Community discussions

MikroTik App

Search found 224 matches

by jkarras
Thu Sep 20, 2018 5:06 am
Forum: Announcements
Topic: v6.44beta [testing] is released!
Replies: 365
Views: 105472

Re: v6.44beta [testing] is released!

I have set up automated exports and the output is saved in version control system, so I know what exactly changed and when. Can you give more info on your setup/workflow? I am interested in implementing something similar. Thanks. RANCID works for this. There are runners for a lot of different NOS. ...
by jkarras
Wed Mar 21, 2018 11:44 pm
Forum: General
Topic: Multiple IP's from ISP but not a subnet block questions.
Replies: 13
Views: 1330

Re: Multiple IP's from ISP but not a subnet block questions.

Could be an order of operations error by not having the more specific network above the less specific in the NAT rules. OSPF shouldn't have any affect on SRCNAT working or not working in this case.
by jkarras
Wed Mar 21, 2018 4:32 pm
Forum: General
Topic: Multiple IP's from ISP but not a subnet block questions.
Replies: 13
Views: 1330

Re: Multiple IP's from ISP but not a subnet block questions.

Masquerade as the last rule as a catch-all is fine. Just make sure its the last rule. That said if the first two rules are correctly defined for the network you shouldn't need it. The reason you want to remove it from the config is with multiple IP addresses its unpredictable what IP it will use for...
by jkarras
Wed Mar 21, 2018 6:14 am
Forum: General
Topic: Multiple IP's from ISP but not a subnet block questions.
Replies: 13
Views: 1330

Re: Multiple IP's from ISP but not a subnet block questions.

Don't forget to add the new IP to the interface and add a DSTNAT rule for the inbound traffic to make it to your SIP broker. The following should work fine. /ip address add interface=ether1 address yy.yy.yy.83 /ip firewall nat add action=src-nat chain=srcnat out-interface=ether1 src-address=192.168....
by jkarras
Mon Feb 26, 2018 1:02 am
Forum: Scripting
Topic: Script for modify ipip tunnel interface
Replies: 11
Views: 1512

Re: Script for modify ipip tunnel interface

Hi,

my connection is over pppoe, not dhcp client. In spite of that, it would be useful for me? Sorry for my english
You'll have to use a scheduled script then. An example can be seen here.

https://github.com/karrots/ros-ddns-ipsec/
by jkarras
Sun Feb 25, 2018 4:31 am
Forum: Scripting
Topic: Script for modify ipip tunnel interface
Replies: 11
Views: 1512

Re: Script for modify ipip tunnel interface

No need to run this as a script. The DHCP client will provide the information on lease update.

https://wiki.mikrotik.com/wiki/Manual:I ... pt_example
by jkarras
Tue Feb 13, 2018 9:45 pm
Forum: Announcements
Topic: v6.42rc [release candidate] is released!
Replies: 538
Views: 113975

Re: v6.42rc [release candidate] is released!

*) radius - increase allowed RADIUS server timeout to 60s; To add an important reason to the too short limit problem of timeout in radius: Successful authentications are answered immediately (in order of milliseconds if possible), but to protect the server from brute-force attacks and DOS-type atta...
by jkarras
Sun Jan 07, 2018 5:55 am
Forum: General
Topic: IPsec IKEv2 Tunnel Tuning
Replies: 10
Views: 3267

Re: IPsec IKEv2 Tunnel Tuning

Cool, thanks for that. I need to learn MikroTik scripting at some point. I've done a few but it's not sticking in my head. On my setup I would have to set: /ip ipsec peer set X address=$variable /ip ipsec policy set X dst-address=$variable sa-dst-address=$variable I have a dyndns account as well, b...
by jkarras
Sat Jun 03, 2017 7:49 am
Forum: General
Topic: Multiple Public IP Addresses with Same Gateway on Same Interface
Replies: 1
Views: 1645

Re: Multiple Public IP Addresses with Same Gateway on Same Interface

Likely an order of operations problem in your NAT table.

The routing mark rule and the two static routes are unneeded.



Sent from my Nexus 6P using Tapatalk
by jkarras
Thu Jun 01, 2017 7:05 am
Forum: Forwarding Protocols
Topic: MPLS/VPLS Public Statics
Replies: 5
Views: 1313

Re: MPLS/VPLS Public Statics

Network diagram would help.
by jkarras
Fri Apr 21, 2017 6:13 pm
Forum: General
Topic: v6.39rc80 [release candidate] is released!
Replies: 63
Views: 13066

Re: v6.39rc76 [release candidate] is released!

I understand. I already had an email typed up after that last version didn't fix it with a sprout from before and after the upgrades. I was waiting until after the next update just in case they fixed it then. My case is actually pretty simple. Standard home Internet provider, DHCP on WAN, masquerade...
by jkarras
Fri Apr 21, 2017 5:32 pm
Forum: General
Topic: v6.39rc80 [release candidate] is released!
Replies: 63
Views: 13066

Re: v6.39rc76 [release candidate] is released!

Marino , and other who might have the same problem potentially. It would be great to get some steps/instructions to support@mikrotik.com how to repeat described problems. Steps for me were to upgrade to anything past rc62. Sites became unbearably slow if the traffic flow went through the fasttrack ...
by jkarras
Fri Apr 14, 2017 5:46 am
Forum: Announcements
Topic: v6.39rc [release candidate] is released
Replies: 391
Views: 93514

Re: v6.39rc [release candidate] is released

Confirmed disabling fasttrack rule fixes slow traffic that would have otherwise been tagged by the rule.
by jkarras
Fri Apr 14, 2017 2:11 am
Forum: Announcements
Topic: v6.39rc [release candidate] is released
Replies: 391
Views: 93514

Re: v6.39rc [release candidate] is released

When I upgraded to ROS v6.39rc62, the following Firewall rule brought my outside access to a crawl: /ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related Once I disabled it, the system began to work normally. This is the same with the current release...
by jkarras
Thu Apr 13, 2017 8:35 am
Forum: Announcements
Topic: v6.39rc [release candidate] is released
Replies: 391
Views: 93514

Re: v6.39rc [release candidate] is released

Spanning Tree is broken since 6.38. We want to implement redundant bridges, to link together carrier VLANs to customer ports or VLANs. The previous STP implementation was essentially similar to PVSTP (per VLAN Spanning Tree Protocol) but the new implementation results in routers sending and process...
by jkarras
Thu Apr 13, 2017 4:19 am
Forum: Announcements
Topic: v6.39rc [release candidate] is released
Replies: 391
Views: 93514

Re: v6.39rc [release candidate] is released

Spanning Tree is broken since 6.38. We want to implement redundant bridges, to link together carrier VLANs to customer ports or VLANs. The previous STP implementation was essentially similar to PVSTP (per VLAN Spanning Tree Protocol) but the new implementation results in routers sending and process...
by jkarras
Wed Aug 10, 2016 6:57 am
Forum: General
Topic: Scientific Explanation needed for DHCP renew needed!
Replies: 6
Views: 1162

Re: Scientific Explanation needed for DHCP renew needed!

I agree with everyone here. Having worked with law enforcement on similar requests I just wanted to mention one other thing to calm some fears. If you're not required by any industry regulation, local law, or company policy to keep the DHCP logs don't worry about getting in trouble with law enforcem...
by jkarras
Wed Aug 10, 2016 6:47 am
Forum: General
Topic: Fastpath on vlan interface.
Replies: 15
Views: 3738

Re: Fastpath on vlan interface.

This really should be a new thread if you want people to look at it. I think there is a misunderstanding of the differences in FastPath and FastTrack as well as what the "auto" setting does with connection tracking. FastPath benefits ROS devices which are only routing. If you use any firewall rules ...
by jkarras
Fri Jun 24, 2016 7:33 am
Forum: General
Topic: [FEATURE REQUEST] Two Factor Authentication
Replies: 22
Views: 15613

Re: [FEATURE REQUEST] Two Factor Authentication

I am just saying that in all cases it's very low on the priority list of things that will give them a competitive advantage because there are already multiple solutions that will give your desired outcome (RADIUS, SSH keys, site-to-site VPN, and remote access VPN via OTP or client certificate based...
by jkarras
Thu Jun 23, 2016 7:27 am
Forum: General
Topic: [FEATURE REQUEST] Two Factor Authentication
Replies: 22
Views: 15613

Re: [FEATURE REQUEST] Two Factor Authentication

Why are you allowing the general Internet to get to the management interfaces of your devices? This should all be ACLd off except to known good ranges you connect from or all be done via VPN. There are ways to encrypt the unencrypted portions of the RADIUS datagram. One example would be an encrypte...
by jkarras
Tue Feb 23, 2016 6:22 am
Forum: Forwarding Protocols
Topic: Vlans on routed backbone?
Replies: 6
Views: 1718

Re: Vlans on routed backbone?

If you're using L2 connectivity just to make DHCP work you should look into DHCP relay. Then you could go L3 to the AP and still have one central DHCP server.
by jkarras
Thu Jan 07, 2016 4:47 pm
Forum: Beginner Basics
Topic: how to hide ip from arp
Replies: 9
Views: 1982

Re: how to hide ip from arp

Why? If you remove it from the ARP table the IP will quit functioning.
by jkarras
Tue Jul 14, 2015 7:29 am
Forum: Announcements
Topic: 6.31 RC testing
Replies: 41
Views: 15591

Re: 6.31 RC testing

How long does Mikrotik plan on supporting bugfix versions. Example once 6.32 is released how long will 6.30.x be in development.
by jkarras
Thu Jul 09, 2015 6:07 am
Forum: General
Topic: Feature Request v7 MacSec CCR 72 Core
Replies: 6
Views: 2530

Re: Feature Request v7 MacSec CCR 72 Core

Looks like the processor used on the CCR line does support MacSec. This is key as MacSec is a PHY level operation.

+1 for this especially with the WAN MacSec extensions to is can be used over MetroEthernet connections.

http://www.tilera.com/files/drim__TILE- ... B_7682.pdf
by jkarras
Tue Jul 07, 2015 5:18 am
Forum: Forwarding Protocols
Topic: VoIP VLAN Routing
Replies: 2
Views: 1503

Re: VoIP VLAN Routing

The tool you pick depends on the design criteria. It sounds like you want to keep the voice traffic separate from other production IP traffic. If this is the case you will want to put the VLAN into a VRF on your MPLS network. http://wiki.mikrotik.com/wiki/Manual:Layer-3_MPLS_VPN_example I assume you...
by jkarras
Tue Jul 07, 2015 2:17 am
Forum: General
Topic: Winbox losing MAC connection to RB850Gx2
Replies: 44
Views: 13119

Re: Winbox losing MAC connection to RB850Gx2

Agreed if this model didn't have a serial port it would be impossible to do initial IP config from blank.
by jkarras
Tue Jun 23, 2015 10:30 pm
Forum: General
Topic: ssl not working with nat
Replies: 6
Views: 2008

Re: ssl not working with nat

by jkarras
Tue Jun 23, 2015 10:28 pm
Forum: General
Topic: ssl not working with nat
Replies: 6
Views: 2008

Re: ssl not working with nat

Are you blocking ICMP outbound? As has been mentioned you have a MTU issue. Its probably more preferred to leave general Ethernet interfaces at 1500. I assume your PPPoE connection is controlled by an ISP if so no amount of changing the local MTU will fix things. The reason is MTU changes must be ma...
by jkarras
Sat Jun 13, 2015 4:24 pm
Forum: General
Topic: Apply IPSec policy to all traffic on GRE tunnel -- impossible?
Replies: 9
Views: 2636

Re: Apply IPSec policy to all traffic on GRE tunnel -- impossible?

