MikroTik

jkarras

Ok figured out the issue was the conversion from "default" network type translates to broadcast. My links in question were via GRE which v6 auto configs default to PtP. After changing to PtP it fixed things. Now I explicitly set all the v6 configs to the correct network type so future tran...

jkarras

I have a device I upgraded from 6.48.x to 7.6. After the upgrade a OSPF instance that runs through a VRF broke. I was able to fix the neighborship by adding the OSPF instance back to the VRF. When I look in the LSA tab I see routes as expected. These routes never make it into the routing table. I've...

jkarras

Per apple doh.dns.apple.com as well https://support.apple.com/en-us/HT210060

jkarras

I have set up automated exports and the output is saved in version control system, so I know what exactly changed and when. Can you give more info on your setup/workflow? I am interested in implementing something similar. Thanks. RANCID works for this. There are runners for a lot of different NOS. ...

jkarras

Could be an order of operations error by not having the more specific network above the less specific in the NAT rules. OSPF shouldn't have any affect on SRCNAT working or not working in this case.

jkarras

Masquerade as the last rule as a catch-all is fine. Just make sure its the last rule. That said if the first two rules are correctly defined for the network you shouldn't need it. The reason you want to remove it from the config is with multiple IP addresses its unpredictable what IP it will use for...

jkarras

Don't forget to add the new IP to the interface and add a DSTNAT rule for the inbound traffic to make it to your SIP broker. The following should work fine. /ip address add interface=ether1 address yy.yy.yy.83 /ip firewall nat add action=src-nat chain=srcnat out-interface=ether1 src-address=192.168....

jkarras

Hi,

my connection is over pppoe, not dhcp client. In spite of that, it would be useful for me? Sorry for my english

You'll have to use a scheduled script then. An example can be seen here.

https://github.com/karrots/ros-ddns-ipsec/

jkarras

No need to run this as a script. The DHCP client will provide the information on lease update.

https://wiki.mikrotik.com/wiki/Manual:I ... pt_example

jkarras

*) radius - increase allowed RADIUS server timeout to 60s; To add an important reason to the too short limit problem of timeout in radius: Successful authentications are answered immediately (in order of milliseconds if possible), but to protect the server from brute-force attacks and DOS-type atta...

jkarras

Cool, thanks for that. I need to learn MikroTik scripting at some point. I've done a few but it's not sticking in my head. On my setup I would have to set: /ip ipsec peer set X address=$variable /ip ipsec policy set X dst-address=$variable sa-dst-address=$variable I have a dyndns account as well, b...

jkarras

Likely an order of operations problem in your NAT table.

The routing mark rule and the two static routes are unneeded.

Sent from my Nexus 6P using Tapatalk

jkarras

Network diagram would help.

jkarras

I understand. I already had an email typed up after that last version didn't fix it with a sprout from before and after the upgrades. I was waiting until after the next update just in case they fixed it then. My case is actually pretty simple. Standard home Internet provider, DHCP on WAN, masquerade...

jkarras

Marino , and other who might have the same problem potentially. It would be great to get some steps/instructions to support@mikrotik.com how to repeat described problems. Steps for me were to upgrade to anything past rc62. Sites became unbearably slow if the traffic flow went through the fasttrack ...

jkarras

Confirmed disabling fasttrack rule fixes slow traffic that would have otherwise been tagged by the rule.

jkarras

When I upgraded to ROS v6.39rc62, the following Firewall rule brought my outside access to a crawl: /ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related Once I disabled it, the system began to work normally. This is the same with the current release...

jkarras

Spanning Tree is broken since 6.38. We want to implement redundant bridges, to link together carrier VLANs to customer ports or VLANs. The previous STP implementation was essentially similar to PVSTP (per VLAN Spanning Tree Protocol) but the new implementation results in routers sending and process...

jkarras

Spanning Tree is broken since 6.38. We want to implement redundant bridges, to link together carrier VLANs to customer ports or VLANs. The previous STP implementation was essentially similar to PVSTP (per VLAN Spanning Tree Protocol) but the new implementation results in routers sending and process...

jkarras

I agree with everyone here. Having worked with law enforcement on similar requests I just wanted to mention one other thing to calm some fears. If you're not required by any industry regulation, local law, or company policy to keep the DHCP logs don't worry about getting in trouble with law enforcem...

jkarras

This really should be a new thread if you want people to look at it. I think there is a misunderstanding of the differences in FastPath and FastTrack as well as what the "auto" setting does with connection tracking. FastPath benefits ROS devices which are only routing. If you use any firew...

jkarras

I am just saying that in all cases it's very low on the priority list of things that will give them a competitive advantage because there are already multiple solutions that will give your desired outcome (RADIUS, SSH keys, site-to-site VPN, and remote access VPN via OTP or client certificate based...

jkarras

Why are you allowing the general Internet to get to the management interfaces of your devices? This should all be ACLd off except to known good ranges you connect from or all be done via VPN. There are ways to encrypt the unencrypted portions of the RADIUS datagram. One example would be an encrypte...

jkarras

If you're using L2 connectivity just to make DHCP work you should look into DHCP relay. Then you could go L3 to the AP and still have one central DHCP server.

jkarras

Why? If you remove it from the ARP table the IP will quit functioning.

jkarras

How long does Mikrotik plan on supporting bugfix versions. Example once 6.32 is released how long will 6.30.x be in development.

jkarras

Looks like the processor used on the CCR line does support MacSec. This is key as MacSec is a PHY level operation.

