MikroTik

StubArea51

Great news about LDPv6 - being able to run single stack IPv6 networks with IPv4 as a service is the way networks are headed and this helps a lot!

StubArea51

This is fantastic work and it's going to open up so many possibilities. Thanks for the effort from the MikroTik team.

StubArea51

The best way to start is to apply for an ASN and an IPv6 prefix with your Regional Internet Registry (https://en.wikipedia.org/wiki/Regional_Internet_registry). You can sign up for an account at the RIR webpage and most of them have FAQ guides to help you begin the process. ARIN which covers North A...

StubArea51

So both /48 and /56 prefixes typically mean that you have provider-dependent (PD) IPv6 space and not a provider-independent (PI) IPv6 prefix. In order to use the two prefixes you already have, you would need every host to use an address from each range. Have you contacted your RIR to apply for a PI ...

StubArea51

It might be helpful to discuss who your upstream providers are and what size prefix you have for IPv6.

For example do they have traffic engineering communities available?

StubArea51

Hope to see ZT offloading AES to the hardware on Routerboards (if not done already)

Same. This would be phenomenal.

StubArea51

My team *always* uses the long term code unless there are specific reasons to run a different branch. We've used this approach to successfully (and stably) operate critical networks for ISPs that connect entire countries as well as multi-billion dollar publicly traded companies and even large social...

StubArea51

Anyone well versed with Mikrotik and advanced routing willing to perform consulting work in the Dallas Texas Metroplex? You would be working with a network savvy person with no familiarity with Mikrotiks to deploy network connectivity to new clients in an entertainment venue. Looking for a local ca...

StubArea51

Please add support for ZeroTier Multipath and its various configuration options and policies: https://zerotier.atlassian.net/wiki/spaces/SD/pages/568459265/Multipath https://twitter.com/ZeroTier/status/1433039278850904065?s=20 https://stubarea51.net/wp-content/uploads/2021/09/zt-multipath.png

StubArea51

Converted one of our office ZT gateways from UBNT to MikroTik - it's working great!

Using a test build of rc3 to test the bug fix for injected routes going inactive - which is now working.

StubArea51

I guess the final question, is throughput. Wireguard has been pretty decent, how does zerotier compare. For example I have two computers on the same ISP 15km apart and both have 1gig connectivity. IF wireguard gives me xxx speed, will zerotier be xxx PLUS or xxx MINUS?? I can't speak to the impleme...

StubArea51

When you look at it from a business standpoint, it makes complete sense. 1) MikroTik needed an SDWAN solution to sell more boxes 2) ZeroTier needed a hardware solution to sell more licenses It's a phenomenal protocol and far better than any other VPN i've used in the last 20 years. This is a great ...

StubArea51

Good to know, It seems though it seems ideal for configuring remotely MT boxes, vice lets say WIREGUARD where I want to let external users use my ISP connection for their needs. Unless there is a way of using zerotier for that purpose??? ZeroTier is awesome for remote connectivity or if you want to...

StubArea51

Of all the request to implement in RouterOS, why specifically ZeroTier? When you look at it from a business standpoint, it makes complete sense. 1) MikroTik needed an SDWAN solution to sell more boxes 2) ZeroTier needed a hardware solution to sell more licenses It's a phenomenal protocol and far be...

StubArea51

So I tested this on one of our ZT networks and connectivity works to any endpoint within the ZeroTier L2 subnet (100.125.130.0/24 in this case) I'm having issues with routes injected from the controller - are those supported yet? The injected route below (10.255.128.0/19) is inactive. I've set allow...

StubArea51

Awesome job MikroTik - i'm super excited to see this one as i've been using ZeroTier for a long time and had to use Ubnt routers as ZT gateways ( i feel dirty

)

This is great news...can't wait to test!

StubArea51

What are your suggestions on how to represent it in winbox? Simply "make it like v6" is not possible because of new features.

Which new features are creating a challenge? That might help the user community to provide some feedback.

StubArea51

I see you are testing IPv6 on dead beef networks as I do. Nice!

Yes! I also like 200:co1d:cola::/48 and 200:7ac0:cafe::/48

StubArea51

Feedback on the route filtering in ROSv7rc1:

viewtopic.php?f=1&t=177846

StubArea51

I've been trying to get this out for a while but my workload keeps getting in the way :) This a summary of feedback on the routing filter syntax from myself and the opinions of a number of other MikroTik users on the new route filtering format. Hopefully it will help further the conversation on chan...

