MikroTik

spippan

had the same issue on winbox
switching over to create peers via CLI (SSH or terminal window in winbox) solved this for me

spippan

I prefer my approach.
Not that much words.

and also can be quite dangerous if your STP goes nuts then ...

spippan

Just checking in... MDC still "cancelled" with no whisper of any viable replacement/work for Dude either (since it hasn't been touched since 6.42 and Mikrotik decided to actively not migrate the wiki content for it to the new help site)? I'm so heavily invested in Mikrotik, but I feel lik...

spippan

Start with a rough alignment by eye Log into both radios, open terminal and manually set tx-sector=36 in order to disable beamforming. And if the range is >400m the use 64800 for the frequency. And you'll want the solidmount Then type in 'align 0' to enter alignment mode and give a real-time readou...

spippan

How do i delete loop back interface? i am not interested in

it was, is and always will be there
now MT is just exposing it to use it.

what is all the struggle with a Lo available? don't get it.

spippan

absolutely viable have 2 4011 in that configuration and it works quite well. those 2 4011 are installed temporarily to insert a "tap point" for a POC setup for a palo alto IDS/IPS solution. working transparently and at wirespeed so far so 5009 surely will handle the load just create a brid...

spippan

Hi, you mean that you can now ping local gateway between leaked VRF imported via MBGP ? I'm not able to get this working, could you please send your working config ? Thanks ! no i meant reachability between clients in different VRFs e.g. "ClientA" in VFR "RED" can reach "Cl...

spippan

+1 HA clustering with configuration preferably on the main node and config sync (like CARP from opnsense)

spippan

... I've seen a lot worse coming from other persons and I've worked with A LOT of nationalities during my career. ... haha exactly. ever dealt with Cisco TAC? most of the time you get connected to someone in india or bosnia ... good luck with that. had my fair share with them and now really like to...

spippan

jaclaz, Thank you for your reply! It is an older Win 10 laptop, and the first thing I did was turn off the its built-in WiFi; I will check the firewall and try again. Should these cubes have worked straightaway? One of the reasons I chose the preprogrammed units was so I wouldn't have to tackle a n...

spippan

...and obviously written without the required English skills. OT but stating that and than write "peopleS" more than once ... quite a shot to the knee i might add ;) PS: MT started as a wireless and routing software company and are fairly young in switching-business. one of the hardest ce...

spippan

tried resetting the switch to default and then update?

spippan

I tried to upgrade a CSS106-5G-1S withou succes .... the webinterface says upgrade availiable. I enter upgrade, it says wait and than "ERROR: Upgrade failed" webinterface is unreachable, all traffic seems to be working. powercycling brings the device back the device in its original state ...

spippan

ever took a look into mikrotik mesh functinality? (i am not talking about any of AC/AX roaming extensions)

mesh.png

spippan

EDIT : i just gave you alternatives RIGHT above your post if you are on a budget ... fs.com S5850 or N5860. i would recommend the N definitely heavier on the price tag than mikrotik but quite solid switches but they work quite well. Those switches are 7x more expensive than the MikroTiks :shock: ye...

spippan

Easy. Don't use mikrotik! What else then? EDIT : i just gave you alternatives RIGHT above your post if you are on a budget ... fs.com S5850 or N5860. i would recommend the N definitely heavier on the price tag than mikrotik but quite solid switches if budget is no concern you could go with juniper ...

spippan

first and foremost tcp has more overhead and is "connection oriented" here are 2 good basic comparisons to understand TCP and UDP a bit more. https://www.spiceworks.com/tech/networking/articles/tcp-vs-udp/ https://www.mathworks.com/help/instrument/tcpip-and-udp-comparison.html IP traffic y...

spippan

RB1100dx4de reboots after few seconds, no supout.rif created, no time needed to do this.
Same router, all working ok for me, no issue.

have the same one - will have a look how mine behaves this or next week

spippan

@spippan There must have been a change in 7.14beta10 maybe the following line? *) route - fixed gateways of locally imported vpnv4 routes; I can now ping endpoints between different VRFs using the route import/export. I can't ping another VRFs gateway address but I can ping hosts on other VRFs it i...

spippan

@spippan

Let me understate, the issue that you are expiring, is that you are not able to learn the route between different VRFs

that was the problem at first yes. which now works as far as VRFs get to learn imported routes (via RD)

have a look at post #28
(EDIT: added link to post#28)

spippan

have two online with a S2S wireguard VPN to my RB1100AHx4
no problems regarding support for WG

(keep in mind to not expect big performance numbers there

)

spippan

I don't know about that. I'd think some mDNS support be more useful, than a print server, in 2024? Indeed! This is just a general "VPN setup in the wrong way" issue. Put your VPN range in a different IP range and it all works fine. Maybe the "automatic discovery of the printer" ...

spippan

What's new in 7.14beta10 (2024-Feb-06 15:47): !) rose-storage - moved SMB service in the RouterOS bundle; !) smb - removed legacy SMB service (replaced with newer and faster ROSE SMB service); *) arp - added ARP status; *) console - improved stability when using autocomplete with "export"...

spippan

For 2x the price I would be happy. I bought a 4011 for 2x the price of a L009 but I get an orphaned device. And it is still being sold today! 300 euro for a 5011 with specs as I hinted would be a good deal. i would also be fine with such a device. currently running a 1100AHx4 DE so a smaller device...

spippan

Actually, not that many. There is no real product "for the higher-end home user" with 8+ switch ports and modern WiFi. The 4011 is not well supported, the 5009 has no WiFi, the hAP ax3 has too few switchports. I think you should make a successor to the 4011 (the 5011?) that has fully supp...

