MikroTik

nichky

*) wireless - include last frequency when manually setting frequency step in "scan-list";

what exactly will do for us?

nichky

get rid of band=b. Channel-width=20/40mhz-XX depending of the distance

nichky

i'm running VPN which is IKEv2 and with the ip address from modeconf (HQ) i'm running IPIP tunnel. Everything works fine i mean the tunnel and everything. I've just seen that when i'm accessing from the HQ side to the BRANCH office on ipip-tunnel adress i heve (see picture-and after min im lossing t...

nichky

*) winbox - added "revision" parameter to "System/Routerboard" menu;

what for?

nichky

and also Does it make sance?

"if you have DHCP, etc on the device, you will have to also add the bridge to tagged"
on the Router wich is running DHCP-Server

nichky

one question regarding this topic. So as soon as VLAN filtering is enabled traffic will go through CPU? i mean if i want to get ether and wlan i have to tick VLAN Filtering in my case i have 3 routerOS, and the thing is i need to run VLAN on ether and wlan. So acording that traffic will go through C...

nichky

use User Manager

nichky

Hi, for me the static ARP entry works great. Your case sounds to me like your server NIC isn't able to wake up the server upon receiving a magic packet after unplug / plug the network cable. Can you still wake up the server from within your LAN in this situation? When i ll do unplug / plug,i can't ...

nichky

@CapFloor does it work correctly?
in may case everything works perfectly until i unplug/plug cable from computer/server. From that time stopped to work. What about in your case?

nichky

Here is the configuration I used to test compatibility with NordVPN. However, it is not working yet with the latest public beta version (6.45beta45). You will need to upgrade to the next beta when it is released. I will probably make an official tutorial on wiki later. /ip ipsec mode-config add nam...

nichky

Questions regarding Power-Line
1. What is the max range that i can connect two Power-Line?
2. Can i connect more than 2 devices?
3. Is there any chance to block button? (for protection purposes)?

nichky

OK - what command will tell me what OSPF function the router is (IR, Backbone, ABR, ASBR )

/routing ospf lsa> print detail where type=
/routing ospf as-border-router
/routing ospf area-border-router

nichky

i modiface from msatter . i found it makes traffic ONLY when Speedtest.net is running, but what eals i found special dummy rules dont make traffic,even on connect-list fasttrack is 0. Do im getting fastrack for Speedtest? Filter add action=fasttrack-connection chain=forward comment="Speedtest fasttr...

nichky

msatter , good idea by port. i'm running torch on same time with speed test. There is millions of ports Speedtest.net is using destination port 8080 and my line in Mangle is then: /ip firewall mangle add action=fasttrack-connection chain=prerouting comment="Speedtest fasttracking" connection-mark=n...

nichky

speedtest.net uses normal http port on many different servers so nothing to match on (port is not unique and neither DNS name nor IP address are predictable).

So this kind of cheating won't work.

i was waiting for you. Which matching you recommending instead of Content?

nichky

currently my rules looks like that, im not happy because the metchers comes from Content,i found it doesn't need to be for this case - Filter - add action=add-dst-to-address-list address-list=Speedtest-List address-list-timeout=1d 00:00:00 chain=forward comment="Get SpeedTest IP-Address" content=spe...

nichky

i'm trying to to fastrack only on speed test for the problematic customers :) Currently i got this rules, it seems leke doesn't work any suggestions add action=fasttrack-connection chain=forward comment=FastTrack connection-state=established,related content=speedtest.net add action=accept chain=forw...

nichky

youtube.com or *.youtube.com or *youtube*

nichky

try Content instead of TLS-Host

nichky

update from MikroTik

This is not a bug, because when you set the WPA2 security profile the PSK key is generated passphrase+SSID and that is why the connection in this type of scenario is not possible.