+1 for this especially with the WAN MacSec extensions to is can be used over MetroEthernet connections.

http://www.tilera.com/files/drim__TILE- ... B_7682.pdf

jkarras

The tool you pick depends on the design criteria. It sounds like you want to keep the voice traffic separate from other production IP traffic. If this is the case you will want to put the VLAN into a VRF on your MPLS network. http://wiki.mikrotik.com/wiki/Manual:Layer-3_MPLS_VPN_example I assume you...

jkarras

Agreed if this model didn't have a serial port it would be impossible to do initial IP config from blank.

jkarras

These two links explain it a bit better than I just did.

http://forum.mikrotik.com/viewtopic.php?t=29114#p141838

http://blog.ipspace.net/2013/01/tcp-mss ... hy-do.html

jkarras

Are you blocking ICMP outbound? As has been mentioned you have a MTU issue. Its probably more preferred to leave general Ethernet interfaces at 1500. I assume your PPPoE connection is controlled by an ISP if so no amount of changing the local MTU will fix things. The reason is MTU changes must be ma...

jkarras

In the IPSEC policy just change the protocol from all to GRE. This will then cause only the encryption of GRE packets leaving all other traffic in the clear.

Out of curiosity what other traffic are you worried about being encrypted by the more open policy?

jkarras

Can you encrypt data layer 2 multi hop when we only have control of devices both ends not in the middle? Depends on the type of service. If its a MetroEthernet e-line service like EPL it should work fine. If it is a EVPL service there will be issues. If your switches connecting to the service suppo...

jkarras

hi everyone i`m new on mikrotik i have a problem with rb850gx2 when i upgarde it to v6.29.1 i cant acces it even with ip or with mac i dosn`t show the mac.and it keep restarting .even when i try to reset it.it`s the same any idea. thanks in advance Best to start a new thread rather than tack a sepa...

jkarras

It should work fine with the new WAN extensions. With out the WAN extensions it may work but it depends on a how the L2vpn is setup.

jkarras

You'll need to setup MPLS between the three routers so that they can pass VRF routing information between each other.

Take a look at this wiki article for an example. It may need to be adapted slightly but everything is there.

http://wiki.mikrotik.com/wiki/Manual:La ... PN_example

jkarras

No it does not.

jkarras

You should only have one ground point. If you have multiple ground rods they need to be tied together and only fed from one conductor. Shielded cable needs to be terminated into shielded patch panels or jacks. The shield only protects from EMI. Surge protectors protect equipment from voltage spikes....

jkarras

To get around the two SA same policy issue did you try setting each policy with a different priority?

jkarras

Is the CPE always a router of some kind? I am thinking business clients here not home routers. If so it sounds like you should setup BGP between your network and the CPE allowing the routing to help with the decision. That or move to a fully routed backbone removing the VLAN bridges and implement VR...

jkarras

What your describing is the need for first hop redundancy VRRP is created for solve just that problem. What is done after the first hop is up to your routing policies. I have exactly this scenario setup to add first hop redundancy to our ISP for devices that can't just use a dynamic routing protocol...

jkarras

I believe any of these methods will preserve the DSCP marking across the tunnel. Should be easy to test by taking a packet capture.

jkarras

The trouble is leaving it up to the client (if they even support it) is basically making it unknown. Its best if the network behaves in a deterministic way. If you use VRRP and other routing techniques to present a consistent experience to the customer it will reduce the support unknown. Basically i...

jkarras

By preserve do you mean it makes it to the other side of the tunnel? Or do you mean it moves the marking up a level to the tunnel IP header?

jkarras

What does your DHCP config look like. Are you using RADIUS?

jkarras

Clients typically only support one default route. You should look into VRRP to solve your issue.

jkarras

My reason for pointing out the other vendors was only to answer the others above who said other vendors supported two-factor. Good point on the single home router. Anything past one device would increase the administration quite a bit as there would be one entry in the app for every router. Centrall...

jkarras

Is there a default gateway defined in the VRF(routing mark) in question?

jkarras

Like has been mentioned earlier any site with large deployments is likely using RADIUS for central administration authentication anyway. Adding on Google Auth to FreeRADIUS is pretty simple way to get this done today. I can't think of any competing products that offer OTP on the switch or router its...

jkarras

The only difference between these two models is the amount of memory it has. If your are going to take a full BGP feed from your ISPs go with the -em model. If not the non -em model should work fine.

