MikroTik

nje431

You may have misunderstood me. Our MTU path was fine too. The problem appears to be internal to the x86 router which causes it to ignore MTU.

nje431

I came across a similar problem. In our case the Dude server was a x86 server. The client trying to connect on the LAN through the Ethernet card would get stuck at "getting stuff". But remote clients connecting through an EoIP tunnel with one end terminating at the x86 server worked fine. ...

nje431

I've gone a step further in my monitoring on the Dude. I test for a communications fail, and if it fails, I return a value of -1. Then I have a function the alarm probe uses, that during a communications fail will return a value of 24 if the alarm is already clear, and a value of 0 if it's in alarm....

nje431

I was about to point out the extraneous decimal point myself. You can use the full numeric OID if you wish, just drop that leading decimal point.

nje431

But the first rule is "don't forward anything that isn't source 192.168.1.46", before the rule you mentioned. And rule order matters......

nje431

For my 2 cents, what struck me is you are only allowing traffic outbound from you daughter's source IP. But I'm not seeing a rule allowing return traffic to get back to her. I think what I would do, is a separate rule to accept her source IP, followed by the drop rule, but condition the drop rule to...

nje431

I asked about the connection tracking, because I used to have similar mystery problems until I removed the IPsec protocol and the IPsec specific UDP ports (500 and 4500) from connection tracking in the Raw firewall tab (prerouting and output chains). It stabilized our tunnels tremendously.

nje431

When you say you flushed the connection, may I assume you mean the "Installed SAs" under IPSec? Have you tried flushing the connections in "Connection Tracking" under firewall (both ends)?

nje431

That was my post quoted above. I can say that with all the RB1100AHx4 routers we have deployed (same architecture as 4011), we were seeing lockups every one to two weeks. After 6.47.8 was released at the end of November, and we upgraded, we haven't had a single lockup. Running 6.47.8 and now 6.47.9,...

nje431

6.47.8 has resolved our issues and has been error free.

nje431

Not in the US. US versions don't support superchannel.

nje431

I see, and I wish you well. If there is very little licensed 6gHz MW in the area, you may be in luck. I just have my doubts MT will jump through all the hoops to develop a FCC type accepted outdoor product that can be imported anytime soon.

nje431

I'm curious how you intend to use 6E in the US. The FCC rules allow very low power indoors only, out of the box. For outdoor use you will be required to register the coordinates with a service, which I suspect will require a paid subscription, and then the devices will need to maintain contact with ...

nje431

We've been running our 50 or so 2 year old RB1100AHx4 routers on 6.47.8 with IPSec and DHCP for about a month now with zero problems. Before, about a week is all we could get with either of those turned on.

nje431

My experience has been that ARM processors running any software newer than 6.43.16, doesn't play well with IPsec (or possibly DHCP as well). In our case that is the RB1100AHx4. We've switched to L2TP with the less than ideal Microsoft encryption to get stability. However...... Mikrotik just yesterda...

nje431

*) arm - improved system stability;

Can you elaborate please? Does this fix the 4011 & 1100AHx4 management lockouts?

Thanks

nje431

Yay! It works on the RB1100AHx4 now too. As far as the Dude, I do custom functions to get the OID values and divide that by 10. Then another to create the display which you then place on the device appearance label (One of several functions I've replaced the defaults on the label with. The others in...

nje431

Hi nje431 Out of curiosity, how do u power cycle them remotely? We currently have one power port plugged into a ups and the other is plugged directly into the main power wall socket If I could power cycle it remotely myself it would save so much time!? Regards Simon We've used several devices. Most...

nje431

Well, so much for that. I hadn't much more than hit submit, than I heard from one of our techs that one of the routers had stopped responding to SNMP overnight, so he did a remote power cycle to bring it back. This is making me all that much more suspicious of that DHCP package. Time for more testin...

nje431

Interesting. TLDR: I have narrowed our issue down to software releases sometime following 6.43.16, but starting prior to 6.45.8, and using IPsec. Somewhere between these 2 releases is when Mikrotik changed the security package to require the DHCP package. Originally we were running our network of ~5...