Best regards,
Viesturs R.

nichky

im using Wake-On-Lan, by LAN IP, and everything working fine until unplug and plug the cable.

nichky

Three thing you have to have for your case:
- Crrect Configuration
- Enough Bandwidth
- RouterOS which supported ipsec acceleration

I can't tell you more according your post.

nichky

im so proud of you guys, how IPsec become so flexible. well done!!!

nichky

*) dhcpv4-server - added "client-mac-limit" parameter;

which number over here goes?

nichky

well done,it works perfect

nichky

raystream, nichky, LetMeRepair, proximus, Cha0s, 3bs, Vlad2, sterod, mserge, STEVEUK1, elgrandiegote - We can not seem to reproduce the problem with Winbox login. Can you provide more details? From which version did you upgrade your router? Do you, for example, use RADIUS for Winbox authorisation? ...

nichky

The only access i can get is via SSH. and i downgrade to 6.44.3,nothing happens

nichky

and how can we get access?
You can't That is the point of this issue. Only the admin himself could trigger the problem. it's not a serious issue, but we still fixed it.

So we have to replace the router? so fany

nichky

!) security - fixed vulnerabilities CVE-2018-1157, CVE-2018-1158; Fixed again? Both CVE's were fixed in the previous versions, but they could be reproduced differently if you had access to the www service and user account with "full" rights. We have removed this possibility as well. and how can we ...

nichky

it is my remote site!!!!!
any bug make sense....this one...hhhhhh

nichky

i upgrade my RB433AH after that...i couldn't access with current user and password and with admin????

nichky

can we see you config?

nichky

have a look , you can find something about DHCP Option 82

nichky

I will wait for couple of days,there already on this forum.

nichky

sindy, even with /interface wireless connect-list doesn't have any effect. however Thanks.

nichky

That how my config looks like. Keep in mind Sindy both side have to be APs,because wds-ignore-ssid=yes will work between APs In this case wds-ignore-ssid=yes will not work,if i switch security-profile=WPA2 to default, i can change SSID on both side and the link will established. With security-profil...

nichky

Sorry Sindy I couldn't get nothing useful from your message. My question was very simply, i will repeat again. So when i'm using "wds ignore ssid" (wiki: If this property is set to yes, then SSID of the remote AP will not be checked.) It works excellent without security profile, as asson i as do the...

nichky

In my case im using WDS. I found that i can change the SSID on the remote side and sill i can have connectivity by the futures "wds ignore ssid". Everything is okay..as long as those two sides are without encryption. As soon as i add encryption (WPA,NV2). The link will not connect at all. My questio...

nichky

Right now it works well.

Thanks

nichky

Is Backup-cloud stil working?
I use to since it comes up,but so fare i got some error.

on log says:
"Problem connecting with server"

nichky

if you don't know like trainer how you expecting from us

Just a joke. I did discovery about that. i found:
viewtopic.php?t=120951

Also i got presentation regarding DHCP Server and Option 82.
As soon as i find that i send on this forum.

nichky

Basically he was explaining how can you use the real interface and virtual interface, and from his experience he mentioned which one should be AP wich on Station

nichky

i'm wondering what sindy recommends about that.

nichky

Simple, just download the version you want from https://mikrotik.com/download (make sure correct version). - drag and drop to file - system package click downgrade (winbox) - reboot - sustem routerboard upgrate fimware. According what you wrote on your post, maybe you кnow maybe don't, but i want to...

nichky

of course it does, so my ether1 has public interface and my outgoing interface has local ip. You can see from my picture above. There is no interfaces and local IPs on your picture. Probably you're talking about some other picture? okay, so on ether1 is terminated pppoe connection. Outgoing interfa...

nichky

we do update the database regularly, so in most cases, this should be correct. Maybe sometime later it will clear the issue. Also, for the detection the IP address you are communicating with the server is used. As a result, if you use tunnels it might guess incorrectly. nichky : do your outgoing in...

nichky

janisk, what about in my case? did i do correct, did you see the picture above?

nichky

need your config

if you see two or three time out, that fine. In your case you saying that they don't ping each other at all.

nichky

clear all the files on /files then upload the npk, stop and clear cache on webproxy, it will give you little space. Are you REALLY running a webproxy on a hAP using the flash as the proxy cache???? :-o :-o :-o In my case, i didn't run web proxy, but still my routerOS has been freezed. After while t...

nichky

i got 2011UiAS-2HnD. After upgrading to 6.44.2 my RB is freezing. When im pinging the router from my computer it goes 1ms..10ms 600.ms..and timeout....over and over again

nichky

Can anyone give me more info what this does?
interface wireless spectral-history wlanx samples=xx

i know what spectral-history does, but what is the point when samples combaint each other

i couldn't find documentation what actually it does

Thanks

nichky

[admin@MikroTik] /ip cloud> print ddns-enabled: yes ddns-update-interval: none update-time: yes public-address: 82.x.x.x dns-name: 757bxxxxxxxx.sn.mynetname.net status: updated It displays public address, but will return local address in actual lookup. C:\>nslookup 757bxxxxxxxx.sn.mynetname.net Non...

nichky

I tested with an option Use IP Local Address but being with CGNAT but only returns the Public IP.

