MikroTik

bommi

I just did another upgrade on the capsman to 7.17rc1 and the caps are only again.
In 7.17rc1 includes the same fix as 7.16.2:
*) certificate - fixed handling of capsman-cap certificates (introduced in v7.16);

Therefore I suspect this to be some other issue.

bommi

Hi,

I did an upgrade on my capsman (CHR) and caps (cap AX and hAP ax2) from 7.16.1 to 7.16.2.
In the logs of the caps I can see this message:
"no suitable CAPsMAN"

Anybody else seeing the same issue?

bommi

Hi,

yes disabling ipv6 is enough.

bommi

If you pay for 2.5 Gbps you should get hardware which supports this bandwith.
Even with two interface each with one gigabit a single stream would be limited to 1 gigabit.

bommi

I just use mikrotiks own ddns service and set a CNAME record in one of my domains to this ddns domain.

Dont know if this could be a solution for you too.

bommi

Found something in the documentation: "Starting from RouterOS v7.17, DHCP snooping is supported with hardware offloading bonding interfaces." Source: https://help.mikrotik.com/docs/display/ROS/CRS3xx%2C+CRS5xx%2C+CCR2116%2C+CCR2216+switch+chip+features Once 7.17 is released, we should have...

bommi

From my understanding it should behave like a trusted port, just because DHCP Snooping is not "working" on this bond.

bommi

Do you want to tell us the vpn protocol you are using?

bommi

Did you get a response from them already on this topic?

bommi

Yes, if you are running FreeRADIUS inside a docker container on your CHR.
Otherwise use MikroTiks own radius server which is called User Manager.

bommi

Can you please provide more information?

Do you have some screenshot / cli output which shows this issue?
Which version of RouterOS do you use?
Which version of CAPsMan are you using?

bommi

I already requested that feature via SUP-158802. Details11/Jul/24 11:09 AM Description Hello, I have a feature request: It would be nice to have a column in wifi/registration-table which shows the active security-type of the registered client. e.g. wpa2-psk,wpa3-psk,etc. Maybe even more “granular” ...

bommi

Can you please show us the output of following commands from both peers:

/ip/ipsec/active-peers/print
/ip/ipsec/installed-sa/print

bommi

Could you please insert the used WPA version inside the capsman registration table?
So that we could see which version of WPA is used by a client?
I think that this would be a valuable enhancement.

bommi

Which release of RouterOS?
Can you show an export of the smb configuration?

bommi

Correct, SLAAC and DHCPv6 including Prefix Delegation is supported.
What else do you need?

bommi

+1

And it should be possible to download the lists to memory or to define the storage space manually.

bommi

Do you see any SSH logins at the same time?

bommi

I ran into a problem with VLAN's: wireless clients got MGT VLAN addresses assigned as well as HOME VLAN addresses. Found out from looking at the DHCP leases and IP ARP entries. After downgrading to 7.15.3 the problem was solved. Yes, all information was supplied to support. Standalone AP or using C...

bommi

Is the training material still on 6.49.x ?

bommi

IP / SMB / SHARES - required-encryption option leads to hard restart of RB5009 in 7.15, is it already solved in this version, or in what version is planned? Some info? On my hEX s the smb with encryption is stable on 7.16rc2, but this device uses an other CPU architecture. I would suggest to create...

bommi

What type of users do you mean?
Sessions in user-manager or client VPN connections?

bommi

From my experience SMB is somewhat bad when used through an Internet VPN. SMB traffic gets performance issues when the latency is getting higher, what is your latency using this VPN?

bommi

*) wifi - send channel switch announcements to clients when switching channels at requested re-select intervals;

Is it supported for standalone wifi, capsman or both?

bommi

Great to see a discussion about the Linux Kernel, that brings me to a feature request I have seen in this forum a lot :-)
When will Mikrotik introduce the support of IPsec VTI?
It is supported by Linux Kernel since 3.6.

bommi

from time to time, im not able to log in to the MT by using winbox, reboot fixed it.
Does anyone aware of that?