spippan

Please make dynamic vlan assignment possible for wifi-qcom-ac wireless driver

do you mean via RADIUS?

spippan

got me a CSS610-8G-2S+ and was disappointed at first because the SwOS it came with was ... yeah BAD mildly said BUT ... then there came an update 2.17 (built at Wed Aug 16 2023 08:57:30 GMT+0200 (Central European Summer Time)) and now this switch is really in use and runs without any major flaws or ...

spippan

imagine a world/dimension where there is routeros feature richness and customizability and a GUI like from that "UB.." company

spippan

i am looking for a free collector which will get fed by mikrotik routers and should forward to "ntopng" will have a look into ipfixcol2 I have used https://github.com/synfinatic/netflow2ng as a free alternative to nProbe to feed to ntopng with great success. that is great news to hear. ne...

spippan

If you don't care about details but just traffic, observium!

has Observium a collector in it?

i am looking for a free collector which will get fed by mikrotik routers and should forward to "ntopng"
will have a look into ipfixcol2

spippan

i reckon OP might need some help to configure INTER-VLAN ROUTING on his switch maybe i do not know if a CSS could do that. on a CRS326 it is absolutely possible and i also installed a setup at a friends home with his CRS326 but it is not q point-and-click beginner easy setup if one does not understa...

spippan

both
winbox dark theme support +1
webfig dark theme support +1

spippan

If the router does not have a public IP address (4G connection), all traffic is routed through MikroTik servers, right?

no. why would you think that?

spippan

can we get more info about : *) bgp - allow to leak routes between local VRFs; how that works? there is a topic on that. also i spotted the current behaviour in v7.4 but it disappeared and now is back again. leak from VRF to VRF somehow starts to exchange routing information but forwarding still is...

spippan

MikroTik_RouterOSv7.14beta8_BGP_RouteLeak_VRF.png

Hurrah!

E interact with MikroTik devices since 2007-2008...
And Just now... But it is a beginning.

Now we need to check if the behavior is correct with L3VPN / IPv6...

viewtopic.php?t=181846#p1051300

spippan

maybe this helps: i also tested something on ROSv7.12.1 ("VDSL-A1-02" is the name of the pppoe-client connection) :global PPPoE02 [/interface/pppoe-client/monitor VDSL-A1-02 as-value once ] :global PPPoE02 ($PPPoE02 -> "local-address") and i got the correct local-address of that ...

spippan

- There are no known problems with VPNv4 and route reflectors. There is a known/not yet fixed problem with VPLS and route reflectors.

do you consider not being able to leak routes properly between local VRFs (bgp-vpnv4 local) "no known problems"?

spippan

and it does not work. despite there are routes to 192.168.10.0/24 in VRF20 and VRF30 clients in either of these VRFs can reach any 192.168.10.x/24 IP [admin@RT1] > export hide-sensitive # 2024-01-24 12:19:25 by RouterOS 7.14beta8 # software id = # /interface vlan add interface=ether1 name=ether1.100...

spippan

What's new in 7.14beta8 (2024-Jan-22 21:07):

*) bgp - allow to leak routes between local VRFs;

YES. tests will follow

spippan

answer to SUP-138970
it will come in future releases. up until now, no time information WHEN though

spippan

it somehow worked in v7.4
even the static route in VRF10 got redistributed to VRF20 and VRF30

interVRF-ROS7.4.png.png

as soon as i go e.g. to 7.12.1 it stops working:

interVRF-ROS7.12.1.png

spippan

what would be a possible solution to protect VRRP e.g. on a WAN link where the VRRP member IP addresses are public IPs? VRRP uses non-routable multicast, so only the ISP router if /29 is bridged could even get involved – not some random host on the internet. You can block protocol=vrrp in the bridg...

spippan

I use VRRP in most deployments, but never with authentication: since if VRRP fails, you now have an outage/issues — the idea of VRRP is avoid downtime. And just take comfort in the RFC don't recommend it. Perhaps "simple" may be enough? IMO that does prevent accidental misconfiguration on...

spippan

@infabo

MT could just strip that "noise" entries and just write at the end of changelog:

*) misc fixes and improvements

that would make it even MORE vague.

spippan

Very interesting...

where did you get that from? would like to bookmark that. and also have a friend who might need that soon

spippan

in protocol also use "any" and for the time torch is running, disable fast-tracking

spippan

Excuse my ignorance, could you be more specific or put the complete scripts?

/system logging set [find where topics="info"] topics=info,!wireguard

spippan

instead of using EoIP, use VxLAN (less overhead) but way better to achieve the link as stated by others ... use PtP 60GHz i maintain some of these type of links at work and they are quite a no-brainer once aligned correctly for links below ~200m and easy alignment - wAP 60G is your friend otherwise ...

spippan

Hi, When installing the latest beta 7.14beta4 I got these messages on a wireguard road warrior connection, with the stable 7.13 (and earlier) it didn't happen: wg-rw: XN58CdM6ppiSQpDaQT0bh1IMYgUP0czYYY92N1IBwE3c=: Handshake for peer did not complete after 5 seconds, retrying (try 2). When I connect...

spippan

Excuse me, but that means that the functionality is only starting with 7.14 or that there is (was) another method working on previous releases? If the latter, can you post the corresponding example with the "old" method? Maybe it is just me, but 7.14 is still a bit too new/experimental to...