Can you give more info what for “ Use IP Local Address” . i haven't an idea how can i use.

nichky

You mean, local_address being "washington-street-bld-123-office-57a"?

like 192.168.88.1.sn.mynetname.net. And i was thinking that i ca use like public address

.To be honest

nichky

i thought that if i tick “use-local-address” is going to be local_address.sn.mynetname.net

nichky

Cen i get some info regarding Ip Cloud. Since new version 6.44.1 Ip Cloud has features “use-local-address” if i tick that domain names is not going to change, it's still *.sn.mynetname.net

nichky

What for *) winbox - added "use-local-address" parameter in "IP/Cloud" menu; What I have seen I'd it means that IP/Cloud will expose your internal addresses in DNS. If you have a router inside your company that got 192.168.88.206 this will be the addresse it will return where will return? Sent from...

nichky

What for *) winbox - added "use-local-address" parameter in "IP/Cloud" menu; What I have seen I'd it means that IP/Cloud will expose your internal addresses in DNS. If you have a router inside your company that got 192.168.88.206 this will be the addresse it will return where will return? Sent from...

nichky

What ealse have you got in your firewall?

nichky

What for
*) winbox - added "use-local-address" parameter in "IP/Cloud" menu;

nichky

This one you have to follow, not youtube from unknown persons

https://mum.mikrotik.com//presentations/ID14/aldi.pdf

nichky

tamagochi - Do you mean that e-mail settings were corrupted? I do not see how this would be possible by this upgrade. If you downgrade router back, then setting re-appears? Please test if when you downgrade device, set TO parameter, upgrade back and the setting is gone again; No, e-mail settings ar...

nichky

Just upgraded to 6.44 /ip ipsec identity add auth-method=pre-shared-key-xauth generate-policy=port-strict peer=peer9 policy-template-group=redescambo xauth-login=alfandega1 add auth-method=pre-shared-key-xauth generate-policy=port-strict peer=peer9 policy-template-group=redescambo xauth-login=alfan...

nichky

Just i need info about this: !) ipsec - removed "users" menu, XAuth user configuration is now handled by "identity" menu; Basically from now we have to use identity tab. Because USER has been replaced with it. I got PC clients using this features Does it will covered ? /ip ipsec identity add auth-me...

nichky

tick allow remote requests.
did you set up dhcp-server?

nichky

The easy way could be if you use default configuration just set up your WAN interface like you did. Plug at your WAN into ether1.

nichky

omberli, focus on wireless export, are you able to export like:

/interface wireless export verbose

nichky

Just i'm willing to know more dip what this script does. Like you have mentioned " if it couldn't reach the endpoint it would force the tunnel to restart". My quastion will be what exactly will restart? Because in IPsec you got features DPD, wich means: "One the DPD interval has met the Max Failures...

nichky

Sounds like Safe Mode

nichky

This features from which version will start up?

nichky

Try this one. Only one trying can get access. The rest of will be rejected. (until the limit expire) add chain=input connection-state=established,related add chain=input connection-state=new dst-address-type=local dst-port=23 limit=3/1h,0:packet protocol=tcp add action=reject chain=input dst-address...

nichky

Hi. Until recently I have been working fine with the l2tp / ipsec protocol. Now, I do not know why it fails and I get the following message in log: xx.xx.xx.xx failed to pre-process for ph2 packet xx.xx.xx.xx peer sent packet for dead phase2 In the ipsec window I get the following message: Unsafe c...

nichky

make filter accept for IPsec port=500,4500. And also L2TP

nichky

So what you want after 5 times connecting, would you like to stop processing the packets in your router?

It means no one can get access

nichky

*) ipsec - accept only valid path for "export-pub-key" parameter in "key" menu;

Can we have more info about that.

