MikroTik

spippan

SSTP AES hardware acceleration please! SSTP is the only standard protocol for Windows road warriors (but also can be used on other platforms with additional software) which works nearly anywhere. All other options like l2tp, ikev2, wireguard etc. are sometimes blocked in public or hotel networks. N...

spippan

....on your router's make and model.

NO! - but on your network's setup! a mikrotik router NAT configuration from plain functionality (not speaking of performance) is model agnostic

spippan

redistribute default route via VRF-BGP is completely broken on v7. I have opened ticket with MikroTik support. i've been told to provide more details (how it works on v6). Once i've done that, almost five days i'm waiting for response VRF route leaking via (i)BGP on ROS v7.xx.x is a complete CF and...

spippan

And they probably won't. cAP ac and hAP ac2 are in the same boat, too little memory (RAM) for the full featured drivers. They could ship some -smallbuffers version of drivers for these devices, but doubt that this will see any light. The cAP AC have 256MB and I think they are enough. there was a 25...

spippan

cisco gives a definitive result which mirrors the routers routing decision rather then MTs version of "hey i got these routes which MIGHT could be used to route your asked DST" a "show" cmd. to reflect the routers routing decision to the current FDB would be great. Unfortunately...

spippan

never use beta versions in routers that are used in real and important networks. use beta where you can reinstall with netinstall

somehow sad and pathetic this has to be told to people (or even those who refer to themselfes as network engineers)

spippan

cisco "show ip route x.x.x.x" is not equivalent to "ip route check". You can already do the same as ciscos show ip route with ip route print where x.x.x.x in dst-address neither is ip route print where x.x.x.x in dst-address an equivalent to cisco "show ip route x.x.x.x&quo...

spippan

For what is worth: after waiting and waiting, I gave up and searched for a different, low-power RJ45 transceiver. I bought one from fs.com (SFP-10G-T100, part number #154925, chipset Broadcom, and marked as Power: ≤1.8W) and that just worked when plugged into a CRS309. On the other end is a S+RJ10 ...

spippan

(already said a couple of time in the last months .. and sent support requests) Old v6 command " ip route check x.y.z.k" still missing! e.g. /ip route check 8.8.8.8 (linux equivalent "ip route get 8.8.8.8") It's very usefull when you have many routes in your routing table and yo...

spippan

Wifi menu is included in the bundle as described in changelog. All routers will have "WifiI" menu. You can not run router without system (a.k.a. bundle) package. "our" suggestion was that you move the WiFi menu and associated software into a separate package as well, so that it ...

spippan

Hello. Please, help with questions. Which package should I install on each device if only 5 GHz is needed? 2.4GHz I don't need. 1) Capsman : CCR2004-16G-2S+ (ARM 64bit) + cAP ac (ARM); 2) Without capsman standalone hAP ac lite (MIPSBE RB952Ui-5ac2nD).Or will Wi-Fi never work on hAP ac lite (MIPSBE ...

spippan

yep, it's in 7.13b1. I've got it up in the lab. pretty straight forward, although I'm having some issue with it forgetting disabled or removed routes. but it does bring routes up so that's step 1! Also, no BFD toggle, BFD is essential for ISIS. quick guess ... they are working on it right now.

spippan

impressive and useful console additions. thanks
also the little added option to ping right away from the DHCP leases menu is a welcome addition.

spippan

Noticed that on all of them I needed to reboot a second time to upgrade the routerboard firmware despite having "/system routerboard settings set auto-upgrade=yes" configured. That's expected and has been so ever since auto-upgrade is available. The reason is that .fwf files with new rout...

spippan

Hi! Below is a link to an alternative backup scenario:
https://forummikrotik.ru/viewtopic.php?p=84538#p84538
https://github.com/drpioneer/MikrotikBa ... backup.rsc

very impressive

spippan

Why would it require IPv4 or IPv6 addressing to function?

feeling confused

Unable to comprehend how to respond
[/quote]

guess it was meant as IS-IS does not need an ipv4/6 connection just to function (because of CLNP)

spippan

Winbox Feature Request In Container when using copy put the "tag" value into the "remote-image" field. so you can effectively duplicate the entry when required. allow to use a log prefix to easily identify which container is actually reporting the thing to the long +10 In Files ...

spippan

Work on ROS6. ROS7 DateTime does not work. hi oh thanks for the reminder - i corrected it yet but forgot to upload here: :log info "primulus_CONFBKB::dailyConfigBackupD START"; #fetch timestamp stuff :local dSysDateTime [/system clock get date] :local dDay [ :pick $dSysDateTime 8 10 ] :lo...

spippan

routeros works quite well with libreNMS (even with auto-discovery)

also take a look at OXiDiZED for automated config archive and versioning of those

EDIT: alternative would be Observium

spippan

how would you like to move phase1 settings to phase2 around or vice-versa?
No need for that. I would (like the other request) just want to specify an initial phase1 profile.

oh sorry, misunderstood
got it. indeed would be favourable

spippan

+1! It would be great to be able to select a profile other than default (but I see exchange mode is not part of the profile) It would be great when these settings would be moved into the profile, e.g. also "passive". how would you like to move phase1 settings to phase2 around or vice-versa?

spippan

I mean real "ZERO TOUCH". so not touching the device at all. Not even reconfigure the boot device. Is this possible to unbox a device, plug in and the device finds its config server automatically, i.e. the TR069 server. have not seen a solution without ever touching a router to achieve th...

spippan

NGINX proxy blah blah blah sounds like a bad kung fu movie. Its knowitallconfigsnobbery plain and simple. I assure you, there are a lot of real-life nginx ninjas out there, managing what must be millions of instances. This is not esoteric knowledge. You simply don't know how to do it yet. and exact...