spippan

bummer. but at least it is somewhat to build a kind-of-workaround thanks for the example to which i can further test this for a prod approach EDIT: are there any hopes or plans for an implementation to be able to achieve this dynamically (well via BGP) like most systems support it? would be great be...

spippan

What's new in 7.14beta4 (2023-Dec-29 10:05): *) system - expose "lo" and "vrf" interfaces; good. now please make VRF import/export (local inter-VRF route leaking) finally work ( https://forum.mikrotik.com/viewtopic.php?p=1045062#p1045062 ) BTW : is BGP even under active patching...

spippan

@nichky FYI - THAT is the whole silverline which should be accomplished as a BARE MINIMUM for a serious implementation of VRFs in rOS! (quote from user "emunt6") The network industry standard is to create a route-table (RD), you can add static/dynamic routes, and assign interface/ interfa...

spippan

EDIT: opened ticket SUP-138970 6 months in testing, asking and trying are definetly a strechted time for patience now vpnv4 - works well, show us your config. please consider post #9 i have 2 VRFs with RD set i want to route-leak each VRF to the other (on that same router) what is missing to achiev...

spippan

@shippan - are you trying to achieve vpn4? - That works well as well. What is not working on v7 - U cant get default gateway via VRF. I have raised a ticket and Maris Is already confirmed that. If you mean to originate the default route from vrf into vpnv4 then currently this feature does not exist...

spippan

Maris, how can we achieve route leaking in RouterOS v7 ?

maris?

spippan

inter-VRF route leaking via RD with import/export on ROSv7 like it was useable in v6 That never existed in v6 either. There was just a workaround where you could establish bgp session between vrfs on a single router and then redistribute. In theory you already can do the same in v7 too. this partic...

spippan

version is 7.14beta3 now and what am i missing here?

mikrotikVRFv7import-export-via-RD.png

how to import ip routing infos from one VRF into another VRF?
something which was possible in v6 (https://wiki.mikrotik.com/index.php?tit ... te_Leaking)

spippan

isn't v6 around the 2.4.x kernel? or am i wrong here?

EDIT:
no, it was linux kernel 3.3.5

spippan

That never existed in v6 either. There was just a workaround where you could establish bgp session between vrfs on a single router and then redistribute. In theory you already can do the same in v7 too. that is the point in vrf route leaking. same on cisco in the internal, underlying structure and ...

spippan

It is time for USB-EXTRAS package..

USB ethernet adapter and USB wireless adapter drivers seperate package for example realtek branded USB adapters..

wrong thread

spippan

inter-VRF route leaking via RD with import/export on ROSv7 like it was useable in v6 That never existed in v6 either. There was just a workaround where you could establish bgp session between vrfs on a single router and then redistribute. In theory you already can do the same in v7 too. that is the...

spippan

Code: Select all
*) system - expose "lo" interface;
no more fake loopback bridges required for ospf :)

did you test it yet? currious if it really works

spippan

...or inter-VRF route leaking via RD with import/export on ROSv7 like it was useable in v6 or since xx-years on cisco ios (yeah that one, which also powered 2800 and 1800 routers...) I don't just understand why ROSv7 is lacking a lot of the generic features dating back to the early 2000s that we ca...

spippan

...or inter-VRF route leaking via RD with import/export on ROSv7 like it was useable in v6 or since xx-years on cisco ios (yeah that one, which also powered 2800 and 1800 routers...)

spippan

remember, there's new ampere chips coming soon. that might come with some routing surprises as well. I doubt those are being brought it just for control plan on marvell switch chips.
It would be stupid if they have a 128 core ampere doing 90s routing vs running vpp / dpdk.

exactly.

spippan

+ 1

And after 3 years

where did normis post that?

spippan

do you know of any good alternative or option to do those things like in the form of a centralized controler for routeros?
I haven't used it, and it's paid offering, but Unimus (https://unimus.net) does with config stuff AFAIK.

thanks a lot - i will give this one a try. looks promising

spippan

Thanks for sharing these details! ... any news on that? unfortunately advanced switching isn't in mikrotik's strong pocket i reckon access layer - yeah, might work aggregation layer - meh might maybe core layer - nah, no way at all with L2 bugs reported/read in the forum and the stagnated (like BGP...

spippan

Tricky question. Dude is old and frozen in functionality...but still works fine. Just not modern. Dude is much better at monitoring and recording data, than "managing" devices. e.g. you can view any router settings or create terminal session to them. But if rolling out config is your main...

spippan

SSTP AES hardware acceleration please! SSTP is the only standard protocol for Windows road warriors (but also can be used on other platforms with additional software) which works nearly anywhere. All other options like l2tp, ikev2, wireguard etc. are sometimes blocked in public or hotel networks. N...

spippan

....on your router's make and model.

NO! - but on your network's setup! a mikrotik router NAT configuration from plain functionality (not speaking of performance) is model agnostic

spippan

redistribute default route via VRF-BGP is completely broken on v7. I have opened ticket with MikroTik support. i've been told to provide more details (how it works on v6). Once i've done that, almost five days i'm waiting for response VRF route leaking via (i)BGP on ROS v7.xx.x is a complete CF and...

spippan

And they probably won't. cAP ac and hAP ac2 are in the same boat, too little memory (RAM) for the full featured drivers. They could ship some -smallbuffers version of drivers for these devices, but doubt that this will see any light. The cAP AC have 256MB and I think they are enough. there was a 25...

spippan

cisco gives a definitive result which mirrors the routers routing decision rather then MTs version of "hey i got these routes which MIGHT could be used to route your asked DST" a "show" cmd. to reflect the routers routing decision to the current FDB would be great. Unfortunately...

