MikroTik

mada3k

I use a Meanwell tuned to 27.2V to float-change two SLA's, But my stuff is 11-30VDC.

27.2V is a bit to close to 28VDC. I would probably add a diode or L7824 or a diode (like MBR1060) to drop the voltage some.

mada3k

CRS112 is not a router. You bought the wrong device.

mada3k

I also suspect that it's only some boring cloud-VM.

Or maybe it's a new container & storage appliance?

mada3k

Anyone defending PPPoE is plain stupid or too old and should retire while they can.

There seems to be an obsession with PPPoE in some countries, even in multiple gigabits FTTH days.

In Sweden it was used by some xDSL providers for a short while.

mada3k

QSFP (4x10G) can't be converted to SFP28 (1x25G) of obvious reasons.

mada3k

It's correct that IS-IS uses it's own protocol for adjacencies, but you need either IPv4 or IPv6 support to make something useful of it.

OSPF is built around/top of IP
IS-IS has support is extensible and has support for IP

mada3k

No need for heating

I once had a computer (not powerfull) in a cold garage. It was put in an insulated box, with a temperature-regulated fan. When it got very cold, the fan stopped, hence keeping the heat.

mada3k

Upgraded my RB5009+three AX2 to 7.12 but still I have very slow speeds on my local network (around 23 MB/s) between my iPad and my NAS whereas I had around 50 MB/s before 7.11 or so. Don’t understand what to do.

Most likley wireless conditions change in some way. Wireless is wireless.

mada3k

Are you using shielded cables?

mada3k

As many already have said, you can't add and summarize bandwidth that way. However you can distrubute the load/sessions.

mada3k

I don't work for a Tier 1 Carrier so I don't know. Yes, Ciena seems to offer it as a high-SLA metro-service concept

mada3k

No, it's mainly used for specialized industries like utilities, industrial, military and so on. When were are often talking Megabits but needs to be very reliable and ultra-fast recovery scenarios. But It could be used as a transport for legacy services on a bigger carrier operator. EVPN and MPLS-TP...

mada3k

Thats one issue with Mikrotik. They just don't have "basic everyday models", they build unicorns.

However, "easy to use and modern graphical interfaces" is not something thats preferable.

mada3k

MPLS-TP is not legacy, but its a niche market.

Correct, there is no reason for Mikrotik to invest in MPLS-TP, since it requires specialized hardware to make any sense.

mada3k

Well, It's often used as a replacement for legacy TDM-like tech, transporting synchronous and latency sensitive applications.

mada3k

MPLS-TP is a very different concept. It often requires and specialized hardware and provisioning concepts to make any sense of it.

mada3k

Yes, you can "bypass" CGNAT with a VPN provider with public IP or VPN to a cloud-hosted host with an public IP.

mada3k

We are using mac-telnet as a sort of "zero touch".

But no, there is no way of downloading a new config at boot via DHCP/TFTP like a Cisco device to my knowledge.

mada3k

i'm guessing that there's more work to be done. Not sure if it will ever work with "switched" ports in some way, only "real" NICs.

But it would of course be great if it got support.

mada3k

I for one can not get my head around openwrt. The base system and packaging is great, but the "uci" is just horrible in comparison to IOS, JunOS or RouterOS. What exactly is confusing? I work with Juniper, Arista, Huawei, MikroTik, Cumulus Linux, Debian/Ubuntu+FRR. For example - The VLAN ...

mada3k

Whats wrong with psu1-voltage & psu2-voltage ?

mada3k

RouterOS can be, very confusing if you are very in to like Cisco/Juniper for since many years. It also can be very confusning if you are a DIY Linux/OpenWRT person and are looking for files to edit. One "drawback" is that you can accomplish things in different ways, with pros and cons. Thi...

mada3k

PPPoE is very CPU heavy without hardware offload (witch Mikrotiks doesn't have) For 3Gbit PPPoE troughput you probaby need at least a CCR2004-like device.

To expensive? Downgrade your Internet connection or choose a non-PPPoE provider

mada3k

Some Supermicro board with 2x10G ports.

mada3k

Many many many times yes. But not a RB450G.

