MikroTik

Kindis

To someone having problems with SIP phones: Could you please check log of the router with ROS 6.48, whether there are unexpected flapping events (link down/up) or not? Since the linkdowns last between 1 and 2 seconds (as observed in my lab), it could cause "Lagged" state in Asterisk when ...

Kindis

They are and this you should be able to do. Never done this so cannot help there but they operate independently of each other.

Kindis

Great. As wiki states doing this removed hardware offload which explains the CPU Use split horizon bridging to prevent bridging loops. Set the same value for group of ports, to prevent them from sending data to ports with the same horizon value. Split horizon is a software feature that disables hard...

Kindis

Export your config with hide-sensitive option and post your output here.
Also have a look at tools>profile to see what process consumes the CPU.
And finally verify hardware offload is active on the ports

Kindis

I have an RB1100AHx4 running on 6.47 for about 185 days now, which is when that version was released. I'm currently not experiencing any issues, bugs or any other problems yet. I checked change logs and there doesn't seem to be any security fixes since then. Should I leave it as is or upgrade? Rout...

Kindis

Almost every device out there based on ipq4018/4019 has atleast 256MB of RAM. With a few exceptions, like RT-AC58U which struggles to not throw errors because of the very limited memory available out of the 128MB total. So I wouldn't keep my hopes up to see it running in the future on lower require...

Kindis

So in this case I agree and disagree at the same time. If I compare this to other routers I meet at work like Cisco or Juniper a upgrade of the version thus upgrade both OS and firmware at the same time, even if the upgrade process is way way worse sometimes. The way I see this is that ROS is a OS r...

Kindis

So if you have 2 * 8 cores I think you have to provide a Max of 8 cores per virtual socket.

Kindis

This does not make sense to me. I mean if you use VPN Disney+ should not see your original IP address but only your VPN address. So how did they get your IP?
What VPN service was used?

Kindis

What happen if you put a Gbit switch between? Just to see if the switch can get at 1 Gbit link. So I tested with a gigabit switch, and it didn't work. (some cheap tp link) I also set 2 bridge ports on the IPS router (the one they gave to me), and used it as a gigabit switch - the HAP links at 1gbps...

Kindis

What happen if you put a Gbit switch between?
Just to see if the switch can get at 1 Gbit link.

Kindis

I would remove the above file as this contains a little bit more then I would suggest you share. Run /export hide-sensitive instead and post the output here. However I have a all Mikrotik core at home and run 6.47.7 on all routers and do not have this issue. I also reside in Sweden and all my units ...

Kindis

So each socket has 64 cores and each CPU is it's on NUMA node if my memory is correct. So if you want to use more then 64 cores you have to use more then one socket.

How have you configured CPU on the VM the CHR is running on?

Kindis

Updated one wAP R and one CRS326-24G-2S+RM all without issues.

Kindis

Is the company going to correct this error? Did you write to support with that problem? This is not a problem of a single device but a stable branch 6.47.X At 6.46.X works correctly 951Ui-2HnD models - cyclic reboot SUP-32199 RB2011UiAS-2HnD - show "ether boot" on LCD Regardless you shoul...

Kindis

The defconf issue is already resolved. Fix will be included in the next RouterOS release. It has been resolved before! I would hope that when such mistakes are made, they are added to the regression testing done before releasing a new version, especially in [stable]. Yes I agree how does this not g...

Kindis

If the issue is THAT specific I agree with You, but after all said above, I'm guessing that the Support team is aware what it is and working on fix, but not successful obviously. At least for now. As I stated I do not think there is one issue I think there are multiple. The more cases we pile on to...

Kindis

I know it has been said before here but I also think that there is not 1 issue here but several. Might be hardware for some and software for some users. So to fix I think it is important to generate a supout file during the issue and email support@mikrotik.com to get your own case for your issues. O...

Kindis

I think you are misunderstanding IP on the bridge. This is the vlan that the bridge itself is on. So when you add a IP to the bridge you put that IP on that vlan. View this as the MGMT VLAN. Now according to the example the last thing you do is to set a rule for vlan 1 that is tagged for Bridge but ...

Kindis

As you see the router can you connect using MAC address instead?

Kindis

https://wiki.mikrotik.com/wiki/Manual:IP/Settings

From the Wiki: Disable or enable Linux route cache. Note that by disabling route cache, it will also disable fast path.

Kindis

I said this in DM but I noticed that UPnP is disabled. So test to enable it would be a good start.
Also agreed ports are confusing as hell but hopefully UPnP would solve this.

Kindis

If you run the code in CLI the rules will be placed last and below the drop rules so they will not work. You have to move them so they are above the drop rules which are last.

Kindis

Hello, So the NAT rules should be like this: /ip firewall nat add action=dst-nat chain=dstnat dst-port=3074 in-interface=ether1 protocol=tcp to-addresses=192.168.88.246 add action=dst-nat chain=dstnat dst-port=88,500,3074,3544,4500,5730-5731,5739 in-interface=ether1 protocol=udp to-addresses=192.168...

Kindis

Ok so you can forward and open these port or use UPnP. Now I'm no fan of UPnP but in this case it might be the best option for you. Can you do a export hide-sensitive and paste the output. Could be UPnP that needs tweaking. If not we can help with NAT rules as we can se interface names and so on th...