spippan

never use beta versions in routers that are used in real and important networks. use beta where you can reinstall with netinstall

somehow sad and pathetic this has to be told to people (or even those who refer to themselfes as network engineers)

spippan

cisco "show ip route x.x.x.x" is not equivalent to "ip route check". You can already do the same as ciscos show ip route with ip route print where x.x.x.x in dst-address neither is ip route print where x.x.x.x in dst-address an equivalent to cisco "show ip route x.x.x.x&quo...

spippan

For what is worth: after waiting and waiting, I gave up and searched for a different, low-power RJ45 transceiver. I bought one from fs.com (SFP-10G-T100, part number #154925, chipset Broadcom, and marked as Power: ≤1.8W) and that just worked when plugged into a CRS309. On the other end is a S+RJ10 ...

spippan

(already said a couple of time in the last months .. and sent support requests) Old v6 command " ip route check x.y.z.k" still missing! e.g. /ip route check 8.8.8.8 (linux equivalent "ip route get 8.8.8.8") It's very usefull when you have many routes in your routing table and yo...

spippan

Wifi menu is included in the bundle as described in changelog. All routers will have "WifiI" menu. You can not run router without system (a.k.a. bundle) package. "our" suggestion was that you move the WiFi menu and associated software into a separate package as well, so that it ...

spippan

Hello. Please, help with questions. Which package should I install on each device if only 5 GHz is needed? 2.4GHz I don't need. 1) Capsman : CCR2004-16G-2S+ (ARM 64bit) + cAP ac (ARM); 2) Without capsman standalone hAP ac lite (MIPSBE RB952Ui-5ac2nD).Or will Wi-Fi never work on hAP ac lite (MIPSBE ...

spippan

yep, it's in 7.13b1. I've got it up in the lab. pretty straight forward, although I'm having some issue with it forgetting disabled or removed routes. but it does bring routes up so that's step 1! Also, no BFD toggle, BFD is essential for ISIS. quick guess ... they are working on it right now.

spippan

impressive and useful console additions. thanks
also the little added option to ping right away from the DHCP leases menu is a welcome addition.

spippan

Noticed that on all of them I needed to reboot a second time to upgrade the routerboard firmware despite having "/system routerboard settings set auto-upgrade=yes" configured. That's expected and has been so ever since auto-upgrade is available. The reason is that .fwf files with new rout...

spippan

Hi! Below is a link to an alternative backup scenario:
https://forummikrotik.ru/viewtopic.php?p=84538#p84538
https://github.com/drpioneer/MikrotikBa ... backup.rsc

very impressive

spippan

Why would it require IPv4 or IPv6 addressing to function?

feeling confused

Unable to comprehend how to respond
[/quote]

guess it was meant as IS-IS does not need an ipv4/6 connection just to function (because of CLNP)

spippan

Winbox Feature Request In Container when using copy put the "tag" value into the "remote-image" field. so you can effectively duplicate the entry when required. allow to use a log prefix to easily identify which container is actually reporting the thing to the long +10 In Files ...

spippan

Work on ROS6. ROS7 DateTime does not work. hi oh thanks for the reminder - i corrected it yet but forgot to upload here: :log info "primulus_CONFBKB::dailyConfigBackupD START"; #fetch timestamp stuff :local dSysDateTime [/system clock get date] :local dDay [ :pick $dSysDateTime 8 10 ] :lo...

spippan

routeros works quite well with libreNMS (even with auto-discovery)

also take a look at OXiDiZED for automated config archive and versioning of those

EDIT: alternative would be Observium

spippan

how would you like to move phase1 settings to phase2 around or vice-versa?
No need for that. I would (like the other request) just want to specify an initial phase1 profile.

oh sorry, misunderstood
got it. indeed would be favourable

spippan

+1! It would be great to be able to select a profile other than default (but I see exchange mode is not part of the profile) It would be great when these settings would be moved into the profile, e.g. also "passive". how would you like to move phase1 settings to phase2 around or vice-versa?

spippan

I mean real "ZERO TOUCH". so not touching the device at all. Not even reconfigure the boot device. Is this possible to unbox a device, plug in and the device finds its config server automatically, i.e. the TR069 server. have not seen a solution without ever touching a router to achieve th...

spippan

NGINX proxy blah blah blah sounds like a bad kung fu movie. Its knowitallconfigsnobbery plain and simple. I assure you, there are a lot of real-life nginx ninjas out there, managing what must be millions of instances. This is not esoteric knowledge. You simply don't know how to do it yet. and exact...

spippan

New install 7.8??? 7.11.2 would be a new install.......

maybe the HARDWARE itself is meant as the "new install" and not the FIRMWARE -.-

spippan

overall on v7 BGP development/improvement is a bit stalled at MT

spippan

spippan

masquerade uses the first IP on the OUT interface if there are more than one ip on that OUT interface, masquerade uses the (i guess) lowest IP of that interface you need to explicitly src-nat with your desired IP for DST-NAT: if there are more than one IP on the IN interface you dst-nat on, you also...

spippan

little astray ... but you could even setup the nginx/apache rproxy in a container on your mikrotik ;=)

spippan

AFAIK one needs to at least set the devices to change the default boot device (which was "nand-if-fail-then-ethernet") to something other desired (e.g. "try-ethernet-once-then-nand") otherwise the router will start with the factory default config when powered on the first time ma...

spippan

Connection dies and is not accessible to the outside, after rebooting it works for some time. Mikrotik support can't help since +2 years, it's tcp connection. What to do? first, describe the setup, your desired connection, your firmware version, what you'd like to do and what you expect after all??