Make sure that you haven't disabled it under /port och /system/console

mada3k

On the other hand - you really can't buy a Nexus or QFX without a pricey support agreement (except for second hand)

mada3k

"production-grade" is a strange term of use. What your are talking about is a serious datacenter-switch. Yes, Mikrotik should implement EVPN support. And Yes, they should implement MPLS/VXLAN hardware support if possible. TCAM space comes with a cost, and makes no sense for a regular enter...

mada3k

Probably some minor vulnerability that makes the web-server crash

mada3k

The issue is most likley the lack of insuffiecent buffers to handle the "speed conversion". A lot of cheaper switches suffers from this.

mada3k

On the other hand, using a PC, depending on the CPU, it can handle more traffic than almost all MikroTik models, especially IPsec. Of course, but is that really an issue when talking home/small office case? The main reason for on running a PC is that you either like to roll your own firewall (linux...

mada3k

All operating systems works like this. Permissions are checked at login - not during session.

mada3k

The drawbacks of using a PC as router/firewalls is power-up time, power consumption, size, number of ports, lack of hardware switched ports, etc.

mada3k

The DAC most likely doesn't have a temperature sensor since it's a DAC.

mada3k

Thumbs of for IS-IS support! MikroTik should make use of DPDK for packet forwarding/originating from the router itself and use XDP hardware offloaded mode for packet filtering. Their existing hardware line can definitely hit peak line-rate performance. Maybe, maximal possible throughput at any cost ...

mada3k

I know about BFD and we use that as well. But thats only for detecting issues faster than the IGP itself. But there is no "penalty" concept so it triggers constant IGP recalculation. And it only works for L3.

mada3k

Should work, albeit you need to do some string-spilt to get the actual value.

 > :put [/tool/snmp-get address=192.168.1.1 version=2c community=xxxxxxx oid=.1.3.6.1.4.1.14988.1.1.7.6.0 as-value]
oid=1.3.6.1.4.1.14988.1.1.7.6.0;type=octet-string;value=Apr/07/2022 17:53:31

mada3k

This is very useful when running into bad cabling or having problems with underlaying equipment. This should cover routing protocols as well, where sudden packetloss somtimes tiggers constant adjacency change between routers. It has been present in other vendors for many years now. https://www.cisco...

mada3k

I suppose that the UPS network module supports SNMP. Then in theory you could use /tool/snmp-get and some scripting to regulary ask the UPS of its state.

mada3k

Its a strange quirk indeed that you need to add the bridge to itself as tagged

mada3k

I use address lists as IP-aliases or "host objects" in firewall.

mada3k

€300 is quite reasonable for a 5G all-on-one box. In my country they are priced around €400-900 - witch is indeed expensive. I'm guessing that the powerful CPU and multiple radio/antennas help push the price up, not only the 5G modem.

Maybe the should release an antenna-modem-bridge only device?

mada3k

Those pins is a 3.3V TTL-level UART port - not RS-232. You will probably damage the device is you connect a regular RS-232 port there. You will need a MAX232 or simmilar chip to make it compliant with RS-232.

mada3k

You might need to allow input of ether-frames 0x8847 (mpls-unicast) somehow.

mada3k

Running with connection tracking off cuts down CPU usage quite much since connections doesn't need to be kept or matched. You really should consider creating raw rules.

If you are using L3HW support, then you could create rules under /interface ethernet switch rule maybe instead.

mada3k

Bump. This is really a product segment Mikrotik should consider. The market today basically consists of either stupid dumb, or overpriced industrial variants with horrible and outdated software OR astonishingly expensive Cisco IE-series stuff. Something performance-wise like the hEX or new L009. 2 S...

mada3k

Be very careful not do cause unnecessary writing to the filesystem and wear out the NAND.

mada3k

If you are configure correctly, then the performance will be same on both OS. The difference is in management and features.

mada3k

This is a rather pointless feature and should be removed.

mada3k

The 1072 is quite old. Would not recommend it. All CCR10xx only does software routing, hence there is no real upper limit (except for memory) CCR2116 is a better choice. However, No Mikrotiks can hold million of routes in hardware. Not sure what a MX5 does but probably more, since a couple of factor...