spippan

New install 7.8??? 7.11.2 would be a new install.......

maybe the HARDWARE itself is meant as the "new install" and not the FIRMWARE -.-

spippan

overall on v7 BGP development/improvement is a bit stalled at MT

spippan

spippan

masquerade uses the first IP on the OUT interface if there are more than one ip on that OUT interface, masquerade uses the (i guess) lowest IP of that interface you need to explicitly src-nat with your desired IP for DST-NAT: if there are more than one IP on the IN interface you dst-nat on, you also...

spippan

little astray ... but you could even setup the nginx/apache rproxy in a container on your mikrotik ;=)

spippan

AFAIK one needs to at least set the devices to change the default boot device (which was "nand-if-fail-then-ethernet") to something other desired (e.g. "try-ethernet-once-then-nand") otherwise the router will start with the factory default config when powered on the first time ma...

spippan

Connection dies and is not accessible to the outside, after rebooting it works for some time. Mikrotik support can't help since +2 years, it's tcp connection. What to do? first, describe the setup, your desired connection, your firmware version, what you'd like to do and what you expect after all??

spippan

i tied that before but couldnt fiure out what was wrong. directory listing shows "forbidden". not helpful neither For stable release, you can see the "directory listing" https://mikrotik.com/download/archive If you want to download it directly using a version name from RouterOS,...

spippan

Yeah container's disk seem "fragile". There are a lot of corner cases just not covered that come up in the real world. Mainly if ROSE or USB is not mounted when the container try to start, it doesn't try again. If disk name changes due plugging in new things, also a problem. And changing ...

spippan

sorry, off-topic but ... an additional empty bridge "Lo0" for example would not violate that, right? (for loopback addressing) Loopback is fine, I have single bridge for physical ports/LACP/The works, and separate bridge with STP disabled for loopback. But in some cases, such as MPLS/VPLS...

spippan

maybe also useful to add a "bind to interface" for winbox operation or discovery

maybe something like this

wbox-bindIF-19-09-2023.png

spippan

I am tired of the crappy information provided. Is anybody here able to articulate some helpful cue? you know mikrotik has a wiki, help pages and a youtube channel where exactly NETINSTALL is mentioned. and also - routeros is not a "shiny clicky pointy" system - you need to have at least s...

spippan

You're violating the Linux DSA network stack by having multiple bridges. Multiple bridges is a concept that has been depreciated with the introduction of VLAN aware bridging, migrate to proper single bridge configuration. Your topology is improper if you can't do it with single bridges and VLAN awa...

spippan

Most network engineers understand the technology/theory and can navigate easily between different vendors' implementations to achieve the same results. If it takes you days to set up a VLAN, then most likely you are not well-versed with the technology you are trying to use. Just because on other ve...

spippan

wow for ~20 years of "experience" OP should learn SDN stuff and not individuall and cost-effective setups there is no, i repeat NO, vendor out where all is calm-and-charm to just setup - even meraki has some fairly downsides. same goes for cisco, juniper, palo alto, barracuda, checkpoint (...

spippan

yes this is a windows thing client reports its PTR back to the windows dhcp/dns server it can be manually invoked via CMD ipconfig /? Options: /? Display this help message /all Display full configuration information. /release Release the IPv4 address for the specified adapter. /release6 Release the ...

spippan

CSS swOS (lite) does not feature this function

https://help.mikrotik.com/docs/display/ ... ies+Manual

spippan

... and then there are (probably) thousands of us using RouterOS on dozens of devices from home applications to medium size enterprises and did not encounter any serious issue for years, so we are perfectly fine with calling it "stable" :) RouterOS has so many features, most of the interc...

spippan

The solution is simple: "stable" channel should be renamed to Beta (as it is actually beta, regardless of what mikrotik marketing team says). ... and then there are (probably) thousands of us using RouterOS on dozens of devices from home applications to medium size enterprises and did not...

spippan

Sometimes you need to pick several items from a list or enter several items and to apply them to an entry, or both. i.e; 1:many, many:1, many:many; e.g; We'd like to set the winbox service available on VRF red, green, and blue; /ip/service/set winbox vrf= ? I tried: /ip/service/set winbox vrf=R,G,B...

spippan

According to https://help.mikrotik.com/docs/display/ ... l+Overview, this feature is not available yet:

Some kind of mechanism to import/export routes from one vrf to another within same router

got lucky my 3 CCR1072 at work are still v6 "able"

spippan

Feature: ability to interact with Ansible, and script running capabilities e.g Python/Netmiko for network automation.

ansible can be integrated by today - (rest) api and ssh with pubkey-auth

spippan

Besides, under Linux, NetInstall 7.x is broken completely and I can only NetInstall using 6.x (I did that several times). maybe you should try to set every other interface "down" on your linux host ("(sudo)ip link set [IFNAME] down") except the one which netinstall should run on...

spippan

If you mean VPNv4, it is currently implemented. VPNv6 is still in the To Do list. cannot import/export routes from VRF to another VRF locally say: RD 111:123 import 111:123 export 111:123 import 222:456 RD 222:456 import 222:456 export 222:456 import 111:123 on 7.8 it kind of worked ... upward the ...

spippan

here the rOS v7.8 in contrast with the same configuration [admin@RRZ] > ip vrf export terse # sep/04/2023 18:28:37 by RouterOS 7.8 # software id = # /ip vrf add interfaces="e1.151(rz),Lo0" name=rz /ip vrf add interfaces="e1.1113(39390)" name=39390 /ip vrf add interfaces="e1....