nje431

Because EoIP has overhead, it can't encapsulate a full 1500 byte packet in a 1500 byte packet to go out the normal 1500 byte Ethernet port. Auto default is to limit the packet size to what it can pack in without fragmenting the packet. But EoIP can fragment and reassemble without breaking TCP. By fo...

nje431

Probably a MTU problem. Manually change the bridge MTU to 1500 and see if it works.

nje431

RLeemans is correct. There is something else causing coil/chock L2 to burn. I suspect something external to the device. Typically a small choke in a device like this is there to block RF coming in an external cable. Without a schematic, I can't tell you exactly what, but I have some educated guesses...

nje431

Approximately (50) 1100AHx4 routers deployed now, and after 30 days not so much as a hiccup. The reason? Rolling back to 6.43.16. That is not an option on new routers, as I discovered, since you can't roll back beyond the factory installed version, and the last one we bought was at 6.45.x. One inter...

nje431

Join the crowd over here:
viewtopic.php?f=2&t=149062

nje431

In our network, we are using RSTP for loop protection. If there is a momentary interruption, RSTP will flood packets out all ports while it figures out the new pathway, and we will see that message occassionally. If you aren't using it for loop protection, you may actually have a loop somewhere and ...

nje431

First, in my limited testing, bypass only works if R1 is powered off.

If ports 11 and 12 on R1 aren't bridged, would a Netwatch ping looking for WAN 2 connectivity work for you?

nje431

Are you using RSTP, intentionally or not?

nje431

Thanks,
Hmmm, that country lock looks like it locks a single value in. If I apply a lock for "united states", but that's not one of the current selections, I may lock myself out.

I did send support a bump again today. We'll see what happens.

nje431

Thanks, tried the real 24dBi antenna setting, still no love.

And as far as PTP set-asides, it appears the FCC has dropped those from the regulations, as far as I can find.

nje431

I received a new 911G-5HPnD-QRT-US (QRT-5). My intent was to use this for PTP service in the 5.1gHz band. The problem is that in the country dropdown, the only choices I have are "canada2" and "united states3". The "united states" selection which includes the 5.1 band i...

nje431

Never contacted support. It's never been a big issue for me. The only image I use is a screenshot from Open Street Maps that I use as a background for my main map. Then I place submaps of our remote locations on top of the main map in the proper positions. I learned a long time ago to never copy dev...

nje431

Cosmetic error on a RB1100AHx4 in Winbox under System>Health. It's showing 49.5 amps. Terminal is showing 495 ma.

nje431

It happens to me too, every several months or so. Usually not days or weeks though. I keep a copy of my one image I use in the root directory, then I can copy it back into the files directory when needed. I see the one in the root has been there since Dec 2017, so it seems to be stable there. Runnin...

nje431

Starting from version 6.47beta19 / 6.47 there have been health improvements. More information can be found under "/system health gauges print" and if you are looking for oid "/system health gauges print oid". Too bad that ARM devices (1100x4) randomly lock up and reboot on anyth...

nje431

That works! Thanks!

nje431

Found my problem. "Router OS" has to be enabled. But the Dude is flaky and doesn't always want to connect when you first check the box and apply. It has to wait until the next connect time, which by default is 24 hours. And rebooting the Dude doesn't connect on the first try either. Arrrr.

nje431

if you use the dude to monitor then you can get this value using a function round(ros_command(":put [/system health get psu1-voltage]"))/10 Is there something else we need to do? In the Dude or in the router? I'm trying this with a RB1100AHx4 running 6.45.9, and it's not working. The &quo...

nje431

None of our problem child 1100x4 routers are currently running L2TP in any flavor. BTW - So far, I'm seeing promising results rolling back the 1100x4's to 6.43.16. I've been running 23 routers at 6.45.9 and 23 routers at 6.43.16 for the last couple weeks. Only the 6.45.9 routers have farbled so far ...

nje431

Unless you need it, Try turning off RSTP on each of the bridges and see if that works.

nje431

I see your IP addresses are attached to Ethernet ports which are attached to a bridge. My understanding/experience is that the IP addresses should be attached to the appropriate bridges.