Kindis

Ok so you can forward and open these port or use UPnP. Now I'm no fan of UPnP but in this case it might be the best option for you. Can you do a export hide-sensitive and paste the output. Could be UPnP that needs tweaking. If not we can help with NAT rules as we can se interface names and so on tha...

Kindis

Thanks all. I have managed to have a sort out and so should be able to fit the IN version in the cabinet. Just one more quick question, would there be a noticeable improvement in general performance leaving the 4011 for routing duties only and adding the separate switch? I have 2 4011 (acting as LA...

Kindis

When I said that this is outrageous and miktotik did a horrible job, all users told me I am a troll and mikrotik is the best.... This is more than a 5 months old issue and still no fix. CRS354 sucks big time and mikrotik doesnt give a sh*t about it ! We should ask for refund for this garbage hardwa...

Kindis

Run this and post the output (and remove public IP addresses if you use those

/export hide-sensitive

Also explain from which port to which port are you copying. If Bridge is correctly configured you should get wire speed.

Kindis

I upgraded a new 328-24P-4S+ to this release. When setting a bridge VLAN in Winbox the new window shows a VLAN ID of 4294967295 and 'VLAN IDs' is red (since number is invalid). I change it to the VLAN ID I want and it seems to be fine. It shows this each time I add a new VLAN. I confirmed this happ...

Kindis

So I do not perhaps understand the question fully but if we compare AMD Epyc and Intel I9 I would say that Intel is better depending on workload. AMD still have more CPU latency due to their architecture and that is most lightly a benefit in network operation but that is also down to load and what y...

Kindis

Upgraded my home hAP ac^2 and I had a problem that I saw for the first time. It seems like router only preserved 200-something address list entries, and many were gone completely or only partially preserved, breaking access to the router itself and internet access (because I use those as NAT out ad...

Kindis

Currently only the long-term version channel (v6.46.7) has all the necessary fixes for this CVE. We are working on getting them published in stable and testing channels as well. Sorry for any inconvenience.

Thanks for the clarification.

Kindis

So what has be stumped here is what is vulnerable and what is not. The Github repro says this: Affected Versions(tested) 6.41.3 (long term release) 6.45.8 (long term release) 6.45.9 (long term release) 6.46.4 (stable release) 6.47.2 (stable) 6.47.3 (stable) 7.0beta5 (beta) 7.1beta2 and below So if t...

Kindis

I've Winbox 3.27 on Wine (ubuntu) and I can't log in to any device after upgrading them to 6.47.3. It stays at "Logging in" and nothing is happening. Of course, devices are accessible by in.ex. SSH but winbox is missing. From windows I still can log in. Trying older winbox didn't work. St...

Kindis

Thanks for the hears up but what should I do on my lunch and afternoon break now? ;)

Kindis

I have CRS354-48G-4S+2Q+ switch and no traffic problem on ports 1-8. You must add each port to Marvell chip so add "hw=yes" Now I do not have this switch, I have different models, but from what I read this is traffic based. Those that report issues must have hw=yes otherwise they could ne...

Kindis

You had the same issues with 6.47.2 if I remember correctly? I wonder if this is more for you setup. I have a couple of these switches and I do not have this problem but I run them on Long-Term. I keep all my switches on this release to not have to patch as often. @Kindis If you read my post proper...

Kindis

Switch CRS326-24G-2S+ Software upgrade successful from v6.47.2 TO v6.47.3 but after upgrade no longer able to login using Winbox to upgrade the firmware -- showing the following error message: ERROR could not connect to 192.168.10.88 When using Mac Address to login returns error message: ERROR coul...

Kindis

MikroTik is there any chance to add wireguard in v6?

I might be off here but my understanding is that this is a feature in the Linux kernel and version 6 will not upgrade the kernel without major overall I think this will be a V7 feature we have to wait for,

Kindis

Can we have more information on CVE-2020-3702 and what it is.
More should I patch now or later type of question.

Kindis

What's new in v3.27:

*) fixed content drawing of read-only tables (introduced in v3.26);

Many thanks for a super quick response! All my issues are now gone!

Kindis

In CapsMAN under configuration I cannot configure a country anymore. It only says unknown and there are not options in the drop down list and I do not se anything under Radio. I have cleared the cache and it did not help anything. Note that this might have been true under 3,25 as well. Saw this when...

Kindis

So as this is probably not a hardware fault as you swapped the unit out to a new one, I hope you swapped the power supply as well otherwise that could be a problem? The only option I can provide until you get a response from support is to downgrade to long-term and see if this help. Also do you have...

Kindis

What version of ROS are you running?

Kindis

Installed beta27
Worked for ~12 hours
Then the problem came again
It works more if there's only a few ports busy or traffic is low

Well that sucks. Have you created a supout during the issues and sent to MT?

Kindis

What's new in v3.25: *) improved window resizing and scaling behavior on systems that include high DPI monitors; YES finally I can have Safe Mode Enabled and not fear that I forget to disable it and trying to close Winbox. Before the prompt if I still would like to close was not formatted correctly...

Kindis

Which release of SWOS are you running? I think 2.12 had issues if you had flow control activated on a port.
Regardless this looks like something you need to e-mail support as other here on the forum can get better speeds that this.

Kindis

You should not create any VLAN under interface but only handle the VLANS in the Bridge.