spippan

was there any issues, i haven't noticed anything like that since ros 7.9+ till 7.12b3 BGP VPN (VRF import/export) does not work if anything of that helps... the routes are not getting propagated among the VRFs/routing tables [admin@RRZ] > ip vrf export terse # 2023-09-04 18:18:58 by RouterOS 7.12be...

spippan

Yes of course, it will be implemented.

do we have any upgrade on this?

spippan

apparently this still is the "at the moment way to go" in routeros v7

https://help.mikrotik.com/docs/pages/vi ... eId=328206
at least after version 7.8 where the import/export at least happens

spippan

Thank you, why would routes exchanged by BGP work and static ones not ? This is the minimum config for example: (this is not Mikrotik) .... That's all, this is way more simple than the RouterOS 6.x way. I do not know the "RouterOS 7.x" VRF implementation. still not working as far as i tes...

spippan

is VRF import/export from one VRF to anothet VRF on the same router finally working on rOS v7??

spippan

Thank you for encouraging response! There are several models used by ISP (Tet). Modem list can be found in this article: https://tet.lv/palidziba/lv/palidziba_majai/internets/majas-internets/problemas_un_risinajumi/32902 from which latest model used by ISP is Alcatel Lucent I-240W-A from what I can...

spippan

and do not forget to add 224.0.0.5 and 224.0.0.6 to your "allowed adresses"

spippan

I mean, that pesky routing process, it must be THE job, don't you think? Pretty ironic, all other bells&whistles worked. It takes years to gain reputation, and only days to lose it. ROSv7 can not be considered stable and suitable for production or remote areas. It is strictly SOHO now. A shame....

spippan

You had one job...

and that is one of the wrongest assumptions ever made considering software development and upgrade-paths

spippan

... Also, loosely related to the topic: taking ports into account in the PCC calculation may bite your back if your LAN clients access paranoid web sites (typically banking ones) - such sites often like to redirect the client's "application session" between multiple servers, but drop the ...

spippan

After upgrade from 7.11 to 7.11.1 many my devices can not get IP from DHCP. Tell me, please, what could be the reason? Downgrade to 7.11 was fix this problem. more details would be good. is the dhcp client a 7.11.1 client or is the dhcp server on 7.11.1? or both? what was the status on the DHCP ser...

spippan

Hello I try to run a script when a user login via Wireguard. Is that possible? This is what I have: /interface wireguard set wireguard1 on-up=WireGuardConnectScript and /system script add name=WireGuardConnectScript source={ :log info "Wireguard Login from $peername" } Thanks for helping ...

spippan

WG/ChaCha lack support för HW acceleration

which hardware has this in hw-offload?
until now i know of none

spippan

same thing for all my containers on my RB1100AHx4
after a reboot i always have to copy the container, re-insert the tag (..:latest, or whatever), remove the old one, let the new one extract and after that i am able to start up them again.

annoying

spippan

it appears to be that way:
https://help.mikrotik.com/docs/display/ ... d-Advanced
yes, but it does not matter for BTH. That is for Cloud DNS feature, unrelated to this topic. BTH does not care if you have public or private IP.

thanks for the clarification

spippan

I've seen this on MikroTik, but what about other vendors?

Plain Debian, or whatever or any big vendor. Do they proactively kill user session upon deletion immediately?

don't know if upon deletion but you have the option to kill a session proactively
something which is not possible at all on rOS

spippan

if you need reliable MLAG hardware go for cisco, extreme or if you need to be on budget ... fs.com

speaking of fs...
MLAG featuring switches:
N5860-48SC (mlag or stack)
S5860-48SC (stack)
S5850-48S6Q (mlag)

routing ... mikrotik
switching ... cisco, fs, aruba, extreme

spippan

use-local-address is not for Back to Home. It is for Cloud DNS.
So what will happen if I enable use-local-address ? The Cloud DNS will be set to my local public ipv4 address?

it appears to be that way:
https://help.mikrotik.com/docs/display/ ... d-Advanced

spippan

do you see ARP records when the sniffer is not running?
maybe there is a problem with ARP learning or ageing on the bridge and/or vlan interfaces

spippan

*) wireguard - added "wg-add-client" configuration wizard (CLI only);
*) wireguard - added "wg-export" and "wg-import" functionality (CLI only);

Thank you very much.

yes. that is a welcome addition - hopefully this will come to winbox (and maybe webgui) too

spippan

if they would let out a piece of demo/test software or make statements about it, the forum would again explode with complaints and roars of critic (with which most of the time no one can improve anything; often plain nagging) this might unnecessarily open another front for mikrotik staff to look int...

spippan

No IS-IS, no 6VPE. The wait continues...
A protocol from 1992. Why not change to OSPF

maybe because is-is performes a bit better
[ https://ipwithease.com/ospf-vs-isis/ ]

2023-08-25 02_26_23-OSPF vs ISIS _ Detailed Comparison - IP With Ease — Mozilla Firefox.png

spippan

Stable 7.8 IKEv2 users vpn work 1 day, after traffic on ipsec rules. reboot router and work again... fucking stable... You are apparently one of those that is confused about the label "stable" in a RouterOS release name. Lots of people think that the "stable" versions are the on...

spippan

Hi, Im just wondering why is this topic still open...it has been 2 years since first information about MDC and nothing till now. Not even alpha, beta etc. Everyone is writing their wisches here but realisticly there may not been any device controller from Mikrotik. If you chech competition... MT is...

spippan

Another feature request: when enabling a "filter" in winbox, after adding one or more filter rules, then disabling the filter, please remember the filter rules so that when filter is enabled again the last-used rules re-appear, and not a blank new filter. Also when changing the filter top...

spippan

Re: RB3011 - still a good choice?
: No.

depends.
what are the requirements of the desired setup...

spippan

I believe that the LCD screen is not supported on RouterOS 7. So, forget that the screen.