mada3k

Will this apply for higher end models as well? (like CCRs) What will happen when you do a reset? Go back to the on-label password?

mada3k

Interesting. I think it's best practice not to have any chance of overlapping LSR-ID's, but I'm not sure. It will probably work. We have solved our redundant tunnels with basically terminating twice (in core1 and core2) and let RSTP decide path. We also have some EoIP tunnels, but those are bound to...

mada3k

Or have an DC input in addition to AC like the recent ones.

mada3k

Judging by the inside photos, there seems to be a resonable sized transformer, often used for isolated DC/DC. But if the negative input is tied to the chassis is unknown.

mada3k

The correct choice to do

mada3k

Two VmWare ESXi servers with two 100-Gig ports ( 4 ports for redundant communications) Two NAS server with two 100-Gig ports ( 4 ports for redundant communications) Two 100-GIg uplink/downlink ports to other switches ( 2 ports) So far - for a simple tiny network room of 2 servers and 2 nas devices ...

mada3k

Well, the CRS504 is not designed for server-rooms - it has all the wrong features. It's made for a city/metro network as I see it.

Go buy white-box/bare-metal 100G switches if you need it for you servers. Don't see the point why Mikrotik should make it.

mada3k

What is untagged in a CRS112 then, VLAN ID 0 or 1?

That means that I need to allow it on all trunks I guess? on edge/accesses also?

There seems to be a lack of examples how to set this up in the wiki/help

mada3k

We use CRS112's as "CPE" like nodes in our network, to terminate customer services. On some occations we daisy-chain two switches with optical or RJ45 between. We usually setup switching under /interface ethernet switch section and no use multiple bridges. One management-VLAN and others fo...

mada3k

I use SNMP via collectd->influxdb->grafana. But just for interfaces/load.

mada3k

whats "hotspot over VPLS"?

mada3k

*) console - added option to create new files using "/file add" command (CLI only);

Thanks! That makes future deployments so much easier!

mada3k

As long as the power & cooling-requirements for the module is taken care of then it should work just fine.

mada3k

The switch-chip must also support NBase-T standard. 10GBase-T/SFP+ does not imply 2.5G support. Nbase-T is an later standard.

mada3k

Because in a lot of buildings, such as hotels or apartments, replacing the cabling is not an option. The cost of removing the walls is the cost that you might as well spend on building an entirely new structure. Are they molded into the concrete? DOCSiS I can understand since it's buried into the g...

mada3k

MoCA is strange, why not just replace the Coax with Cat6 or fiber? However, I can agree that it's quite impressive that they managed to squize that into a SFP module, but I'm sure it runs terribly hot. I wish Cable ISPs provided two alternatives - one all-in-one-wifi-box for the consumers, and one m...

mada3k

Really cool devices, but do you have any plans to support SPB, EVPN, CE or similar? Feels a bit wasteful setting up a 25G/100G links with plain RSTP (witch results in a lot of unused links). Or is the idea to not use and L2 at all?

mada3k

Personally I think Mikrotik should stop releasing dumb equipment with great numbers. There are already cheap stuff on Aliexpress for those who just want the numbers.

With that said. A 24/48 1G+2.5G combo switch with and without PoE and maybe 2-4 SFPs would not hurt. But NOT with SwOS.

mada3k

GPON is unfortunally what it is. It's an active intelligent component and not just a SFP transciever. In essential it's part of the providers network.

Fortunally in my country PON is very very rare. All FTTH networks here uses BiDi SFP-based and can usually be moved to whatever equipment you like.

mada3k

RB5009 + AP

mada3k

You have misunderstood what a container is.

mada3k

Well, the CRS112 maxes out on ~80Mbit of IP-routing, so it's not a good router. A ring of switches is not a great idea either. I would: - Assign one VLAN for each site with its own subnet. - Use the CRS317 with Inter-VLAN routing and run OSPF between them and the CCR1009. - Put a router before or af...

mada3k

Yes, the Internet Detect issue is not solved yet. When it will be fixed, then that will be mentioned in the release notes. We are aware of a problem with Detect Internet. Best solution would be to just remove it. It did not work out, it does not solve any issue or provide any useful function, yet i...

mada3k

This is why Mikrotik should not bother with the Consumer/Ho-market.