Can you do a full export with hide-sensitive

Kindis

For me this is a question about support and what is the outfall of an outage. So if it is a Office network and there are some problem with the network is that a large incident or is that an inconvenience? Where I work we have network that we can use MT equipment without issues if we would like to ge...

Kindis

So this cannot be the complete config. The picture we see do not correlate to the config you pasted. So even if ports are hardware offloaded conditions must be met. For instance VLAN in this case is not correct and I think this may break the offloading. You need to implement VLAN filtering on the Br...

Kindis

*) wireless - added support for U-NII-2 for cAP ac; *) wireless - added support for U-NII-2 for wAP ac; Which U-NII-2 ecactly: 2A, 2B or 2C? 5350-5470 MHz is U-NII-2B; 2A and 2C were already supported weren't they? Or do you mean in some specific countries? I was also confused by this but I think t...

Kindis

Has the beta solved the issue ? I do not know but if I understood Beta 23 (never went public) where good for some and now that Beta 27 is out I'm interested if people have tested and what the result are. Based on the fact that this thread went silent that can mean that people might have good result...

Kindis

So I do not have this switch but how does the new beta work? Based on the silence in this thread it might be better now?

Kindis

This level 3 offloading looks very interesting. Do we have any numbers to show what it can mean as this has the potential to put emphasis on the R in CRS :-)

Kindis

So I have done this a lot of times. What version of ROS are you running. They have made improvements to the update process in newer versions.

Kindis

is there some public bug tracker available? where we can track some status? would also be good for their changelogs to reference bug numbers, so everybody knows what they fixed there. O man I would love a bug tracker like MS does with KB articles or also what Cisco is doing. As of now I only know o...

Kindis

Did you see that this changelog entry also was in 6.47.1? What's new in 6.47.1 (2020-Jul-08 12:34): *) crs3xx - fixed HW offloading for netPower 15FR and netPower 16P devices (introduced in v6.47); *) crs3xx - fixed increased CPU temperature for CRS354-48G-4S+2Q+ device (introduced in v6.47); *) cr...

Kindis

ld more like to read "fixed ethernet port group traffic..." instead of "improved". "Fixed" = Admission that it was broken in the first place = grounds for compensation I wouldn't hold my breath waiting :-) That is somewhat true. Worst changelog I ever read was for a so...

Kindis

viewtopic.php?f=21&t=163308&p=811799#p811759

What's new in 6.48beta27 (2020-Aug-18 06:20):

Changes in this release:
*) crs3xx - improved Ethernet port group traffic forwarding for CRS354 devices;

Now all can test :)

Kindis

*) wireless - added support for U-NII-2 for cAP ac; Can someone enlighten me about this one? I have 3 of these and one of them run channel ch54-5270 and this works and this is within U-NII-2 or I'm I just plain stupid after the vacation as my brain has yet to start working, which is most likely the...

Kindis

So do I understand that the phone works great on the same wireless network but a Nintendo Switch does not? I would move away from using internal DNS unless you need it. I would provide the users with "real" DNS servers instead so give them 8.8.8.8 or 1.1.1.1 as primary DNS server and see i...

Kindis

6.48beta12 I still have a problem! Please attach 6.48beta23

E-mail support and you will get access to the version that way. I would never run anything I can download outside official channels.

Kindis

I had the same problem for Sweden. I looked it up and I can run these so something is up with ROS.
I removed the country in CapsMAN and now it works.

Kindis

I have had issues with equipment that are connected and redundant for example via LACP and the equipment then builds and internal software switch which links the two sides together and creates a loop. Should not that when this has happen it is 100% my own fault for missconfiguration! Testing one by ...

Kindis

Must be a loop in the 24 port switch somewhere. Have you checked all equipment attached to this switch?

Kindis

This is probably not the answer you wanted but I would not run the DNS service on the router. In smaller setups if can make sense but in larger setups like yours I would say two dedicated servers would be the best option. Note that you not need high cost servers for this. In come cases it might even...

Kindis

Please do a /export hide-sensitive and post output.

Kindis

Many thanks, you guys are awesome. This picture should be added to the documentation of the unit

PS. With modding I mean brining out the saw and making "none supported alteration to the unit

DS

Kindis

So I'm interested in buying a few cAP Ac units. I want to walk mount them all but the cable need to run along the wall and all info I can find or pictures shows the cable exiting out of the wall. So simple question is possible without modding the unit to wall mount them with the cable running down t...

Kindis

Great!
But Winbox CRASH DOWN, when Press + under System -> IPsec-> Policies.

Please fix that bug...

Tested this and I have no issues with this so this might be related to your setup.

Kindis

I use to run a CHR on Hyper-V and it worked great. Only issue I had was a crash in a specific build but other then that I had no issues. I however is a user of Hyper-V and like the hypervisor but I think you should run the hypervisor you feel comfortable with and can operate. That will in the end wo...

Kindis

My guess is that this will be hard to fix here if it is a mem leak. Take a supout file, when you can se the problem, and send it to support@mikrotik.com and they can have a look at it. If you want someone here to be able to help please run /export hide-sensitive and post the output here after you re...

Kindis

So out of pure interest I had to test this :-) So for a test I removed all the cables from a LACP Interface and the bonding itself went down and reported down. So I'm not seeing the same behavior as you do. Try it with a dumb switch in the middle, remember I'm not getting a physical link down. It's...