StubArea51

i'm not the one to stop progress, but can we have a settable option in /console ? like so:
Code: Select all
/console set help-key=\?
PLEASE allow the help key to be bound to alternative mappings, or just return it to ?

Agree with this 100% - either use the '?' or allow for it to be set.

StubArea51

I would try moving the active/backup bonds to 802.3ad and see if you still have issues

StubArea51

I would agree....you need to be running the same long term version of RouterOS on each router and restest.

StubArea51

Red are administrators (e.g. @normis), green are moderators. I might be wrong, but I think @nz_monkey is not MT staffer.

No @nz_monkey is not part of MT staff.

StubArea51

I'm super excited to see more of the Marvell family of chips.

This could be a great tower or last mile router for a compact enclosure or to build HA in a small footprint. I'm very excited about this one. :)

StubArea51

There is no good reason to use flow control in 2021. It's an old protocol - leave it off.

Shaping traffic with queues is the best way to handle traffic congestion so that flow control is never needed.

StubArea51

A few questions

1. What version of RouterOS are you using?
2. What is the configuration on each router? (/export compact hide-sensitive)
3. What kind of radios are you using for the PTP link?
4. What are the statistics on the interface counters for the PTP RF link?

StubArea51

The CCR2004 is probably not the right choice for this - it's a router and still has some stability/performance issues.

What are you trying to connect in a redundant way. Servers, Storage, ISP Customers?

StubArea51

Sorry for my ignorance, but why does anybody need route filters? Routing filters are needed when running dynamic routing protocols to ensure that subnets that shouldn't be advertised aren't leaked inadvertently. An example: Two organizations are merging that have separate networks. The networks wil...

StubArea51

The latest long term version (6.47.10) is stable and contains a number of OSPF and MPLS bug fixes since the 6.44 series.

That's what we typically put on client networks.

StubArea51

I wrote a post recently on v7 timeline and current status:

https://stubarea51.net/2021/07/09/mikro ... l-release/

StubArea51

We typically use Unimus for this as it works well at large scale. You can schedule the upgrade so that it's automated on whatever code lifecycle makes sense for the organization. https://unimus.net/blog/network-wide-mikrotik-routeros-upgrade.html We can typically upgrade several thousand MikroTik ro...

StubArea51

NBMA on a WISP PTP link only masks an underlying problem with either: 1. The backhaul itself dropping traffic or a misconfiguration or issue with OSPF multicast streams 2. Traffic congestion tearing down OSPF neighbor adjacencies without QoS for the control plane 3. Misconfiguration of OSPF like a d...

StubArea51

Three things to check for flapping VPLS

1. Duplication of MAC addresses on VPLS interfaces from copy/paste
2. Loop Detect is set on some or all routers - disable it
3. Bridging loop in one or more VPLS instances

StubArea51

It's on the roadmap for protocol support in the v7 status page

https://help.mikrotik.com/docs/display/ ... col+Status

StubArea51

Oops, we accidentally posted implemented but yet unreleased features. Well, I guess that now you have an official sneak peek of the upcoming changes. Not complaining :P What range of values will be possible for MTU on the CRS3xx series? RouterOS v7.1beta7: variable MTU / Jumbo frame support.

StubArea51

How many routers are you testing with? Is LDP running between routers for label exchange?

StubArea51

Trying to handle failover at Layer 2 is the wrong way to design redundant PTP RF between routers. Migrate to routed and use OSPF for failover. https://stubarea51.net/2019/09/15/wisp-design-migrating-from-bridged-to-routed/ If you still need VLANs, you can use MPLS/VPLS https://stubarea51.net/2020/03...

StubArea51

Start here :)

Most likely the example config you're looking for and answer is in this thread:

viewtopic.php?f=23&t=73214

StubArea51

Since you are using a subnet inside of a larger subnet that already has an IP inside the /27, you'll probably need to enable Proxy ARP on the interface that 1x.168.109.25/27 is configured on - this can sometimes cause a brief loss of reachability, so be sure that you have OOB access to the CHR. Esse...