Side-note: CGNAT-providers should provide more than one CGNAT-adress to avoid NAT-over-NAT issues.

mada3k

Please don't confuse L3HW with NAT Firewall

mada3k

We have done that with CCR1009. Beware that "48 volts" often means negative 48V. So the chassis must be isolated from ground/earth.

mada3k

Not going to read all details, but you are having a server on 10G and a client of some kind on 1G at the other end? Mikrotik switches are known to not have big packet buffers - and when you try to feed a lot of data into a smaller pipe, the packet buffer on the switch takes a hit, causing packet dro...

mada3k

Not everyone has LAN/Fiber, I have a Coax DOCSiS modem put in bridged mode.

Find a DSL modem that supports bridged mode or some passtrough mode.

mada3k

Tried setting static speed/duplex and disable auto-nego?

mada3k

From Cisco: https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-9300-series-switches/white-paper-c11-742415.html (emphasis mine) I applaud and welcome the fact that we also get it on the little ARM/ARM64 boxes. In the coming months, out of the hundreds of RouterOS devices I have ins...

mada3k

... Well made points. The market is already flooded with SDWAN, IDS, NGFW stuff, and it's probably very hard to gain any foot there because those who want's this are willing to pay for it. But RouterOS is the only alternative I know besides the "giants" that does advanced BGP, BGP-VPNv4, ...

mada3k

And there is no info about the SFP either?

Copper SFPs can be tricky, especially when mixing vendors. Always try to force speed & duplex.

mada3k

Some SDWAN solutions can detect protocols, hostnames & applications and take decision what path it should take. It's great for it's purpose, but often proprietary. <Raises hand> Um, I have six 2116's and just bought two more.</hand down> I also have a farm of NUCs, Mac Mini's, and Mac Pro 5,1's ...

mada3k

What about having different ROS versions for SOHO boxes and serious routers? So one team can work on nerdy-stuff like containers and similar and another team can work on finally fixing and implementing basic routing stuff for CCR2x16 boxes? I tend to agree. I can see that making RouterOS interface ...

mada3k

No core routing (BFD,EVPN, buggy VPN4) functionality for routers

Would be nice to have an alternative to hideously expensive Cisco/Juniper/Arista EVPN switches instead of relying on spanning-tree.

mada3k

I would wait until they actually releases any SAN/NAS hardware, or else it's pointless (since it exists so many NAS platforms for generic x86 already) in general called SD-WAN. This is implemented in v7 using ZeroTier. Thats properitary and requires a central controller somewhere, and can't co-exist...

mada3k

Fasttrack is just a software acceleration scheme. L3HW uses a on-chip routing table with in-chip lookups and forwarding.

Pure L3 routing = no firewall rules, no connection tracking, no QoS, no NAT, no mangle.

mada3k

This is a disappointing release as 7.8, should have been 7.7.1. When are we going to see Mikrotik address those critical route/switch features that most enterprises use. Specifically: 1. BFD fixed 2. BGP-VPNv4-VRF RR fixed 3. Something equivalent to Cisco DMVPN, HP DVPN, Meraki AutoVPN, or Fortinet...

mada3k

documentation draft:
https://help.mikrotik.com/docs/display/ROS/ROSE-storage

Intresting. Mikrotik planning to enter the SAN/NAS business?

mada3k

I would not trust a switch as a firewall. Only for pure L3 routing.

mada3k

These are getting a bit old by now. The capacitors are probably going end of life.

mada3k

For speeds over 100Mbps, you should buy a proper router, not a switch with limited CPU resources.

mada3k

I am still stuck on a CRS125 routing at 1Gig??? It's primarly a switch. If you can afford 2Gbps of Internet then you probably can afford a router that can handle it as well. Cries in 50/10 internet connection And I'm on 100/10. I can upgrade to 1000/100 but thats €89/month and simply not worth it.

mada3k

Creating a new file and appending input from CLI. Adding a new public ssh key as file, and importing it to a user. Today it has to be done via SCP/SFTP, then imported.