In the IPSEC policy just change the protocol from all to GRE. This will then cause only the encryption of GRE packets leaving all other traffic in the clear.

Out of curiosity what other traffic are you worried about being encrypted by the more open policy?
by jkarras
Sat Jun 13, 2015 4:02 pm
Forum: Forwarding Protocols
Topic: Encrypt 10Gb/s Links
Replies: 5
Views: 2216

Re: Encrypt 10Gb/s Links

Can you encrypt data layer 2 multi hop when we only have control of devices both ends not in the middle? Depends on the type of service. If its a MetroEthernet e-line service like EPL it should work fine. If it is a EVPL service there will be issues. If your switches connecting to the service suppo...
by jkarras
Sat Jun 13, 2015 4:38 am
Forum: General
Topic: Winbox losing MAC connection to RB850Gx2
Replies: 44
Views: 13119

Re: Winbox losing MAC connection to RB850Gx2

hi everyone i`m new on mikrotik i have a problem with rb850gx2 when i upgarde it to v6.29.1 i cant acces it even with ip or with mac i dosn`t show the mac.and it keep restarting .even when i try to reset it.it`s the same any idea. thanks in advance Best to start a new thread rather than tack a sepa...
by jkarras
Thu Jun 11, 2015 6:10 pm
Forum: General
Topic: EoIP + Cisco Macsec
Replies: 2
Views: 1479

Re: EoIP + Cisco Macsec

It should work fine with the new WAN extensions. With out the WAN extensions it may work but it depends on a how the L2vpn is setup.
by jkarras
Thu May 21, 2015 11:27 pm
Forum: Forwarding Protocols
Topic: Routing, VRF help
Replies: 1
Views: 978

Re: Routing, VRF help

You'll need to setup MPLS between the three routers so that they can pass VRF routing information between each other.

Take a look at this wiki article for an example. It may need to be adapted slightly but everything is there.

http://wiki.mikrotik.com/wiki/Manual:La ... PN_example
by jkarras
Wed May 13, 2015 3:13 pm
Forum: RouterBOARD hardware
Topic: Grounding rack with mikrotik's
Replies: 9
Views: 1845

Re: Grounding rack with mikrotik's

No it does not.
by jkarras
Fri May 08, 2015 10:17 pm
Forum: RouterBOARD hardware
Topic: Grounding rack with mikrotik's
Replies: 9
Views: 1845

Re: Grounding rack with mikrotik's

You should only have one ground point. If you have multiple ground rods they need to be tied together and only fed from one conductor. Shielded cable needs to be terminated into shielded patch panels or jacks. The shield only protects from EMI. Surge protectors protect equipment from voltage spikes....
by jkarras
Wed Jan 28, 2015 5:33 am
Forum: General
Topic: Amazon AWS VPN -- A Working Configuration Example and Bug
Replies: 41
Views: 32373

Re: Amazon AWS VPN -- A Working Configuration Example and Bu

To get around the two SA same policy issue did you try setting each policy with a different priority?
by jkarras
Tue Jan 27, 2015 9:34 pm
Forum: General
Topic: double gw mentioning in dhcp-server? How to use?
Replies: 10
Views: 1863

Re: double gw mentioning in dhcp-server? How to use?

Is the CPE always a router of some kind? I am thinking business clients here not home routers. If so it sounds like you should setup BGP between your network and the CPE allowing the routing to help with the decision. That or move to a fully routed backbone removing the VLAN bridges and implement VR...
by jkarras
Tue Jan 27, 2015 8:05 pm
Forum: General
Topic: double gw mentioning in dhcp-server? How to use?
Replies: 10
Views: 1863

Re: double gw mentioning in dhcp-server? How to use?

What your describing is the need for first hop redundancy VRRP is created for solve just that problem. What is done after the first hop is up to your routing policies. I have exactly this scenario setup to add first hop redundancy to our ISP for devices that can't just use a dynamic routing protocol...
by jkarras
Tue Jan 27, 2015 7:37 pm
Forum: General
Topic: VPN and QoS (802.1p and DSCP)
Replies: 4
Views: 1494

Re: VPN and QoS (802.1p and DSCP)

I believe any of these methods will preserve the DSCP marking across the tunnel. Should be easy to test by taking a packet capture.
by jkarras
Tue Jan 27, 2015 4:23 pm
Forum: General
Topic: double gw mentioning in dhcp-server? How to use?
Replies: 10
Views: 1863

Re: double gw mentioning in dhcp-server? How to use?

The trouble is leaving it up to the client (if they even support it) is basically making it unknown. Its best if the network behaves in a deterministic way. If you use VRRP and other routing techniques to present a consistent experience to the customer it will reduce the support unknown. Basically i...
by jkarras
Tue Jan 27, 2015 6:34 am
Forum: General
Topic: VPN and QoS (802.1p and DSCP)
Replies: 4
Views: 1494

Re: VPN and QoS (802.1p and DSCP)

By preserve do you mean it makes it to the other side of the tunnel? Or do you mean it moves the marking up a level to the tunnel IP header?
by jkarras
Tue Jan 27, 2015 6:31 am
Forum: General
Topic: Problem - logged out: lost dhcp lease
Replies: 3
Views: 1694

Re: Problem - logged out: lost dhcp lease

What does your DHCP config look like. Are you using RADIUS?
by jkarras
Tue Jan 27, 2015 6:18 am
Forum: General
Topic: double gw mentioning in dhcp-server? How to use?
Replies: 10
Views: 1863

Re: double gw mentioning in dhcp-server? How to use?

Clients typically only support one default route. You should look into VRRP to solve your issue.
by jkarras
Sat Jan 24, 2015 3:41 am
Forum: General
Topic: [FEATURE REQUEST] Two Factor Authentication
Replies: 22
Views: 15613

Re: [FEATURE REQUEST] Two Factor Authentication

My reason for pointing out the other vendors was only to answer the others above who said other vendors supported two-factor. Good point on the single home router. Anything past one device would increase the administration quite a bit as there would be one entry in the app for every router. Centrall...
by jkarras
Sat Jan 24, 2015 2:38 am
Forum: Forwarding Protocols
Topic: Port Forward from no default Gateway problem
Replies: 2
Views: 1038

Re: Port Forward from no default Gateway problem

Is there a default gateway defined in the VRF(routing mark) in question?
by jkarras
Sat Jan 24, 2015 2:29 am
Forum: General
Topic: [FEATURE REQUEST] Two Factor Authentication
Replies: 22
Views: 15613

Re: [FEATURE REQUEST] Two Factor Authentication

Like has been mentioned earlier any site with large deployments is likely using RADIUS for central administration authentication anyway. Adding on Google Auth to FreeRADIUS is pretty simple way to get this done today. I can't think of any competing products that offer OTP on the switch or router its...
by jkarras
Wed Jan 21, 2015 2:08 am
Forum: RouterBOARD hardware
Topic: Choosing the right mikrotik hardware
Replies: 2
Views: 969

Re: Choosing the right mikrotik hardware

The only difference between these two models is the amount of memory it has. If your are going to take a full BGP feed from your ISPs go with the -em model. If not the non -em model should work fine.

There are 4 SPF slots on the device so if that number works for you then you should be good.
by jkarras
Mon Jan 19, 2015 5:37 am
Forum: Forwarding Protocols
Topic: BGP Implementation
Replies: 17
Views: 2945

Re: BGP Implementation

If you must implement BGP you could look at turning on BFD to help with the timing issue. Won't solve everything but will help.
by jkarras
Thu Jan 15, 2015 6:46 am
Forum: General
Topic: IPv6 RAs leaking out of VLANs - IPv6 unusable.
Replies: 5
Views: 1939

Re: IPv6 RAs leaking out of VLANs - IPv6 unusable.

The trouble is you have both tagged frames and untagged frames on the same port. The PC if not VLAN aware will pick up both. In other words you have port 17 setup as a partial trunk then expect it to not send both tagged and untagged frames out of it.

What is your intended use?
by jkarras
Thu Jan 15, 2015 12:46 am
Forum: General
Topic: Help required with MTU settings
Replies: 5
Views: 1771

Re: Help required with MTU settings

Did your ISP state what their L3 MTU was set at? You need to match what they set their side to or you'll end up with odd packet drops when packet reassembly happens.

Like the previous poster mentions do a ping test but instead of pinging the Internet ping the next hop towards your ISP.
by jkarras
Wed Jan 14, 2015 8:19 am
Forum: Forwarding Protocols
Topic: OSPF Example Network
Replies: 18
Views: 6570

Re: OSPF Example Network

Lets say the public IP space your ISP gave you is 10.0.0.0/24 and they route it to you via a /30 network at 172.31.0.0/30 telling you to use the IP 172.31.0.2 and that their side would be 172.31.0.1. All you need to do is put the IP range they assigned to you on your PPPoE server then make sure all ...
by jkarras
Wed Jan 14, 2015 5:06 am
Forum: General
Topic: Help required with MTU settings
Replies: 5
Views: 1771

Re: Help required with MTU settings

What MTU is your ISP expecting to receive have you asked them?
by jkarras
Wed Jan 14, 2015 5:04 am
Forum: General
Topic: ipv6 in hotspot without autentification
Replies: 1
Views: 655

Re: ipv6 in hotspot without autentification

I don't believe hotspot supports IPv6. At least it doesn't create any of the necessary rules needed to capture traffic on the IPv6 firewall.
by jkarras
Wed Jan 14, 2015 4:58 am
Forum: Forwarding Protocols
Topic: OSPF Example Network
Replies: 18
Views: 6570

Re: OSPF Example Network

Just set your Public IP pool on the PPPoE server. As long as your routing is working fine traffic will get there.

