MikroTik

tuxtlequino

Haha. I cannot believe I didn't notice and nobody else pointed it out. Thank you very much. Will change!

tuxtlequino

I understand. It is a big issue. For your particular case a script would be the best way to setup things. For that reason it may not be the best solution to a lot of people. MikroTik seems to be geared towards the enthusiast and thinkers who want to save money. I would start a new thread and ask how...

tuxtlequino

Well setting a dynamic VLAN without CAPsMAN on a WLAN interface for clients, has always been there.

Wow, I didn't know that. Thank you for the info.

Maybe if you are interested, you could try putting an example of doing that with this configuration. It will be super helpful.

tuxtlequino

What is the purpose of radius server at all here? Why tie in capsman....... Need the so what overall view..... No clue what is an active directory or why its needed......... Hi Anav, Synology Server Directory is an implementation of Windows Active Directory (AD.) Both are directory servers (think o...

tuxtlequino

1. Introduction - Preliminary info NOTE - THIS IS USING SYNOLOGY DSM 7 and their Directory Server Package!! Synology Server Directory is an implementation of Windows Active Directory (AD.) Both are directory servers (think of LDAP) and are very well known to people that have to admin computers and ...

tuxtlequino

Nice writeup, thank you! It would also be interesting to see dynamic VLANs without CAPsMAN, i.e. only with one router and its integrated WiFi capabilities. I wonder how much that would differ from this tutorial. I don't believe that it is possible since there is no way to set the datapath dynamical...

tuxtlequino

To correct the problem I have to manually remove ether13 interface from all bridge VLANs and even manually add the cap interfaces to the bridge VLAN. With over 50 caps that can not be a solution. So has anyone a real solution for this? I posted that question some time ago about this limitation, but...

tuxtlequino

Hi, I am not familiar with Active Directory, and I am not sure if you are using Mikrotik CAPsMan. But the following may help you, https://mum.mikrotik.com/presentations/EU18/presentation_5159_1523293520.pdf I am also including this other tutorial I wrote doing what you want with a couple of caveats....

tuxtlequino

Try to see if this info helps you.

viewtopic.php?p=936639&hilit=radius+vla ... ic#p936639

tuxtlequino

pe1chi's suggestion would be the best in my mind. You could also have static DHCP addresses for staff and use address lists in your firewall filter rules and bypass the AD Group Membership. For example, you could do something like, /ip firewall address-list add address=192.168.40.200 comment="C...

tuxtlequino

@mkx Thank you for trying to help. Hopefully someone comes up with something. It sounded like common sense to me to use the existing "lists" inside the interfaces to configure such a thing. Then you just have to add your CAPs into a certain list and use those "lists" to configure...

tuxtlequino

@mkx Thank you for taking the time to respond and try to help. This is a problem that is related to data paths and RADIUS. I know that it is a pain when someone sends you somewhere to read a series of posts when, but believe me that in this case, reading the posts will give you a better idea. I am c...

tuxtlequino

@Mkx Thank you for the response. Yes, I figured that maybe using the term "bridge" would be confusing. I found out this is something other people have been having problems with before. https://forum.mikrotik.com/viewtopic.php?f=7&t=119494&sid=95dcbca39c04dfed0b2e340d25e7b445#p77926...

tuxtlequino

Okay, this is the question. I am starting to change our setup to CAPsMAN. I am using dynamic VLANs. One of the questions that I have is this. In order to make sure that my dynamic VLAN allocation works, I need to add every single CAP interface into the appropriate "/interface bridge vlan" ...

tuxtlequino

Actually it matters little or nothing what the vlan wants to do. Well. Yes. But have you ever talked to someone new trying to setup Mikrotik about what they wan a VLAN for? It is always good to have the info. Maybe not for setup, but just to make sense of what is going on in their minds. For exampl...

tuxtlequino

MAKE SURE YOU REMOVE YOUR DEVICE SERIAL NUMBER from your code! Okay, let's start with this. 1. Tell me what each VLANID is supposed to do. 2. Tell me what you want your router do to. For example. You want this interface to carry all these VLANs to this other router (or coming from this router). Or i...