There are 4 SPF slots on the device so if that number works for you then you should be good.

jkarras

If you must implement BGP you could look at turning on BFD to help with the timing issue. Won't solve everything but will help.

jkarras

The trouble is you have both tagged frames and untagged frames on the same port. The PC if not VLAN aware will pick up both. In other words you have port 17 setup as a partial trunk then expect it to not send both tagged and untagged frames out of it.

What is your intended use?

jkarras

Did your ISP state what their L3 MTU was set at? You need to match what they set their side to or you'll end up with odd packet drops when packet reassembly happens.

Like the previous poster mentions do a ping test but instead of pinging the Internet ping the next hop towards your ISP.

jkarras

Lets say the public IP space your ISP gave you is 10.0.0.0/24 and they route it to you via a /30 network at 172.31.0.0/30 telling you to use the IP 172.31.0.2 and that their side would be 172.31.0.1. All you need to do is put the IP range they assigned to you on your PPPoE server then make sure all ...

jkarras

What MTU is your ISP expecting to receive have you asked them?

jkarras

Just set your Public IP pool on the PPPoE server. As long as your routing is working fine traffic will get there.

Turning on BFD will help a bit with failover times especially on links like the wireless where the link may go down but the physical interface on the RB750 won't show it.

jkarras

Is wlan1 on R1 your Internet connection or just some web servers. Ngnr is correct you are missing a default route but your also just missing routes between the two devices. Do you control routing on the Intranet as well if so a GRE tunnel is possibly unnecessary.

jkarras

Your setup is probably bigger than can be answered easily by the forum. The short answer is if your clients have private IP addresses they are going to need to be mapped to public addresses somewhere along the line. Without knowing your full topology its hard to tell you where to do the NAT. It coul...

jkarras

Unsure if this will work with the information given but I believe it will.

/ip route
add  dst-address=<staticnetworkhere>/?? gateway=<interfaceofprivatenetwork> 
add dst-address=<privatenetworkhere>/?? gateway=<interfaceofstaticnetwork> routing-mark=static

jkarras

True the dest address can be left blank if there is only one IP on the incoming interface in question. If one needed to do some form of one-to-one NAT with multiple incoming IP addresses a source address would be needed.

jkarras

The DST address in your DST-NAT rule needs to be the IP address assigned to the outside interface on your Mikrotik. It looks like you have it assigned to use the IP address of the modem. Because your already going through one NAT gateway that IP doesn't exist on the Mikrotik.

jkarras

Are you speaking of the DHCP server in ROS or an external DHCP server? If external are you looking for the DHCP relay feature?

jkarras

Your saying you want these ports to accept and transmit only certain vlan combinations? You will need to do this in the switch menu by configuring which VLANs are allowed on which ports. http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Example_-_802.1Q_Trunking_with_Atheros_switch_chip_in_R...

jkarras

Can you describe your network a little better? Is the connection between your router and the VPS (Virtual Private Server???) a direct point to point link? If so no tunneling protocol is needed. Do you have publically routeable IP addresses assigned to your clients? If not some form of NAT will need ...

jkarras

With this setup you have effectively created a VRF. This means routes from your main table can't see your static table. VRFs are to routing what VLANs are to switching. So effectively you have created a little logical router just to handle the static IP addresses. If you want the two to mingle your ...

jkarras

There is nothing that sets a zeroconf address apart from one assigned by DHCP or manual entry. As long as the DirectTV boxes are on the same L2 network I don't see why things would be an issue.

jkarras

To connect a IPSEC tunnel from a Mikrotik to a Cisco ASA you'll need to add the "level=unique" setting to your policy. On a side note highly suggest you change your crypto and hashing to AES (higher the better) and SHA1 at a minimum. /ip ipsec policy add dst-address=172.16.0.0/21 sa-dst-ad...

jkarras

I am working on two metarouter sample setup to confirm and show the potential issue. This will be cleaner than posting my existing config here. My experience so far and the wiki show that the BGP instance route filters are applied before the BGP peer route filters. VRF filters seem to be on their ow...

jkarras

So actually my problem is the opposite of what you describe. My default discard rule in the peer filter is discarding routes that were accepted in the VRF filter.