Kindis

So out of pure interest I had to test this

So for a test I removed all the cables from a LACP Interface and the bonding itself went down and reported down. So I'm not seeing the same behavior as you do.

Kindis

I don't think your LACP works at all, since you have not specified a primary Link... Whats the point of 802.3ad if you just add only one member? It's totally wrong to me... Yes this and also what does Link is broken mean and what is your expected behavior. I use LACP for redundancy on a hardware le...

Kindis

From what I can see in the security landscape bugs that cause a crash in a important process like console or similar is often targeted for RCE. This can not always be used and you have to look at the ease of use. What is more of an issue now is the used of chained attacks. You can now find reported ...

Kindis

Personally "authenticated user can do x" (meaning administrator) is complete nonsense. So I personally do not agree with this. What we see in term of security now is that one flaw that can allow for RCE or Elevation of privileges can be used in chains to attack a target. A vulnerability o...

Kindis

This sound like a case for support@mikrotik.com and a supout file when you have the issue.

Kindis

This looks relay strange. Even I do not full get what you have done it should not behave like this and as you say the CPU does not seam to be be bottleneck. So most CCR routers do not have a switch chip in them. I wonder if your port layout or something else is causing this issue. Having a look at t...

Kindis

What happens if you run the same command but without update=yes This so you see if you need the firmware. I got a similar issues on an wAP-R that has the "R11e-LTE" card. Do not remeber the all of the error message but I know I got TIme-Out and in my case it was two issues. I did not have ...

Kindis

So I wonder if you have issues with Mac address protection. Check so you do not have this on for the cards.
Also in regards to VLAN etc read this one.
viewtopic.php?f=15&t=105465

Kindis

So I wonder if the new secure winbox connection cannot handle NAT. Was setting up a new router that I pre configured but managed to frogg up the OSPF config on the new one. GRE connected but I had to NAT my connection to get route back and Winbox did not want to connect with legacy mode on or off. U...

Kindis

All the issues I had with scaling is now gone as far as I know BUT i noticed something before. I run a 2 monitor setup with one 4K (laptop) and the other 1440 (external screen). If I had the problem where I could not read the logs on either screens dragging the winbox window from one screen to the o...

Kindis

I guess i should Trash-Can it?

Thank you..

No I don't think you have to do that. You should try Netinstall and reinstall the OS on the router. Google around there are briliant guides out there how to use Netinstall.

Kindis

Yes. You should allocate at least 2GB if you plan to run the Dude as a trial. If you have a more extensive requirement for the Dude you need to plan ahead. I remember, and I might be wrong, that they have limited the boot drive to 1 GB. I have not tested but think I remember reading this a changelo...

Kindis

Yes. You should allocate at least 2GB if you plan to run the Dude as a trial. If you have a more extensive requirement for the Dude you need to plan ahead. I remember, and I might be wrong, that they have limited the boot drive to 1 GB. I have not tested but think I remember reading this a changelo...

Kindis

Are you sure that you have 1000Mbit link on ETH1 (and on the port you connect your speedtest-running PC on) ? Your configuration sets port 1-5 (the gigabit ports) to SPEED=100M . The other ports (ETH6-10) is 100Mbit only on the RB2011. 100% sure about link, also for PC. 100mbit is weird a bit, but ...

Kindis

Are you sure that you have 1000Mbit link on ETH1 (and on the port you connect your speedtest-running PC on) ? Your configuration sets port 1-5 (the gigabit ports) to SPEED=100M . The other ports (ETH6-10) is 100Mbit only on the RB2011. This one has fooled me many times before. This is a export of t...

Kindis

What is the lease time on DHCP addresses? I have two Xbox One's that connect via swicthes (none MT units) to my core router (4011) and I had issues that if the Xbox one was in standby mode for more then the lease time I could not turn if on by using the app from my phone or see that it had renewed i...

Kindis

When you test what is the status of the CPU?

I see you have a few mangle rules. Did you create those and can you disable those for a test?

Kindis

Oo this is a big update and also the version you have have several security issues that are more or less very critical. I would go for a export of configuration and perform a Netinstall but otherwise do as mentioned above. You will also get the new bridge setup and a lot of other features so as I sa...

Kindis

This can be many thing.

Run this and post the config
export hide-sensitive

Kindis

So if I read your config correctly you only have Firewall filter rules based on Established, Related and nothing on New. Never seen this before but I can see that you have Fast-Track rules as well but they are at the bottom of you rules so they never apply so you are in effect not using Fast-Track. ...

Kindis

Based on you old firmware you must also have a old and vulnerable ROS. First update ROS System > Packages >> Check for Update and upgrade. Now this can be somewhat of a risky business depending on what version you are on so make a backup and export config before doing this! After you have upgraded R...

Kindis

I think it is important to get all the info and not just waft it away and say No this is an old thing so do not worry. It all boils down to risk management and how this could effect someone. By being silent on the issue Mikrotik only manages to look bad if you ask me. Much better to release informat...

Kindis

Now from what I can see this is a man in the middle attack that is not solved. Article mentions Winbox 3.20 which is the latest and ROS 6.43 which is old but you can read the following from Tenable Disclosure Timeline 10/15/2019 - Tenable discloses. 90 day is Jan. 14, 2020. 10/17/2019 - MikroTik ack...

Kindis

*) security - fixed vulnerability for routers with default password (limited to Wireless Wire), admin could login on startup with empty password before default configuration script was fully loaded;

Don't forget to update the Security blog. During writing this the blog has not been updated.