spippan

i tied that before but couldnt fiure out what was wrong. directory listing shows "forbidden". not helpful neither For stable release, you can see the "directory listing" https://mikrotik.com/download/archive If you want to download it directly using a version name from RouterOS,...

spippan

Yeah container's disk seem "fragile". There are a lot of corner cases just not covered that come up in the real world. Mainly if ROSE or USB is not mounted when the container try to start, it doesn't try again. If disk name changes due plugging in new things, also a problem. And changing ...

spippan

sorry, off-topic but ... an additional empty bridge "Lo0" for example would not violate that, right? (for loopback addressing) Loopback is fine, I have single bridge for physical ports/LACP/The works, and separate bridge with STP disabled for loopback. But in some cases, such as MPLS/VPLS...

spippan

maybe also useful to add a "bind to interface" for winbox operation or discovery

maybe something like this

wbox-bindIF-19-09-2023.png

spippan

I am tired of the crappy information provided. Is anybody here able to articulate some helpful cue? you know mikrotik has a wiki, help pages and a youtube channel where exactly NETINSTALL is mentioned. and also - routeros is not a "shiny clicky pointy" system - you need to have at least s...

spippan

You're violating the Linux DSA network stack by having multiple bridges. Multiple bridges is a concept that has been depreciated with the introduction of VLAN aware bridging, migrate to proper single bridge configuration. Your topology is improper if you can't do it with single bridges and VLAN awa...

spippan

Most network engineers understand the technology/theory and can navigate easily between different vendors' implementations to achieve the same results. If it takes you days to set up a VLAN, then most likely you are not well-versed with the technology you are trying to use. Just because on other ve...

spippan

wow for ~20 years of "experience" OP should learn SDN stuff and not individuall and cost-effective setups there is no, i repeat NO, vendor out where all is calm-and-charm to just setup - even meraki has some fairly downsides. same goes for cisco, juniper, palo alto, barracuda, checkpoint (...

spippan

yes this is a windows thing client reports its PTR back to the windows dhcp/dns server it can be manually invoked via CMD ipconfig /? Options: /? Display this help message /all Display full configuration information. /release Release the IPv4 address for the specified adapter. /release6 Release the ...

spippan

CSS swOS (lite) does not feature this function

https://help.mikrotik.com/docs/display/ ... ies+Manual

spippan

... and then there are (probably) thousands of us using RouterOS on dozens of devices from home applications to medium size enterprises and did not encounter any serious issue for years, so we are perfectly fine with calling it "stable" :) RouterOS has so many features, most of the interc...

spippan

The solution is simple: "stable" channel should be renamed to Beta (as it is actually beta, regardless of what mikrotik marketing team says). ... and then there are (probably) thousands of us using RouterOS on dozens of devices from home applications to medium size enterprises and did not...

spippan

Sometimes you need to pick several items from a list or enter several items and to apply them to an entry, or both. i.e; 1:many, many:1, many:many; e.g; We'd like to set the winbox service available on VRF red, green, and blue; /ip/service/set winbox vrf= ? I tried: /ip/service/set winbox vrf=R,G,B...

spippan

According to https://help.mikrotik.com/docs/display/ ... l+Overview, this feature is not available yet:

Some kind of mechanism to import/export routes from one vrf to another within same router

got lucky my 3 CCR1072 at work are still v6 "able"

spippan

Feature: ability to interact with Ansible, and script running capabilities e.g Python/Netmiko for network automation.

ansible can be integrated by today - (rest) api and ssh with pubkey-auth

spippan

Besides, under Linux, NetInstall 7.x is broken completely and I can only NetInstall using 6.x (I did that several times). maybe you should try to set every other interface "down" on your linux host ("(sudo)ip link set [IFNAME] down") except the one which netinstall should run on...

spippan

If you mean VPNv4, it is currently implemented. VPNv6 is still in the To Do list. cannot import/export routes from VRF to another VRF locally say: RD 111:123 import 111:123 export 111:123 import 222:456 RD 222:456 import 222:456 export 222:456 import 111:123 on 7.8 it kind of worked ... upward the ...

spippan

here the rOS v7.8 in contrast with the same configuration [admin@RRZ] > ip vrf export terse # sep/04/2023 18:28:37 by RouterOS 7.8 # software id = # /ip vrf add interfaces="e1.151(rz),Lo0" name=rz /ip vrf add interfaces="e1.1113(39390)" name=39390 /ip vrf add interfaces="e1....

spippan

was there any issues, i haven't noticed anything like that since ros 7.9+ till 7.12b3 BGP VPN (VRF import/export) does not work if anything of that helps... the routes are not getting propagated among the VRFs/routing tables [admin@RRZ] > ip vrf export terse # 2023-09-04 18:18:58 by RouterOS 7.12be...

spippan

Yes of course, it will be implemented.

do we have any upgrade on this?

spippan

apparently this still is the "at the moment way to go" in routeros v7

https://help.mikrotik.com/docs/pages/vi ... eId=328206
at least after version 7.8 where the import/export at least happens

spippan

Thank you, why would routes exchanged by BGP work and static ones not ? This is the minimum config for example: (this is not Mikrotik) .... That's all, this is way more simple than the RouterOS 6.x way. I do not know the "RouterOS 7.x" VRF implementation. still not working as far as i tes...

spippan

is VRF import/export from one VRF to anothet VRF on the same router finally working on rOS v7??