Are router filters not first match (with the exception of passthrough) like firewall rules?

jkarras

In testing BGP route filters I have noticed the following behavior and wonder if it is correct. It seems that for an out filter the order of operations is as follows: 1) BGP instance out filter 2) BGP VRF out filter 3) BGP peer out filter The trouble is it seems that accept rules in the VRF filter d...

jkarras

It wipes the full hard drive.

jkarras

Have you tried a netinstall to get them back up and running. Sounds like you may have a corrupted image upload or bad flash.

jkarras

add action=accept append-bgp-communities="" bgp-communities=MYASN:100 chain=IXPTRANSIT-OUT comment="Reannounce prefixes with BGP community MYASN:100" match-chain="" I think the issue is that your appending a blank community in the same filter rule as your match. I seem...

jkarras

Couple of things I noticed. A)You have no return route on R1 telling it how to get traffic to R2 via the GRE tunnel. B)There are too many masquerade rules. If I understand your desired traffic flows correctly there isn't a need for any. C)There are a couple of static routes that don't make a lot of ...

jkarras

As bajodel mentioned each table evaluated independently as each have a different function. If you look at the data flow diagrams at the link below helps it make more sense.

http://forum.mikrotik.com/viewtopic.php ... 49#p418449

jkarras

How is the check you speak of not just the loop prevention that iBGP does? I.e. iBGP only advertises locally originating routes thus needing a full mesh or route-reflector.

jkarras

See inline for a few answers. A few firewall questions a) in 'mangle' I see also the accept/drop/reject actions. I though mangle is intended for marking traffic, not for making decisions on how to handle it? Or is the 'mangle' table just a normal firewall table that is just consulted first before th...

jkarras

Basically you will need to setup IPSEC using the site-to-site instructions. Then when defining the policy configure the source and destination information based on where your EoIP tunnel originates. So you don't add too much overhead to the tunnel uncheck the "tunnel" box on the policy. Th...

jkarras

Think of MPLS as just another routing method. You will still need a way to physically (i.e. direct fiber) or logically (i.e. circuit from telco, or VPN) connect these offices together. In other words MPLS in and of itself will not reduce the need for the DSL modems or other form of carrier circuit b...

jkarras

What does your peer config look like on the Mikrotik side?

jkarras

I created a script to dynamically add and remove DNS entries via the lease-script. It also tracks which lease created the entry so two machines with the same name don't have conflicts. First machine to claim the name gets it.

https://github.com/karrots/ROS-DDNS

jkarras

All I created a script which will update your IPSEC peers and policies based on the DNS when it changes. Try it out and let me know any feedback.

https://github.com/karrots/ros-ddns-ipsec

jkarras

Is sounds like you are looking for the technologies I mentioned in my earlier post. Do a search for them on Cisco's website and you will find design guides.

jkarras

Are you going to need to describe what your wanting a bit better.

You might be looking for port security with IP source guard and DHCP snooping.

jkarras

It depends on how your configured with the ISP. If they have you plugged into the same device on their side or a VRRP pair then you can use VRRP as well. Most of the time I have just seen ISPs desiring to do two different BGP sessions as your being connected to different POP locations. Both scenario...

jkarras

What DB are you using for the user credential store? Is it local users on the ACS or Active Directory? Per the wiki and my experience PAP is used for SSH, Telnet, and Webfig. CHAP is used for Winbox. If AD is your backing store CHAP will not work with ACS. You should be able to get in with the other...

jkarras

The MAC based connection would make initial connection then act as though it was disconnected and quit updating but never actually disconnects. How much time went by between when you made the connection and when you noticed it had stopped updating? Long enough for the initial window to populate. Th...

jkarras

You would need to setup interface tracking rules to propagating a link failure into a VRRP master change. That said it isn't necessary for that type of failure when correctly setup. What should be done is a BGP (or other routing protocol) peer should be setup between R1 and and R2. This could be via...

jkarras

I have had the same issue mentioned here with my RB850x2. The MAC based connection would make initial connection then act as though it was disconnected and quit updating but never actually disconnects. I have two others I purchased at the same time but have yet to set them up yet. Its a very differe...

jkarras

I need to pick up a new CCR with dual PSUs. I was looking on routerboard.com and it looks like only the 1009 and 1016 have dual power supplies. Is there any word on when the 1072 will be out with dual power supplies? Last I could find it was supposed to be released in Nov but no word yet. I'd be ok ...

jkarras

If you read the text on the side of the fiber jumper and/or cable it should mention what micron it is and possibly even if its OM3 or OM4. OM1 and OM2 typically don't say. If its infrastructure cable it may have a manufacturer and model number that can be looked up. For patch cords as has been menti...

jkarras

Is the issue because your effectively stripping the VLAN tags as traffic enters the VPLS tunnel.

Your current config shows the port plus the three VLANs bridged together.

jkarras

What version of ROS is being used?

jkarras

A filter like the one below should accomplish both the tagging and the redistribution.