Kindis

@Kindis https://forum.mikrotik.com/viewtopic.php?t=146857 Please post at this thread. Be sure your have firmware v13 /interface lte firmware-upgrade lte1 I'm already on the latest firmware. This is really not a issue for me as I can use LTE but as I tested I did not manage to get 3G to work. I migh...

Kindis

OK I had to test this myself as I know I have both LTE and 3G coverage where the router is located and I cannot connect to 3G. Now I have not waited for a long time but in the logs I can see it connect then I get this error: 09:03:35 lte,debug I_WAN: network access technology: 3G HSDPS & HSUPA 0...

Kindis

I have a wAP LTE with the same modem. My modem is running "MikroTik_CP_2.160.000_v013" as the modem firmware and ROS is 6.46.1 I have a option under LTE and Network Mode. There I can select GSM, 3G or LTE. Now I do not have a issues with LTE where this device is placed so I have never test...

Kindis

Delete

Kindis

This announcement does not show up under General or other sub "channels". It only shows up under Announcement. Can we make it visible in all parts of the forum?
Edit: Fixed, thanks who ever fixed it!

Kindis

Have you tested to update the LTE modem firmware?

Kindis

As far as I know using backup file is only supported on the same device. So if you are to move config export / import is what you must use. Don't really know what can go wrong with using a backup file but I think it will replace stuff like Mac address and use the old one etc. Guessing this is what c...

Kindis

I have a lot of both GRE + IPSec and L2TP +IPSec and I do not have this issue. I use SHA256 + AES 256 in all proposals for IPSec and I have not seen this issue. Most of the tunnels do not have heavy traffic but one that push backup data off site using GRE.
What proposal do you have for the tunnel?

Kindis

Updated 4011, 3011, wAP AC, RB750gr3 and hAP AC2 without issues.

Kindis

Had a look into my logs as I log every connection to port 22 and 23 and blocks those IP's for 30 days. I see a increase in blocked addresses but both for port 22 and 23 with port 23 dominating in the logs. In general management ports like SSH and Winbox should not be open to internet by default. Add...

Kindis

Just extend the disk to 1GB. During start it will extend the filesystem.

Kindis

Update when smooth, but NAT rules no longer work.

Is that not like saying "The surgery went well but he died"?

At least for me no NAT rules would mean the update did not go well.

Kindis

Post your config so we can have a look.

Kindis

/system package update check-for-updates
channel: stable
installed-version: 6.45.2
latest-version: 6.45.2
status: System is already up to date

The 6.45.3 is not available yet!

You can download via the download page.
https://mikrotik.com/download

Kindis

@CrimzinZA You have 3 things to check

ROS version, MT firmware and modem firmware.
Upgrading modem firmware solved my 4G issues.

Here is how to update modem firmware https://wiki.mikrotik.com/wiki/Manual:I ... re_upgrade

Kindis

What version of ROS are you running? Also have you updated the modem firmware. I had big issues getting 4G to run on my unit until I upgraded modem firmware.

Kindis

RouterOS version 6.45.2 has been released in public "stable" channel! *) wireless - improved 802.11ac stability for all ARM devices with wireless; Did I miss something? What was going wrong with cAP ac before this? Can you please give some details, please? Also, will it be backported to l...

Kindis

Wow 9 CVE fixed! Very nice will try this one on the test systems asap!

Kindis

We are trying to upgrade to 6.44.3 from 6.29. I can download the file and it is in the files window. It will not install. I have tried to reboot 5 or 6 times and still nothing. Any advice? That is not advisable! You have not updated for so many years that it cannot be expected to be a smooth proces...

Kindis

Hello, Since v6.43.4 a lot has happen and also some CVE has been fixed. If you are on Stable release I would start with changing to Long-Term Release and upgrade to 6.43.16 If the issue still continues I would export config, read though so there is nothing strange in the config (you have been hacked...

Kindis

Please note that I said support and not work. The drivers are most lightly there but in term of support for MT it is a huge difference. Granted that hypervisors can cost but there are cheaper and even free hypervisors out there. Hyper-V is free and has max vcpu per guest of 64. For raw performance w...

Kindis

CHR is a virtual appliance where MT can deliver a product to a plattform they know. They only have to deal with drivers from each hypervisor and hardware drivers are maintained by the hypervisor. This makes the support much much easier to handle as the number of scenarios for drivers is limited. So ...

Kindis

My guess is that the router check if there are any new versions available.
I have noted that if I use the Mikrotik app on Android I see on the "login page" if there is a update available on some units before I check manually.
But this is a guess of mine.

Kindis

The fast connection of winbox was part of a release where they improved and secured the connection. Might have been 6.43 release. I do not remember but I do remember a lot of happy people talking about how quick it is now

So the connection of both faster and more secure now.

Kindis

What is the lifetime of the key in the proposal? On both units.

Kindis

Kindis could you share your email backup script please? Yes here they are. I have switched from E-mail backups to FTP. So now all routers upload to a FTP server that then send the backup offsite. The reason is that the ISP I have thinks the backup generated e-mail where a sign that my SMTP account ...