For example:

/file add name="user.pub" content="ssh-rsa XXXXXXXXXXXXXXXXXXXXX"

mada3k

The host table doesn't show IP or VLAN ID... Ugh.

I't cant show IPs of connected hosts, it's a L2 switch

mada3k

SwOS is unfortunally just impossible to manage in scale since it's a basic web-managed switch with no security or central managebility. It's for pure home-usage.

I could have been the successor of the excellent CRS112

mada3k

The 2Gb pipe will come through ethernet.

Yes but at what standard? A single 2.5GBase-T ?

mada3k

I agree, SwitchOS is a no-no for some envoriments.

mada3k

Why on earth would you use USB instead of PCIe ?

mada3k

An Rb5009 for example.

How will this 2Gbit line be delievered? As a SFP+, 2.5G SFP or 1G 2xRJ45?

mada3k

I use OSPF between two locations with 3-4 subnets on each side just for simplicity. Sure, you can use EoIP, but why would you need to carry VLANs over Internet? IPIP has lower overhead. Just point the dhcp-relay to the Windows DHCP server at HQ. Traffic/network isolation and will be done in the near...

mada3k

I agree, setup some IPIP-tunnels and run OSFP over them. Let each branch access Internet by themselves.

For DHCP you can use the dhcp-relay service. DNS can continue to point at the HQ.

mada3k

Just a bunch of Chinese development boards with horrible software support. Where is the actual products?

mada3k

This may be a valid point. But wouldn't this cause all devices offline? For example in one city in Germany I have two devices. They were both online when I was last there to install them. After 2 days one of those devices went offline and never got back. One is always online since then (>1week). Or...

mada3k

Ericsson F5521gw

At least in my country, all providers are shutting down 3G services (making room for 5G) this last year. Maybe that's you old 3G modems are getting kicked out.

mada3k

The 1072 was probably a bit on the bleeding edge of reasonable hardware design.

mada3k

USB-PD needs quite complicated logic to provide more power than a regular USB. That logic comes with a cost.

mada3k

No. The CPU does the FIB calculation, then the forwarding is done in hardware.

mada3k

The biggest drawback of the rb1100ahx4 is the lack of SFP ports otherwise a great router.

mada3k

Depending on the specific function and workload, Mikrotiks might be able to do the job.

You simply have to buy and test, but it will never "replace" a MX204 or a Cisco ASR as a complete product replacement.

mada3k

Tried setting no-negotiate and static speed & duplex?

mada3k

Probably none. It's quite exotic with x86 boards with built in manageable switch chip.

mada3k

It's also the one of the hardest protocols to get right when developing for an ASIC so tackling easier protocols first is understandable.

I'n my view it should be the simpliest. The MPLS FIB is basically Label in & out and swap or pop.

HW NAT and/or HW IPv6 sounds like a logical nightmare.

mada3k

Sometimes it's very useful to be able to daisy-chain some APs when new cabling is not possible.

mada3k

The most cases of inter-VLAN routing have some kind of firewalling in mind, and that most likley will break the HW acceleration. The hardware can never fit a full real-life Internet BGP-table either.

MPLS is used by many smaller WISP/ISP for VPLS services customers and VPN VRFs.

mada3k

It's a bit strange to begin with IPv4&6 HW offload, and not MPLS. All major providers use MPLS for carrying internal traffic between core nodes. IPv4/6 offloading only work with plain forwarding, and people except to be able to use complicated firewall rules, nat, tracking, pppoe, tunnels and ot...

mada3k

I say that it's a great feature to be able to power both 24V and 48V systems with the same device, depending on what powersupply you use. If you don't use any PoE at all then you can just use a simple 12V/1A plug to power the switch itself. But I see the hassle then someone is buying a "PoE swi...

mada3k

I've have run RouterOS x86 bare metal on some old appliances. Sometimes it worked and sometimes not.