/route filter add chain=addcommunities protocol=connect append-bgp-communities=65390:501 action=accept
/route filter add chain=addcommunities protocol=static append-bgp-communities=65390:500 action=accept

jkarras

No it isn't and my intent was never to say it was. It was only to debunk that L3 switches are incapable at out routing a "router". The CRR and the Cisco 6500 don't really live in the same performance or feature realm I would not expect them to be the same price. All the extra chips needed ...

jkarras

With the Brocade line mentioned it would be a issue. It only supports 16k routes. If you move to something bigger it can certainly handle it with the same HW offload mentioned before. Right box for the right job. Just take a look at the Sup 2t on the Cisco side or something in the MLX line from broc...

jkarras

Could be a limit on the CPU as well.

jkarras

This is only partially true. While the switches of the larger vendors do have smaller CPUs just like the CRS they also don't rely on it nearly as much as Mikrotik. The larger vendors Cisco, Brocade and such have built hardware based L3 forwarding engines into their switches. In Cisco land its called...

jkarras

Not if your PCC rule tells the traffic to go out the interface aer are not discussing.

jkarras

One other option is to create 5 NAT rules. One for each portion of your IP space each mapping to a specific IP.

If you want one rule you'll need to use the SAME action. Netmap is only for 1:1 mappings.

jkarras

FYI I am just reading the wiki for this information.

To keep people on the same IP for all connections use the same option. From previous discussions on the forum masquerade uses the first IP.

jkarras

I believe you can just put a range of IPs into the "To Address" field of the SRC-NAT action and it will do what you are referring to.

If you had wanted to do a 1:1 mapping you would use the netmap feature.

jkarras

What is it you are trying to accomplish?

jkarras

Disclaimer I don't own a CRS. I have messed with it on RB750GLs.

The link below should get you started.
http://wiki.mikrotik.com/wiki/Manual:CR ... _Switching

jkarras

You need to use the switch chip features found under the switch menu instead of a bridge. Bridges are CPU constrained and don't use the switch chip.

jkarras

+1 please

jkarras

+1 for this request. I miss the feature from pfsense as well.

Also agree with tighter DNS DHCP integration as well. That said the new lease script helps a bunch. I modified a script here that works well for me.

https://github.com/karrots/ROS-DDNS

jkarras

Sounds like a VLAN trunk is in order. Assign IPTV to one VLAN WAN to the other. Make your port 5 a trunk.

jkarras

I just had this issue as well. The Cisco router wasn't showing up in the IPv6 neighbor list and ROS refused to send IPv6 forwarded packets the direction of any static route. Its as though ROS ignores ND packets from the cisco side if its sending RAs as well or the Cisco side doesn't send NDs when it...

jkarras

Setup your IP addresses on the three interfaces as you indicate. That is all that should be needed assuming you have no firewall rules to get in the way. No NAT is needed.

jkarras

Unless you peer from both devices all the time you'll have to wait for things to rebuild and establish.

jkarras

Can you post your actual NAT rule? It should work fine assuming your provider allows you to have two addresses.

jkarras

What layer of the network stack to you want logged just L3/L4 stuff or L7 HTTP URL type logging? If Layer 7 your going to need to have something that can see L7 traffic like a transparent proxy.

jkarras

Config sync

jkarras

It sounds like your trying to forward unknown thing. Do you know the service you want available behind the NAT is it HTTP, SMTP, or something else?

netstat will tell you what is listening but the typical computer these days is listening to a lot of things.

jkarras

My guess is its because the two halfs of your /25 are not in your routing table. Its only going to aggregate routes that fully exist.

jkarras

No news on this? Trying to link the 8-port SFP unit with the 24-port switch unit using an SFP. Must be SFP because only have 1 fiber between sites. Mikrotik only sell 10G SFP+ with 2 fiber. I am confused by your question No one here seems to be talking about 1GBase-BX optics. One option you have is...

jkarras

Can't speak for the BGP aggregation but your filter command is incorrect and likely the problem. Try one of the following depending on what you wish to match. Match /24 and /25 prefix length: /routing filter add action=discard chain=out-filter invert-match=yes prefix=150.13.0.0 prefix-length=24-25 M...

jkarras

Fully agree on not running dynamic routing on the firewall.

9.x has has 4 major releases though. Three with BGP support 9.1, 9.2, and 9.3. Now 9.2 and 9.3 won't run on a non -X ASA though.

jkarras

Never said they were exactly the same just in the security & firewalling realm.

That said they do support BGP these days. Can't speak for its stability as I haven't ever run a ASA with a dynamic routing protocol turned on.

jkarras

I have only seen this when there isn't enough overlap between access points coverage or if you cause a Layer 3 roam to happen. Assuming all your access points wifi interface are connected to the same L2 domain no L3 roam should be happening. I have also seen this when say you are in a warehouse and ...

jkarras

I realize you're looking for one-on-one help but here is a minor suggestion that may help. Have you implemented BFD with your OSPF? It can help minimize the link failure detection. Its best used on links that may be over another carriers MetroEthernet as a down circuit may not equal a down interface...

jkarras

There is no provision in the 802.11 spec currently for AP assisted roaming. Its currently all up to the clients wifi drivers. There isn't even a provision in the spec as to when a client should roam. The only difference between using CAPsMAN and setting up discrete access points all configured the s...

jkarras

I have some packets lost when switching between APs', 0.5-2 seconds gap in CSipSimple (SIP client for Android).