nje431

By chance, have you checked your user group policies to make sure "web" didn't get disabled somehow?

nje431

No OSPF

But:
EoIP w/AES128 GCM
VLANs
Static routes

nje431

Rolling back ROS has been my latest test. I've got a few on 6.43.16 and so far, so good. But it's too early to celebrate just yet. My other experiments with scheduled SNTP and disabling 1000/half on 6.45.9 have settled things down considerably, but hasn't been 100% effective. So time will tell.

nje431

I know this is a shot in the dark, but try disabling 1000/half under auto negotiate. The switch chip doesn't support that option, and if your ISP connection does...... I've disabled it in all ours, and they seem to be a lot more stable since then. Or maybe it's just my imagination.

nje431

Who knows? But the forum thread is focused on management lockouts where Winbox, SSH, Telnet, and SNMP, all stop responding, but revenue traffic continues to flow. Your symptoms seem to be counter to this. But in my dealing with Mikrotik support, I get the impression that they have no idea what the p...

nje431

No we haven't. A) Because we couldn't get the seller to even respond to an out of the box power supply failure. And Mikrotik won't handle the warranty directly. B) I really don't believe it's a hardware problem. Actually, we've deployed a good majority of them, and with some configuration changes, w...

nje431

@UpRunTech
Thank you! I've been wondering how to do that.

nje431

Actually, I did. A couple times. That answer is always the same. You have bad hardware, return it to the seller for warranty (not Mikrotik, like most manufacturers would do). We couldn't get the Amazon seller to even respond to one with a bad power supply out of the box. Plus with so many failing th...

nje431

Yes, I noticed that. My suspicion is that ROS is asking the chip to do something it's not capable of, and creating an out of bounds condition. That in turn is causing unexpected behaviour. That's my current working theory anyway.

nje431

I may have found something. While it's a bit too early to know for sure, the fix is simple enough and safe to try. First, what didn't work. I tried dropping the CPU clock, but that didn't work for me. Then I disabled the SNTP client, but that just changed how the failure presented itself from random...

nje431

No more problems since reducing the CPU freq to 1200 Mhz; running for two months now.

That sounds promising. Thanks! I just hope I didn't jinx you

nje431

We are having the same problems as the OP. I got the same response from support that it's failed hardware. We bought 50 of the RB1100AHx4 and have deployed about 13 so far with 5 units each having done a management lockout. So I'm having a hard time believing a hardware failure. It's a pretty dismal...

nje431

Can anyone post reasonable reason why it's important? Verification that file is downloaded is plain strange. If you don't trust the auto-upgrade mechanism, use Fetch, or use other more reliable ways. I'll turn the question around, could you provide a good reason why they should to be hidden? I'm no...

nje431

What you are attempting is similar to what we did for our RoIP system. You A-C link is down because RSTP is protecting you from loops. Let it do it's job. Being a non IT guy, I wouldn't go down the MPLS/VPLS road, you'll just get frustrated. EOIP with RSTP is beautifully simple for what you are tryi...

nje431

Yes, SNMPv3 is broken. The one configuration I've found that works is Authentication=MD5 / Privacy=None. Anything else fails for me.

nje431

@becs On VLAN Example #2 (Trunk and Hybrid Ports) there is a port mismatch /interface bridge vlan add bridge=bridge1 tagged=ether2,ether7,ether8 untagged= ether3 vlan-ids=200 add bridge=bridge1 tagged=ether2,ether6,ether8 untagged= ether4 vlan-ids=300 add bridge=bridge1 tagged=ether2,ether7,ether8 ...

nje431

Hello everyone - that's my first post although adventure with mikrotik started many years ago :-) I have a problem with 64-bit counters. In changelog v6.36: Fixed - diff64 function broken. I installed dude on mmips (RB750Gr3) - but for this platform dude is available from 6.37.5 version - maybe fix...

nje431

nje431 - some quick tests didn't show any problems using Webfig Dude>Server Config (6.38.1) from Chrome/Firefox. Can you repeat this from different PC ? Thanks. Originally I saw the problem on a Win7 laptop. I just tried it on an Android tablet and got the same result. So I tried rebooting the rout...