Turning on BFD will help a bit with failover times especially on links like the wireless where the link may go down but the physical interface on the RB750 won't show it.
by jkarras
Wed Jan 14, 2015 4:54 am
Forum: Forwarding Protocols
Topic: GRE tunnel
Replies: 6
Views: 1916

Re: GRE tunnel

Is wlan1 on R1 your Internet connection or just some web servers. Ngnr is correct you are missing a default route but your also just missing routes between the two devices. Do you control routing on the Intranet as well if so a GRE tunnel is possibly unnecessary.
by jkarras
Sat Jan 10, 2015 7:15 pm
Forum: Forwarding Protocols
Topic: Best solution for this situ
Replies: 3
Views: 946

Re: Best solution for this situ

Your setup is probably bigger than can be answered easily by the forum. The short answer is if your clients have private IP addresses they are going to need to be mapped to public addresses somewhere along the line. Without knowing your full topology its hard to tell you where to do the NAT. It coul...
by jkarras
Sat Jan 10, 2015 6:55 pm
Forum: Forwarding Protocols
Topic: how to allow traffic between 3 subnets after applying policy
Replies: 7
Views: 1876

Re: how to allow traffic between 3 subnets after applying po

Unsure if this will work with the information given but I believe it will.
/ip route
add  dst-address=<staticnetworkhere>/?? gateway=<interfaceofprivatenetwork> 
add dst-address=<privatenetworkhere>/?? gateway=<interfaceofstaticnetwork> routing-mark=static
by jkarras
Sat Jan 10, 2015 6:50 pm
Forum: Forwarding Protocols
Topic: Mikrotik Port Forwarding Help Needed
Replies: 4
Views: 1439

Re: Mikrotik Port Forwarding Help Needed

True the dest address can be left blank if there is only one IP on the incoming interface in question. If one needed to do some form of one-to-one NAT with multiple incoming IP addresses a source address would be needed.
by jkarras
Sat Jan 10, 2015 5:12 am
Forum: Forwarding Protocols
Topic: Mikrotik Port Forwarding Help Needed
Replies: 4
Views: 1439

Re: Mikrotik Port Forwarding Help Needed

The DST address in your DST-NAT rule needs to be the IP address assigned to the outside interface on your Mikrotik. It looks like you have it assigned to use the IP address of the modem. Because your already going through one NAT gateway that IP doesn't exist on the Mikrotik.
by jkarras
Fri Jan 09, 2015 7:19 am
Forum: Beginner Basics
Topic: Multiple IP Addresses Per MAC
Replies: 2
Views: 744

Re: Multiple IP Addresses Per MAC

Are you speaking of the DHCP server in ROS or an external DHCP server? If external are you looking for the DHCP relay feature?
by jkarras
Fri Jan 09, 2015 7:11 am
Forum: Beginner Basics
Topic: Different vlan combos per ethernet interface
Replies: 1
Views: 757

Re: Different vlan combos per ethernet interface

Your saying you want these ports to accept and transmit only certain vlan combinations? You will need to do this in the switch menu by configuring which VLANs are allowed on which ports. http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Example_-_802.1Q_Trunking_with_Atheros_switch_chip_in_R...
by jkarras
Fri Jan 09, 2015 6:43 am
Forum: Forwarding Protocols
Topic: Best solution for this situ
Replies: 3
Views: 946

Re: Best solution for this situ

Can you describe your network a little better? Is the connection between your router and the VPS (Virtual Private Server???) a direct point to point link? If so no tunneling protocol is needed. Do you have publically routeable IP addresses assigned to your clients? If not some form of NAT will need ...
by jkarras
Fri Jan 09, 2015 6:41 am
Forum: Forwarding Protocols
Topic: how to allow traffic between 3 subnets after applying policy
Replies: 7
Views: 1876

Re: how to allow traffic between 3 subnets after applying po

With this setup you have effectively created a VRF. This means routes from your main table can't see your static table. VRFs are to routing what VLANs are to switching. So effectively you have created a little logical router just to handle the static IP addresses. If you want the two to mingle your ...
by jkarras
Fri Jan 09, 2015 6:32 am
Forum: Forwarding Protocols
Topic: link-local 169.254.0.0 traffic | Issues
Replies: 1
Views: 1171

Re: link-local 169.254.0.0 traffic | Issues

There is nothing that sets a zeroconf address apart from one assigned by DHCP or manual entry. As long as the DirectTV boxes are on the same L2 network I don't see why things would be an issue.
by jkarras
Fri Jan 09, 2015 4:55 am
Forum: Beginner Basics
Topic: Site to site VPN - can only establish from one end
Replies: 4
Views: 2664

Re: Site to site VPN - can only establish from one end

To connect a IPSEC tunnel from a Mikrotik to a Cisco ASA you'll need to add the "level=unique" setting to your policy. On a side note highly suggest you change your crypto and hashing to AES (higher the better) and SHA1 at a minimum. /ip ipsec policy add dst-address=172.16.0.0/21 sa-dst-address=<<<W...
by jkarras
Wed Jan 07, 2015 7:31 am
Forum: Forwarding Protocols
Topic: BGP route filter order
Replies: 4
Views: 1635

Re: BGP route filter order

I am working on two metarouter sample setup to confirm and show the potential issue. This will be cleaner than posting my existing config here. My experience so far and the wiki show that the BGP instance route filters are applied before the BGP peer route filters. VRF filters seem to be on their ow...
by jkarras
Wed Jan 07, 2015 5:04 am
Forum: Forwarding Protocols
Topic: BGP route filter order
Replies: 4
Views: 1635

Re: BGP route filter order

So actually my problem is the opposite of what you describe. My default discard rule in the peer filter is discarding routes that were accepted in the VRF filter.

Are router filters not first match (with the exception of passthrough) like firewall rules?
by jkarras
Tue Jan 06, 2015 8:18 am
Forum: Forwarding Protocols
Topic: BGP route filter order
Replies: 4
Views: 1635

BGP route filter order

In testing BGP route filters I have noticed the following behavior and wonder if it is correct. It seems that for an out filter the order of operations is as follows: 1) BGP instance out filter 2) BGP VRF out filter 3) BGP peer out filter The trouble is it seems that accept rules in the VRF filter d...
by jkarras
Sun Jan 04, 2015 7:43 am
Forum: General
Topic: How To Choose RouterOS Install Partition on HDD?
Replies: 1
Views: 774

Re: How To Choose RouterOS Install Partition on HDD?

It wipes the full hard drive.
by jkarras
Sun Jan 04, 2015 1:46 am
Forum: General
Topic: upgrade from 6.2 and 6.15 to 6.24 crashed CCR1016
Replies: 2
Views: 929

Re: upgrade from 6.2 and 6.15 to 6.24 crashed CCR1016

Have you tried a netinstall to get them back up and running. Sounds like you may have a corrupted image upload or bad flash.
by jkarras
Sun Jan 04, 2015 12:12 am
Forum: Forwarding Protocols
Topic: Redistribute routes tagged with a special BGP community
Replies: 13
Views: 3005

Re: Redistribute routes tagged with a special BGP community

add action=accept append-bgp-communities="" bgp-communities=MYASN:100 chain=IXPTRANSIT-OUT comment="Reannounce prefixes with BGP community MYASN:100" match-chain="" I think the issue is that your appending a blank community in the same filter rule as your match. I seem to remember having a similar ...
by jkarras
Sat Jan 03, 2015 11:53 pm
Forum: Forwarding Protocols
Topic: GRE tunnel
Replies: 6
Views: 1916

Re: GRE tunnel

Couple of things I noticed. A)You have no return route on R1 telling it how to get traffic to R2 via the GRE tunnel. B)There are too many masquerade rules. If I understand your desired traffic flows correctly there isn't a need for any. C)There are a couple of static routes that don't make a lot of ...
by jkarras
Sat Jan 03, 2015 11:23 pm
Forum: Beginner Basics
Topic: firewall questions
Replies: 5
Views: 1737

Re: firewall questions

As bajodel mentioned each table evaluated independently as each have a different function. If you look at the data flow diagrams at the link below helps it make more sense.

http://forum.mikrotik.com/viewtopic.php ... 49#p418449
by jkarras
Sat Jan 03, 2015 4:35 pm
Forum: Forwarding Protocols
Topic: BGP routes not propagated between iBGP and eBGP
Replies: 14
Views: 13519

Re: BGP routes not propagated between iBGP and eBGP

How is the check you speak of not just the loop prevention that iBGP does? I.e. iBGP only advertises locally originating routes thus needing a full mesh or route-reflector.
by jkarras
Sat Jan 03, 2015 12:05 am
Forum: Beginner Basics
Topic: firewall questions
Replies: 5
Views: 1737

Re: firewall questions

See inline for a few answers. A few firewall questions a) in 'mangle' I see also the accept/drop/reject actions. I though mangle is intended for marking traffic, not for making decisions on how to handle it? Or is the 'mangle' table just a normal firewall table that is just consulted first before th...
by jkarras
Fri Jan 02, 2015 4:50 pm
Forum: Forwarding Protocols
Topic: EoIP over encription tunnel
Replies: 1
Views: 929

Re: EoIP over encription tunnel

Basically you will need to setup IPSEC using the site-to-site instructions. Then when defining the policy configure the source and destination information based on where your EoIP tunnel originates. So you don't add too much overhead to the tunnel uncheck the "tunnel" box on the policy. This will ma...
by jkarras
Fri Jan 02, 2015 4:43 pm
Forum: Forwarding Protocols
Topic: MPLS without internet
Replies: 1
Views: 790

Re: MPLS without internet

Think of MPLS as just another routing method. You will still need a way to physically (i.e. direct fiber) or logically (i.e. circuit from telco, or VPN) connect these offices together. In other words MPLS in and of itself will not reduce the need for the DSL modems or other form of carrier circuit b...
by jkarras
Fri Jan 02, 2015 6:41 am
Forum: Beginner Basics
Topic: Site to site VPN - can only establish from one end
Replies: 4
Views: 2664

Re: Site to site VPN - can only establish from one end

What does your peer config look like on the Mikrotik side?
by jkarras
Tue Dec 30, 2014 6:59 am
Forum: Scripting
Topic: Sync DNS entries with DHCP leases
Replies: 9
Views: 3737

Re: Sync DNS entries with DHCP leases

I created a script to dynamically add and remove DNS entries via the lease-script. It also tracks which lease created the entry so two machines with the same name don't have conflicts. First machine to claim the name gets it.

https://github.com/karrots/ROS-DDNS
by jkarras
Tue Dec 30, 2014 3:10 am
Forum: Scripting
Topic: IPSEC DNS update script
Replies: 0
Views: 628

IPSEC DNS update script

All I created a script which will update your IPSEC peers and policies based on the DNS when it changes. Try it out and let me know any feedback.

https://github.com/karrots/ros-ddns-ipsec
by jkarras
Fri Dec 12, 2014 5:12 pm
Forum: General
Topic: Cisco 3750 + Mikrotik = IP-Port-MAC
Replies: 5
Views: 1484

Re: Cisco 3750 + Mikrotik = IP-Port-MAC

Is sounds like you are looking for the technologies I mentioned in my earlier post. Do a search for them on Cisco's website and you will find design guides.
by jkarras
Wed Dec 10, 2014 3:53 pm
Forum: General
Topic: Cisco 3750 + Mikrotik = IP-Port-MAC
Replies: 5
Views: 1484

Re: Cisco 3750 + Mikrotik = IP-Port-MAC

Are you going to need to describe what your wanting a bit better.