You may want to look at increasing your coverage density if you get dropped packets and have a need for VoIP on your wireless.

jkarras

True if your NAT ~1024 IP addresses into 1 IP address the profile to a hacker is one IP to scan instead of two. Functionally the same thing can be accomplished with just a default deny firewall rule. Functionally a default deny firewall policy and many-to-one SNAT end up accomplishing similar things...

jkarras

Ah, yea probably falls into the not quite all multithreaded category. Does one of the CPUs get pegged?

jkarras

802.3ad doesn't do per packet load balancing just per flow. So any individual flow will not exceed the port speed its going over. With a L2/L3 hashing chosen pretty much any connection for a computer through a local default route will get hashed the same. Better load balancing would be L3/L4 but it ...

jkarras

I should note one other difference between VLANs and separate interfaces. VLANs will all share the bandwidth of the interface they are attached to. That said the 1016 is unlikely push more packets than one 1GigE port with firewalling enabled.

jkarras

The only difference between using VLANs and physical interfaces is one burns more interfaces. You still have all the same control over traffic. You will need to setup 5 access ports on your switch to keep all the traffic on their respective VLANs. One difference between the ASA and Mikrotik is the A...

jkarras

Can you give an example?

jkarras

Did you verify its not just a trunking problem by setting a port on your CRS to vlan 300 and testing access?

jkarras

The trick with ROS is that IPSEC policy applies before local input policy. This can be seen in the packet flow diagram on the wiki http://wiki.mikrotik.com/wiki/Manual:Packet_Flow_v6 This is different than a Cisco ASA which will behind the scenes take care of excluding local connections. To fix this...

jkarras

What RouterOS version? 5.x or 6.x?

jkarras

You will need to use a dynamic routing protocol. Any of them will meet your needs. Its unclear to me why each phone will get a subnet and not just a single IP from the OVPN IP pool.

jkarras

Can you explain your local traffic portion of the problem more? Do you mean traffic destined for the local gateway for devices on say 172.16.10.x/24? Or do you have two or more different networks on the router that are local?

jkarras

Good idea on using the DHCP network for the domain name. The trouble is that there isn't always a one to one mapping between the network and the DHCP server. I could do a comparison between the IP the client received and the list of networks to find the value. I'll have to look into the IP compariso...

jkarras

All, I noticed while looking for scripts that would set DNS entries for DHCP leases that all of them were old and used the scheduler. I have created a new script using the new on-lease script functionality in ROS 6.2+. My code is on Github at the link below. Would love feedback. https://github.com/k...

jkarras

Still didn't answer where the clients are connecting to. Do they connect to another box or to the Mikrotik? Also what do your firewall rules look like? It sounds as though you have a rule blocking access.

jkarras

I assume you power cycled the device? Pull power wait ~30 sec plug back in. Be sure and wait. The caps need to drain.

jkarras

Three NAT statements are only needed if you are not routing all of the connections in your network. You should only need the NAT statement on the first device connected to the Internet.

jkarras

You will need to know what type of traffic is coming in. Is it traffic to/from a directly connected route e.g. non ISP traffic?

jkarras

Worth checking Steam is basically a flood of UDP packets. So its much harder on the connection tracking and will come closer to the 64-byte speed measurements Mikrotik publishes.

Also check that your buffers of any parent queues that steam and VoIP packets share.

jkarras

What type of authentication are you talking about wifi auth like 802.1x WPA2-enterprise or hotspot?

For wifi auth as long as your settings match across APs SSID, auth type, password if PSK you should be fine and roaming happens normally with no additional authentication.

jkarras

Are you hitting 100% CPU at these times? It may just be that you are exceeding the limits of the device. If there isn't overhead available there will be issues.

jkarras

More information is needed to solve this.

What kind of VPN protocols are used? Where are the VPN endpoints located? Do they traverse the Mikrotik? What kind of firewall rules exist on your bridge?

jkarras

So your loopbacks should be a /32. They don't need more than one IP address so anything larger is just wasting IP addresses. To gain access to the loopbacks you will need an interface that is part of the connected/loopback OSPF routing domain used for your MPLS infrastructure. That or route leak you...

jkarras

Is the hotspot traffic the only traffic on the device? If so standard routing changes (default route towards VPN) to force the traffic over the PPTP link should work fine.