Thanks

nichky

what this ip address=192.168.98.0/24 does?

nichky

have you have any plan to get some certifications . Maybe it will help you to build up your network.

Like Redmor said: export your config

nichky

And also try to avoid b-standard. This days you don't need, it's too old method.
btw The purpose of antenna gain is to decrease the power.

nichky

i'm looking for info what does it make.
L2TP-Server
- One Session Per Host

nichky

Glad you figured it out....MTU can play havoc with an MPLS network. Two basic MTU rules to remember if you want to pass a 1500 byte frame in MPLS. Minimum MTU for MPLS (for 1500 byte frame) 1526 (L2 and MPLS MTU) - untagged frame 1530 (L2 and MPLS MTU) - tagged frame Can we have more info regarding...

nichky

Under Security Profiles, set your Group Key Update to: 01:00:00.

Why 01:00:00?

nichky

useful

Thanks

nichky

ognjen did you check country-list for your country?

PozZ iz Makedonie

nichky

sebastia is right ,just i want to show you deep how it goes

nichky

I think Country Debug it´s equal or better than old no_country_set. > interface wireless info country-info no_country_set ranges: 2402-2472/b,g,gn20,gn40(30dBm) 2417-2457/g-turbo(20dBm) 5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(17dBm) 5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dB...

nichky

I think Country Debug it´s equal or better than old no_country_set. > interface wireless info country-info no_country_set ranges: 2402-2472/b,g,gn20,gn40(30dBm) 2417-2457/g-turbo(20dBm) 5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(17dBm) 5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dB...

nichky

Like here, in this case you can play with none:

https://wiki.mikrotik.com/wiki/Manual:B ... interfaces

nichky

Depend on what you want to use it.

nichky

The same result - RB962, 2 x SXT HG5 ac [admin@MikroTik962_Fug31] /interface wireless info> country-info "czech republic" ranges: 2402-2482/b,g,gn20,gn40(20dBm) 2417-2457/g-turbo(20dBm) 5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive 5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80...

nichky

nichky - "/interface wireless export verbose" should tell us why your output differs from mine.

However i send to you rif file. from your last command

nichky

Can you provide supout file to support@mikrotik.com? Honestly, I do not see how (if you did not play around with Photoshop ) you could get this information under country info.

Screenshot 2018-12-22 21.41.45.png

I dare not play with you.

you can see from other device

nichky

i'm wondering what's differences between new "installation" and distance? actually what the new feature does? Thanks Distance adjusts ack settings. Installation decides which frequencies and powers you can use, based on regulations. So normis basically it means we always have to look what this comm...

nichky

I think that "normis" post was missing "indoor/outdoor" setting in country information simply because example country does not have such limits. Here you can see info for Latvia: /interface wireless info country-info latvia ranges: 2402-2482/b,g,gn20,gn40(20dBm) 2417-2457/g-turbo(20dBm) 5170-5250/a...

nichky

i'm wondering what's differences between new "installation" and distance?
actually what the new feature does?

Thanks
me too
distance is for ACK calculation and installation ist foot frequency selection.....

make sense ,but need more info

nichky

i'm wondering what's differences between new "installation" and distance?
actually what the new feature does?

Thanks

nichky

did you check packet fragmentation?

nichky

NSSA simple means: The ASBR generates a Type 7 LSA that contains the external routing information. The ABR receives each Type 7 LSA, translates it to a Type 5, and floods it into area 0. - So it goes opposite side - ISP ll NSSA ll BACKBONE https://wiki.mikrotik.com/wiki/Manual:OSPF_Case_Studies#NSSA

nichky

Do you really need SSTP? It’s TCP protocol, it means it’s process of acknowledgement. If you can choose from one of those i’ll play with l2tp and manually set up IPsec

nichky

to je to, prava stvar

nichky

complitly same just follow the rule for exsample: your router 3 has ip from dhcp-server let say you got from your dhcp= 192.168.2.2 on ip route: dst-address=address of where you want to go e.g 192.168.y.x on gaytway=ip add of your dhcp gateway let say the gaytway is=192.168.2.1 On router 1 dst-addre...

nichky

the ansure is here:

https://wiki.mikrotik.com/wiki/Manual:S ... ic_Routing

nichky

can you show us your topology?

i just found wrong configuration on your description

“m33 route dst-addres=192.168.1.0 gateway=192.168.90.1”

it has to be dst-address=192.168.1.0/24

nichky

Thanks

nichky

Does anyone know how can i make this command in RouterOS terminal

nichky

From now it starts to work, i didn't change the configuration.I was pretty sure that i'm on correct way, just i was i wanted to double check with you guys.