But the machine your linked to is very new, so I would probably use some Linux KVM or FreeBSD/bhyve, then CHR on top.

mada3k

I would say that the performance is astonishing for a router released in 2016 for $60

mada3k

Usually <0.5W is only possible with sleep/deep-sleep modes, and that usually stops many functions in the operating system, something a router/gateway never can do.

KNOT is not the IoT device, it's just a gateway.

mada3k

I also would use arduino of some kind that acts as a timer and turning on the KNOT. But I'm not sure how much the KNOT likes to be powered down/up all the time. The only better way is to do your application in an arduino/rpi-zero/esp32 native and connect it to a NB-IoT modem of some kind. For exampl...

mada3k

Are people buying this as a cheap dual 25G NIC?

mada3k

Looks like it's on the +12V rail. Try to verify that there is not a short after the fuse with a multimeter.

mada3k

I'd rather kill myself than using juniper or cisco again....

Don't mind working with juniper & cisco devices, but the cost is sometimes prohibitive and I hate working with licensing.

mada3k

Sounds like a horrible idea with only two ports.

You you need to NAT/Firewall 10Gbps of traffic, then you probably can afford a CCR2004-16G-2S+PC

mada3k

"totaly useless" sound a bit over exaggerated. But it would be better if the used routes where offloaded, not everything.

mada3k

As I mentioned earlier, we are talking about a wAP AC - so there is no switch chip to take in consideration.

DHCP and firewalling is done on another device behind the switch, so that's outside this topic.

mada3k

Thanks, I'm aware of CAPSMAN but it's overkill for my home. ether1 runs to my central switch. 30 is currently for all clients, 39 is for management. It's the vlan-mode=use-tag vlan-id=X bits I'm a bit unsure of. Should it be used or not, and then how? /interface wireless add master-interface=wlan1 n...

mada3k

Hi, I'm a bit unsure here. What is the correct way of setting up virtual SSID's that related to some VLANs? I'm using two wAPs at home and would like to create a guest SSI and maybe some IoT SSID as well, that ends up on separate VLANs. Current setup: /interface bridge add name=bridge1 protocol-mode...

mada3k

Can't have a hAP in the ceiling. When is the cAP/wAP ax ready?

mada3k

FreeBSD is indeed a wonderfull OS, but it's most likely up to the kernel developers to implement the Mikrotik-specific stuff in the alc driver, that have been done to the Linux kernel one.

mada3k

As chechito says. The flash memory sits on the SPI-bus. Are you using the flash memory for something?

mada3k

Waiting for the cAP or wAP version.

mada3k

I would recommend ditching PPPoE at such high speeds. It's just unnecessary overhead.

mada3k

Everything is not about speed.

mada3k

Not use I understand what your asking for. Just create bridges for the different services/tentants. i.e. eoip-cust1-serv1 <-> bridge-cust1-serv1 <-> Ether1 eoip-cust2-serv1 <-> bridge-cust2-serv1 <-> Ether2 eoip-cust2-serv2 <-> bridge-cust2-serv2 <-> Ether3 eoip-cust2-serv3 <-> bridge-cust2-serv3 <-...

mada3k

bad idea running user manager on a switch

Agree

That's the issue with many users of RouteROS. When everything's possible, then it's suddenly possible to do stupid things, and then you run into problems.

mada3k

It's possible that the FCS bits is completly unused to keep complexity down. Any bit-errors will just show up as "bad pixels", thus no point to discard the whole frame.

mada3k

CSS610-8P-2S+IN looks good. Would prefer CRS (RouterOS).

Agree. We simply have no use for CSS series because the lack of security.

mada3k

One of my customers is subject to PCI DSS quarterly vulnerability scans. They sent me a report which enumerates several problems with www-ssl service (Webfig over TLS). What is doing the scanning and why does it have access to the Mikrotik admin interfaces? The auditors often requires and asks for ...

mada3k

Are you sure that the LED displays are talking valid Ethernet and not some custom protocol?

mada3k

SwOS doesn't support Winbox. Only HTTP management.

mada3k

Much better with separate devices.

mada3k

PowerPC is certainly soon dead. Some telecoms-vendors still hang on but the next generations will be ARM or embedded x86. ARM is more or less replacing MIPS in SoHo devices.