If you have other traffic must stay moving out the WAN normally you may need to look into a VRF.

jkarras

The setup you describe should work fine with no NAT. It sounds like there is a unicast routing issue either at the ISP or on your router. What happens if you traceroute from somewhere else to your IP block. Do you see the packets making it to your router? Do you have an firewall rules in the forward...

jkarras

Putting all the ports in a bridge will kill the L2 switching performance because everything will hit CPU.

What ROS version are you running. I believe in the latest 6.x version they added per interface stats even when ports are in a switch group.

jkarras

Prerouting is still in the same place. Just post routing is different. I haven't used simple queues that much and I have really only ever used an interface as a target with packet marking. I have yet to target an interface+IP range. If your setting up individual queues for customer classes you shoul...

jkarras

I assume its rule 90 that works and 91 doesn't?

Did you look at how the packet flows change with v6? Queues now happen after source-nat. Do you do any NAT with these addresses? Also are you setting up a list of /32s to divide up bandwidth? Have you looked into PCQ?

jkarras

There is a page on the wiki that lists all of the 5.x->6.x changes. http://wiki.mikrotik.com/wiki/Manual:What%27s_New_In_v6 There were changes to the packet flow as well that you may be hitting. http://wiki.mikrotik.com/wiki/Manual:Packet_Flow#Changes_in_RouterOS_v6 http://wiki.mikrotik.com/wiki/Man...

jkarras

You mentioned monitoring so I figured it was one monitoring station off site. As for IPv6 you are right in that most home users may not have a router that supports IPv6. Most ISPs support it on their backbones and for business/enterprise links. With one or two of the RIRs having run out of IPv4 to h...

jkarras

Why not just connect to your loopback addresses they are there for that kind of thing.

jkarras

If your NATing traffic your router handles remapping the return traffic. No renegotiation needed. DNAT away the router will work around it.

Have you thought about using a VPN or IPv6 instead of soany DNAT rules for monitoring?

jkarras

Do both IPs go out the same WAN. How does the router decide which WAN to send traffic out? I think you have a asymmetric routing issue.

jkarras

I think we need more information about how the connections work. Your PPTP connection isn't an L2 connection so the router on the other end can't be a first hop router for clients. Also if your using 10.0.0.0/8 on both sides of your PPTP link you have overlapping subnets and your computers will thin...

jkarras

84.5Mbps on a 100Mbps LAN port is not too bad. There is Ethernet overhead to account for so you will never see a perfect 100Mbps. I have seen as high as ~95Mbps but its pretty typical to only get ~90Mbps when nothing else is on the wire.

jkarras

Default gateway doesn't matter as it's the gateway for your router not the clients even if it was it still wouldn't break anything. DNS does but you can just add a allow rule above the reject allowing only DNS (TCP/UDP port 53). Do you see hits on your rule? Try making it purely a IP based rule so s...

jkarras

Change this rule (from first post) /ip firewall filter add action=reject chain=input dst-address-list=172.16.42.2-172.16.42.254 in-interface=wlan3-guest-2G reject-with=icmp-admin-prohibited to this /ip firewall filter add action=reject chain=forward dst-address=172.16.42.0/24 in-interface=wlan3-gues...

jkarras

Your reject rule needs to be on the forward chain not the input chain.

jkarras

Auto-MDIX is part of the Gigabit standard. No need for a crossover cable.

jkarras

COS is on the VLAN tag not on the IP as TOS. TOS is different . When you say things run over OVPN do you mean a OVPN connection on your Mikrotik or are the phones themselves connecting to OVPN? If the phones are the OVPN clients there will be no way to know the DSCP markings unless it marks the tunn...

jkarras

But at some point there is a choke point on the Mikrotik where you could sniff traffic correct?

jkarras

The RB has a way to setup a mirror port if you want to go with looking at wireshark. Do you manage the phones as well or are they a hosted setup? Looking at the manual for the phones/phone system it should tell you what its default DSCP values are. Logging into the mgmt interface on the phone will a...

jkarras

Do your phones tag the packets with DSCP or COS values? It may be easy to pickup on those values for your QOS.

jkarras

Change the master port on all ports to "none". This will turn off switching.

http://wiki.mikrotik.com/wiki/Manual:Interface/Ethernet

jkarras

You could get rid of the EoIP tunnel saving some CPU and just turn on multi-hop and peer across R3.

Is your intent to get the ~400k routes into OSPF or does R3 just have a default route to one of the BGP routers?

jkarras

If hashing is set to MAC-IP-port you will get some bandwidth increase out of a single host. Only 1Gig per stream though as mentioned. In my experience it balances out pretty well.

jkarras

Netinstall is available for x86. I just used it the other day. When booting your server choose network boot from the BIOS boot menu.

jkarras

Was going to say I am pretty sure LACP is all done in software on both of these platforms at this point. As was mentioned the CRS will support it in hardware in the future.