You might be looking for port security with IP source guard and DHCP snooping.
by jkarras
Tue Dec 09, 2014 10:18 pm
Forum: General
Topic: Hardware Redundancy
Replies: 3
Views: 1463

Re: Hardware Redundancy

It depends on how your configured with the ISP. If they have you plugged into the same device on their side or a VRRP pair then you can use VRRP as well. Most of the time I have just seen ISPs desiring to do two different BGP sessions as your being connected to different POP locations. Both scenario...
by jkarras
Tue Dec 09, 2014 7:41 am
Forum: General
Topic: MikroTik + Cisco ACS 4.2
Replies: 7
Views: 3573

Re: MikroTik + Cisco ACS 4.2

What DB are you using for the user credential store? Is it local users on the ACS or Active Directory? Per the wiki and my experience PAP is used for SSH, Telnet, and Webfig. CHAP is used for Winbox. If AD is your backing store CHAP will not work with ACS. You should be able to get in with the other...
by jkarras
Tue Dec 09, 2014 7:36 am
Forum: General
Topic: Winbox losing MAC connection to RB850Gx2
Replies: 44
Views: 13119

Re: Winbox losing MAC connection to RB850Gx2

The MAC based connection would make initial connection then act as though it was disconnected and quit updating but never actually disconnects. How much time went by between when you made the connection and when you noticed it had stopped updating? Long enough for the initial window to populate. Th...
by jkarras
Tue Dec 09, 2014 6:57 am
Forum: General
Topic: Hardware Redundancy
Replies: 3
Views: 1463

Re: Hardware Redundancy

You would need to setup interface tracking rules to propagating a link failure into a VRRP master change. That said it isn't necessary for that type of failure when correctly setup. What should be done is a BGP (or other routing protocol) peer should be setup between R1 and and R2. This could be via...
by jkarras
Tue Dec 09, 2014 5:45 am
Forum: General
Topic: Winbox losing MAC connection to RB850Gx2
Replies: 44
Views: 13119

Re: Winbox losing MAC connection to RB850Gx2

I have had the same issue mentioned here with my RB850x2. The MAC based connection would make initial connection then act as though it was disconnected and quit updating but never actually disconnects. I have two others I purchased at the same time but have yet to set them up yet. Its a very differe...
by jkarras
Fri Dec 05, 2014 1:06 am
Forum: RouterBOARD hardware
Topic: Dual power supply models
Replies: 0
Views: 932

Dual power supply models

I need to pick up a new CCR with dual PSUs. I was looking on routerboard.com and it looks like only the 1009 and 1016 have dual power supplies. Is there any word on when the 1072 will be out with dual power supplies? Last I could find it was supposed to be released in Nov but no word yet. I'd be ok ...
by jkarras
Wed Nov 12, 2014 4:53 am
Forum: General
Topic: How do I know what fiber a Mikrotik SFP will work with?
Replies: 7
Views: 2821

Re: How do I know what fiber a Mikrotik SFP will work with?

If you read the text on the side of the fiber jumper and/or cable it should mention what micron it is and possibly even if its OM3 or OM4. OM1 and OM2 typically don't say. If its infrastructure cable it may have a manufacturer and model number that can be looked up. For patch cords as has been menti...
by jkarras
Sat Nov 01, 2014 9:02 am
Forum: Forwarding Protocols
Topic: STP Over VPLS
Replies: 12
Views: 4450

Re: STP Over VPLS

Is the issue because your effectively stripping the VLAN tags as traffic enters the VPLS tunnel.

Your current config shows the port plus the three VLANs bridged together.
by jkarras
Sun Oct 19, 2014 12:45 am
Forum: RouterBOARD hardware
Topic: sudden high cpu usage for unknown reasons on ccr 1036
Replies: 3
Views: 1203

Re: sudden high cpu usage for unknown reasons on ccr 1036

What version of ROS is being used?
by jkarras
Sun Oct 19, 2014 12:43 am
Forum: Forwarding Protocols
Topic: BGP community tagging during redistribution?
Replies: 2
Views: 1176

Re: BGP community tagging during redistribution?

A filter like the one below should accomplish both the tagging and the redistribution.
/route filter add chain=addcommunities protocol=connect append-bgp-communities=65390:501 action=accept
/route filter add chain=addcommunities protocol=static append-bgp-communities=65390:500 action=accept
by jkarras
Wed Oct 15, 2014 6:18 am
Forum: RouterBOARD hardware
Topic: ccr 1036 vs layer 3 switch
Replies: 8
Views: 3755

Re: ccr 1036 vs layer 3 switch

No it isn't and my intent was never to say it was. It was only to debunk that L3 switches are incapable at out routing a "router". The CRR and the Cisco 6500 don't really live in the same performance or feature realm I would not expect them to be the same price. All the extra chips needed to do the ...
by jkarras
Tue Oct 14, 2014 10:20 pm
Forum: RouterBOARD hardware
Topic: ccr 1036 vs layer 3 switch
Replies: 8
Views: 3755

Re: ccr 1036 vs layer 3 switch

With the Brocade line mentioned it would be a issue. It only supports 16k routes. If you move to something bigger it can certainly handle it with the same HW offload mentioned before. Right box for the right job. Just take a look at the Sup 2t on the Cisco side or something in the MLX line from broc...
by jkarras
Tue Oct 14, 2014 5:44 am
Forum: RouterBOARD hardware
Topic: RB850Gx2 - Release date?
Replies: 193
Views: 50310

Re: RB850Gx2 - Release date?

Could be a limit on the CPU as well.
by jkarras
Sun Oct 12, 2014 6:04 am
Forum: RouterBOARD hardware
Topic: ccr 1036 vs layer 3 switch
Replies: 8
Views: 3755

Re: ccr 1036 vs layer 3 switch

This is only partially true. While the switches of the larger vendors do have smaller CPUs just like the CRS they also don't rely on it nearly as much as Mikrotik. The larger vendors Cisco, Brocade and such have built hardware based L3 forwarding engines into their switches. In Cisco land its called...
by jkarras
Fri Oct 10, 2014 3:55 pm
Forum: General
Topic: SRC NAT or Masquerade with Multi IP
Replies: 10
Views: 2963

Re: SRC NAT or Masquerade with Multi IP

Not if your PCC rule tells the traffic to go out the interface aer are not discussing.
by jkarras
Wed Oct 08, 2014 10:44 pm
Forum: General
Topic: SRC NAT or Masquerade with Multi IP
Replies: 10
Views: 2963

Re: SRC NAT or Masquerade with Multi IP

One other option is to create 5 NAT rules. One for each portion of your IP space each mapping to a specific IP.

If you want one rule you'll need to use the SAME action. Netmap is only for 1:1 mappings.
by jkarras
Wed Oct 08, 2014 6:57 pm
Forum: General
Topic: SRC NAT or Masquerade with Multi IP
Replies: 10
Views: 2963

Re: SRC NAT or Masquerade with Multi IP

FYI I am just reading the wiki for this information.

To keep people on the same IP for all connections use the same option. From previous discussions on the forum masquerade uses the first IP.
by jkarras
Tue Oct 07, 2014 11:39 pm
Forum: General
Topic: SRC NAT or Masquerade with Multi IP
Replies: 10
Views: 2963

Re: SRC NAT or Masquerade with Multi IP

I believe you can just put a range of IPs into the "To Address" field of the SRC-NAT action and it will do what you are referring to.

If you had wanted to do a 1:1 mapping you would use the netmap feature.
by jkarras
Tue Oct 07, 2014 4:25 pm
Forum: General
Topic: SRC NAT or Masquerade with Multi IP
Replies: 10
Views: 2963

Re: SRC NAT or Masquerade with Multi IP

What is it you are trying to accomplish?
by jkarras
Tue Oct 07, 2014 3:36 am
Forum: General
Topic: CRS125-24G-1S-RM LAN performance
Replies: 3
Views: 1172

Re: CRS125-24G-1S-RM LAN performance

Disclaimer I don't own a CRS. I have messed with it on RB750GLs.

The link below should get you started.
http://wiki.mikrotik.com/wiki/Manual:CR ... _Switching
by jkarras
Tue Oct 07, 2014 3:11 am
Forum: General
Topic: CRS125-24G-1S-RM LAN performance
Replies: 3
Views: 1172

Re: CRS125-24G-1S-RM LAN performance

You need to use the switch chip features found under the switch menu instead of a bridge. Bridges are CPU constrained and don't use the switch chip.
by jkarras
Mon Oct 06, 2014 8:31 am
Forum: General
Topic: Feature request: Stateful HA with Conntrackd
Replies: 30
Views: 8134

Re: Feature request: Stateful HA with Conntrackd

+1 please
by jkarras
Mon Oct 06, 2014 8:28 am
Forum: General
Topic: Feature Request: DNS Override for specific subnets
Replies: 19
Views: 6580

Re: Feature Request: DNS Override for specific subnets

+1 for this request. I miss the feature from pfsense as well.

Also agree with tighter DNS DHCP integration as well. That said the new lease script helps a bunch. I modified a script here that works well for me.

https://github.com/karrots/ROS-DDNS
by jkarras
Mon Oct 06, 2014 8:14 am
Forum: General
Topic: At a loss
Replies: 1
Views: 651

Re: At a loss

Sounds like a VLAN trunk is in order. Assign IPTV to one VLAN WAN to the other. Make your port 5 a trunk.
by jkarras
Sun Oct 05, 2014 5:15 am
Forum: General
Topic: ipv6 default gateway?
Replies: 2
Views: 3388

Re: ipv6 default gateway?

I just had this issue as well. The Cisco router wasn't showing up in the IPv6 neighbor list and ROS refused to send IPv6 forwarded packets the direction of any static route. Its as though ROS ignores ND packets from the cisco side if its sending RAs as well or the Cisco side doesn't send NDs when it...
by jkarras
Wed Sep 24, 2014 10:23 pm
Forum: Beginner Basics
Topic: Route LAN IP to another LAN
Replies: 4
Views: 1206

Re: Route LAN IP to another LAN

Setup your IP addresses on the three interfaces as you indicate. That is all that should be needed assuming you have no firewall rules to get in the way. No NAT is needed.
by jkarras
Sun Aug 10, 2014 9:44 pm
Forum: Forwarding Protocols
Topic: Single homed BGP edge router redundancy
Replies: 9
Views: 2902

Re: Single homed BGP edge router redundancy

Unless you peer from both devices all the time you'll have to wait for things to rebuild and establish.
by jkarras
Sun Aug 03, 2014 6:31 am
Forum: Beginner Basics
Topic: 2 Wan ip translation error to LAN
Replies: 1
Views: 712

Re: 2 Wan ip translation error to LAN

Can you post your actual NAT rule? It should work fine assuming your provider allows you to have two addresses.
by jkarras
Sun Aug 03, 2014 6:19 am
Forum: General
Topic: Log hotspot Users Activity
Replies: 2
Views: 1046

Re: Log hotspot Users Activity

What layer of the network stack to you want logged just L3/L4 stuff or L7 HTTP URL type logging? If Layer 7 your going to need to have something that can see L7 traffic like a transparent proxy.
by jkarras
Sat Aug 02, 2014 3:35 pm
Forum: General
Topic: Replacing Cisco ASA5520 with CCR1016-12G
Replies: 18
Views: 4268