Kindis

Removed
Read this on a phone and missread your config so my advice is useless

Kindis

I'm using CAPSMAN and set Group-key-update to 01:00:00 and have had no luck with 2 doorbells. aes and WAP WPA2 on with now a shorter 8 character password. No issues connecting with any other device. Anyone else have experience? The device says has a problem connecting to the Internet. Seems like it...

Kindis

I have a relatively complex IPsec configuration (tunnels to five end-points, running on three different non-Mikrotik platforms, both IPv4 and IPv6, plus an L2TP-over-IPsec dial-in VPN which I configuration in pieces using the IPsec menus directly rather than the "IPsec secret" option on t...

Kindis

Maybe its time for UK to change to EU plug. Ahh, I did forget UK goes out of EU :) I have travel around the world and UK plug is one the ugliest and largest plug out there.... I live in Sweden but I must say the UK plug is one of the bulkiest to work work with it is also one if the smartest with fu...

Kindis

The only time I needed a backup was when a device was broken. That does not work in the case? I am currently using a script for the backup. Back is for restore on the same device. If you restore a backup file on a different unit it will rewrite some configuration that might create issues for you. I...

Kindis

After upgrade from ROS 6.43.12 to 6.44 - I have lost possibility co connect to my MT with L2TP (with preshared key) VPN. I was changing firewall settings, trying other.... but after downgrade to 6.43.12 - IT WORKS AGAIN. So something is BAD with ROS 6.44 and L2TP VPN ! MikroTik team - please repir ...

Kindis

I have now updated two wAP AC, One 493G, Two CHR's, one 4011 and two 3011. One 3011 hold several GRE tunnels with IPSec and no issues after upgrade. Endpoints to where GRE tunnels are connecting are still on 6.43.12 so no issues between versions either.
Great job MT!

Kindis

Deleted as question was answered above

Kindis

Hello, I've got IPSec problem after upgrading to v6.43.12. I use RB1100 devices, with IPSec vpn. The ipsec peers are configured in the IP->IPSec->Peers menu. The peer profile is sha512/aes256/modp8192 in both side, and the auth method is rsa signature. After upgrading to 6.43.12 in the log I see th...

Kindis

Hello, I've got IPSec problem after upgrading to v6.43.12. I use RB1100 devices, with IPSec vpn. The ipsec peers are configured in the IP->IPSec->Peers menu. The peer profile is sha512/aes256/modp8192 in both side, and the auth method is rsa signature. After upgrading to 6.43.12 in the log I see th...

Kindis

Hello, Group key did the trick for the Chime! I tried this before but then I had a 20 characters long and that did not work! Now I have 8 and set the group key to 1 hours and it works like a charm, well at least for 10 min now! :-) What is the recommended group key update interval. I have always jus...

Kindis

Hello, Just bought a Ring Doorbell 2 and a Ring Chime and I'm having a very hard time getting it to work on my wAP AC devices. The Doorbell connects but had a lot of issues connecting an loosing connection all the time. The Chime on the other hand do not connect at all. I get unicast key exchange ti...

Kindis

Updated two 3011, one 4011, one 493G, two CHR and two wAP AC and all went fine.
Updated from 6.43.11

Kindis

After upgrading my RB3011, one of the CPUs peeks at 100% all the time (switches back and forth between CPUs). Anyone else with the same problem?

No both of mine are just fine. Have you updated firmware and rebooted a second time?

Kindis

I have to add that only one side has a fixed IP, so GRE won't work. Thank you anyway...

I have dynamic IP on both sides and still use GRE. I have a script that checks every 5 min if my IP has changed and If so changes my IP on the GRE interface. Works like a charm.

Kindis

Thanks everyone for your input! I will give wAP LTE a try and see what it provides!

Kindis

I have deployed them only in rural areas here in Finland. The problem is that we have three operators and on band 20 (800MHz) the channel width is only 5MHz (or was it 10MHz?) Anyways the net result is around 20Mbps throughput. I have also used directional 14dBi antennas (yes, I have been asked to ...

Kindis

Hello, Anyone on this forum that have experience using wAP LTE (RBwAPR-2nD&R11e-LTE) in Sweden? If so how was your experience using it and what kind of speed are you getting? Thinking about getting one to add redundancy to my network in case of ISP failure but I would like to know how it works i...

Kindis

Could it we scheduled script. They run in the management process if I remember correctly.

Kindis

Not really sure what you want to do but FastTrack is to offload the CPU and bypass firewall etc of the device and it requires hardware support and CHR cannot handle that. Can you describe what you want to do in more details because FastTrack should not be needed from my point of view. I have a serv...

Kindis

Not really sure what you want to do but FastTrack is to offload the CPU and bypass firewall etc of the device and it requires hardware support and CHR cannot handle that.

Can you describe what you want to do in more details because FastTrack should not be needed from my point of view.

Kindis

No fasttrack does not work on CHR.

Kindis

I do not have fast track on a 750Gr3 and are able to transfer 250Mbps. OP does only get 23Mbps,so its not only fast track.

But he said MB not Mbit

Kindis

I don't think this is a VLAN issue. My guess is that if you look at profile when you would see that firewall holds the CPU. Add fasttrack and this problem should go away. Add this rule before/above your "Accept established,related" add action=fasttrack-connection chain=forward comment=&quo...

Kindis

No, major misunderstanding

Not "it will be fixed in v7", but "It can only be fixed in v7".

So sorry but I could not just contain myself

Not that I'm missing V7 I just follow the forum

Kindis

This sums up how I think ROS 7 is communicated!

