MikroTik

Network5

Hi,
I suppose that this problem is still active?

I have the same problem with 7.14.2 on CCR2216.

Network5

I have a tricky problem that came out during MPLS debugging: Supposed to have three routers, Router A - CCR2004, Router B - CCR2004, and Router C - CCR2216. Routers A and B are linked with AirFiber 24 and the same is between B and C. AirFiber supports jumbo frame. If pinging from A to B with MTU 900...

Network5

@pedkoschi - Use PS to update your Windows IKEv2 configuration to the encryption level that suits for both clients: PS C:\Users\user> Set-VpnConnectionIPsecConfiguration -ConnectionName "xxxx" -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES256 -EncryptionMethod AE...

Network5

That is a good news!

Network5

Hi, Find below the RR peering configuration: #RR211 add address-families=ip,l2vpn,l2vpn-cisco,vpnv4 as=xxx cisco-vpls-nlri-len-fmt=auto-bits cluster-id=10.255.255.1 connect=yes \ disabled=no input.affinity=alone .filter=ibgp-in-4 listen=yes local.address=10.255.255.211 .role=ibgp multihop=yes name=\...

Network5

@azg Now... here are the strange effects: - When I disable PW12 then also PW10 and PW11 go down for about a second, before they come back. - When I wait until PW10 and PW11 are back up, and then enable PW12, then PW12 comes up (and works) I have the same behaviour for VPLS terminating at the same en...

Network5

@baragoon I'm not a BGP expert, but with multihop BPG setup you should use loopback addresses to do such work and specify the source address in the BGP connection (one of the main differences in ROS7 compared to ROS6). @dmitris I'm using mainly version above 7.11.x. If the router has LDP/MPLS the ma...

Network5

Hi Dmitri, We also use redundant RR in our network. The RR part in BGP on ROS 7 seems not to be finished jet, but can be used. Please, try to set the roles on the RR side to ".role=ibgp-rr", this should help in receiving duplicate routes. Use ibgp-rr-client (this should be the same as ibgp...

Network5

I'm using RPKI since ROS 7.xx. Never had a problem with that. One session is pointing to Routinator and the second one to Fort validator. add chain=bgp_rpki disabled=no rule="rpki-verify groupFIRT" add chain=bgp_rpki disabled=no rule="if (rpki invalid) { reject }" Pay attention t...

Network5

Today I was trying to import the configuration from our production router that runs ROS 7.13 on CCR2216 to our lab router, CCR2216 running ROS 7.13 to test the 7.13.3. Resetting the configuration and running the script from there it gives an error because of line in bold. Removed that it worked. (Th...

Network5

This same, but reboots about 10 seconds.
This morning I've updated a CCR2004 with MPLS/VPLS, LDP. The router has restarted in less than 1 minute. Downgraded to 7.12.1 seems to be stable.

Opened support ticket SUP-138412

Network5

I tested this version on my CCR 1016 where MPLS and VPLS {LDP} is running. After 3 to 5 minutes router reboots and it keeps repating over and over. On version 7.12.1 everything is ok. Has anyone same experience? No error in log. This same, but reboots about 10 seconds. This morning I've updated a C...

Network5

Yes, this is an old issue with big routing tables. There are also some other issues as searching by a community or blackhole routes or whatever. Not all routes are displayed. Same behaviour in CLI or in Winbox.
They are already working on it.

Network5

Could be the reason why BGP-VPLS is not working in between peers that have not direct BGP session. I have to test another strange behaviour, but have to do further testing: if the setup uses two (redundant) RR, the tunnels will be flapping undefinetly. What ROS7 version did you used? Please open a s...

Network5

Happened to do some work for a client, setting up a IPsec/IKEv2. With the increased security in iOS the incompatibility between the various configurations is huge. The main problem for Mac clients tends to be the LifeTime parameter. As far as I know, the only way to set up a common security profile ...

Network5

I have some TCP performance issue on a CCR2004 (Router B) running 7.12beta3 and beta7, but just on forwarding plane. You say forwarding but then you are testing from router to router? To test forwarding performance, put an end-system (e.g. a PC) at each end behind the routers, and test between the ...

Network5

I have some TCP performance issue on a CCR2004 (Router B) running 7.12beta3 and beta7, but just on forwarding plane. This is the result of a simple speed test to and from the router itself: Router A (CCR2216) <-> Router B (CCR2004) status: done time-remaining: 0s ping-min-avg-max: 9.44ms / 9.49ms / ...

Network5

You are a lucky guy.
The CCR2004 with two IPv4 and two IPv6 took around 40min to announce my networks.

Recently we upgarded our edge routers to 2216 and now seems to be better, no more long waiting times for the announces to propagate.

Network5

Try with this:

if ( dst in 0.0.0.0/0 && dst-len == 0) { accept;}

You don't need the reject line, as it rejects by default.

Network5

I have a similar issue with OSPF, when changing address of the interface or manipulating with the physical interface the routing remains suspended. Sometimes even it chooses the wrong gateway. Only a reboot helped.

Do you know if the fix will be released in the next releases?