It Works!!!!

nichky

In my case doesn’t go. On my PC I’m using free Shrew Client ( i found on free version doesn't include the Split DNS feature), but also from iPhone i got same result.

Thanks

nichky

I got one question about IPsec.

"/ip ipsec mode-config static-dns or system-dns."

Basically means if other side has restriction like openDNS for some website with static-dns and system-dns we avoid restriction.

Thanks

nichky

Take a look at this if you want an example of a production deployment with HA for VPLS and public subnets. Configs are in this post - https://www.stubarea51.net/2018/04/23/wisp-design-building-highly-available-vpls-for-public-subnets/ https://dev.stubarea51.net/wp-content/uploads/2018/08/vpls-1.png...

nichky

How you mean "and I sent ppppoe connections to pppoe server over eoip."

just keep in mind all non backbone MUST be connected to backbone area, otherwise you have to play with virtual link.

nichky

yes i'm doing like that, So i need answer on my questions. Did you notice in your RB something like that?

nichky

I found that some of the Wireless card doesn't support "tx power mode=card rates".

- How can i know which carts supports which no?
- Just i need to decrease tx power, i'm avoiding "all-rates-fixed" because MikroTik doesn't recommended to use it.

Thanks

nichky

Do you know what a difference between default and stub and totally stubby area? Which types goes through areas,which no? and whats the goal?
The answer will be dependent what you want to do

https://networklessons.com/ospf/ospf-ls ... explained/

nichky

inject-summary-lsas=no

nichky

if you want to sleep better, play with totally stub area

nichky

This log comes form R1 and it says:
IPsec_IN = 0c:5b:54:40:0b:00 belongs to "R2"
IPSec_OUT = 0c:5b:54:98:f9:00 belongs to "cl1"

nichky

I have been testing many tunnel like EoIP-IPSec, IPIP-IPSec, L2TP-IPSec. Only i found that this rules makes traffic when i'm playing with tunnel mode, on any other it doesn't make any traffic at all.

i'm waiting for your comment

nichky

It shows excellent the process how it goes. Just i'm wondering in which scenario can i use like for example L2TP-IPSec or some other situacion.

That was my question

nichky

actually what it does?

nichky

transport?

nichky

From default configuration:

add action=accept chain=forward comment="defconf: accept in ipsec policy" disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" disabled=yes ipsec-policy=out,ipsec

Does it affect only for tunnel mode?

Thanks

nichky

did you make a test? what your result say?

nichky

As i understand it goes with Ping Start After Boot, so when Watchdog happen it will be ping time out for 60s and then process will start over

nichky

At the moment i don't have router who supported *) led - added "dark-mode. Just im wondering how does it look like

*) led - added "dark-mode" functionality for wsAP ac lite, RB951Ui-2nD, hAP and hAP ac lite devices;

nichky

so what was quastion ?

nichky

i'm wondering what's the issues?

nichky

@vecernik87 That is the new update:

nichky

*) ipsec - allow multiple peers to the same address with different local-address (introduced in v6.43);
Thanks for including this fix.
It works ok now

i pointed on same things

nichky

@nichky Best would be to check your detailed logs from both server and client. There will be your "unknown" reason written. It is highly possible that you don't have enabled such logging, so you will need to add logging actions for topics "ipsec" and "l2tp" (one action for each topic) and once your...

nichky

Actual reason for this rule is that packets that should match ipsec policy must not be masqueraded. Masquerade will change source address and packets will fail to match against ipsec policy. That much better explanation. Thanks mrz i got L2TP-IPSec between two location and i'm having l2tp-ipsec dis...

nichky

Just i reset my router i by default, and i have seen this one. Need explanation about yellow highlighter:

nichky

set up dns, as i can see you dns looks like blank

nichky

how your DNS looks like?