spippan

Thank you for encouraging response! There are several models used by ISP (Tet). Modem list can be found in this article: https://tet.lv/palidziba/lv/palidziba_majai/internets/majas-internets/problemas_un_risinajumi/32902 from which latest model used by ISP is Alcatel Lucent I-240W-A from what I can...

spippan

and do not forget to add 224.0.0.5 and 224.0.0.6 to your "allowed adresses"

spippan

I mean, that pesky routing process, it must be THE job, don't you think? Pretty ironic, all other bells&whistles worked. It takes years to gain reputation, and only days to lose it. ROSv7 can not be considered stable and suitable for production or remote areas. It is strictly SOHO now. A shame....

spippan

You had one job...

and that is one of the wrongest assumptions ever made considering software development and upgrade-paths

spippan

... Also, loosely related to the topic: taking ports into account in the PCC calculation may bite your back if your LAN clients access paranoid web sites (typically banking ones) - such sites often like to redirect the client's "application session" between multiple servers, but drop the ...

spippan

After upgrade from 7.11 to 7.11.1 many my devices can not get IP from DHCP. Tell me, please, what could be the reason? Downgrade to 7.11 was fix this problem. more details would be good. is the dhcp client a 7.11.1 client or is the dhcp server on 7.11.1? or both? what was the status on the DHCP ser...

spippan

Hello I try to run a script when a user login via Wireguard. Is that possible? This is what I have: /interface wireguard set wireguard1 on-up=WireGuardConnectScript and /system script add name=WireGuardConnectScript source={ :log info "Wireguard Login from $peername" } Thanks for helping ...

spippan

WG/ChaCha lack support för HW acceleration

which hardware has this in hw-offload?
until now i know of none

spippan

same thing for all my containers on my RB1100AHx4
after a reboot i always have to copy the container, re-insert the tag (..:latest, or whatever), remove the old one, let the new one extract and after that i am able to start up them again.

annoying

spippan

it appears to be that way:
https://help.mikrotik.com/docs/display/ ... d-Advanced
yes, but it does not matter for BTH. That is for Cloud DNS feature, unrelated to this topic. BTH does not care if you have public or private IP.

thanks for the clarification

spippan

I've seen this on MikroTik, but what about other vendors?

Plain Debian, or whatever or any big vendor. Do they proactively kill user session upon deletion immediately?

don't know if upon deletion but you have the option to kill a session proactively
something which is not possible at all on rOS

spippan

if you need reliable MLAG hardware go for cisco, extreme or if you need to be on budget ... fs.com

speaking of fs...
MLAG featuring switches:
N5860-48SC (mlag or stack)
S5860-48SC (stack)
S5850-48S6Q (mlag)

routing ... mikrotik
switching ... cisco, fs, aruba, extreme

spippan

use-local-address is not for Back to Home. It is for Cloud DNS.
So what will happen if I enable use-local-address ? The Cloud DNS will be set to my local public ipv4 address?

it appears to be that way:
https://help.mikrotik.com/docs/display/ ... d-Advanced

spippan

do you see ARP records when the sniffer is not running?
maybe there is a problem with ARP learning or ageing on the bridge and/or vlan interfaces

spippan

*) wireguard - added "wg-add-client" configuration wizard (CLI only);
*) wireguard - added "wg-export" and "wg-import" functionality (CLI only);

Thank you very much.

yes. that is a welcome addition - hopefully this will come to winbox (and maybe webgui) too

spippan

if they would let out a piece of demo/test software or make statements about it, the forum would again explode with complaints and roars of critic (with which most of the time no one can improve anything; often plain nagging) this might unnecessarily open another front for mikrotik staff to look int...

spippan

No IS-IS, no 6VPE. The wait continues...
A protocol from 1992. Why not change to OSPF

maybe because is-is performes a bit better
[ https://ipwithease.com/ospf-vs-isis/ ]

2023-08-25 02_26_23-OSPF vs ISIS _ Detailed Comparison - IP With Ease — Mozilla Firefox.png

spippan

Stable 7.8 IKEv2 users vpn work 1 day, after traffic on ipsec rules. reboot router and work again... fucking stable... You are apparently one of those that is confused about the label "stable" in a RouterOS release name. Lots of people think that the "stable" versions are the on...

spippan

Hi, Im just wondering why is this topic still open...it has been 2 years since first information about MDC and nothing till now. Not even alpha, beta etc. Everyone is writing their wisches here but realisticly there may not been any device controller from Mikrotik. If you chech competition... MT is...

spippan

Another feature request: when enabling a "filter" in winbox, after adding one or more filter rules, then disabling the filter, please remember the filter rules so that when filter is enabled again the last-used rules re-appear, and not a blank new filter. Also when changing the filter top...

spippan

Re: RB3011 - still a good choice?
: No.

depends.
what are the requirements of the desired setup...

spippan

I believe that the LCD screen is not supported on RouterOS 7. So, forget that the screen.

LCD supported on v7 (at least up to 7.10.2)

spippan

in general as of the time of writing ... if you do NOT need any feature from v7 but rely on BGP ... stay with v6 ! a pity you could not upgrade to the new CCR devices and other ARM(64) routerboards this way. ..., except that "refresh" does not work between versions, you need to disconnect/...

spippan

Well, there probably was an important customer/prospect who insists on having IS-IS. In general I do not like that MikroTIk embarks on so many new projects, while leaving existing ones unfinished. I would say: first make sure all those red and yellow squares in the routing status page are removed, ...

spippan

Play with the tools you have.
Reboot.
Done.

is this some kind of useless trolling?

a PROD router is not always elegible for "just a quick reboot"
imagine a BGP router has this issue and needs a reboot ...

spippan

as @pontus said: "This seems like a basic feature which is available on other platforms."