Re: Replacing Cisco ASA5520 with CCR1016-12G

Config sync
by jkarras
Fri Aug 01, 2014 5:43 am
Forum: General
Topic: opening port on firewall - nat
Replies: 8
Views: 2451

Re: opening port on firewall - nat

It sounds like your trying to forward unknown thing. Do you know the service you want available behind the NAT is it HTTP, SMTP, or something else?

netstat will tell you what is listening but the typical computer these days is listening to a lot of things.
by jkarras
Thu Jul 31, 2014 5:29 am
Forum: Forwarding Protocols
Topic: BGP aggregate configuration
Replies: 9
Views: 5042

Re: BGP aggregate configuration

My guess is its because the two halfs of your /25 are not in your routing table. Its only going to aggregate routes that fully exist.
by jkarras
Tue Jul 29, 2014 5:53 am
Forum: RouterBOARD hardware
Topic: CCR1036-8G-2S+ SFP Problems
Replies: 55
Views: 44486

Re: CCR1036-8G-2S+ SFP Problems

No news on this? Trying to link the 8-port SFP unit with the 24-port switch unit using an SFP. Must be SFP because only have 1 fiber between sites. Mikrotik only sell 10G SFP+ with 2 fiber. I am confused by your question No one here seems to be talking about 1GBase-BX optics. One option you have is...
by jkarras
Tue Jul 29, 2014 5:46 am
Forum: Forwarding Protocols
Topic: BGP aggregate configuration
Replies: 9
Views: 5042

Re: BGP aggregate configuration

Can't speak for the BGP aggregation but your filter command is incorrect and likely the problem. Try one of the following depending on what you wish to match. Match /24 and /25 prefix length: /routing filter add action=discard chain=out-filter invert-match=yes prefix=150.13.0.0 prefix-length=24-25 M...
by jkarras
Sun Jul 27, 2014 11:30 pm
Forum: General
Topic: Replacing Cisco ASA5520 with CCR1016-12G
Replies: 18
Views: 4268

Re: Replacing Cisco ASA5520 with CCR1016-12G

Fully agree on not running dynamic routing on the firewall.

9.x has has 4 major releases though. Three with BGP support 9.1, 9.2, and 9.3. Now 9.2 and 9.3 won't run on a non -X ASA though.
by jkarras
Sun Jul 27, 2014 4:23 pm
Forum: General
Topic: Replacing Cisco ASA5520 with CCR1016-12G
Replies: 18
Views: 4268

Re: Replacing Cisco ASA5520 with CCR1016-12G

Never said they were exactly the same just in the security & firewalling realm.

That said they do support BGP these days. Can't speak for its stability as I haven't ever run a ASA with a dynamic routing protocol turned on.
by jkarras
Sat Jul 26, 2014 10:52 pm
Forum: Wireless Networking
Topic: Wireless mesh with ethernet interfaces
Replies: 24
Views: 12294

Re: Wireless mesh with ethernet interfaces

I have only seen this when there isn't enough overlap between access points coverage or if you cause a Layer 3 roam to happen. Assuming all your access points wifi interface are connected to the same L2 domain no L3 roam should be happening. I have also seen this when say you are in a warehouse and ...
by jkarras
Sat Jul 26, 2014 10:24 pm
Forum: Forwarding Protocols
Topic: MPLS/VPLS Setup
Replies: 10
Views: 2519

Re: MPLS/VPLS Setup

I realize you're looking for one-on-one help but here is a minor suggestion that may help. Have you implemented BFD with your OSPF? It can help minimize the link failure detection. Its best used on links that may be over another carriers MetroEthernet as a down circuit may not equal a down interface...
by jkarras
Sat Jul 26, 2014 10:22 pm
Forum: General
Topic: How to build a Wi-Fi roaming environment of using CAPsMAN
Replies: 11
Views: 8902

Re: How to build a Wi-Fi roaming environment of using CAPsMA

There is no provision in the 802.11 spec currently for AP assisted roaming. Its currently all up to the clients wifi drivers. There isn't even a provision in the spec as to when a client should roam. The only difference between using CAPsMAN and setting up discrete access points all configured the s...
by jkarras
Sat Jul 26, 2014 8:17 pm
Forum: General
Topic: How to build a Wi-Fi roaming environment of using CAPsMAN
Replies: 11
Views: 8902

Re: How to build a Wi-Fi roaming environment of using CAPsMA

I have some packets lost when switching between APs', 0.5-2 seconds gap in CSipSimple (SIP client for Android).
You may want to look at increasing your coverage density if you get dropped packets and have a need for VoIP on your wireless.
by jkarras
Sat Jul 26, 2014 8:14 pm
Forum: General
Topic: Replacing Cisco ASA5520 with CCR1016-12G
Replies: 18
Views: 4268

Re: Replacing Cisco ASA5520 with CCR1016-12G

True if your NAT ~1024 IP addresses into 1 IP address the profile to a hacker is one IP to scan instead of two. Functionally the same thing can be accomplished with just a default deny firewall rule. Functionally a default deny firewall policy and many-to-one SNAT end up accomplishing similar things...
by jkarras
Sat Jul 26, 2014 4:56 am
Forum: General
Topic: CCR-1009-8G-1S-1S+ tops out at ~500mbps?
Replies: 7
Views: 4057

Re: CCR-1009-8G-1S-1S+ tops out at ~500mbps?

Ah, yea probably falls into the not quite all multithreaded category. Does one of the CPUs get pegged?
by jkarras
Sat Jul 26, 2014 4:43 am
Forum: General
Topic: CCR-1009-8G-1S-1S+ tops out at ~500mbps?
Replies: 7
Views: 4057

Re: CCR-1009-8G-1S-1S+ tops out at ~500mbps?

802.3ad doesn't do per packet load balancing just per flow. So any individual flow will not exceed the port speed its going over. With a L2/L3 hashing chosen pretty much any connection for a computer through a local default route will get hashed the same. Better load balancing would be L3/L4 but it ...
by jkarras
Fri Jul 25, 2014 8:04 am
Forum: General
Topic: Replacing Cisco ASA5520 with CCR1016-12G
Replies: 18
Views: 4268

Re: Replacing Cisco ASA5520 with CCR1016-12G

I should note one other difference between VLANs and separate interfaces. VLANs will all share the bandwidth of the interface they are attached to. That said the 1016 is unlikely push more packets than one 1GigE port with firewalling enabled.
by jkarras
Thu Jul 24, 2014 6:06 pm
Forum: General
Topic: Replacing Cisco ASA5520 with CCR1016-12G
Replies: 18
Views: 4268

Re: Replacing Cisco ASA5520 with CCR1016-12G

The only difference between using VLANs and physical interfaces is one burns more interfaces. You still have all the same control over traffic. You will need to setup 5 access ports on your switch to keep all the traffic on their respective VLANs. One difference between the ASA and Mikrotik is the A...
by jkarras
Wed Jul 23, 2014 6:55 am
Forum: Beginner Basics
Topic: add management IP to CRS switch? how to? example not working
Replies: 9
Views: 4260

Re: add management IP to CRS switch? how to? example not wor

Did you verify its not just a trunking problem by setting a port on your CRS to vlan 300 and testing access?
by jkarras
Wed Jul 23, 2014 6:48 am
Forum: Forwarding Protocols
Topic: IPSec Site-to-Site with overlapping route of last resort
Replies: 8
Views: 3031

Re: IPSec Site-to-Site with overlapping route of last resort

The trick with ROS is that IPSEC policy applies before local input policy. This can be seen in the packet flow diagram on the wiki http://wiki.mikrotik.com/wiki/Manual:Packet_Flow_v6 This is different than a Cisco ASA which will behind the scenes take care of excluding local connections. To fix this...
by jkarras
Wed Jul 23, 2014 6:32 am
Forum: Forwarding Protocols
Topic: IPSec Site-to-Site with overlapping route of last resort
Replies: 8
Views: 3031

Re: IPSec Site-to-Site with overlapping route of last resort

What RouterOS version? 5.x or 6.x?
by jkarras
Wed Jul 23, 2014 4:55 am
Forum: Forwarding Protocols
Topic: Add OpenVPN Route to another CLOUD Core
Replies: 1
Views: 1122

Re: Add OpenVPN Route to another CLOUD Core

You will need to use a dynamic routing protocol. Any of them will meet your needs. Its unclear to me why each phone will get a subnet and not just a single IP from the OVPN IP pool.
by jkarras
Wed Jul 23, 2014 4:48 am
Forum: Forwarding Protocols
Topic: IPSec Site-to-Site with overlapping route of last resort
Replies: 8
Views: 3031

Re: IPSec Site-to-Site with overlapping route of last resort

Can you explain your local traffic portion of the problem more? Do you mean traffic destined for the local gateway for devices on say 172.16.10.x/24? Or do you have two or more different networks on the router that are local?
by jkarras
Sun Jul 20, 2014 4:24 pm
Forum: Scripting
Topic: Script for setting DNS entries for DHCP clients
Replies: 5
Views: 3757

Re: Script for setting DNS entries for DHCP clients

Good idea on using the DHCP network for the domain name. The trouble is that there isn't always a one to one mapping between the network and the DHCP server. I could do a comparison between the IP the client received and the list of networks to find the value. I'll have to look into the IP compariso...
by jkarras
Sun Jul 20, 2014 12:59 am
Forum: Scripting
Topic: Script for setting DNS entries for DHCP clients
Replies: 5
Views: 3757

Script for setting DNS entries for DHCP clients

All, I noticed while looking for scripts that would set DNS entries for DHCP leases that all of them were old and used the scheduler. I have created a new script using the new on-lease script functionality in ROS 6.2+. My code is on Github at the link below. Would love feedback. https://github.com/k...
by jkarras
Fri Jul 18, 2014 4:44 am
Forum: Forwarding Protocols
Topic: Mikrotik Router interface bridge block VPN
Replies: 3
Views: 1355

Re: Mikrotik Router interface bridge block VPN

Still didn't answer where the clients are connecting to. Do they connect to another box or to the Mikrotik? Also what do your firewall rules look like? It sounds as though you have a rule blocking access.
by jkarras
Wed Jul 16, 2014 8:10 am
Forum: RouterBOARD hardware
Topic: RB751u-2hnd ethernet 1 gone bad?
Replies: 6
Views: 1264

Re: RB751u-2hnd ethernet 1 gone bad?

I assume you power cycled the device? Pull power wait ~30 sec plug back in. Be sure and wait. The caps need to drain.
by jkarras
Tue Jul 15, 2014 6:16 am
Forum: General
Topic: how to port forwarding from some routers to IP CAMERA
Replies: 3
Views: 1213

Re: how to port forwarding from some routers to IP CAMERA

Three NAT statements are only needed if you are not routing all of the connections in your network. You should only need the NAT statement on the first device connected to the Internet.
by jkarras
Tue Jul 15, 2014 6:15 am
Forum: Forwarding Protocols
Topic: Odd OSPF route selection
Replies: 7
Views: 1494

Re: Odd OSPF route selection

You will need to know what type of traffic is coming in. Is it traffic to/from a directly connected route e.g. non ISP traffic?
by jkarras
Tue Jul 15, 2014 5:49 am
Forum: General
Topic: VoIP QoS not working correctly
Replies: 9
Views: 1627

Re: VoIP QoS not working correctly

Worth checking Steam is basically a flood of UDP packets. So its much harder on the connection tracking and will come closer to the 64-byte speed measurements Mikrotik publishes.