LCD supported on v7 (at least up to 7.10.2)

spippan

in general as of the time of writing ... if you do NOT need any feature from v7 but rely on BGP ... stay with v6 ! a pity you could not upgrade to the new CCR devices and other ARM(64) routerboards this way. ..., except that "refresh" does not work between versions, you need to disconnect/...

spippan

Well, there probably was an important customer/prospect who insists on having IS-IS. In general I do not like that MikroTIk embarks on so many new projects, while leaving existing ones unfinished. I would say: first make sure all those red and yellow squares in the routing status page are removed, ...

spippan

Play with the tools you have.
Reboot.
Done.

is this some kind of useless trolling?

a PROD router is not always elegible for "just a quick reboot"
imagine a BGP router has this issue and needs a reboot ...

spippan

as @pontus said: "This seems like a basic feature which is available on other platforms."

+1 for this feature

+1 too

default behaviour in cisco and fs

spippan

Mikrotik, please finally add the option to forcefully kill a logged in user session especially if a privileged user (user in group "full", for example) is logged in and kicks a "lower privileged" user or a user which DOES NOT EXIST any longer! this behaviour is very concerning ->...

spippan

Reboot. Problem solved. no, not at all ! rOS needs a "kill session" since FOREVER! even it would be on CLI only ... but not even that is available and it drives me crazy. in winbox there also should be a button to kill sessions - especially if i am the user with "full" privilege...

spippan

What seemed to fix the VPLS was connecting to wifiwave station and disabling/enabling the vpls interface. No other changes. I am wondering why the interface did not reconnect once the link recovered and connectivity was restablished. had that issue on VPLS links also in the past when the underlying...

spippan

backups (.rsc + binary) are vital and essential
ESPECIALLY when upgrading beta and rc versions - frankly, always when updating IMHO

spippan

As far as I have looked at and understood the relevant instructions, I apply it as follows, but I did not get a solution, where am I going wrong? /routing filter rule add chain=bgp3 disabled=no rule=\ "if (dst in 192.168.0.0/26 && dst-len in 24-32) {accept}" add chain=bgp3 disable...

spippan

We are very sorry if you felt offended in some way. i saw that all old beta forum topics are erased i reported few time when v7.10 betaX started to show, that WG with IPv6 and non /64 suffix have a problem in 7.11beta topic there was also another user with same observation, and i clearly remember t...

spippan

how does the problem described relate to the topic header "Change stable to long term" ??

spippan

This issue has been resolved. :D :D As is sometimes the case, the apparent problem wasn't really the issue. I'll be brief, but I hope this can help somebody else in the future. The design requires that sites 1-3 from the original diagram are able to access the public internet without first going th...

spippan

hello, ospf neighbor discovery using multicast address 224.0.0.0 - you should allow that address to flow inside the wg tunnels. or... you can specify ospf interface as ptp with unicast static neighbors. so... there are a lot of subnets to pass the wg tunnels : ospf itself and the rest of the networ...

spippan

https://help.mikrotik.com/docs/display/ ... l+Overview

it is happening

IS-IS-routing.png

spippan

Tools, Check for updates.
Error: Upgrade file was corrupted.

it is literally the first thing the "important note" section states.

spippan

Can they just put the source code online for us to just compile it! They are not selling this. They are selling the device and the router. So management software is not part of their product.! yes it is. take checkpoint or barracuda for example ... similar case. oh and making THIS a priority seems ...

spippan

firstly, consider a good read on that one
https://help.mikrotik.com/docs/display/ ... nd+Filters

spippan

@spippan

try viewtopic.php?p=1015720#p1015720

if i had not pressed SAVE it also would not work in the webGUI.
did that.
but thanks for the hint

spippan

Thanks! I did not know that. ur welcome Try to hide the MPLS menu. It has several sub-menus. When (in Webfig) MPLS is removed (and even when all sub-menus are removed), in Webfig the MPLS item is completely gone, but in winbox it remains visible but when clicked it shows an "empty" (small...

spippan

Connect your Mikrotik device to ONT. VLAN ID 2. setup PPPoE with your A1 Internet username and password. see https://www.a1community.net/internet-fuer-zu-hause-449/modem-only-bei-ftth-257350 can confirm. just switched over to directly connect my 1100AHx4 to the ONT via ether12 added vlan 2 to ether...

spippan

Thank you everybody for the replies! I'll definitely try to replace the isp modem, not the converter and let you know how it goes (I'm on vacation). Those providers make it really difficult to change hardware, they don't want you going dark on them 🙂. hi. also from austria also A1 customer you migh...

spippan

- better recognizable "active" state of the Safe Mode button (make it yellow or red when active, not just a different shade of grey) +1 - allow to "lower" a window in the windows list (e.g. via right-click), in addition to the current possibility of "rising" a window y...

spippan

I am mostly inside. Usually I don't even switch on the lights in the office because I can't stand the light. And yet I don't want dark theme. Working with computers since 1980. I started on monochrome CRT screens so I know what it is like to have black background. Still don't like it. same with the...

spippan

Those who want the black theme don't really work , they just want it as a whim " because others do it "... Try to work under the sun with a fuck–g black theme that doesn't let you see correctly what is present on the screen.... "don't really work" ... how come you conclude that?...