nje431

nje431 - some quick tests didn't show any problems using Webfig Dude>Server Config (6.38.1) from Chrome/Firefox. Can you repeat this from different PC ? Thanks. Originally I saw the problem on a Win7 laptop. I just tried it on an Android tablet and got the same result. So I tried rebooting the rout...

nje431

Updated from 6.38rc to 6.38.1 (X86) tonight, then checked out the Dude in Winfig (still checking to see if Web maps are ready for prime time :). Whenever I go to Dude>Server Config., it locks up Chrome. Also locks up IE 11, but IE does give me a message that it has stopped responding due to a long r...

nje431

Can you elaborate on the RSTP incompatibility? We've been using 6.30/6.34/6.36 for some time now between different devices without a problem, including inter-operating with another vendor (A few HP/Aruba 48 port switches). Does this change affect the inter-operability with other vendors? Q Thanks. ...

nje431

Can you elaborate on the RSTP incompatibility? We've been using 6.30/6.34/6.36 for some time now between different devices without a problem, including inter-operating with another vendor (A few HP/Aruba 48 port switches). Does this change affect the inter-operability with other vendors?

Thanks.

nje431

Now that the Dude supports maps in Webfig, I updated our test Dude from 6.37rc15 to 6.38rc35. A few things I'm seeing with the Webfig maps: Can't click on a sub-map from the primary map to display it. Background images take forever to display. It's not displaying the temperature symbol correctly. It...

nje431

Would love to see the Dude have a minor/major alarm display option instead of partial/full down. A service would be specified as a minor or major service, which would change the color of the device and submap icon, based upon the most severe service that's down.

nje431

You may already know this then, since 10g interfaces are on your to-do list. But in 6.37rc15 at least, diff64 has a serious limitation. While it can handle 64 bit counters as inputs, its output is the least significant 32 bits. So any difference over ~4.29 billion is erroneous.

Cheers

nje431

I noticed in the change log, that diff64 was fixed in 6.36. Was that change introduced into 6.37rc, and if so, in which release? And what was fixed?

Thanks

nje431

Do you consider it safe to upgrade from rc15 to rc21 for our test setups yet? (You still have the warning on the inital post)

nje431

A few bugs I've seen. As I mentioned, we are running Dude 4.0b3 on our production network, and I'm experimenting with "Dude NG" as I call 6.37rc12 on X86. When I exported and then imported the database from 4.0b3 to 6.37, I noticed that it cleared the Submap>Background>Tile checkbox on all...

nje431

Found the slow startup problem. I had the change the ether1 queue on the server from "only-hardware-queue" to "ethernet-default". It made a big difference in how "snappy" it is. On a different note, I'm seeing times when a device which is disabled doesn't change its col...

nje431

Are either of your machines running a demo version of ROS? Could be related to that somehow?

Thanks

nje431

Interesting. I just installed Demo ROS on an old Vista machine. If you change the Winbox port in X86, then it automatically changes the Dude port with it. So they share the same port. That was my confusion. Different applications, I would have assumed you would want different ports. I guess not. Oh,...

nje431

I understand there are workarounds. Duct tape and baling wire are workarounds.

I just looked at the Winbox launch to see where I could change the port. If it's there, I'm not seeing it.

nje431

What am I missing here? Out of 64k ports available, you choose to use the same port for the Dude as the default Winbox port? I don't understand the logic behind that. Can you explain? Because from the outside this seems to just complicate things with no real benefit. I was about to set up a test Dud...

nje431

After years of tweaking 4.3, I've got it working reliably for our needs. From where I stand, it appears 6.34 isn't halfway to 4.3 yet. Have to use it on a ROS device? Not ideal, but not a deal breaker. No Web interface? Ouch! When I'm out and about, I don't carry a PC, but I do have a phone. The Web...

nje431

*) ipsec - use local-address for phase 1 matching and initiation;

Please elaborate. And does this apply to EoIP ipsec?

nje431

You probably tried to CTRL-M a dynamic item. Works OK on static items on my 1100AHx2 (and this is how it should be....). No, I'm well aware of dynamic entries. I first noticed it while updating filter rules, then tried it on all kinds of entries. None worked on any of our 1100AHx2s. But like I ment...

nje431

Sorry, I fat fingered that : ) I meant control M doesn't work on the 1100AHx2.

nje431

Found a minor bug in 6.30.4, easy to duplicate.