Also check that your buffers of any parent queues that steam and VoIP packets share.
by jkarras
Tue Jul 15, 2014 5:47 am
Forum: General
Topic: Roam across VLANs?
Replies: 1
Views: 682

Re: Roam across VLANs?

What type of authentication are you talking about wifi auth like 802.1x WPA2-enterprise or hotspot?

For wifi auth as long as your settings match across APs SSID, auth type, password if PSK you should be fine and roaming happens normally with no additional authentication.
by jkarras
Tue Jul 15, 2014 5:25 am
Forum: General
Topic: VoIP QoS not working correctly
Replies: 9
Views: 1627

Re: VoIP QoS not working correctly

Are you hitting 100% CPU at these times? It may just be that you are exceeding the limits of the device. If there isn't overhead available there will be issues.
by jkarras
Mon Jul 14, 2014 5:04 pm
Forum: Forwarding Protocols
Topic: Mikrotik Router interface bridge block VPN
Replies: 3
Views: 1355

Re: Mikrotik Router interface bridge block VPN

More information is needed to solve this.

What kind of VPN protocols are used? Where are the VPN endpoints located? Do they traverse the Mikrotik? What kind of firewall rules exist on your bridge?
by jkarras
Mon Jul 14, 2014 5:01 pm
Forum: Forwarding Protocols
Topic: Routerboard maintenance over VPLS tunnel
Replies: 5
Views: 1339

Re: Routerboard maintenance over VPLS tunnel

So your loopbacks should be a /32. They don't need more than one IP address so anything larger is just wasting IP addresses. To gain access to the loopbacks you will need an interface that is part of the connected/loopback OSPF routing domain used for your MPLS infrastructure. That or route leak you...
by jkarras
Fri Jul 11, 2014 3:19 pm
Forum: General
Topic: re-route traffic of hotspot to VPN
Replies: 1
Views: 704

Re: re-route traffic of hotspot to VPN

Is the hotspot traffic the only traffic on the device? If so standard routing changes (default route towards VPN) to force the traffic over the PPTP link should work fine.

If you have other traffic must stay moving out the WAN normally you may need to look into a VRF.
by jkarras
Fri Jul 11, 2014 3:17 pm
Forum: General
Topic: Routing public ip block to existing another subnet
Replies: 3
Views: 1182

Re: Routing public ip block to existing another subnet

The setup you describe should work fine with no NAT. It sounds like there is a unicast routing issue either at the ISP or on your router. What happens if you traceroute from somewhere else to your IP block. Do you see the packets making it to your router? Do you have an firewall rules in the forward...
by jkarras
Fri Jul 11, 2014 3:05 pm
Forum: Beginner Basics
Topic: Individual port stats on RB750UP
Replies: 3
Views: 868

Re: Individual port stats on RB750UP

Putting all the ports in a bridge will kill the L2 switching performance because everything will hit CPU.

What ROS version are you running. I believe in the latest 6.x version they added per interface stats even when ports are in a switch group.
by jkarras
Fri Jul 11, 2014 3:04 pm
Forum: General
Topic: upgrading from v5
Replies: 6
Views: 1140

Re: upgrading from v5

Prerouting is still in the same place. Just post routing is different. I haven't used simple queues that much and I have really only ever used an interface as a target with packet marking. I have yet to target an interface+IP range. If your setting up individual queues for customer classes you shoul...
by jkarras
Fri Jul 11, 2014 7:55 am
Forum: General
Topic: upgrading from v5
Replies: 6
Views: 1140

Re: upgrading from v5

I assume its rule 90 that works and 91 doesn't?

Did you look at how the packet flows change with v6? Queues now happen after source-nat. Do you do any NAT with these addresses? Also are you setting up a list of /32s to divide up bandwidth? Have you looked into PCQ?
by jkarras
Fri Jul 11, 2014 6:39 am
Forum: General
Topic: upgrading from v5
Replies: 6
Views: 1140

Re: upgrading from v5

There is a page on the wiki that lists all of the 5.x->6.x changes. http://wiki.mikrotik.com/wiki/Manual:What%27s_New_In_v6 There were changes to the packet flow as well that you may be hitting. http://wiki.mikrotik.com/wiki/Manual:Packet_Flow#Changes_in_RouterOS_v6 http://wiki.mikrotik.com/wiki/Man...
by jkarras
Thu Jul 10, 2014 3:46 pm
Forum: General
Topic: Large Port Forwarding NAT table - Best Practices
Replies: 3
Views: 1322

Re: Large Port Forwarding NAT table - Best Practices

You mentioned monitoring so I figured it was one monitoring station off site. As for IPv6 you are right in that most home users may not have a router that supports IPv6. Most ISPs support it on their backbones and for business/enterprise links. With one or two of the RIRs having run out of IPv4 to h...
by jkarras
Thu Jul 10, 2014 8:47 am
Forum: Forwarding Protocols
Topic: Routerboard maintenance over VPLS tunnel
Replies: 5
Views: 1339

Re: Routerboard maintenance over VPLS tunnel

Why not just connect to your loopback addresses they are there for that kind of thing.
by jkarras
Thu Jul 10, 2014 8:44 am
Forum: General
Topic: Large Port Forwarding NAT table - Best Practices
Replies: 3
Views: 1322

Re: Large Port Forwarding NAT table - Best Practices

If your NATing traffic your router handles remapping the return traffic. No renegotiation needed. DNAT away the router will work around it.

Have you thought about using a VPN or IPv6 instead of soany DNAT rules for monitoring?
by jkarras
Wed Jul 09, 2014 6:45 am
Forum: General
Topic: port forwarding to multiple inside networks
Replies: 4
Views: 1656

Re: port forwarding to multiple inside networks

Do both IPs go out the same WAN. How does the router decide which WAN to send traffic out? I think you have a asymmetric routing issue.
by jkarras
Wed Jul 09, 2014 6:42 am
Forum: General
Topic: Confusion with gateways
Replies: 4
Views: 1258

Re: Confusion with gateways

I think we need more information about how the connections work. Your PPTP connection isn't an L2 connection so the router on the other end can't be a first hop router for clients. Also if your using 10.0.0.0/8 on both sides of your PPTP link you have overlapping subnets and your computers will thin...
by jkarras
Wed Jul 09, 2014 6:38 am
Forum: General
Topic: File transfer in LAN. What is a good throughput?
Replies: 4
Views: 1064

Re: File transfer in LAN. What is a good throughput?

84.5Mbps on a 100Mbps LAN port is not too bad. There is Ethernet overhead to account for so you will never see a perfect 100Mbps. I have seen as high as ~95Mbps but its pretty typical to only get ~90Mbps when nothing else is on the wire.
by jkarras
Tue Jul 08, 2014 7:48 am
Forum: General
Topic: How to firewall LAN for Hotspot users?
Replies: 6
Views: 2511

Re: How to firewall LAN for Hotspot users?

Default gateway doesn't matter as it's the gateway for your router not the clients even if it was it still wouldn't break anything. DNS does but you can just add a allow rule above the reject allowing only DNS (TCP/UDP port 53). Do you see hits on your rule? Try making it purely a IP based rule so s...
by jkarras
Tue Jul 08, 2014 6:33 am
Forum: General
Topic: How to firewall LAN for Hotspot users?
Replies: 6
Views: 2511

Re: How to firewall LAN for Hotspot users?

Change this rule (from first post) /ip firewall filter add action=reject chain=input dst-address-list=172.16.42.2-172.16.42.254 in-interface=wlan3-guest-2G reject-with=icmp-admin-prohibited to this /ip firewall filter add action=reject chain=forward dst-address=172.16.42.0/24 in-interface=wlan3-gues...
by jkarras
Tue Jul 08, 2014 5:53 am
Forum: General
Topic: How to firewall LAN for Hotspot users?
Replies: 6
Views: 2511

Re: How to firewall LAN for Hotspot users?

Your reject rule needs to be on the forward chain not the input chain.
by jkarras
Sat Jul 05, 2014 7:55 am
Forum: RouterBOARD hardware
Topic: problem of gigabit port between cisco and mikrotik
Replies: 41
Views: 25822

Re: problem of gigabit port between cisco and mikrotik

Auto-MDIX is part of the Gigabit standard. No need for a crossover cable.
by jkarras
Fri Jul 04, 2014 8:25 am
Forum: General
Topic: Firewall/QoS rules for small office RB2011 and CRS125
Replies: 9
Views: 2804

Re: Firewall/QoS rules for small office RB2011 and CRS125

COS is on the VLAN tag not on the IP as TOS. TOS is different . When you say things run over OVPN do you mean a OVPN connection on your Mikrotik or are the phones themselves connecting to OVPN? If the phones are the OVPN clients there will be no way to know the DSCP markings unless it marks the tunn...
by jkarras
Fri Jul 04, 2014 3:47 am
Forum: General
Topic: Firewall/QoS rules for small office RB2011 and CRS125
Replies: 9
Views: 2804

Re: Firewall/QoS rules for small office RB2011 and CRS125

But at some point there is a choke point on the Mikrotik where you could sniff traffic correct?
by jkarras
Fri Jul 04, 2014 3:00 am
Forum: General
Topic: Firewall/QoS rules for small office RB2011 and CRS125
Replies: 9
Views: 2804

Re: Firewall/QoS rules for small office RB2011 and CRS125

The RB has a way to setup a mirror port if you want to go with looking at wireshark. Do you manage the phones as well or are they a hosted setup? Looking at the manual for the phones/phone system it should tell you what its default DSCP values are. Logging into the mgmt interface on the phone will a...
by jkarras
Thu Jul 03, 2014 8:50 am
Forum: General
Topic: Firewall/QoS rules for small office RB2011 and CRS125
Replies: 9
Views: 2804

Re: Firewall/QoS rules for small office RB2011 and CRS125

Do your phones tag the packets with DSCP or COS values? It may be easy to pickup on those values for your QOS.
by jkarras
Thu Jul 03, 2014 8:43 am
Forum: Beginner Basics
Topic: How to disable RB450up switch
Replies: 2
Views: 944

Re: How to disable RB450up switch

Change the master port on all ports to "none". This will turn off switching.

http://wiki.mikrotik.com/wiki/Manual:Interface/Ethernet
by jkarras
Tue Jul 01, 2014 7:25 am
Forum: Forwarding Protocols
Topic: Help Please - iBGP setup - The Correct Way
Replies: 5
Views: 2205

Re: Help Please - iBGP setup - The Correct Way

You could get rid of the EoIP tunnel saving some CPU and just turn on multi-hop and peer across R3.

Is your intent to get the ~400k routes into OSPF or does R3 just have a default route to one of the BGP routers?
by jkarras
Mon Jun 30, 2014 5:22 am
Forum: General
Topic: LACP Question...
Replies: 15
Views: 11459

Re: LACP Question...