Never seen an issue like this. Using RouterOS since 2014.

bommi

Can you enable ipsec logging and try to establish the VPN?

bommi

You can try to upgrade the firmware of your lte modem:

/interface lte firmware-upgrade lte1 upgrade=yes

bommi

What do you mean with "different band"?
Most Mikrotik accesspoints can operate on the 2.4Ghz and 5GHz band simultaneously.

Which hardware do you use?

bommi

I would pay money for an automatic activated safe mode

Had too many bad changes in my home network

bommi

There is no CIFS / SMB client included IJ RouterOS, only the server part is implemented.

bommi

Which Switch do you use?
Some are able to boot to RouterOS instead of SwOS, then you can do InterVLAN Routing.

bommi

The 'h' in hAP stands for 'Home', seems to be the wrong device for your needs.

bommi

Does anyone know for sure whether or not (without assumptions) nv2 is available on an AX ap/cpe in the AC band?

It is not available.

bommi

Can you please make the storage for adlist configurable, so that I can use the sd-card in my hex S?
Or the ramdisk. No need to permanently save that file, it is only a tmpfile.

This would be the best way.

bommi

I configured adlist and it can't download all of my configured lists because of insufficient storage.
I get this message in my logs:
[adlist] no space to store a file

Can you please make the storage for adlist configurable, so that I can use the sd-card in my hex S?

bommi

as per the above post this is not encouraging my hopes already sunk, 802.1x + 802.1q is pretty much standard in the campus/enterprise, I'm not a native english speaker so please bare with me with the question 802.1x + 802.1q + radius (usermanager/freeradius) with wifi-qcom-ac/wifi-qcom latest and g...

bommi

I would like to see enhancements in the ipsec area like:

IPSec VTI
DH-Group 32

bommi

Dynamic ARP Inspection and IP Source Guard are my most missed L2 security features when it comes to Mikrotik.

bommi

Since RouterOS 7.7 we can use diffie-hellmann group 31: *) ike2 - added support for DH Group 31 (EC25519) (CLI only); The support is limited to ike2 / phase-1, could you please also bring this to ipsec / phase-2? Is your crypto stack already able to support DH-32 (Curve448)? This would also be a gre...

bommi

I have one issue with my cap ax wifi which is controlled by my capsman controller on my hex s. Some devices aren't placed in the correct vlan. In this screenshot you can see two devices which are connected to the same interface / ssid: Screenshot_20231203_190437.png One device got placed into the c...

bommi

I have one issue with my cap ax wifi which is controlled by my capsman controller on my hex s. Some devices aren't placed in the correct vlan. In this screenshot you can see two devices which are connected to the same interface / ssid: Screenshot_20231203_190437.png One device got placed into the co...

bommi

Do devices running the new wifi-qcom-ac package still have the old wifiwave2 limitation where VLANs couldn't be configured? Found it in the wiki: 802.11ac chipsets do not support this type of VLAN tagging (vlan-id), but they can be configured as VLAN access ports in bridge settings. I just did the ...

bommi

still no ed25519 private key for ssh?

Already included in 7.12.

bommi

Can we get a “update” to go back to 7.10.2? As downgrade seems to be broken as well. Really need my network back!

For me the downgrade worked. Uploaded the old version and hit the "Downgrade" Button in the Package Update menu.

bommi

I have some more feature requests regarding encryption topics :-) Since RouterOS 7.7 we can use diffie-hellmann group 31: *) ike2 - added support for DH Group 31 (EC25519) (CLI only); But the support is just implemented in ike2 / phase-1, could you please also bring this to ipsec / phase-2? Is your ...

bommi

*) ssh - added support for user ed25519 public keys;

Great to see this one!
I use my openpgp key based on ed25519 on my Yubikey for SSH logins.

bommi

What is Wifi Wave 2 for?

You can find all information about wifiwave2 here:
https://help.mikrotik.com/docs/display/ROS/WifiWave2

bommi

Running Torch or Sniffer solves it because it disables bridge FastPath, the same as using: /interface bridge settings set allow-fast-path=no I thought I had the same problem on my hEX S, but disabling the fast-path didn't help. The device does not respond on all vlans interfaces on the bridge after...

bommi

Well, dates aren't heavily used in RouterOS.