RISC-V, haven't seen a single device with it yet, a part for some development-boards.

mada3k

It's probably RS-232 3.3V TTL and you should be able to run MODBUS over it yes. RouterOS has built in "Terminal server" capabilities. But it will not automaticlly be MODBUS-TCP (port 502)

mada3k

You already seems to be behind three layers of NAT, so getting a public IP adress on your own equipment looks very unlikley.

mada3k

Indeed. We tried to order a couple of Catalyst 9200's and got dates in 2023.

mada3k

Running SMB over Internet sounds like a horrible idea. Not even sure it will work behind NAT at all.

Use some VPN tunneling at least.

mada3k

How long is a rope?

What is the purpose and use case of the router?

mada3k

I think we are talking about two things.
A "device manager" that acts as a hub for CPEs and stuff.
And a conventional NMS that actually monitors and manages a network.

mada3k

TR-069 is horrible and basically just good for customer CPEs.

There should be two ways for handling management. API from devices to the management server (for devices behind NAT) - and - direct management/monitoring (as in the management server is reaching directly to a device via ssh or some api)

mada3k

- As a VM appliance - Web based. Not phone apps and such non-sense. - Manage software updates, pushing out updates in a controlled manner - Configuration templates, backup and change-logs - "Global rules" such as firewall, access-lists and so on - REST-API for integrations with other syste...

mada3k

It's probably running over the same I2C-bus as the sensors, and the ONU corrupts the data.

mada3k

Basically a CCR2004-16G-2S+ but as a pure switch.

mada3k

Smells like MTU issues. What the the maximum allowed MTU on the line between the CCR'es?

mada3k

Reasons for redundancy is of course availability and ability to perform maintenance without downtime.

If it's acceptable with an hour or so to restore functionality, and if you can plan downtime for maintenance, then you're fine with "spares on the shelf".

mada3k

Hmm... MTU or fragmentation issue?

Just start count the overhead backwards from the MTU used by your ISP

mada3k

Probably the wrong choise for general storage network and such things.

mada3k

It's indeed a very nice backbone/ring product. ETSI-format, 48-volts. etc.

"ToR" 10/25/40/100G datacenter switches is a completly different product category.

mada3k

You are not using the PTP/IEEE1588 functions of the Napatech?

mada3k

Well, thats sometimes the downside with selling highly configurable devices to pure home users. It's no difference to having "admin/admin" configured Cisco-routers at every home with telnet open. ISPs in my country tend to ship very dumbed-down devices with basically no user-configuable se...

mada3k

You can't bridge two bridges, just use one bridge then with VLANs (to separate access)

But you can route IP traffic between two bridges.

mada3k

NetXMS and Ansible

mada3k

Is anyone really using RIP anymore?

mada3k

I agree, NGFW is a stupid term. Also, it starting to fade out since everything moving to the cloud and you use local firewalls and (H)IDS software on all nodes instead.

mada3k

Did IPv6 and MPLS get enabled for hw-offload? I'm pushing 1.6Gbps over VPLS using LDPv6 through a CCR2116 P router and have two CCR2004-16G-2S+ acting as PEs The routing/route output shows IPv6 labeled prefixes as hw-offloaded and the cpu on the CCR2116 is only at 4% under a 1.6Gbps load Wow!!

mada3k

Can't get it to work either

  File "/usr/local/lib/python3.9/site-packages/paramiko/transport.py", line 1498, in auth_password
    raise SSHException("No existing session")
paramiko.ssh_exception.SSHException: No existing session

mada3k

But isn't quite inefficent to try to store millions of routes in a HW FIB ? Cisco once solved it many years ago with caching "active traffic" in the hardware, but letting "unused" routes just reside in regular memory until needed. It's not likley that you will communicate with th...

mada3k

So Mikrotik should try to get into the market of enterprise storage now ?

Isn't that quite a saturated market by now.

mada3k

Buy two?

It's still a 10th of Cisco/Juniper 100G stuff.

mada3k

All routes in WebFig doesn't show up.

mada3k

Well done!