+1 for this feature

+1 too

default behaviour in cisco and fs

spippan

Mikrotik, please finally add the option to forcefully kill a logged in user session especially if a privileged user (user in group "full", for example) is logged in and kicks a "lower privileged" user or a user which DOES NOT EXIST any longer! this behaviour is very concerning ->...

spippan

Reboot. Problem solved. no, not at all ! rOS needs a "kill session" since FOREVER! even it would be on CLI only ... but not even that is available and it drives me crazy. in winbox there also should be a button to kill sessions - especially if i am the user with "full" privilege...

spippan

What seemed to fix the VPLS was connecting to wifiwave station and disabling/enabling the vpls interface. No other changes. I am wondering why the interface did not reconnect once the link recovered and connectivity was restablished. had that issue on VPLS links also in the past when the underlying...

spippan

backups (.rsc + binary) are vital and essential
ESPECIALLY when upgrading beta and rc versions - frankly, always when updating IMHO

spippan

As far as I have looked at and understood the relevant instructions, I apply it as follows, but I did not get a solution, where am I going wrong? /routing filter rule add chain=bgp3 disabled=no rule=\ "if (dst in 192.168.0.0/26 && dst-len in 24-32) {accept}" add chain=bgp3 disable...

spippan

We are very sorry if you felt offended in some way. i saw that all old beta forum topics are erased i reported few time when v7.10 betaX started to show, that WG with IPv6 and non /64 suffix have a problem in 7.11beta topic there was also another user with same observation, and i clearly remember t...

spippan

how does the problem described relate to the topic header "Change stable to long term" ??

spippan

This issue has been resolved. :D :D As is sometimes the case, the apparent problem wasn't really the issue. I'll be brief, but I hope this can help somebody else in the future. The design requires that sites 1-3 from the original diagram are able to access the public internet without first going th...

spippan

hello, ospf neighbor discovery using multicast address 224.0.0.0 - you should allow that address to flow inside the wg tunnels. or... you can specify ospf interface as ptp with unicast static neighbors. so... there are a lot of subnets to pass the wg tunnels : ospf itself and the rest of the networ...

spippan

https://help.mikrotik.com/docs/display/ ... l+Overview

it is happening

IS-IS-routing.png

spippan

Tools, Check for updates.
Error: Upgrade file was corrupted.

it is literally the first thing the "important note" section states.

spippan

Can they just put the source code online for us to just compile it! They are not selling this. They are selling the device and the router. So management software is not part of their product.! yes it is. take checkpoint or barracuda for example ... similar case. oh and making THIS a priority seems ...

spippan

firstly, consider a good read on that one
https://help.mikrotik.com/docs/display/ ... nd+Filters

spippan

@spippan

try viewtopic.php?p=1015720#p1015720

if i had not pressed SAVE it also would not work in the webGUI.
did that.
but thanks for the hint

spippan

Thanks! I did not know that. ur welcome Try to hide the MPLS menu. It has several sub-menus. When (in Webfig) MPLS is removed (and even when all sub-menus are removed), in Webfig the MPLS item is completely gone, but in winbox it remains visible but when clicked it shows an "empty" (small...

spippan

Connect your Mikrotik device to ONT. VLAN ID 2. setup PPPoE with your A1 Internet username and password. see https://www.a1community.net/internet-fuer-zu-hause-449/modem-only-bei-ftth-257350 can confirm. just switched over to directly connect my 1100AHx4 to the ONT via ether12 added vlan 2 to ether...

spippan

Thank you everybody for the replies! I'll definitely try to replace the isp modem, not the converter and let you know how it goes (I'm on vacation). Those providers make it really difficult to change hardware, they don't want you going dark on them 🙂. hi. also from austria also A1 customer you migh...

spippan

- better recognizable "active" state of the Safe Mode button (make it yellow or red when active, not just a different shade of grey) +1 - allow to "lower" a window in the windows list (e.g. via right-click), in addition to the current possibility of "rising" a window y...

spippan

I am mostly inside. Usually I don't even switch on the lights in the office because I can't stand the light. And yet I don't want dark theme. Working with computers since 1980. I started on monochrome CRT screens so I know what it is like to have black background. Still don't like it. same with the...

spippan

Those who want the black theme don't really work , they just want it as a whim " because others do it "... Try to work under the sun with a fuck–g black theme that doesn't let you see correctly what is present on the screen.... "don't really work" ... how come you conclude that?...

spippan

After a while, it seems that Wifi is not stable on hAP AX3 on 7.10.2 ! Constant internet drops, or poor wifi quality. On my Old hAP AC2 wifi is muc much stable and better then this on hAP AX3. do have "detect internet" active? if so ... disable anything regarding it and reboot the device ...

spippan

Well, of course for "just access points" it is much easier to do than for generic devices like MikroTik. I use UBNT access points, but their controller configures similar things as CAPsMAN. The generic solution for a network of routers is much more complicated. E.g. I would like to see a ...

spippan

The "Input accept NLRI" filtering in BGP would be more usable when there is an extra "accept default route" option. As it is now, you can accept prefixes in certain subnets (as present in the address-list parameter of "Input accept NLRI"), but once you want to accept t...

spippan

[FEATURE REQUEST] - Firewall History Log could it be possible to implement a firewall connections log (a seperate TAB for example directly in the ip>firewall window/section)? with maybe some settings like "max-conn-count", "max-lines" and/or "max-history-timeframe" (whi...

spippan

it might be a problem you addressing the VPN clients within the same subnet as the LAN clients

EDIT: the routing engine in ros v7 is different from v6, so that might impact that config

spippan

Now you can upgrade to 7.11 beta4 there is fix for the WiFi issue

do you mean:

*) wifiwave2 - fixed interface hangs on IPQ6010-based boards (introduced in v7.9);

spippan

...for how long?
The posts already present "speak" for themselves.

good

spippan

Is anyone here interested in volunteering to approve and disapprove new member posts? Let me know, and let's fight the AI/LLM spam together
This time I'll just stop being an asshole, so I don't give any more problems.