spippan

After a while, it seems that Wifi is not stable on hAP AX3 on 7.10.2 ! Constant internet drops, or poor wifi quality. On my Old hAP AC2 wifi is muc much stable and better then this on hAP AX3. do have "detect internet" active? if so ... disable anything regarding it and reboot the device ...

spippan

Well, of course for "just access points" it is much easier to do than for generic devices like MikroTik. I use UBNT access points, but their controller configures similar things as CAPsMAN. The generic solution for a network of routers is much more complicated. E.g. I would like to see a ...

spippan

The "Input accept NLRI" filtering in BGP would be more usable when there is an extra "accept default route" option. As it is now, you can accept prefixes in certain subnets (as present in the address-list parameter of "Input accept NLRI"), but once you want to accept t...

spippan

[FEATURE REQUEST] - Firewall History Log could it be possible to implement a firewall connections log (a seperate TAB for example directly in the ip>firewall window/section)? with maybe some settings like "max-conn-count", "max-lines" and/or "max-history-timeframe" (whi...

spippan

it might be a problem you addressing the VPN clients within the same subnet as the LAN clients

EDIT: the routing engine in ros v7 is different from v6, so that might impact that config

spippan

Now you can upgrade to 7.11 beta4 there is fix for the WiFi issue

do you mean:

*) wifiwave2 - fixed interface hangs on IPQ6010-based boards (introduced in v7.9);

spippan

...for how long?
The posts already present "speak" for themselves.

good

spippan

Is anyone here interested in volunteering to approve and disapprove new member posts? Let me know, and let's fight the AI/LLM spam together
This time I'll just stop being an asshole, so I don't give any more problems.

...for how long?

spippan

After upgrade from 6.48.6 to 7.10 default timers bfd isn't correct 6.48.6 /routing bfd interface set [ find default=yes ] disabled=no interface=all interval=0.2s min-rx=0.2s \ multiplier=5 7.10 /routing bfd configuration add disabled=no interfaces=all min-rx=200us min-tx=200us multiplier=5 what is ...

spippan

For now, all BGPs uptime for 19:10:13 without interruption....
Still all up and working without problems. (2d 16:54:56)

BFD activated or BFD not in use at the moment?

spippan

I never understand why people want free professional consultancy work or even vendor consultancy work on forums.

as by a lot of recent posts here. i do not get it either

spippan

Please revert to the old WebFig Style or at least give the user the choice. - The new one is confusing - Everything needs more clicks. - Traffic stats now have the size of a stamp - There is no (really, 0) advantage - The width of columns is not saved which is annoying. I'm using it on a 24" s...

spippan

You can read here for more details, but I'm sure you can find more design info in the public web, Facebook isn't the only one doing this design, ISP/Telcos who are up-to speed do as well: https://www.rfc-editor.org/rfc/rfc7938.html Preferably OSPF should be replaced with ISIS, but that's not suppor...

spippan

OSPF+BFD. BGP+BFD. This is a MikroTik problem that's likely resolved in 7.10 stable upcoming. The OSPF+BGP design is used by Facebook as well in their large-scale deployments. It's not a new design approach. hopefully yes. then this design surely should work fine. oh do they, didn't know about that...

spippan

Use OSPF for underlay to learn loopbacks of all adjacent neighbours. Use iBGP to full-mesh with all loopbacks.

would this not just rank up convergence timers and overhead?

sure sounds like a quite good plan but timing, i guess may be problematic here

spippan

got very instable BFD sessions with min-rx/-tx below 50ms and a multiplier less than 3 in combination Sorry, but who does/needs that?!?! This is absolutely not a "usual" setup. When I turn my room light on and off so quickly, I don't need to be surprised when it pops... there are people h...

spippan

got very instable BFD sessions with min-rx/-tx below 50ms and a multiplier less than 3 in combination

spippan

wow ... it really is happening.
awesome

2023-05-28 15_32_10-.png

spippan

blog = new help docs? No, blog = https://blog.mikrotik.com/ But nothing has been posted there for nearly two years... thanks. totally forgot about that one anyway, hoping there will be a fix out soon for those not using ipv6 the temp. fix/workaround should mitigate the problem a bit at least.

spippan

Blog entry following soon
Blog? I did not know it still existed...

blog = new help docs?

spippan

both

spippan

also, do not forget to backup your v6 config

spippan

Ok thank you guys for the clarifications.. Now i have another router. A hAP AC2 with up to date 6.49.7 OS/Firmware. I downloaded the available upgrade here in the product page: https://mikrotik.com/product/hap_ac2#fndtn-downloads So i got the file: routeros-arm-7.9.npk I uploaded the file to the mi...

spippan

what is the desired goal here?

already looked up here?
https://help.mikrotik.com/docs/

spippan

In today's world, there is no place for such a shitty design, looking like a 90ties Unix clone. Just look at Ubi Unifi interface - that's how modern interface should look like. you really cannot compare unifi (home and small business grade) with the flexibility and function richness of routerOS tha...

spippan

running on 7.9 stable now hap ac² hap ac rb1100ahx4 all good so far. 2 container (kuma uptime, adguard) running well BGP sessions over wireguard peers also running fine. noticed bgp stability improvement when refreshing route informations. thanks for the effort to MT now ... back to waiting on BFD ;...

spippan

No thanks, it bears no resemblance to the oPs question so not interested. He has four separate MT routers each with public internet, no need to add a single point of failure xtra pppoe router............??/ pppoe router is just a substitute for the isp/www for the lab. every of those 4 router is co...

spippan

No capiches sipan. Are you saying that all four routers are connected to the same PPPOE router, and dont have their own publicly accessible IP. I do not understand your diagram in the least........ it's "spippan" the "pppoe router" simulates an ISP or "the www" i attac...