Kindis

@eider Thank you for your post. "In newer version password is no longer stored as plain-text so it can not be used to encrypt backup file without user explicitly providing password." In the newer version, Does it mean that the user password of RouterOS is not used by default for the encry...

Kindis

Hi! Setup CHR in my VPS. HDD space 50GB. After first boot - router os resize disk, remains 15GB.. Where is the rest of the disk space? Had a vague memory that they limited the size of CHR disk in a release so I made a search in the change logs and I found the following: What's new in v6.40 (2017-Ju...

Kindis

Could be this.

What's new in 6.43 (2018-Sep-06 12:44):

MAJOR CHANGES IN v6.43:
----------------------
!) backup - do not encrypt backup file unless password is provided;

Kindis

I have not seen this issue in any of my setups but you should consider adding more safety to your setup. Right now you do not drop everything new to efter1 which is you WAN port. I woudl recommend that you do the following: /ip firewall filter add action=fasttrack-connection chain=forward connection...

Kindis

What license do you have on the CHR?

Kindis

I had a similar issue as you. I have my printer, and other devices I do not trust, on a separate subnet at home. Now the client my wife gets from her local IT at work have just started a automatic VPN tunnel that uses forced tunneling. This means she cannot use our printer at all as 0.0.0.0/0 point ...

Kindis

6.37 is vulnerable to a couple of exploits and you may have been compromised.
Export config, review config for any strange scripts and so, netinstall the device and import config. Just to be safe.

Kindis

You cannot see the H under installed SA in winbox (bug) [..] Are you sure that Hardware AEAD is greyed out in SA detail screen status bar? Otherwise you can see H flag by enlarging the first grid column. Jesus Christ I use Excel to much. I'm so use to dubbel clicking on the column separator that it...

Kindis

I have one RB750Gr3 connecting to a 3011 using L2TP/IPSec and it uses SHA256 and aes-256-cbc. You cannot see the H under installed SA in winbox (bug) but if you use console or webfig I can see that the hardware offload is working. I have a 100 Mbit connection to it and I can easily push that connect...

Kindis

No you cannot do that as far as I know on a DC. In this case your best bet is to add a other DNS server that can perform what you want and redirect all clients to this DNS. Make sure DNS for the domain works aswell. Maby a tiny Linux server with BIND could allow you to do what you want? You also get...

Kindis

I have a 3011 and do not have this issue. Can you export your mangle rule? I can see if I can test it.

Kindis

Yesterday upgraded two CCRs from 6.41.3 to 6.43.1 in the hotel I had vacation in Greece :) At least, now it's not vulnerable to WinBox user database reading xD Unfortunately, WinBox access is still allowed for every Free WiFi user in the hotel :( Feel free to add a new title to you business card &q...

Kindis

We both have the same version of Windows server but I'm on .18970 but I have not had any issues with this on any lower build anyway. So the CHR build in it self should not be the issue. Are you running any other VM in the Hyper-V and do they have any issues? This is a tricky one but I would start w...

Kindis

We both have the same version of Windows server but I'm on .18970 but I have not had any issues with this on any lower build anyway. So the CHR build in it self should not be the issue. Are you running any other VM in the Hyper-V and do they have any issues? This is a tricky one but I would start wi...

Kindis

I'm very happy with this build I must say. Must be the best .0 build ever provided. Been running it since launch and a lot of things are better. OSPF is faster for some reason but it may come down to the huge improvements to CHR under Hyper-V. Granted I do not have a advanced environment and do not ...

Kindis

Many do this and send to mikrotik. So they can troubleshoot.

https://kb.vmware.com/articleview?docid=2000542

Kindis

What version of Ros are you using and also which version of hyper-v?

Kindis

Just upgraded two CHR instances to 6.43 and all worked great but I cannot see Cloud under IP !) cloud - added support for licensed CHR instances (including trial); I do not see it in WinBox or via Webfig. Cleared cache and all that and does not appear. I can see it via console or SSH so I have manag...

Kindis

On regards related to hardware choice. Now performance would come down to the choice of testing. AMD CPU has more core and if they are added to CHR it should be able to hold more load but Intel is still king of single threaded performance. Also AMD has more intra core latency and this could also res...

Kindis

Upgraded two 3011, one 493G, two CHR and two wAP AC. No issues what so ever. Also disabled PMKID for WPA2 and have no issues so far.

Kindis

Don't know if this will help but have you read this?
https://support.hpe.com/hpsc/doc/public ... -c00653544

Kindis

Did you find a solution to the problem? I have a similar problem. I can not upgrade to version 6.42.6 He says: ERROR: not enough disk space, 7.1MiB is required and only 6.7MiB is free How can I clean it? Have you tried this? https://www.mikrotik.com/download/share/fix_space.npk You can read more on...

Kindis

According to changelog it is fixed

What's new in 6.40.8 (2018-Apr-23 11:34):

!) winbox - fixed vulnerability that allowed to gain access to an unsecured router;

Kindis

I've got a CRS125-24G-1S that has Routerboard 3.41 in it and RouterOS is 6.40.4. I've tried several times to upgrade the RouterOS version to 6.42.6 as well as to 6.40.5. Neither will work. After rebooting, the CRS125 still shows RouterOS at 6.40.4. Suggestions? John Rayfield, Jr. What does the log ...