What about certificates?

bommi

The possibility to use SSH Keys based on ed25519 would be a nice Feature addition ;-)

bommi

Do you see autosupout.rif files in the filesystem of your Routerboard?
If you find those files, just check the creation time if this is related to your outage and create a case with mikrotik.

I am also using a Rb760iGs with 7.10.2 and dont see any issues here.

bommi

IKE2 rfc states the use of RSA.
What would be the client devices that support EC? Why exactly you need this?

EC key exchanges are much faster than RSA, because the keysize is much smaller.
My usecase are mobile devices on bad mobile connections.

bommi

Will we get IPv6 Support?

bommi

*) ipsec - added DH groups 19, 20 and 21 support for phase1 and phase2 (CLI only);

Is there a chance to get support for brainpool ec curves like DH group 28, 29 and 30?

bommi

Hi,

cli over ssh works even at 640x480

bommi

Hi,

could you show us the output of:

/ip firewall filter export

and

/ip firewall nat export

Regards
bommi

bommi

Will this wireless-rep package also provide CAPsMAN support?

bommi

In changlelog I saw this: *) wireless - added new package "wireless-rep"; Where can I find more information about this package? "New version RouterOS will support single radio AP/Client for repeater support!" As noted here: http://forum.mikrotik.com/viewtopic.php?f=21&t=1042...

bommi

Any update on this?
Is this the same behavior for CAPsMAN v2?

bommi

*) sstp - allow ECDHE when pfs enabled;

Does this mean you switched to a newer openssl library in this version?
When will it be possible to connect to the webinterface using pfs with dhe or ecdhe?

bommi

Could you please disable RC4 in your ssl stack? Or just give us an option to do it by ourself.
Also enabling perfect forward secrecy for www-ssl and api-ssl would be really nice.

bommi

6.31rc13 changelog says:

*) chr - added support for virtio disks
*) chr - added support for HyperV fast ethernet

But where can we find the new images for download?

bommi

Can you provide log files of both sides?

bommi

Can you provide an configuration example or config screenshots of your watchguard?

bommi

Try to get useful logs by enabling ipsec logging:

/system logging add topics=ipsec

bommi

Please integrate virtio drivers.

bommi

Try to get useful logs by enabling ipsec logging:

/system logging add topics=ipsec

bommi

+1 for dyndns script, 6.29.1!working and 6.30 broken more likely that your script is broken. scripting language improves over time, the scripts need to be updated. MikroTik did not make th DynDNS script, you have to ask the person who wrote it, or maybe post this question in the "Scripting&quo...

bommi

Hello,

is the sector writes problem fixed?

Changelog for 6.29rcXX had following note:
*) firewall - fixed sector writes rising starting since 6.28;

I cant find this note in the changelog for 6.29.

bommi

Hi,

it is not possible to install RouterOS on this device.

Regards,
bommi

bommi

What's new in 6.27 (2015-Feb-11 13:24):
*) ipsec - fixed crash that happened in specific situation;

In what specific situation?

I try to setup an IPSec IPv4-over-IPv6 VPN between Mikrotik and Juniper ScreenOS.
The Mikrotik Device crashes when trying to establish Phase 2.

bommi

Hello,

there is a list of used open source software in RouterOS at the end of this document :
http://www.mikrotik.com/downloadterms.html

I cant see bind9 there, but this security problem also affected other dns software like unbound or powerdns.

bommi

When using self signed certificates have a look at this:

http://wiki.cacert.org/FAQ/subjectAltName

bommi

Any news what has changed in RouterBoot Firmware 3.19?

Nothing listed here:

http://wiki.mikrotik.com/wiki/RouterBOOT_changelog

bommi

There is also an firmware update for my 951G-2HnD to version 3.19.
Any news what has changed?

This site has not yet been updated:
http://wiki.mikrotik.com/wiki/RouterBOOT_changelog

Search found 76 matches