spippan

Can I disable connection tracking feature if I use it for per-connection classifier with nat load-balancing? I thought I can not. Also I have thousands of connections in my real user traffic and the last screen is for real traffic, not any perfomance tests like btest or iperf. if you mean fast-trac...

spippan

Hi, I have similar setup. Could enyone help me how to setup OSFP between those location connected thorough wireguard? Thank you some basic questions: 1. are you understanding OSPF and how it works? 2. how are you planing to troubleshoot and maintain it? 3. without any further information on your se...

spippan

just if someone might want to take a look less interfaces and sleeker configuration (on the wireguard side at least) made a EVE-NG setup which works with EACH router of those 4 only having ONE wireguard interface and peers with each other NO routing (not static nor dynamic) NO firewalling just basic...

spippan

... would have been better to just use FRR instead ...

it would be just awesome if there would be native support for FRR in MT (like a npk package like the "rose" npk for example!) --- speaking of, is there a topic covering that route?

spippan

Kudos to the MikroTik team for keeping their cool given the tone by a few customers. Given that we're dealing with humans on either side of the keyboards I don't think they deserve the abuse they are receiving here, regardless of what their employers' strategy, roadmap and quality of delivery may b...

spippan

Nope not aware, as I said I have no experience with OSPF. that has nothing to do with ospf it is the vpn peering among the 4 routers every router has 1 WG IF and 3 wg-peers all interfaces in a common /29 address space, which is also included in "allowed addresses" for the wireguard config...

spippan

you know that only 1 wg IF is needed on each router and the rest is peer configuration, right?

after that OSPF or BGP if wanted/needed for route exchange

spippan

would interconnect those 4 sites with WIREGUARD and setup a OSPF instance for dynamic routing
so every router has 1 wg-interface and 3 peers and via those wg-interface you could setup OSPF (optionally; otherwise static routing)

MT_VPN_195487_18-04-2023.png

spippan

Unfortunately they are not allowed.
Otherwise, they will lose the North American market.

pardon?

spippan

for Method 2:

before you add the routing mark, first mark the connection

then add routing mark only to those marked connections
did a similar configuration for a company about a month ago

spippan

Thanks alot guys for the recomendations and guidance. Will upgrade the hex and keep the lites on v6.

for the time being ... if you do not need a certain function only available in v7, there is no big deal staying with v6 atm.
v7 still has some weird quirks sometimes. keep that in mind ;)

spippan

for the switch v6->v7 you need to choose the "upgrade" channel on "check for updates" window Thanks alot. Is there any chance that upgrading to v7.8 will slow down any of those devices? hEX (S) should be fine. keep in mind, most of the time it is depending on your setup but as l...

spippan

Hi. My rb750gr3 and 2x hap lite haven’t got the update yet. They are all currently at 6.49.7 stable (firmware too). Do i need to wait for the update to come up? I saw other people using v7.x on rb750gr3, could region be the reason? Im in Europe/Cyprus. for the switch v6->v7 you need to choose the &...

spippan

On RouterOS 7.9rc2 file get-custom-defconf

thanks! gotta look into the package later tonight

spippan

I am going to install OpenWRT on these boxes and will post screenshots on the forum to show the comparison and usability of both.

@pnwise
did you manage to get a comparison with OpenWRT?

spippan

What is MikroTik RouterBOARD L009???

where did you get that from?

spippan

What exactly do you think I'm doing?? I've set up a lab! I'm getting familiar with Mikrotik. I'm getting familiar with routing, firewalling, and VLANs... before as you say, "playing WISP".. whatever the [insert something here] that means?? I swear.. open mouth, insert foot kind of guy I s...

spippan

Outstanding! Thank you for this kind replay so that I can 'digest'. -Richard not much to digest here - these are the def.conf FW rules on a RB CCR/CRS are shipped with no default config! PLEASE, for [insert something here] sake - get familiar and get GOOD with mikrotik, routing and firewalling befo...

spippan

On a serious note, I will endeavour to learn a bit about them before asking my usual 20 questions that will drive you bonkers....... Eh don't lower yourself by pandering to anyone's badgering. Given the total lack of documentation we don't know why IGMP proxy is working for some or what it's doing ...

spippan

just had to bring it up here xD

MTapr1stBFD.png

spippan

I don't know if this will help with RB1100, ....

can confirm - running a RB1100AHx4 (v7.8) with vlan-filtering enabled on a single bridge which contains all ports 2-10 is hw-offloaded
no IGMP or DHCP snooping enabled

spippan

I'll get my documentation together and post a new thread so its easily findable.

looking forward to see

spippan

May I ask, if anybody is using BGP route reflector and route reflector client roles. I have problems distributing l2vpn and vpnv4 routes. It looks like with normal (no role) iBGP these kind of routes are distributed, once switched to rr and rr client, they are gone. Are any special filters that sho...

spippan

BGP routes recursively resolved on ECMP routes will also be ECMP, see here:
https://wiki.mikrotik.com/wiki/Manual:B ... interfaces

Feature where BGP creates multipath routes (BGP multipath) is not implemented at the moment.

also working in v7 ?

spippan

And what is this?
viewtopic.php?t=174354#p992598

good advice

spippan

Will you stop offending forum users?

maybe "metti ordine in casa tua" might be suitable here...

seen your post where you also uncomprehendingly behave alike sometimes, so ... could you maybe stick to the topic? for the sake of users which might want/"need" mDNS aid
thanks

spippan

What is this? "(then also added the LAN subnet + 192.168.1.0/24)"

he wanted to mark it ITALIC inside a

code

section which does not work in this forum

see:

code block text with [i]italic fomating [/i]inside

spippan

Is it any perfomance tests for CHR working on vmware? I am trying to get 10gbps with simple routing + nat load balancing (per connection classifier feature) and I cannot get more than 5gbps. I use 8 core CHR ver 7.6-7.8 with vmxnet3 network cards at esxi 7. I don't see cpu bottleneck (no CHR cores ...