tuxtlequino

@mgabriel I think that it will help you to organize things a lot better. I have a system to do so that you can use. 1. Start with your VLANs. Make a table with the purpose and the id. | VLAN Name | VLAN Comment | VLAN Id | | ------------ | ---------------- | --------| | AVoIP-VL7 | Voip, blah, blah....

tuxtlequino

Okay. This is what you need to do. 1. Read what Chechito asked me to read. 2. Understand that when you are trying to use those certificates, depending encryptions you have available is what your connection will do. For example, if you have EAP-TLS and EAP-PEAP and you cannot connect using EAP-TLS, i...

tuxtlequino

Really useful information, nice work! :thumbsup: :thumbsup: Just a suggestion but maybe you should move this thread to a forum called " Useful user articles " -- BR Thank you Larsa. I am not joking when I say that I am new to this. I have no clue how to move this to that place in the foru...

tuxtlequino

So, I have few devices like smart TV's connected in VLAN's and I have NAS devices connected in bridge1, can I establish communications between two or more VLAN's so that I can use NAS devices with my TV's and manage my TV's while I'm on any network..? 1. Are your VLANs isolated from each other? 2. ...

tuxtlequino

If you rather read this on a PDF, here is the file.

tuxtlequino

NOTE: I added a firewall rule that I forgot that was necessary and changed the /user-manager/user/group default auth to make sure you could use this to login into Mikrotik. Let me know if I am forgetting something! RADIUS Pre-Requisites I AM ASSUMING YOU ARE USING THE SAME ROUTER CONFIG AS ABOVE IF ...

tuxtlequino

I have the tutorial written on Markdown but I see that this doesn't use Markdown. At this point it is easier for me to just link the PDF to the tutorial. If you find this useful, I will post the tutorial on here on Friday or Saturday. Any helpful tip is appreciated. I do want some input from people ...

tuxtlequino

I found a discussion and solution to my problem by googling '"defconf: drop all not coming from LAN" mikrotik'

That lead me to a post that has plenty of good information on why, and how to fix this issue. Hope this helps someone

tuxtlequino

Hi, I am trying to figure out why my main router cannot ping to itself. I know what filter rule is causing the problem. It is this one. /ip/firewall/filter add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!WITH_INTERNET The interface list has a ...

tuxtlequino

@own3r1138 Thank you very much for that help. Okay, this is what I figured out. 1. I needed to modify some of the inner-auths and other-auths in order to get login to work. THIS WAS THE TRUE PROBLEM. 2. I was trying to get my CAPsMAN router to connect to a working RADIUS server, but my firewall was ...

tuxtlequino

@own3r1138 I had shown all of my configurations in the first post. I figured out that I couldn't login authenticate because I didn't have the right inner and outer-auths in my '/user-manager/user/group' groups. But if I modify my configuration to the following, /user-manager/user/group set [ find de...

tuxtlequino

Hi own3r1138, I was actually hoping you or fritzme read my post since I had read and re-read the post you linked before. I am not sure why the instructions didn't work for me. And I am not sure why trying them broke the login in Mikrotik that was already working. Maybe I made a mistake somewhere, bu...

tuxtlequino

I have been trying to get RADIUS to work under the using the new user manager on ROS7 (7.2.3). It is very easy to use add RADIUS to authenticate into Mikrotik. I will add the configuration here just in case I am missing something. For the sake of simplicity I am using the same router to provide the ...

tuxtlequino

Thank you Chechito. I think I get the idea. What I should be asking now would be the following then. Can I do RADIUS in CAPsMAN using simple symmetric encryption without having to deal with certificates? Something like EAP-PEAP (If I understood correctly by reading for 15 min)? Like I said. This is ...

tuxtlequino

I am trying to enable RADIUS on CAPsMAN using the new User-Management in version 7. I understand the concepts and I have been using RADIUS to "login" into the routers. The process is very straightforward and easy to understand with the new User-Management. The problem is trying to enable t...