nichky

ooooo..why?

nichky

I have l2tp-ipsec between two MikroTik. I need that for one simple reason i can't open one one the website in the city where im living at the moment. For that reason im using "Policy Base Routing". Evrything is okey. Just i've seen l2tp disconection, not very usual. It goes after couple of days..may...

nichky

if i choose one of the frequency and also on Scan-List. What's the point of XX?
My question is how correct do i need to set up frequency and Scan-List to get better result, with XX?

nichky

So when i'll play with XX i have to set up frequency=auto?

nichky

I had same issues.
Play like that:

- Policy Proposal:
Auth. Algoritms: sha1,sha256
Encr. Algoritms: aes-256 cbc

- Peer Profile
Hash Algorihms: sha1
Enccryption Algorithm: aes-256

btw i'm using v6.43.2

nichky

These warnings were added based on this research paper which explains how pre shared keys are vulnerable to offline dictionary attacks even in main mode and IKEv2. https://www.ei.rub.de/media/nds/veroeffentlichungen/2018/08/13/sec18-felsch.pdf Just i want to get more information from your link. Can...

nichky

since 6.43
*) ipsec - added warning messages for incorrect peer configuration;

You can use what you want, it's just reminder.

nichky

I know what you mean.
Thanks a lot

nichky

okay, i got activated allow-dual-stack-queue on my clients and im using ipv4, but nothing happens in QoS side.

nichky

i'm interested WHY and WHEN,because as soon as pressed "Make Static" by default is enabled

*) winbox - added "allow-dual-stack-queue" setting to "IP / DHCP Server / Leases" menu;

nichky

Why this?
*) winbox - added "allow-dual-stack-queue" setting to "IP/DHCP Server/Leases" menu;

nichky

Wielkie dzięki

nichky

Can i get information what does it mean and where can i use?

*) wireless - added option to disable PMKID for WPA2;

nichky

harvey, what kind of routers do you use?

nichky

wow thanks a lot

nichky

@lustyffh

what you expecting, to run dhcp-server on interfaces who is in the bridge? ncncnc

nichky

wowww

nichky

@Serafimko

If you are not familiar with new 6.41 vlans. This pdf doc is very useful.

https://mum.mikrotik.com/presentations/ ... omeini.pdf

nichky

Jotne well done

nichky

nichky

Thanks a lot

nichky

i made L2TP/BCP tunnel. Works fine.
Just i've seen in "ppp profile Bridge Port Priority and Bridge Path Cost" What it does?

i'm wondering can i improve my tunnel using this tabs?

Thanks

nichky

Hi sindy,
same question where did you find that 7621 switch chip does not support VLANs?

nichky

i think you need script. im not expert of scripting.
Basic solution will be do both script like:
/interface pppoe-client disable [find] and set up on scheduler time and interval and
/interface pppoe-client enable [find] also set up on scheduler

nichky

yeee i found.

MTZ say Yes, it is possible to configure pptp client/server, l2tp client/server at the same time

nichky

Because different clients use different proposals on their end and if the proposals of the peers don't match in at least one algorithm for each purpose (authentication, encryption, initial key exchange, PFS), the connection cannot be established. So nothing on the list of auth-algorithms of your pe...

nichky

i add sha1 in proposal,now it works.
Any explanation why it goes like that will be great

nichky

yes it is

nichky

i'm trying to establish L2TP tunnel.
Issues become when accessing by iPhone
MT to MT works great.

I haven't tested it by android i'll try today

nichky

Can you update your script. So it works pretty well but, what i found is when im opening the file it goes like 0C:EA:99:97:XX:XX0C:EA:99:79:XX:XX Can you change to get information like:

0C:EA:99:97:XX:XX
0C:EA:99:79:XX:XX

nichky

Same, just let schedule knows

nichky

From where does it come 10.132.104.1?

nichky

viewtopic.php?t=119469 uses $leaseActIP for cleanup and is working fine. Are you sure that $leaseActIP is empty on deassign?

nice one:)

nichky

see here

https://mum.mikrotik.com/presentations/ ... omeini.pdf

nichky

Hello Experts, We are trying to connect 2 points using VPLS tunnel, the client is trying to pass MPLS traffic, but he can only ping in one direction with MPLS, ping works on both sides, I am not sure if there is a setting I am missing, as everything looks good. Anybody tried to pass MPLS traffic in...

