i will do after that

When you know the port you can use an "ip firewall nat" rule to forward that port to a private IP address. And this is how your camera will be reachable from the outside network.

lz1dsb

Dear Member I have the following config on Cisco interface FastEthernet0/0 ip address 2.1.1.1 255.255.255.252 interface FastEthernet0/1 ip address 1.1.1.1 255.255.255.252 interface Vlan1 description -=LAN-1=- ip address 192.168.1.1 255.255.255.0 Interface 0/0 and 0/1 IPs are for BGP with 2 upstream...

lz1dsb

My guess is its because the two halfs of your /25 are not in your routing table. Its only going to aggregate routes that fully exist. Good point. It's interesting if it's really the case. I'll test it tonight if I have time. But strange though... I don't recall reading for such a requirement in the...

lz1dsb

I think I started to get it!!! When I use the parameter bgp-origin= set to something it actually does not set the BGP Origin parameter! It matches it! So the only way I have found to set it is in an unexpected place ... setting the dummy ip route itself. This is where it's possible to set this, and ...

lz1dsb

Can you post your full routing table (assuming it's not a full public) No, it's not a routing table with public prefixes. I haven't applied the configuration on the production system yet. I'm testing it in GNS3 with a QEMU image of RouterOS. I stumbled upon this fairly old thread... http://forum.mi...

lz1dsb

What does the connected route for 212.6.82.0/32 look like? I just tried it, setting up a session between two MTs, one with a /32 mask, and the other with a /31. As I expected, the routes are active on the unit with the /32 mask, and not on the one with the /31. /32 unit: /ip address add address=169...

lz1dsb

Can't speak for the BGP aggregation but your filter command is incorrect and likely the problem. Try one of the following depending on what you wish to match. Match /24 and /25 prefix length: /routing filter add action=discard chain=out-filter invert-match=yes prefix=150.13.0.0 prefix-length=24-25 ...

lz1dsb

Anyone?
Am I the only one trying to use BGP Aggregate on RouterOS?

lz1dsb

For BGP, you can use a /31 on the Cisco side; and a /32 on the MT side, with the network= parameter set to the Cisco's side of the /31. So, with the Cisco config you have, you would want to change the MT side to: /ip address add address=212.6.82.1/32 interface=vlan-2958 network=212.6.82.0 That won'...

lz1dsb

For BGP, you can use a /31 on the Cisco side; and a /32 on the MT side, with the network= parameter set to the Cisco's side of the /31. So, with the Cisco config you have, you would want to change the MT side to: /ip address add address=212.6.82.1/32 interface=vlan-2958 network=212.6.82.0 That won'...

lz1dsb

The question is, how it's done? I haven't found so far a good example about this and I've been testing a bit lately. So here's my config& I have a public /24 prefix which is divided into two /25 networks. And off course I would like to advertise the prefix to the provided as only one /24. /routi...

lz1dsb

Hi Everyone, i need some help routing OSPF between many routers. i would like to have them bundle in different areas, but im having trouble making it work. could someone plz help me design the OSPF areas. So i might have 5 routers in one area and then connected with backbone. i have attached a newo...

lz1dsb

RouterOS doesnt support RFC3021? :shock: You shouldnt need /30 for running OSPF or BGP...as both routing protocols work just fine with RFC3021 adressing scheme. As public ipv4 space is exhausted, every little trick, helps a bit in siuations where you cannot use ipv6. It's a question we've got from ...

lz1dsb

Haven't you tried /30 subnet? It has also network and mulicast addresses in addition and it could help. Maybe. Yes i did. It works, the question is... why RouterOS does not work with /31 subnet? We'll establish a BGP session with a backup provider and they've asked whether our equipment supports th...

lz1dsb

I've just decided whether the same situation is valid for all routing protocols, yes it is! I've started OSPF between the routers - the same situation. Than I've configured a parallel connection between the routers. The parallel connection was configured with a standard /24 mask. And... voilla! It l...

lz1dsb

I stumbled upon this thread http://forum.mikrotik.com/viewtopic.php?f=14&t=32935 and as it's a bit old, I've decided to start another one. So the scenario is pretty simple: I have a Cisco router on one end of the connection, on the other end, there's the MikroTik router. The requirement is to us...

lz1dsb

I just wanted to post what was my experience so far. 1. Creating a QEMU image of RouterOS turned out to be quite an easy task. I followed the description in mum.mikrotik.com/presentations/ID13/rofiq.pdf 2. Putting the RouterOS image in GNS3 is also a matter of setting a path to the QEMU image and se...

lz1dsb

Here's the situation. i was able to create an qemu image of RouterOS and I successfully started it in GNS3. Connecting it to other routers works, and it's amazing that I can simulate different vendors on one common platform where I can interconnect the way I like. My question is more or less about.....