Kindis

Have you tested a second restart? Updated: I remembered that there where issues with neighbor service after a .0 release but did not remember what release it was. Dug around in the change log and it is 6.41 release that had this issue. A second restart should solve this issue or fixing the interface...

Kindis

To which version are you upgrading?

Kindis

I have a crazy feature request. Abandon the current GUI framework that WinBox is using and move to QT. Yes, I know it will be a LOT of work, but it will make life easier for Mikrotik developers, and allow Mikrotik to add more features in the long run. I would go even further and say please rewrite ...

Kindis

Are you using VLAN? I have two CHR running on this version that have DHCP client working so it should be config.

Kindis

Big problem...
Updated Mys CCR (to 6,43rc27) an now stucked outside! All is running but cant connect - wrong username or password??? A bit of PANIC!!!

------------------
Sorry! Had two winbox on my pc!! Just need new winbox! Sorry!

You need Winbox 3.14

Kindis

I Tried 6.42.3 and 6.43rc19, same result New RC release. Test if this will work for you. My guess is they have fixed an issue. *) chr - fixed boot on hosts older than Windows Server 2012 when running CHR on Hyper-V But you might already know this as you might be the one who reported this issue in t...

Kindis

I would upgrade to 6.40.8 (latest bugfix) before upgrading to new bridge. You can always contact MT support and check from which version to new version is best. You have a better bet at upgrading from latest bugfix to latest current. At least my guess is so. As you current version contains some nast...

Kindis

Contact support and inform them. A year or two ago I had an issue where the router should boot and you could login via console but everything timed out. They told me that it should work and they had no issues. After a while they told me the tested on Windows 10 Hyper-V which is = Server 2016 and I r...

Kindis

Upgrades two CHR (running on Hyper-V), two 3011, one 493G and 2 wAP AC without any issues.

Kindis

I would export config, netinstall and then import config. You might need to tweek config before import due to version differences.

Kindis

For you that have this issue what guest servies have you activated? Are all activated including Dynamic Memory?
I wonder if this issue goes away if you disable all services including dynamic memory.

Kindis

I have updated one 3011 and two CHR (Hyper-V) and so far so good. Took the ones that have a public IP first.
Don't think this was a problem for me though as I block anyone, for 30 days, coming from internet trying to connect to Winbox port.

Kindis

When upgrade packages to v6.42 in CHR router (Hyper-V image), after reboot have: Loading system with initrd ERROR: could not find disk! Please attach it somewhere else. System hangs up. When loading blank chr-6.42.vhdx, the same error. Before v6.42 all works fine. Something wrong with .vhdx image? ...

Kindis

Regarding upgrading to BugFix Only. It should be safe but it all comes down to config. I run everything on Current but in your case I would upgrade first to Bugfix channel. All changes from the release you are on can be viewed here, it a long read. https://mikrotik.com/download/changelogs/bugfix-rel...

Kindis

Install and upgrade via packages menu option crashed my 3011. Anyone else have issues. Now in constant boot loop. Cannot launch kernel. Any recommended next steps ?

I have updated two 3011 without issues. My guess is netinstall for you.
from which version did you upgrade? I want from 6.41.4

Kindis

Hi I have RB450G (mipsbe) version (6.34.1) which is shown as 100% CPU, I noticed that the profile is shown as 95% for unclassified. Has anyone had this issues ands what is inside of unclassified. You are on a very old build. Update to 6.40.7 (Bugfix only) and see if the issues goes away. Make sure ...

Kindis

Updated two 3011, two wAP AC, one CHR running on Hyper-V and also a 493G without any issues.
Are there any official plan to fix the firmware so it auto upgrades so I do not have to restart each machine twice every time? By offical plan I mean when this will be solved and not Yes it will be solved.

Kindis

The test is singel threaded and only uses one core which is 100 % load which is 50 % in total as there are 2 cores.
You should test the throughput of the router/switch from a machine attached to the router/switch.

Kindis

This is a quote from the thread I linked, please read it. It doesn't matter if the user has public or private IP, it's about interfaces. When interfaces connect/disconnect, with combination with NAT, it gives you high CPU usage. So simply eliminate NAT from that router. Have a separate router "...

Kindis

Would it be possible for MT staff to create a pinned thread about this. With info about what attack vector was used, from what version of ROS are you safe and how to mitigate if you are effected. I know you can read all here, if HTTP vulnerability is confirmed to be used, but it would be great to h...

Kindis

Would it be possible for MT staff to create a pinned thread about this. With info about what attack vector was used, from what version of ROS are you safe and how to mitigate if you are effected. I know you can read all here, if HTTP vulnerability is confirmed to be used, but it would be great to ha...

Kindis

Read this thread
viewtopic.php?f=2&t=117958&p=648577&hil ... pu#p648577

Kindis

Had simular issues with my wAP AC but noticed in the log after a while that it said radar detect and tried another channel and then loop. Added a channel that does not require radar scan here. This made 5 Ghz stabil for me.

Kindis

Have you contacted support@mikrotik.com

Kindis

What type of hardware are you using today for your CHR?

Kindis

I do not use BGP myself in any way that you describe but as I understand that the BGP process is singlethreaded you are most lightly looking for a CPU that can handle singlethreaded performance very well. Have a look at this table: https://www.cpubenchmark.net/singleThread.html If money is not an is...

Search found 505 matches