nichky

That works

nichky

What is your quastuon?
Yes you can combain thogheter Gre-tunnel with Ipsec.
The peers can be dynamicly or you can set up (im preferring manually)

Also if one side has dynamic IP, still you can use Gre-TUNNEL.

nichky

florid, on wich MikroTik have you got this configuration?

nichky

set local-address to 0.0.0.0 then it will be automatically picked

Yes, simple easy.
Thanks

nichky

interesting case, Korg how your conf looks like? So if you set up ip address (GW) on any interface where EoIP-tunnel goes and connecto to other side with similar ip address, you can deliver everything you like you can access to your device and so on. Just set up correct MTU watch out from fragmentat...

nichky

sindi i was waiting for your answer.

I was thinking to do VPN between two MikroTik and from my side if i want to access someone "mark routing" (mark where i want to go) and fly where want to fly

Thanks

nichky

it's possible to reach other side let say i got MikroTik on B location, but i want to change my public ip or clone my ip because i don't like other side see my real ip. Can MikroTik do that?

nichky

The firmware has gotten in sync with RouterOS versions....even if nothing has changed in the firmware. I hope one time it will be separated again and as extra information a second version number stating minimal RouterOS version. brow..you doing upgrade on your firmware or NO after new version cum u...

nichky

do i need to upgrade the firmware every time when new version comes out?

nichky

Interesting, have you got already test results from those two versions.

You don't need to do special for me,but if you got that..will be interesting for us to see it

nichky

only this CCR1036 had bgp?
Before 6.41 was everything good, did you see any issuess?

nichky

Check it out, there presentation about MPLS/VPLS.
It helps me to find out how the fragmentation happen.

https://mum.mikrotik.com/presentations/ ... 282068.pdf

nichky

Can you quickly do only tunnel without IPSec and do test. And how you checking your result by B-test, watchout B-test is CPU extensive.

nichky

So you playing with tunnel mode and you didn't set up NAT or RAW rule to accept your LAN and LAN from other side. Can you ping other side?

nichky

@millenium7 Just watch out of MTU.Set up correct MTU because any single interface has own MTU

nichky

@nicku How your firewall looks like? use RAW instead of NAT.

nichky

since MikroTik has been removed P2P on Mangel,what is another solution,only Layer7?

Thanks

nichky

@ipro Where did you see different value of MTU on your network,only on test result, right? Ping on MPLS network is different behavior. After "Solved..... Reset configuration and re configured again"------>>> Did you check MTU value,it's same or...different like before? Why you have added large value...

nichky

Sten is correct. Interface MTU is irrelevant when the packet egressing is an MPLS labelled packet. I usually make the MTU the same as my MPLS mtu purely to make fault finding easier e.g. If 1530 byte packet with DF bit set will traverse the path than 1530byte MPLS packet should, if it wont pass the...

nichky

export your conf

nichky

have you got any issues except this one?

nichky

I'm trying to implement the kid control solution for my clients, releasing control over sxt http, but version 6.43.2 is presenting this bug in the attached photo. When I have a solution in mind, some of my clients are anxiously waiting, and I'm also making it easier for them to control their babies...

nichky

viewtopic.php?t=45209

nichky

and how you access, on same way, just you regenerate-host-key (y/N)=y, right?

nichky

I found some strange i want to share with you. I've got issues with limitations the traffic. Simple i can specify the time e.g. 15:00:00 17:00:00, and if i set up same on Time For Rate Limited: 15:00:00 17:00:00 it will no work. I have to set up like 15:00:00 15:00:00 Rate Limit=1M Anyone can shere ...

nichky

I will repeat again.

The only thing that you have to do is to adjust "packet size" or disable if you don't know what is does. And that you can set up priority on QoS. that's it.

How you testing does it work or no?

nichky

try to disable Connection Rate

nichky

disable it

nichky

Of course it does, just adjust "packet size"

nichky

Did you set up priority?

How did you try . Did you call someone?

nichky

Nice

nichky

it haped by it self? Your divace looks black , did you instal near chimney?

nichky

wich tab from HotSpot does?

Search found 522 matches