lz1dsb

Hi all, Actually i want to deploy Mikrotik as a Wireless Access Gateway to offer wifi services and manage some users. i was wondering if it is possible to have a layer 3 connection between Mikrotik and the users or if it is necessary to have a L2 tunnel between them. Many thanks in advance! Many th...

lz1dsb

Hello all, 2014-04-25T09:57:37+00:00 vShield-edge-4-0 routing[372]: [user.emerg] EXCEPTION 0x3e01-117: DB DESCRIPTION packet received with invalid master / slave bit. 2014-04-25T09:57:37+00:00 vShield-edge-4-0 routing[372]: [user.info] AUDIT 0x3e01-91: OSPF 1 An adjacency with a neighbor has gone d...

lz1dsb

In order for this to work, you'll have to enable OSPF for both networks 192.168.1.0/24 and 192.168.0.0/24. What I don't see in your topology are the networks behind the RB750GL routers. You'll have to advertise them in OSPF as well. Your setup is pretty straight forward, so I do not recommend to fur...

lz1dsb

I have one Cisco 3750 switch,about 20 Cisco 2950/2960.and about 15 Access point in my network. All switch are managed switch. in all switch i define VLAN and every thing work properly. All Access points belong to a vlan. Like it's already written here - with such setup (only Layer 2 between the end...

lz1dsb

Hi lz1dsb, The things are easier! Get up a PPPoE server and it provides a IP from a ip pool. Let's chek the WIKI. Santiago I agree that PPPoE would work in this case... but to me this is an additional overhead. You'll need additional configuration on every user to establish a PPPoE tunnel to the se...

lz1dsb

How you assign IP to the client? How is possilbe than your client can pick any IP they want? That's pretty legitimate question here.. I think the best way is to use automatic address allocation via DHCP. That's what DHCP is designed for. If the question is though... whether we would like to protect...

lz1dsb

On SXT1 add default route

/ip route add gateway=192.168.1.1

If he does not redistribute the default route over RIP, he also needs to add a default route on SXT2.
Also, all clients need a proper DNS address...

lz1dsb

Hi i have been deploying ccr1036's in pairs and I use a cross over cable to link the 2, but I can't ssh from 1 ccr1036 to the other. I have tried /system ssh user=admin <ip address of the other unit> but it comes straight back How can I get around this ? A That's the way to do it. Have you changed ...

lz1dsb

this is where I've lost it how to do it.
is there a guide?

Here's the guide...

lz1dsb

also could you tell us to what device the board is connected as maybe there is some compatibility problem with ethernet connection? As far as I know from the provider, the device on the other end is a simple non-managed TP-link switch... This is the switch that aggregates the Ethernet connections w...

lz1dsb

According to the official documentation on the subject:
http://wiki.mikrotik.com/wiki/Manual:IP ... _discovery

LLDP is not supported. At least nothing is mentioned in the document. I agree that LLDP is an important feature nowadays...

lz1dsb

I'm running the latest image 6.12.
All right, next time it happens, I'll send the support file.

lz1dsb

Am I the only one facing this issue with RB951G?

lz1dsb

You have supposingly 5x version. You have to copy package files to router manually and reboot.

I've noticed the same thing... When you upgrade to a major RouterOS version, you'll have to do it manually. I guess it makes sense...

lz1dsb

Hmm, maybe this is my problem. I do use RSTP in other parts of the network for redundancy links, but not in this case. I've been expecting it to stop network loops if they occur however. Maybe I am mis-using this. In my diagram above, if a customer on switch 2 creates a network loop at his location...

lz1dsb

Ok I'm going to try this and run some experiments but I'm a bit confused. If I currently have just 1 bridge with all physical Ethernet ports on that bridge, how do the vlans even cross that bridge without utilizing the spanning tree? I would think that all traffic on the bridge would be bound to th...

lz1dsb

I think I was able to pinpoint the reason... Lots of traffic! When I initiate a constant traffic of around 40Mbps over the router - the outbound interface fails after few minutes, it cannot sustain it. The interesting part is though that the router does not fail by itself - its reachable and I can s...

lz1dsb

Have you guys experienced any hardware issues with RB951G-2HnD? I'm quite puzzled here... I've been using this model for an year now. At my home I have two RB951Gs running, without any obvious issues so far. So recently I bought another one for my brother's apartment and since than, the problems sta...

lz1dsb

But than... If I need more Vlans over both ports? Because they're supposed to be trunk ports.
So if I put them in a bridge with a vlan, can I also put them on another bridge with another vlan etc. And will this isolate the traffic between the vlans?

lz1dsb

It is on CCR-1036...

Search found 226 matches