spippan

Impressive amount of work done here, regardless if what anyone specifically wanted didnt get done. The paperwork alone is not trivial, just imagine the testing and integration involved. Kudos to the dev team and test team. 100% true. good someone pointed it out. regardless the BFD topic, people get...

spippan

even the edgerouter has a mdns repeater..
Ever home user needs mDNS. Don't know why mikrotik keeps ignoring this.

why would someone need to have that? worse, why even relay such network noise?

spippan

As diagram shows there are 3 switch chips. I can't recall the specific hardware offloading rules, but it best to keep VLANs from crossing the switch chips - so more like 3 "special" groups. hw-offloading is disabled on bonds, IGMP/DHCP snooping activated. vlan(s) crossing chips is not a b...

spippan

running a hAP ac², hAP and a RB1100AHx4D on 7.8 without any issues or reboots. even running wireguard and BGP sessions with no problems on it. 4 VLANs and the rb1100 does the inter-vlan routing with remarkable speeds please, as far as possible/feasable, do a FRESH netinstall to problematic devices. ...

spippan

maybe (i am not sure right now) but maybe the encryption algorithm negotiated between the 2 routers is not hardware accelerated and has to be processed by the cpu please consult that table for your setup if your configuration has hw-acceleration possibilities https://help.mikrotik.com/docs/display/R...

spippan

...give RouterOS 7 proper configuration transactions... +100 for that would be a killer upgrade (checkpoint, VyOS, barracuda,.... all those vendors have something alike for years now) Pretty much all of the network vendors (except JunOS frankly) have one or more of these exact problems and it is ce...

spippan

note, if you are using the same subnets on both sites you'll need to do NAT between the two sites

spippan

please do not use the BT tool on these 2 routers if they are en-/decrypting ipsec

setup 2 clients on both ends (pc behind RB1100 and another one behind 3011) and run a iperf3 test between the 2 ENDPOINTS not BT tool between the routers!

S: iperf3 -s
C iperf3 -P8 -b0 -c [IP of "S"]

spippan

Hmm, I wonder if this video is about the devices controller:
https://www.youtube.com/watch?v=kKnYhWnch0Q

might be CAP AX (XL)

spippan

You can set up a samba server by using a container... I wish MT do the samba server Hikvision compatible. MT claims that Hikvision is using some strange settings but with others NAS the Hikvision cameras are working. Which conteiner do you mean? Do you have already any in use? maybe checkout this o...

spippan

When you say service - is there any chance you are referring to a circuit ? Asking for the sake of clarity. Yeah a circuit, I wrote it as a "service" in terms that we give them the "service" of connecting them to the internet. But in the case of our ISP they call it a circuit. I...

spippan

Hi, Im just wondering why introducing 7.9 take too much time? :) Isnit gonna be revolutionary build? :) What you wish for? I would like to see: seamless roaming including 800.11v, compatible samba with Hikvision cameras, thats all :) what do you even mean by "too much time"? 7.8 [stable] ...

spippan

Is there any ETA for a new version that fixes all these OVPN problems? I depend a lot on them and, right now, it's unusable, the routers are constantly overloaded and rebooting. I think this is a really important bug that should have been addressed right away... downgrade to a firmware where it wor...

spippan

OVPN stability is horrible for me as well...
Wireguard has been rock solid so far for me on Mikrotik - Would suggest to give it a try!

would not consider it rock solid but WAY BETTER than OVPN implementation
(and more lightweight and faster to configure)

spippan

No need, working on it, almost there......... https://forum.mikrotik.com/viewtopic.php?t=194310#p989515 That was effort #3 ( vxlan over wireguard ) effort #2 is through DHCP options effort #1 is via WG and EOIP ( not yet done as have to deal with where internet comes from on spanned subnets) All th...

spippan

Do you have a vxlan over wireguard example. Im confused as to the local address I assumed these would be addresses anchored to a local wireguard address at each end just not sure if the VTEP setting applies only to an external vxlan aware device and not used when the MT is the VXlan smart device? y...

spippan

- in v6 the "bgp networks" have a "synchronize" option. without that, the prefix will be announced even when the route is not present. v7 no longer has this option, it will advertise ONLY prefixes that actually exist in the routing table. so any "bgp networks" in v6 th...

spippan

No, from the Netherlands. You can see my username, right?

okay. no cannot see any signatures (also i cannot change mine as i noticed last week)
did not know about hamnet until today. great work. currently reading the documentation about it. cheers

spippan

...Release the d*mn thing so that we can have link failure detection again!

...or at least help them TEST that thing and provide feedback for that!