Between that and the bridge on the 1100AHx2 lots of CPU hit is probably the problem.

jkarras

Sounds like a MTU issue. What is the outgoing MTU on your Mikrotik. Also are you plugged into a GigE port or a 10/100?

jkarras

The wiki agrees.

http://wiki.mikrotik.com/wiki/Manual:VRRP-examples

jkarras

Shouldn't your VRRP interface be assigned to the bridge that bridges your VLAN and physical interface not the other way around? Also couldn't you just skip the bridge part and assign the VLAN to the physical interface. It would help get rid of some CPU usage. I do have to say I have never setup VRRP...

jkarras

MPLS/VPLS is probably a better choice if you run the network end to end.

jkarras

You can not really have a non-blocking mesh of switches. If you connect switches together STP will block all but one of the ports. You mentioned the 750s doing routing so I thought it was different subnets. The next best thing you could do is plug in two 750's setup VRRP for your L3 gateway and spli...

jkarras

Do you have an IP assigned to the VLAN? Is the VLAN assigned to the master interface?

jkarras

Are the tunnels across your network or via a network you do not control?

jkarras

Can you tell us more about the L2 and L3 relation ship the 750UPs have with each other and the radios? If you need to maintain L2 connectivity between the radios your currently doing the best setup aside from maybe adding a second switch. If the 750UPs are routing between the radios and the switch y...

jkarras

If you have an upstream device that can tag the traffic with a VLAN then yes you can. If not then you will need to stick another switch in place between the RB750GL and the DSL modems to tag the traffic.

jkarras

If your regulating the traffic via L2 bridge firewall rules then that make sense. If you are doing it at L3 which is what I assumed looking at the small config snip then you could move away from the bridges. That said it would probably only benefit you use multiple ports on your RB2011 to connect to...

jkarras

You should be able to now move your config away from bridges to just using the switch chip for VLAN tagging. This will speed up any L2 communications on your device.

jkarras

Personally I would still set a IP address on the master port for managing. Its much more reliable to use IP management over MAC address based management I have found.

jkarras

+1 but 802.3at or af power

jkarras

Do you have RP filtering turned on?

jkarras

The block diagram would agree.

jkarras

Just assign a IP to the master port (static or DHCP). Assuming you want to setup a separate mgmt VLAN you could create a VLAN interface with the appropriate VLAN ID on the master port as well. If you want to keep the switch from forwarding L3 traffic turn off IP forwarding under the IP->Settings men...

jkarras

Version 6.15

I was able to ping both subnets from a host plugged into ether3.

jkarras

Also make sure your IPSEC policy level is set to unique instead of the default require.

jkarras

I setup my CCR1009 with one subnet on port 1 and another subnet on port 3. Made sure neither port was a slave to the other. Communication between worked just fine. I do find it interesting that you have some non switch ports with the Slave flag set. Maybe you should backup your relevant config, rese...

jkarras

Can we get a screen shot of your interfaces as well?

jkarras

Only thing I can think is that IP Forwarding is turned off for some reason.

/ip settings print

jkarras

The CLI for setting switchchip info is: /interface ethernet switch If you are unable to communicate between subnets but you can ping. It sounds like either the clients don't have a default gateway set correctly or there are firewall rules in the forward chain set on your device. What does a print ou...

jkarras

CCR1009 does have a switch chip. Its only configurable from the CLI at the moment per this post . As for your config it looks valid assuming eth1 and eth2 are independent ports. If eth2 is set to be slave to eth1 the config will not work. Unfortunately my CCR1009 is not set at default config anymore...

jkarras

Are you able to ping those IPs from a client hanging off each port? The first four ports on the CCR1009 are a switch. Depending on how the switch is configured you would need to add the IP addresses to the master port. Try your test with eth1 and eth5.

jkarras

1. Most people use a 10GBase-T switch when connecting CAT6A. I believe 10GBase-T SFP+ modules exist but I went looking and it was hard to find generics at the moment to show an example. When connecting two devices with SFP+ slots at short distances in a data center they use the captive SFP+ connecti...

jkarras

If this is the case how is one supposed to signal to their upstream that said route doesn't need to be exported? Pretty sure other platforms let you do it.

I can see your point if the community was added via a inbound filter.

jkarras

You don't list the exact card or motherboard type so it is unclear what media type the card has. SFP+ slots are backwards compatible with SFP modules. Check the network card data sheet to find what 1Gig modules if any its compatible with. 10GBase-T is typically backwards compatible with 1GBase-T so ...

jkarras

Link as in LAN on R1 needs to be able to talk to LAN on R2? If the goal is not to bridge the two L2 domains then the best option is to change the IP range on one of the LANs. Might need to know more about the intent to answer this question.

jkarras

I notice that in ROS 6.14 the switch chip menu still doesn't show up in Winbox for the CCR1009 models. Any update on when that will happen?

Search found 226 matches