If hashing is set to MAC-IP-port you will get some bandwidth increase out of a single host. Only 1Gig per stream though as mentioned. In my experience it balances out pretty well.
by jkarras
Mon Jun 30, 2014 12:00 am
Forum: General
Topic: Install RouterOS using Netinstall on x86 system
Replies: 3
Views: 5850

Re: Install RouterOS using Netinstall on x86 system

Netinstall is available for x86. I just used it the other day. When booting your server choose network boot from the BIOS boot menu.
by jkarras
Sun Jun 29, 2014 5:28 am
Forum: General
Topic: LACP Question...
Replies: 15
Views: 11459

Re: LACP Question...

Was going to say I am pretty sure LACP is all done in software on both of these platforms at this point. As was mentioned the CRS will support it in hardware in the future.

Between that and the bridge on the 1100AHx2 lots of CPU hit is probably the problem.
by jkarras
Sun Jun 29, 2014 1:34 am
Forum: Forwarding Protocols
Topic: VPLS problems with cisco switches
Replies: 5
Views: 1681

Re: VPLS problems with cisco switches

Sounds like a MTU issue. What is the outgoing MTU on your Mikrotik. Also are you plugged into a GigE port or a 10/100?
by jkarras
Sat Jun 28, 2014 2:28 am
Forum: Beginner Basics
Topic: eth -> vrrp -> (vlan in bridge) = doesn't work
Replies: 3
Views: 1621

Re: eth -> vrrp -> (vlan in bridge) = doesn't work

Shouldn't your VRRP interface be assigned to the bridge that bridges your VLAN and physical interface not the other way around? Also couldn't you just skip the bridge part and assign the VLAN to the physical interface. It would help get rid of some CPU usage. I do have to say I have never setup VRRP...
by jkarras
Fri Jun 27, 2014 5:53 pm
Forum: General
Topic: Eoip or ?
Replies: 3
Views: 1228

Re: Eoip or ?

MPLS/VPLS is probably a better choice if you run the network end to end.
by jkarras
Fri Jun 27, 2014 5:37 pm
Forum: Forwarding Protocols
Topic: Eliminating SPOF with Redundant RB750UP Configuration
Replies: 6
Views: 1377

Re: Eliminating SPOF with Redundant RB750UP Configuration

You can not really have a non-blocking mesh of switches. If you connect switches together STP will block all but one of the ports. You mentioned the 750s doing routing so I thought it was different subnets. The next best thing you could do is plug in two 750's setup VRRP for your L3 gateway and spli...
by jkarras
Fri Jun 27, 2014 7:13 am
Forum: General
Topic: Help configuring CRS226
Replies: 2
Views: 1028

Re: Help configuring CRS226

Do you have an IP assigned to the VLAN? Is the VLAN assigned to the master interface?
by jkarras
Fri Jun 27, 2014 7:02 am
Forum: General
Topic: Eoip or ?
Replies: 3
Views: 1228

Re: Eoip or ?

Are the tunnels across your network or via a network you do not control?
by jkarras
Fri Jun 27, 2014 2:44 am
Forum: Forwarding Protocols
Topic: Eliminating SPOF with Redundant RB750UP Configuration
Replies: 6
Views: 1377

Re: Eliminating SPOF with Redundant RB750UP Configuration

Can you tell us more about the L2 and L3 relation ship the 750UPs have with each other and the radios? If you need to maintain L2 connectivity between the radios your currently doing the best setup aside from maybe adding a second switch. If the 750UPs are routing between the radios and the switch y...
by jkarras
Thu Jun 26, 2014 7:47 am
Forum: General
Topic: Vlan Load balancing
Replies: 3
Views: 1381

Re: Vlan Load balancing

If you have an upstream device that can tag the traffic with a VLAN then yes you can. If not then you will need to stick another switch in place between the RB750GL and the DSL modems to tag the traffic.
by jkarras
Thu Jun 26, 2014 7:35 am
Forum: Beginner Basics
Topic: ethernet port with tagged AND untagged traffic - SOLVED
Replies: 9
Views: 3614

Re: ethernet port with tagged AND untagged traffic - SOLVED

If your regulating the traffic via L2 bridge firewall rules then that make sense. If you are doing it at L3 which is what I assumed looking at the small config snip then you could move away from the bridges. That said it would probably only benefit you use multiple ports on your RB2011 to connect to...
by jkarras
Thu Jun 26, 2014 6:09 am
Forum: Beginner Basics
Topic: ethernet port with tagged AND untagged traffic - SOLVED
Replies: 9
Views: 3614

Re: ethernet port with tagged AND untagged traffic - SOLVED

You should be able to now move your config away from bridges to just using the switch chip for VLAN tagging. This will speed up any L2 communications on your device.
by jkarras
Thu Jun 26, 2014 2:41 am
Forum: Beginner Basics
Topic: How to configure a CRS125-24G-15-RM as a flat L2 switch
Replies: 8
Views: 4204

Re: How to configure a CRS125-24G-15-RM as a flat L2 switch

Personally I would still set a IP address on the master port for managing. Its much more reliable to use IP management over MAC address based management I have found.
by jkarras
Tue Jun 24, 2014 5:16 am
Forum: RouterBOARD hardware
Topic: routerboard with Gbit-PoE-out like 260gsp?
Replies: 2
Views: 1215

Re: routerboard with Gbit-PoE-out like 260gsp?

+1 but 802.3at or af power
by jkarras
Tue Jun 24, 2014 4:28 am
Forum: Forwarding Protocols
Topic: Routed OSPF network 2 WAN DSL connections to ISP
Replies: 5
Views: 2429

Re: Routed OSPF network 2 WAN DSL connections to ISP

Do you have RP filtering turned on?
by jkarras
Tue Jun 24, 2014 2:36 am
Forum: Beginner Basics
Topic: How to configure a CRS125-24G-15-RM as a flat L2 switch
Replies: 8
Views: 4204

Re: How to configure a CRS125-24G-15-RM as a flat L2 switch

The block diagram would agree.
by jkarras
Sat Jun 21, 2014 11:52 pm
Forum: Beginner Basics
Topic: How to configure a CRS125-24G-15-RM as a flat L2 switch
Replies: 8
Views: 4204

Re: How to configure a CRS125-24G-15-RM as a flat L2 switch

Just assign a IP to the master port (static or DHCP). Assuming you want to setup a separate mgmt VLAN you could create a VLAN interface with the appropriate VLAN ID on the master port as well. If you want to keep the switch from forwarding L3 traffic turn off IP forwarding under the IP->Settings men...
by jkarras
Fri Jun 20, 2014 11:42 pm
Forum: General
Topic: CCR1009 and subnets communication problem
Replies: 23
Views: 4136

Re: CCR1009 and subnets communication problem

Version 6.15

I was able to ping both subnets from a host plugged into ether3.
by jkarras
Fri Jun 20, 2014 11:40 pm
Forum: General
Topic: IPsec between Cisco ASA and Mikrotik
Replies: 3
Views: 1147

Re: IPsec between Cisco ASA and Mikrotik

Also make sure your IPSEC policy level is set to unique instead of the default require.
by jkarras
Fri Jun 20, 2014 11:18 pm
Forum: General
Topic: CCR1009 and subnets communication problem
Replies: 23
Views: 4136

Re: CCR1009 and subnets communication problem

I setup my CCR1009 with one subnet on port 1 and another subnet on port 3. Made sure neither port was a slave to the other. Communication between worked just fine. I do find it interesting that you have some non switch ports with the Slave flag set. Maybe you should backup your relevant config, rese...
by jkarras
Fri Jun 20, 2014 4:08 pm
Forum: General
Topic: CCR1009 and subnets communication problem
Replies: 23
Views: 4136

Re: CCR1009 and subnets communication problem

Can we get a screen shot of your interfaces as well?
by jkarras
Fri Jun 20, 2014 4:58 am
Forum: General
Topic: CCR1009 and subnets communication problem
Replies: 23
Views: 4136

Re: CCR1009 and subnets communication problem

Only thing I can think is that IP Forwarding is turned off for some reason.
/ip settings print
by jkarras
Thu Jun 19, 2014 7:28 pm
Forum: General
Topic: CCR1009 and subnets communication problem
Replies: 23
Views: 4136

Re: CCR1009 and subnets communication problem

The CLI for setting switchchip info is: /interface ethernet switch If you are unable to communicate between subnets but you can ping. It sounds like either the clients don't have a default gateway set correctly or there are firewall rules in the forward chain set on your device. What does a print ou...
by jkarras
Thu Jun 19, 2014 6:19 pm
Forum: General
Topic: CCR1009 and subnets communication problem
Replies: 23
Views: 4136

Re: CCR1009 and subnets communication problem

CCR1009 does have a switch chip. Its only configurable from the CLI at the moment per this post . As for your config it looks valid assuming eth1 and eth2 are independent ports. If eth2 is set to be slave to eth1 the config will not work. Unfortunately my CCR1009 is not set at default config anymore...
by jkarras
Thu Jun 19, 2014 2:56 am
Forum: General
Topic: CCR1009 and subnets communication problem
Replies: 23
Views: 4136

Re: CCR1009 and subnets communication problem

Are you able to ping those IPs from a client hanging off each port? The first four ports on the CCR1009 are a switch. Depending on how the switch is configured you would need to add the IP addresses to the master port. Try your test with eth1 and eth5.
by jkarras
Wed Jun 18, 2014 8:18 pm
Forum: RouterBOARD hardware
Topic: Please make these...
Replies: 2
Views: 1249

Re: Please make these...

1. Most people use a 10GBase-T switch when connecting CAT6A. I believe 10GBase-T SFP+ modules exist but I went looking and it was hard to find generics at the moment to show an example. When connecting two devices with SFP+ slots at short distances in a data center they use the captive SFP+ connecti...
by jkarras
Fri Jun 13, 2014 11:30 pm
Forum: Forwarding Protocols
Topic: BGP no-export attribute
Replies: 8
Views: 2961

Re: BGP no-export attribute

If this is the case how is one supposed to signal to their upstream that said route doesn't need to be exported? Pretty sure other platforms let you do it.

I can see your point if the community was added via a inbound filter.
by jkarras
Wed Jun 11, 2014 6:59 am
Forum: RouterBOARD hardware
Topic: 10G NIC connect to CCR1036-12G-4S
Replies: 1
Views: 1228

Re: 10G NIC connect to CCR1036-12G-4S

You don't list the exact card or motherboard type so it is unclear what media type the card has. SFP+ slots are backwards compatible with SFP modules. Check the network card data sheet to find what 1Gig modules if any its compatible with. 10GBase-T is typically backwards compatible with 1GBase-T so ...
by jkarras
Wed Jun 11, 2014 6:39 am
Forum: Forwarding Protocols
Topic: Routing two networks with same addressing.
Replies: 2
Views: 963

Re: Routing two networks with same addressing.