Everything should have DC power input.

mada3k

Since it's Marvell-based, I guess that will be some Marvell NIC?

Very cool product.

mada3k

I often use ipip-tunnels (alternative to GRE) sometimes for 4 reasons: 1) I like to be able to use traceroute. 2) You don't need to add a tunnel policy for all subnets, just route them trough the tunnel. 3) It makes more sense in the firewall to have an actual interface. 4) I have a feeling that PMT...

mada3k

Connection tracking is a firewall feature, not a router feature.

Personally I would rather see better MPLS-HW support. Just plain flat non-VRF L3 routing is a bit limiting and the hardware can never hold full BGP feeds anyways.

mada3k

Would be rather pointless since EoIP is only static point-to-point tunnels (as between two network devices).

mada3k

You need a mDNS proxy, like Avahi-daemon or similar between the networks/VLANs. This is to forward/relay the mDNS announcements.

mada3k

A proper (and legal) switched power supply should not have any required specific hot or neutral leg.

mada3k

configuration backups
tftp files
logs

I also would love to have a small HTTP service.

mada3k

Aren't most power bricks have an c13/14 and auto-switching 90-240VAC?

mada3k

Running 10 CHR's on FreeBSD/bhyve as home lab.

mada3k

Some VPN types simply don't work over CGNAT. That the reality. IPv6 is the only hope there.

mada3k

Since all ports are indivudal interfaces, and not switched ports, i think that all of them can be bonded.

Note that bonding is a in-software feature that will use CPU.

mada3k

Isn't VLAN translation/re-mapping an option?
https://wiki.mikrotik.com/wiki/Manual:C ... ranslation

mada3k

Well, I would use IPSec, since it will take advantage of the hardware encryption support. Wireguard does not.

Personally I prefer real tunnels, like IP-IP or GRE. But you can use policy based tunnels as well.

mada3k

An 3-port high performance router seems a very strange combination.

mada3k

export -> edit -> import

mada3k

Now I get it... Layer-2 security/filter using Layer-3 addresses.. Switch ACL can never check the L3-adress used.

Hmmm.. Static ARP entries on the router/gateway?

mada3k

I don't get it. What switch? Just use /ip services allow-from=x.x.x.x/yy or setup some chain=input firewall rules?

mada3k

I agree, there should be warnings. Just add a logging action=disk then your done in a couple of months.

mada3k

Many users doesn't understand that the SPI Flash has a limited number of writes, and places logs and graphs on it, hence wearing it out.

mada3k

You should never run Multicast UDP/RTP based IPTV över WiFi.

mada3k

Why not use the IGMP-Proxy ?

mada3k

Any photos?

I've seen a bunch of 1036 under the hood.

mada3k

So, you are provided with a EPL service via an operator from one site to another?

Well, just consider it a regular L2-link, like Ethernet cable from one place to another. No need for tunneling or strange setups.

mada3k

Yes, for example VPLS. If you need encryption then EoIP may be the better choise.

If you are suggesting Carrier Ethernet features, then no, there is no support for CE in RouterOS.

mada3k

Are they using multicast as well? I think EoIP is the thing you need.

On the primary site, add the tunnel to the default bridge.
On the secondary site, create a new bridge and add the tunnel and one physical port for the box.

mada3k

My guess is that they are probably using a simple voltage-divider, and resistors has a certain tolerance (like 5-10%) and that will vary with temperature as well. I would probably take a measurement with a good voltmeter on each individual device, and note the offset from the self-reported value (th...

mada3k

Well, RouterOS is very quick in comparison to HPE, Cisco and Juniper, but not instant. To achieve instant-on, you probably need a dumb unmanaged switch.

Disabling RSTP is probably the only way to make it quicker.

mada3k

Which doesn't help very much if you want to access RB using MAC telnet from Linux computer. There's open source client for MAC telnet (https://github.com/haakonnessjoen/MAC-Telnet), but it doesn't work with newer RouterOS, because MikroTik keeps new authentication algorith secret for some strange r...

mada3k

No thanks. I would rather see a cAP with WiFi6 and 2.5GBase-T.

Search found 708 matches