tuxtlequino

That's exactly why we have storm control and loop protect - no need to take the forwarding delay hit for all traffic when that problem is better solved elsewhere. Loop protect is designed for exactly this scenario. That is great. I didn't know that. Although I have several routers/switches (11) in ...

tuxtlequino

This is a simple question. In every example I have see of stp, I see that the configurations have routers in different branches connecting to each other. If in my configuration, I have something that looks like a simple tree in which the branch switches or routers never connect to each other other t...

tuxtlequino

Has anybody tried this on beta 4?

tuxtlequino

Nemo, have you tried the new beta and seen the same issue? Not sure if I want to try the new beta till the problem is solved.

tuxtlequino

I have this error too. Has anybody solved this issue or has a work around?

tuxtlequino

So, it was working in previous versions and was broken in 6.43.4, right? But by your description, it looks like you're using FastTrack. According to the docs, it skips Queues. Thank you. I moved some rules and didn't noticed that my FastTrack rule ended up above and it was FastTracking this traffic...

tuxtlequino

The Queues are not working right. I have a ccr1009 as my main router. This is the queue I have /queue simple add burst-limit=768k/0 burst-threshold=128k/0 burst-time=2s/0s max-limit=512k/2M name=Simple target=VLAN21,VLAN22,VLAN23,VLAN24 And I noticed that it wasn't doing anything. The strange thing ...

tuxtlequino

if you dont intend to use new bridge implementation try routeros 6.40.8

I would think that the problem would persist since as mentioned above, it has something to do with the actual chip used here. For now I will leave it as it is.

tuxtlequino

According to another topic it appears that MT7621 is not VLAN-aware at all, so it is physically impossible to have hardware switching and tagging/untagging on a single port at the same time, leaving aside different VLAN topologies. hAP ac² also supports hardware encryption but its AR8327 is much mo...

tuxtlequino

I had this router using the new bridge vlan configuration found in 6.41, but I was loosing the hardware acceleration so I decided to do the Switch conf. Here is what I have, /interface bridge add comment="VLANs bridge" name=br-switch vlan-filtering=no protocol-mode=none /interface ethernet...

tuxtlequino

Okay. I found the culprit. One of my routers is part of the CRS routers. Although there is a new bridge configuration available for hardware acceleration, this doesn't apply when we are talking about CRS routers (it is kind of a mix and match). I couldn't find that in the documentation, and it was j...

tuxtlequino

I just configure several routers using the new bridge in 6.42 according to the instructions. I am not sure if there is something here that I missed or I miss-configured, but for the life of I have been trying to figure this out for the last four days without any clue. Here are the routers I am using...

tuxtlequino

Thank you, I chased the problem to an incorrect dhcp-client config in my routers. I fixed the dhcp-client config and voila!
Now that I can do that, I have another question, but I think I will create another post for it.

Again, Thank you!

tuxtlequino

Okay, this may be super basic for some, but I have googled and tried searching this forum for an answer. I have 4 VLANS, and I have 4 Hap lite routers in those VLANS. Right now is a pain to managed those routers since I am in a different VLAN; and what I have been doing is connecting to the specific...

tuxtlequino

Okay, I figured it out. It was super freaky. I noticed that the problem was when the router got certain IP. I restarted the main router, but the problem wasn't cleared. I then just cleared the ARP record for the particular IP that was giving me the problem, and VOILA. The mystery is solved. It had n...

tuxtlequino

Does anyone has any idea why adding the wlans interfaces into a bridge results with the router not being able to be reached or to reach anyone in the LAN and WAN? All the clients connected to the router through the ethernet interfaces retain internet connectivity and can reach the LAN, but if I conn...

tuxtlequino

I have seen some examples of doing this using bridges, but I am using the switch chip to create my trunks and manage the VLANS. I understand that concept, but by default those VLANs are isolated from each other. That works well but I would like to have a managing VLAN that can ping and see the other...

tuxtlequino

I want to be able to ping from one subnet to another. I have been reading and experimenting to no avail and I am starting to think that maybe I am missing something very basic. I have tried NAT rules, IP routing, firewall rules, etc., you name it. What I want to do is to be able to ping from the 192...

tuxtlequino

I am very new to this, and there is plenty I still don't understand, but I wrote my own VLAN configuration. See if that helps.