Link as in LAN on R1 needs to be able to talk to LAN on R2? If the goal is not to bridge the two L2 domains then the best option is to change the IP range on one of the LANs. Might need to know more about the intent to answer this question.
by jkarras
Mon Jun 09, 2014 9:20 pm
Forum: RouterBOARD hardware
Topic: CCR 1009 switch chip menu
Replies: 22
Views: 9594

CCR 1009 switch chip menu

I notice that in ROS 6.14 the switch chip menu still doesn't show up in Winbox for the CCR1009 models. Any update on when that will happen?
by jkarras
Sun Jun 08, 2014 9:38 pm
Forum: Forwarding Protocols
Topic: Routing Guru's I need help- 2 routers and only one Gateway
Replies: 4
Views: 1206

Re: Routing Guru's I need help- 2 routers and only one Gatew

The trouble is OSPF doesn't talk to the clients. The client (IP camera and DVR in this case) only know about one router. After sending packets to that router if you want to use ECMP or something to divide traffic it can be done. OSPF can install equal cost multipath routes to divide traffic at a L3 ...
by jkarras
Sat Jun 07, 2014 3:21 am
Forum: Forwarding Protocols
Topic: Single homed BGP edge router redundancy
Replies: 9
Views: 2902

Re: Single homed BGP edge router redundancy

Why the scripting? You would setup VRRP on each VLAN. If your looking for first hop redundancy this is the way to go.
by jkarras
Sat Jun 07, 2014 3:19 am
Forum: Forwarding Protocols
Topic: Routing Guru's I need help- 2 routers and only one Gateway
Replies: 4
Views: 1206

Re: Routing Guru's I need help- 2 routers and only one Gatew

Use VRRP to give your self first hop redundancy. I assume this is why you have two routers.
by jkarras
Thu Jun 05, 2014 9:39 pm
Forum: RouterBOARD hardware
Topic: CRS226-24G-2S+in performance .02gbps unidir sometimes
Replies: 6
Views: 2644

Re: CRS226-24G-2S+in performance .02gbps unidir sometimes

This type of cleaner is great for cleaning the optic side of things. It can also clean the fiber end as well.

http://csmedia.corning.com/opcomm//Reso ... TA_AEN.pdf
by jkarras
Thu Jun 05, 2014 4:53 pm
Forum: RouterBOARD hardware
Topic: CRS226-24G-2S+in performance .02gbps unidir sometimes
Replies: 6
Views: 2644

Re: CRS226-24G-2S+in performance .02gbps unidir sometimes

You may want to clean your fiber ends. Its extremely easy to smudge the end and cause issues. Also I believe the Mikrotik SFP slots support DDM to measure light levels and such if the SFP supports this.
by jkarras
Thu May 15, 2014 4:49 am
Forum: Forwarding Protocols
Topic: OSPF Redundancy and Summarization
Replies: 58
Views: 10678

Re: OSPF Redundancy and Summarization

So is this just a typical setup? As in are other branch offices just like the one mentioned here? The only way you can summarize things is if its a stub are or via some kind of choke point (area to area). So to do this it takes some IP address planning. Things like keeping all IP address ranges at e...
by jkarras
Wed May 14, 2014 4:15 am
Forum: General
Topic: NAT or Virtual Server.
Replies: 5
Views: 7139

Re: NAT or Virtual Server.

If you are doing double NAT yes you need to open the port on both.
by jkarras
Mon May 12, 2014 7:36 am
Forum: Beginner Basics
Topic: Both untagged and tagged ports in RB951-2n
Replies: 9
Views: 2585

Re: Both untagged and tagged ports in RB951-2n

What version of ROS are you running 5.x or 6.x?

Also you may want to turn on Independent learning on your vlan 30. Don't forget to add the other VLANs as well.

I'll see if I can't test your config on my 951-2n
by jkarras
Fri May 09, 2014 7:16 am
Forum: Beginner Basics
Topic: Both untagged and tagged ports in RB951-2n
Replies: 9
Views: 2585

Re: Both untagged and tagged ports in RB951-2n

Unfortunately Mikrotik config isn't quite as abstracted as the major vendors config is. Here is how to do what you desire in hardware using the switch chip. A bridge will cause all the traffic to hit CPU which will mean less than line rate L2 packet forwarding. A good way to compare Mikrotik switchc...
by jkarras
Fri May 09, 2014 6:39 am
Forum: General
Topic: what solution can solve this scenario?
Replies: 4
Views: 877

Re: what solution can solve this scenario?

Also make sure you don't have a IP conflict with PC Client 1 and your modem.
by jkarras
Fri May 09, 2014 6:35 am
Forum: General
Topic: Public IP reachable without gateway!
Replies: 7
Views: 1237

Re: Public IP reachable without gateway!

There is only one default gateway per device. Remember the routing table is just that a large table of destination networks and their next hop routers. If there is a specific route for a network then that next hop router is used. If there isn't one then the default route is used. So in the case of y...
by jkarras
Thu May 08, 2014 5:31 pm
Forum: General
Topic: Public IP reachable without gateway!
Replies: 7
Views: 1237

Re: Public IP reachable without gateway!

The default gateway only needs to be in the same subnet as one network on the device. There isn't a default gateway per network. Even then its for destination not source. Packets coming from the Internet are sent to your device by your ISP's routing table. Packets from your network are sent to your ...
by jkarras
Thu May 08, 2014 6:26 am
Forum: General
Topic: Public IP reachable without gateway!
Replies: 7
Views: 1237

Re: Public IP reachable without gateway!

You only need in default gateway per router. You mention that PPPoE is giving you a default gateway.
by jkarras
Sat May 03, 2014 8:11 am
Forum: General
Topic: Bonjour multicast - How to do it with VLANs ?
Replies: 21
Views: 10480

Re: Bonjour multicast - How to do it with VLANs ?

Before going too much further I should note that Bonjour is designed to not be routed. It uses the 224.0.0.0/24 multicast range which is link-local only. That said if you still want to get PIM routing working it would be best to test your setup with some other protocol. So assuming the stream your t...
by jkarras
Fri May 02, 2014 1:37 am
Forum: General
Topic: Bonjour multicast - How to do it with VLANs ?
Replies: 21
Views: 10480

Re: Bonjour multicast - How to do it with VLANs ?

PIM is the correct mechanism to get multicast traffic from one L3 interface to another in a routed network. I am less familiar with Multicast on Mikrotik but I have a couple of questions. Do you have any firewall rules on these interfaces? Can you confirm that a device on VLAN 200 can connect to you...
by jkarras
Sat Apr 12, 2014 4:40 am
Forum: Beginner Basics
Topic: connecting ethernet port to IPIP tunnel
Replies: 4
Views: 1296

Re: connecting ethernet port to IPIP tunnel

Traffic passes over the tunnel via traditional L3 IP forwarding the same way it passed from a internal subnet out to your ISP. Simply setup a different network on the other interfaces. A subnet can't exist in two places at once which is why your pings time out. Can you tell us how you have your othe...
by jkarras
Tue Apr 08, 2014 5:46 am
Forum: Beginner Basics
Topic: connecting ethernet port to IPIP tunnel
Replies: 4
Views: 1296

Re: connecting ethernet port to IPIP tunnel

Think of an IPIP (IP over IP) tunnel as just a routed link. You need to setup a IP on each side of the link and then either setup static routes or a routing protocol to exchange routes between the two routers. If you want to bridge to different L2 Ethernet segments your going to want an EoIP (Ethern...
by jkarras
Sat Apr 05, 2014 11:00 pm
Forum: General
Topic: VLAN tagging and forwarding - Help needed!
Replies: 8
Views: 1574

Re: VLAN tagging and forwarding - Help needed!

If your Linksys is not sending tagged traffic you should not send it tagged traffic. Like the other posters question is the Mikrotik device being used as your firewall/router or is the Linksys. If you are simply using the Mikrotik as a switch to strip the tags you can use the switch chip features to...
by jkarras
Thu Apr 03, 2014 6:14 am
Forum: RouterBOARD hardware
Topic: Which fiber for S-85DLC05D
Replies: 1
Views: 1093

Re: Which fiber for S-85DLC05D

My advise is don't install any multi-mode fiber between buildings. Only go with single-mode for anything between a building that may have distance. If you ever plan on going over 1GigE on that fiber you will need something other than 62.5 micron. 10GigE only goes 33 meters on 62.5 for example. It ca...
by jkarras
Wed Apr 02, 2014 4:52 am
Forum: General
Topic: how to stop receiving multicast
Replies: 16
Views: 5407

Re: how to stop receiving multicast

Ultimately you will need a switch which supports IGMP snooping. Then it won't send multicast traffic directed towards the port the Mikrotik is plugged into unless its subscribing to the stream. The multicast package seems to just contain items needed for routing multicast traffic (PIM, etc...) I gue...
by jkarras
Wed Mar 26, 2014 6:13 am
Forum: General
Topic: v6.11 released
Replies: 260
Views: 84306

Re: v6.11 released

E-mail with tickets is rather... old solution. Other users can't see my problem(s) and if they have it also, they could leave their observations on bug track. Atlassian Jira or something different and many problems could be gone. This has been discussed. Most of the reports are not bugs. Bug tracke...
by jkarras
Wed Mar 26, 2014 5:36 am
Forum: General
Topic: vLAN with Switch chips _ scenario-based solutions
Replies: 33
Views: 7683

Re: vLAN with Switch chips _ scenario-based solutions

Makes sense then on the fast path. Based on the speed test results on the product page you are basically getting max speed for the RB450G. Assuming its a SMB share your transferring from its not surprising.

http://routerboard.com/rb450g
by jkarras
Wed Mar 26, 2014 1:33 am
Forum: General
Topic: vLAN with Switch chips _ scenario-based solutions
Replies: 33
Views: 7683

Re: vLAN with Switch chips _ scenario-based solutions

Unknown on the remove vs disable question. Someone from Mikrotik can answer that. The other thing I noticed that I should have noticed before. It looks like your systems are on different VLANs. So because its routing your going to hit CPU. Port to port traffic on the same VLAN would be switched by t...
by jkarras
Tue Mar 25, 2014 9:24 pm
Forum: General
Topic: vLAN with Switch chips _ scenario-based solutions
Replies: 33
Views: 7683

Re: vLAN with Switch chips _ scenario-based solutions

Anything flowing through the VLAN 100 is going to hit CPU then because of the bridge. Being a bridge with a metarouter interface will mean it can't go through fast path either.

As a test you could remove the bridge and do your file transfer.
by jkarras
Tue Mar 25, 2014 5:21 am
Forum: General
Topic: vLAN with Switch chips _ scenario-based solutions
Replies: 33
Views: 7683

Re: vLAN with Switch chips _ scenario-based solutions

What is the bridge you have listed on there? That may be causing traffic to be sent to the CPU.
by jkarras
Sat Mar 22, 2014 3:27 am
Forum: General
Topic: v6.11 released
Replies: 260
Views: 84306

Re: v6.11 released

Where is the setting for the auto frequency selection? can't seem to find it anywhere
Choose auto under the frequency selection. Its at the bottom of the list.