(OT: r u an hamnet admin from germany?)

spippan

and "...Just install version 6 and wait..." is not suitable for recent devices. i do not know if you knew, but also some v6/v7 devices are not able to run v6 if they are shipped and FACTORY INSTALLED with v7! (i got 3 CCR2004-1G-12S+2XS which i cannot operate with v6 because of that very ...

spippan

So it seems I was wrong. On latest firmware RB4011 starts randomly, sometimes it boots normally, sometimes it hangs. I bought serial cable ... just to see what is happening during boot. (if you are lucky... RB4011 in netinstall shows "READY" and clicking install just shows "Sending o...

spippan

There is not much to discuss w.r.t. the topic. v7 has no BFD, we all know that. It is claimed to be "a work in progress" for over 1.5 year now, but nothing is happening. What we discuss here (and in other topics) apparently has no influence at all, it keeps getting delayed. what recently ...

spippan

All junk, your nick and your picture does not say Jones, only you are obsessed with adding it at the bottom, otherwise people would not even know.

what does it bother you?
does it hurt someone?

way less offensive than many of your posts anyways. just leave it be, fgs

spippan

@actck you have 2 posts and you are such clever....I do welcome new feature, I have only few devices feom MT but I laready use QOS CAKE, ZEROTIER,WIREGUARD almost all new features introduced in v7. And it is pretty stable on my setup. I do understand it is problem for big ISP that some features are...

spippan

I do need a rock solid reliable OS that runs PPPoE (client and server) and doesn't break SFP modules that previously worked. Routing protocols matter (it's a router!), firewall matters, and tunnels matter. Beyond that I'd be thrilled if everything else was added through separate packages like in th...

spippan

BGP does not reliably append bgp-communities on advertised/exported prefixes! if the bgp session re-initiates /-establishes the route filter community-set has to be disabled and re-enabled again to see bgp-communities appear on peering partner the advertising / exporting PEER: 2023-02-22_MT_7.8rc_bg...

spippan

Hi Everyone, I'm trying to learn MPLS. Let's say we have a topology like this Zrzut ekranu_20221203_230043.png this are the configs of PE routers I was under the impression that I need a full VPLS mesh, but it works even when connection betwen PE1-PE3 is broken. What is going on there. How to DEBUG...

spippan

have a look into the help docs

https://help.mikrotik.com/docs/display/ ... lterSyntax

https://help.mikrotik.com/docs/display/ ... eSelection

spippan

please consider the tests for that being done with 2 clients on each end and NOT with bandwidth test inside the 2 MACsec peers MACsec is VERY cpu intense in relation to normal forwarding and as long as there are no hw-offload options enabled in rOS7 with supported (marvell) switch chips, this will a...

spippan

Where are the additional CRS5xx models?

might be around in summer

spippan

I guess your definition of pins is different than mine. What I see on the RB760iGS circuit board are pads for machine testing with pogo pin probes. These could have wires soldered to them, but there aren't any pins like exist on the Raspberry Pi for GPIO, and that's what I was referring to on the E...

spippan

I'm interested in this, is there a thread where you posted about how you did this? I have an ER-X that I have a Raspberry Pi "debug/console" cable 3.3V TTL connected all the time. It is really useful. The ER-X has header pins soldered in, the hEX S doesn't (that's not an issue, but I thou...

spippan

1.) central FW management (maybe also for groups) 2.) central VRRP and VLAN management (creation of VRRP interfaces and managing VLANs) 3.) update management 4.) export/backup 5.) logging (additionally to rsyslog or an integrated rsyslog service in central mgmt to evaluate and search logs centrally)...

spippan

please check
SUP-107205: dns-static CNAME not working.

works here ...

command on shell is "dig orfcname.at" after setting the entry

statCnameRB1100v7.8b3.png

spippan

excuse the maybe stupid question, but where do you evaluate the routes being "in the ASIC" or how to verify routes being L3HW offloaded? I can't tell from the GUI or CLI, but I can tell when trying to trace a route from one device/router to another through the L3HW offloaded router. I can...

spippan

I am ok with that. Just more worried that 7.7 would be the last update for them.

it won't. why would it?

spippan

L3HW offload is still buggy on 7.7. (Saw this in 7.5 and 7.6 too.) This weekend I upgraded some CCR2116's that have been running 7.4.1 for months with solid L3HW offload (nearly 100 OSPF routes, thousands of BGP routes), and this morning woke up to some of the local routes missing from the ASIC des...

spippan

just stumbled upon this - but does anybody know what's going on on a RB1100AHx4 DE to not recognize its own hardware?

it has 3 UNKNOWN DEVICES on its PCI bus.

sysResPCI_v7.7 _RB1100AHx4DudeE.png

spippan

What's new in 7.8beta3 (2023-Feb-01 16:10):

Important note!!!

Version is not recommended on CRS3xx devices.

can someone please further describe what are the impacts those releases are not recommended on CRS3xx devices?

spippan

the router is located in a one-room apartment. are you kidding me? the password is correct since this situation is treated by reconnecting to the wifi network. What now?

no kidding ... error message could point to those 2 possible factors

spippan

Sorry MT, but I have still a problem with L3HW-offloading with IPv6 in this release. After activating on a CRS326-24G-2S+ the switch reboots spontanious without any obvious reason. After the reboot the LOG shows: hc_401.jpg I opened a ticket with this problem also with 7.6Beta (SUP-92398), and it s...

spippan

With v7.6 5Ghz speed ~800Mbs, with v7.7 speed ~400Mbs using Iphone 12 pro max
Where is your config and what hardware are your running on..

hAP ax3

spippan

If you are grouping the different VRRP interfaces together (using group-master command), you only need to set the sync on the Backup Router's group master interface. Else, I believe that you have to do on all the backup router's VRRP interfaces (Not tested on my side). thank you, i will have a look...

spippan

You are mixing up L7 firewalls and IDPS (intrusion detection and prevention systems) with routers. And the way you throw around acronyms, it's hard to tell if you even know the difference. All types of application awareness are becoming increasingly difficult to achieve these days due to web-based ...

spippan

MT will never play any role in any SDWAN unless the boxes can understand & detect (many) application and steer accordingly.

despite being OT but SDWAN does not have anything to do with application detection.
on the other hand, maybe this is just a misunderstanding as your wrote it

Search found 399 matches