VLAN config

tuxtlequino

Could you let me know more about what you want to do? Why do yo want different IPs? Are you talking about creating unique VLANs that have a different series of IPs? What mikrotik router do you have?

tuxtlequino

Thank you, it worked. I am going to look into the script. I am still chewing all of this.

tuxtlequino

I have been reading the posts available in the forum, and reading some of the most recent questions about how to accomplish a hairpin loop, but it is not working for me. It might have something to do with my configuration, so that I am going to include some of my details. 1. There is a cable router ...

tuxtlequino

I forgot to mention something very important. In my example I said that you could add another ethernet port (I used ether6 as the example)by bridging it, which was correct. What I didn't mention was that if you do that, your ether6 will not get an IP. This is because ether6 doesn't have access to th...

tuxtlequino

I don't think it matters what cable you use. Most modern routers and switches can use either.

tuxtlequino

Jarda, thank you for the clue, but I cannot get it to work. I think I followed the directions, and I have tried several variations, this is what I put, /ip firewall nat add action=masquerade chain=srcnat dst-address=192.168.1.10 dst-port=443 out-interface=VLAN10-Work protocol=tcp src-address=192.168...

tuxtlequino

I have a service in a server inside a VLAN, and I use a dsnat rule to connect to it from the outside. It works when one is outside, but if I use the Domain name while inside the LAN, I cannot connect to it. Any ideas how to do it? Here is my dsnat rule. /ip firewall nat add action=dst-nat chain=dstn...

tuxtlequino

What are you planning to accomplish? I am very new at this, but I might be able to help. You router has two switch chips to do some of the VLANs through them. When you use the chip instead of using bridges, you gain some speed and the router is not loaded as much. The first chip is connected to the ...

tuxtlequino

I am not making this up. I first set up the thing using the DHCP setup. Now, using Winbox there is a little button where you can add additional addresses. My problem was that I thought that it meant that I was picking a range. But NO!!. I was picking TWO addresses. Things were supper erratic, becaus...

tuxtlequino

I just recently bought five routers to overhaul the network we have. I have a CCR1009 as the main router, a CRS109 as a switch of sorts, and three "hAP ac lite". The VLANs work as expected, and when one is connecting using one of the ethernet ports in the other routes, it is possible to ge...

tuxtlequino

Solved the issue, I had a different VLAN id. Thank you for trying to help

tuxtlequino

My idea is to have four VLANs. I read a couple of articles about how to use the switch chip to do VLANs without having to do bridges, and they work for the most part. The problem is that it seems as if only VLAN10 can get an IP address in the other routers. My main router is a CCR109 and has the fol...

tuxtlequino

Chechito, using the configuration that I used above, would it be possible to get a quick example? I am honestly lost.

tuxtlequino

It is showing the right VLAN id for the port, but all the VLANS are visible. Here is how I am adding an IP to a VLAN. Let's say that I am going to add the vlan10. First I modify the switch VLAN I had created with, /interface ethernet switch vlan add ports=ether1,ether4, switch=switch1 vlan-id=10 to ...

tuxtlequino

Yes, but when I do that, all my VLANs are visible. So I can ping 10.10.20.1 from my VLAN 10 (10.10.10.0/24). Or am I incorrect?

tuxtlequino

Okay, I am trying to configure my CCR1009 using the switch core. I followed the instructions in the http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features mikrotik wiki, but couldn't figure out how to get it working without compromising the whole idea of VLANs (somehow I can only make VLANs that ...

tuxtlequino

Lambert,

Wow, thank you very much. Now I know

.

tuxtlequino

This might be very simple and obvious, but I couldn't figure it out nor even know what to ask in Google to get my answer. This is the list of devices that I own, CCR1009-8G-1S - This is my main router CRS109-8G-1S-2HnD-IN - This is my main switch Three HAP ac lites The IP address of the cable router...

Search found 68 matches