Winbox 3rc12
RB1100AHx2

Control B does not work to bring up comments. Works fine on RB2011iL

Cheers

nje431

Excellent. I'm glad you found it.

nje431

joegoldman, noyo - Simple mode uses only few columns so they are hidden/shown by default. If you use Advanced mode, then you can manage columns as you like. Advanced mode offers more clutter than I need. Simple mode would be what I would use if it would open with the Notes column visible ( that's w...

nje431

Glad you got it working. For reference, "roll up the box", refers to the Winbox interface, and clicking the area to the right of the MTU field to close the field. I'm not a CLI expert, so I don't know the specific command.

Cheers

nje431

Your system sounds similar to ours in a lot of ways. Same problem we originally had when adding a L2TP link as well. With the later ROS versions, you can let the router set the MTU by using the auto MTU feature on ALL interfaces except the bridge interface (more on that in a bit). To use auto MTU, s...

nje431

Remember that firewall rules are executed in order. Unless I'm missing something, it looks like rule 3 is dropping packets before they get to rules 7 and 8.

nje431

It could be. I fought a similar problem for a year, several years ago. In my case the problem was the controllers were sending an ARP request, then timing out before the reply returned. In that case, we installed a router in front of each controller and put it on it's own subnet so the ARP reply wou...

nje431

I'm fresh out of ideas for now.

nje431

Zerobyte. It does look like you've hit a lot of points. My apologies for not reading more carefully.

I know this is basic, but have you assigned a unique MAC address to each tunnel endpoint as recommended in the Wiki? Have you checked to make sure you haven't duplicated a MAC somewhere?

nje431

Hmmmm, So as I understand it, you seem to have hit a maximum number of EoIP tunnels beyond which you can't expand. At some of our sites we can't run native EoIP because the ISP connection won't support it (primarily cable modems). In those cases we've switched to unencrypted L2TP/BCP. I wonder if th...

nje431

By the way. Did you see this entry in the 6.28rc20 release notes?

*) Fixed tunnels - Could crash if clamp-tcp-mss was enabled.

Again, not sure this is your problem, but worth looking at.

nje431

My IP was on the bridge. I know bridge groups and switch groups are supposed to be compatible. And 99% of the time everything worked fine. But under the right conditions, things would go crazy. Turning off the switch group and moving all the ports to the bridge group stopped the crazyness.

nje431

I just saw your post. In your first paragraph, you mentioned that ether 2 was both a bridge port and a switch master. I can tell you from painful experience, that you shouldn't do that. When a port is part of a bridge, make all other desired ether ports bridge ports too. Mixing bridge ports and swit...

nje431

I had a similar issue several months ago. The NTP client would work with public NTP servers, but not our Windows time server. After much back and forth with Mikrtik tech support, they finally said they found the issue and would be working on a fix. In the process, I found that if you just need the t...

nje431

Unless I'm missing something, I'm not impressed with the new Winbox. The old version will remember my session settings, column widths, use of Inline comments, etc. The new beta version does not. In fact if you use the new version, the next time you log in with the old version, all those settings are...

nje431

I've sent a detailed bug report to tech support, but here is a brief description of what I've found. The NTP client struggles at best, and refuses to synchronize in other cases, to our Windows 7 NTP server after reboots. Routers with 5.26 and 6.1 don't have this issue, but any upgraded to 6.9 or 6.1...

nje431

To the good folks at MikroTik: When you present a product to your customers or potential customers, whether it be free or paid, that is as buggy as Dude is, whether you realize it or not, you are sending a powerful message about your commitment to quality that no amount of advertising can overcome. ...

Search found 95 matches