Network5

The IS-IS row in the Routing Protocol Overview is something new? :-)

Network5

We had a similar problem with a multipoint BGP-VPLS mash and we forgot enabled the RSTP on a bridge on one router of the mesh. With horizon active on the VPLS part the RSTP blocks the port when the tunnel comes up. (Maybe you can check under bridge/port the port status.) It took months to figure out...

Network5

(I'll relpy in english, as the forum is open to a wider audience.) Yes, the proposed solution could be an alternative. But, as per our internal policy, we hardly change IPs and assigned IPv6 networks to the clients. So we are trying to find a solution, that can be integrated with our RADIUS server a...

Network5

I can understand your point, but from October in our country (IT), due to law enforcement, we'll HAVE TO let the client to specify the level of DNS filtering appropriate for their home network. Three profiles for now, as for my information (no filtering, basic filtering, child filtering). The propos...

Network5

Please can you share you input and output routing filters, from PE and CE?

Network5

Hi Croissante, I'm running BGP signalled VPLS with RR and basically the tunnels are running. BUT, there is a known bug: when using RR instead of a full BGP mash, the traffic in the tunnels is not always routed. Mikrotik support is investigating the problem. As I read trough your post, I can suggest ...

Network5

DNS IPv6 in PPPoE profile +1

Network5

We have several CCR2004 in lab and in production, running 7.8, 7.9 and 7.10rc, no issues with winbox.

Network5

We tested the MACsec with 7.9 on CCR2004 and it seems that the performances have drastically increased. We are around 1Gbps when forwarding packets (not generating the traffic from the router itself.) Good job!

Network5

IMPORT/EXPORT note: When trying to import in 7.9rc3 the configuration from 7.8 there could be a syntax problem on /routing/bgp/vpn, the command line gets discarded. /routing bgp vpn add disabled=yes export-route-targets=xxx:1004 import-route-targets=xxx:1005 label-allocation-policy=per-vrf redistrib...

Network5

May I ask, if anybody is using BGP route reflector and route reflector client roles. I have problems distributing l2vpn and vpnv4 routes. It looks like with normal (no role) iBGP these kind of routes are distributed, once switched to rr and rr client, they are gone. Are any special filters that shou...

Network5

ospf v3 still not working in 7.8

viewtopic.php?t=192529

Our backbone is up and running in dual-stack since 7.5. What part of OSPFv3 is not working for you?

Network5

When importing / coping VRRP configuration, from an export, with VRRP master-group set, the command will fail. Supposing because master group does not exists jet. This on RC3. /interface vrrp add group-master=VRRP-A01 interface=B_A01 name=VRRP-A01 vrid=101 add group-master=VRRP-A02 interface=B_A02 n...

Network5

"Also packet sniffer slows down my IPv6 speed dramatically (off ~150 Mbit, on ~ some kbits) but only on my CCR2004."

I have a similar issue, also on a CCR2004 just for IPv6 traffic. I can generate more than 3GB/s but I can not forward more than 100kB/s.

Network5

Hi xmasin, A similar problem or the same one was solved couple of days ago. You can check this in the 7.7 changelog: mpls - fixed assigning of explicit null label for IPv6. In the case we used IPv6 for the LDP backbone and once the explicit null label parameter was set, the loopback address (transpo...

Network5

Below you can find the LDP status. R1 and R3 are edge routers, R2 is the middle one. (There is also a BGP session between R1 and R3 to keep the VPLS working from R1 to R3.) (Link-local addresses has been removed and the IPv6 block replaced with the demo one.) The topology is going further from R1, h...

Network5

Hi, Today I was able to setup a BGP signalled VPLS configuration. It's running natively on LDPv6, no IPv4 for transport. The main issues were setting up BGP, so in dual stack environment just set the L2VPN and L4VPN only on IPv4 or IPv6 bgp session. If both, none will work. Remains the RR issue: unl...

Network5

Hi pospanko,

We have a 2004 running 2 FIRT and some other sessions running on 7.5 and it's quite stable.
The only strange thing that we are noticing is CPU usage: routing is running on all cores, but one is always at 94% of usage.

Vasja

Network5

Today I've tested MACsec between two CCR2004 in LAB. The interface is working without any problem. These are the results on a 25G link between two sfp28 interfaces. The CCRs were reset to defaults with no other settings set but the ip addresses and the macsec interface. ping-min-avg-max: 88us / 101u...

Network5

I've tried today to setup the MACsec between a 2004 and 1016, both with 7.3.1 that we have in LAB. We need to encrypt an internal gigabit link for a client. When the MACsec is coming up, the 1016 is rebooting, till the interface is disabled. With WireGuard the throughput is something less than 1G fo...

Network5

We’ve had a similar problem on our backbone. It seems that was generated by a flapping link.
It seems that in the middle of the exchange some data get lost, generating that error. The ugliest thing is the error is spread to all other peers.

Network5

+1
I totally agree!

Network5

Hi, I'm trying to set up a BGP-VPLS tunnel to our backbone from a ROSv7 router and ROSv6 backbone. (We have some backbone nodes running on CCR2004s and they are restarting randomly so, the idea is to upgrade to v7, where they get rid of that problem.) Now: OSPF is working fine, MPLS/LDP it seems is ...

Search found 43 matches