...for how long?

spippan

After upgrade from 6.48.6 to 7.10 default timers bfd isn't correct 6.48.6 /routing bfd interface set [ find default=yes ] disabled=no interface=all interval=0.2s min-rx=0.2s \ multiplier=5 7.10 /routing bfd configuration add disabled=no interfaces=all min-rx=200us min-tx=200us multiplier=5 what is ...

spippan

For now, all BGPs uptime for 19:10:13 without interruption....
Still all up and working without problems. (2d 16:54:56)

BFD activated or BFD not in use at the moment?

spippan

I never understand why people want free professional consultancy work or even vendor consultancy work on forums.

as by a lot of recent posts here. i do not get it either

spippan

Please revert to the old WebFig Style or at least give the user the choice. - The new one is confusing - Everything needs more clicks. - Traffic stats now have the size of a stamp - There is no (really, 0) advantage - The width of columns is not saved which is annoying. I'm using it on a 24" s...

spippan

You can read here for more details, but I'm sure you can find more design info in the public web, Facebook isn't the only one doing this design, ISP/Telcos who are up-to speed do as well: https://www.rfc-editor.org/rfc/rfc7938.html Preferably OSPF should be replaced with ISIS, but that's not suppor...

spippan

OSPF+BFD. BGP+BFD. This is a MikroTik problem that's likely resolved in 7.10 stable upcoming. The OSPF+BGP design is used by Facebook as well in their large-scale deployments. It's not a new design approach. hopefully yes. then this design surely should work fine. oh do they, didn't know about that...

spippan

Use OSPF for underlay to learn loopbacks of all adjacent neighbours. Use iBGP to full-mesh with all loopbacks.

would this not just rank up convergence timers and overhead?

sure sounds like a quite good plan but timing, i guess may be problematic here

spippan

got very instable BFD sessions with min-rx/-tx below 50ms and a multiplier less than 3 in combination Sorry, but who does/needs that?!?! This is absolutely not a "usual" setup. When I turn my room light on and off so quickly, I don't need to be surprised when it pops... there are people h...

spippan

got very instable BFD sessions with min-rx/-tx below 50ms and a multiplier less than 3 in combination

spippan

wow ... it really is happening.
awesome

2023-05-28 15_32_10-.png

spippan

blog = new help docs? No, blog = https://blog.mikrotik.com/ But nothing has been posted there for nearly two years... thanks. totally forgot about that one anyway, hoping there will be a fix out soon for those not using ipv6 the temp. fix/workaround should mitigate the problem a bit at least.

spippan

Blog entry following soon
Blog? I did not know it still existed...

blog = new help docs?

spippan

both

spippan

also, do not forget to backup your v6 config

spippan

Ok thank you guys for the clarifications.. Now i have another router. A hAP AC2 with up to date 6.49.7 OS/Firmware. I downloaded the available upgrade here in the product page: https://mikrotik.com/product/hap_ac2#fndtn-downloads So i got the file: routeros-arm-7.9.npk I uploaded the file to the mi...

spippan

what is the desired goal here?

already looked up here?
https://help.mikrotik.com/docs/

spippan

In today's world, there is no place for such a shitty design, looking like a 90ties Unix clone. Just look at Ubi Unifi interface - that's how modern interface should look like. you really cannot compare unifi (home and small business grade) with the flexibility and function richness of routerOS tha...

spippan

running on 7.9 stable now hap ac² hap ac rb1100ahx4 all good so far. 2 container (kuma uptime, adguard) running well BGP sessions over wireguard peers also running fine. noticed bgp stability improvement when refreshing route informations. thanks for the effort to MT now ... back to waiting on BFD ;...

spippan

No thanks, it bears no resemblance to the oPs question so not interested. He has four separate MT routers each with public internet, no need to add a single point of failure xtra pppoe router............??/ pppoe router is just a substitute for the isp/www for the lab. every of those 4 router is co...

spippan

No capiches sipan. Are you saying that all four routers are connected to the same PPPOE router, and dont have their own publicly accessible IP. I do not understand your diagram in the least........ it's "spippan" the "pppoe router" simulates an ISP or "the www" i attac...

spippan

Can I disable connection tracking feature if I use it for per-connection classifier with nat load-balancing? I thought I can not. Also I have thousands of connections in my real user traffic and the last screen is for real traffic, not any perfomance tests like btest or iperf. if you mean fast-trac...

spippan

Hi, I have similar setup. Could enyone help me how to setup OSFP between those location connected thorough wireguard? Thank you some basic questions: 1. are you understanding OSPF and how it works? 2. how are you planing to troubleshoot and maintain it? 3. without any further information on your se...

spippan

just if someone might want to take a look less interfaces and sleeker configuration (on the wireguard side at least) made a EVE-NG setup which works with EACH router of those 4 only having ONE wireguard interface and peers with each other NO routing (not static nor dynamic) NO firewalling just basic...

Search found 469 matches