StubArea51

Have you tried setting the queue type to mq-pfifo on the CCR2004?

What version of ROS are you using?

StubArea51

Thanks for the info on MTU!

I'm curious now to see if I can get it to 1Gbps reliably over wireguard. May have to do some tests into our DC with CCRs

StubArea51

A similar thread from a few days ago:

viewtopic.php?f=3&t=176497

StubArea51

And that's definitely the tradeoff. SSTP is way cleaner for NAT traversal and is hard to block since it's TCP/443. We designed and built an SSTP HA VPN headend using CHRs for several thousand endpoints. It would then dynamically built BGP peerings using scripts to advertise the subnets at the remote...

StubArea51

SSTP is TCP over TCP so you're not going to see the same level of throughput and responsiveness as a VPN protocol that's based on UDP, GRE, etc

We've found L2TP with ipsec to be one of the better performing VPN protocols if you want a similar design to an SSTP server.

StubArea51

If an ISP has the money to get Public IPv4 at auction then sure I'd rather use that over NAT but that's not always the case or it's not practical to sit on the RIR waiting list. The better answer is to use IPv6 in dual stack with public IPv4 if possible and CGNAT if not. This reduces the logging loa...

StubArea51

Do not do that, do not have any legal value p2p@paramount.copyright-notice.com or others.... Do not cooperate with echelon. They just try to intimidate, if they REALLY make a lawsuit for each case, it would take thousand of years to do them all, on all cuntry... then they try to intimidate the ISPs...

StubArea51

It sounds like you just need a transport segment for servers/VMs to connect to the router so they can peer. Build a VLAN and a /24 (or larger if needed) and use that for peering between the servers and the CCR2004.

Then the servers can advertise /32s with the /24 providing the next hop.

StubArea51

FWIW, I need to retest with some better servers. I think the small packet sizes were more of a limitation of the servers I was using than the CRS.

Overall L3 HW offload works!

https://stubarea51.net/2020/10/12/mikro ... e-testing/

StubArea51

We use https://lucidchart.com for our network engineering team which has a free version. Here are some examples of drawings i've done with LucidChart: https://stubarea51.net/wp-content/uploads/2021/06/MIkroTik-MLAG-blog.png https://stubarea51.net/wp-content/uploads/2020/03/routing-design-iBGPOSPF-an...

StubArea51

Consider using an OSPF transit fabric instead of bonding so that you can use all the bandwidth when the speeds aren't equal. You can use it with just OSPF or pair it with eBGP for large scale I presented at the US MUM in 2017 on this design and we've had a number of WISP clients that have successful...

StubArea51

My blog at

https://stubarea51.net

has a ton of MikroTik articles.

StubArea51

They did away with the default route as part of the instance configuration. From the help docs: All route distribution control is now done purely with routing filter select, no more redistribution knobs in the instance. This gives greater flexibility on what routes from which protocols you want to r...

StubArea51

Short answer - ROSv6 and v7 don't support /31 but there is a workaround with /32s (which I don't recommend due to OSPF issues)

Long answer:

viewtopic.php?p=163163

StubArea51

OSPF ECMP will be used if the cost is equal to reach a destination prefix over multiple paths. ECMP is a session based load balancing algorithm - not per packet From the Tik wiki: Because results of the forwarding decision are cached, packets with the same source address, destination address, source...

StubArea51

If you want to dive into the "why" and "how" of networking, Cisco has a great training program that will go deep into the protocols. I am a current CCNA and CCNP and both have helped me immensely in my career - and surprisingly with MikroTik. Understanding how networking works ma...

StubArea51

Consider using the Audience. MikroTik audience is fantastic for home WiFi....I have three of them as APs/MPLS routers and use a CRS328 for switching with a CCR1009 to connect to symmetric 1G fiber. Then I use OSPF/MPLS to build VPLS for the main and IoT SSIDs. I hope we'll see MikroTik continue to a...

StubArea51

If the devices are all L2 and the problem increases as the network gets bigger, one of the problems you could be facing is spanning tree diameter with 70 devices out there. Generally, once you exceed 7 switch hops, the STP/RSTP timers need to be modified or the send/receive of BPDUs to calculate a l...

StubArea51

Is this issue solved in v6 yet? It seems to me the overall IPv6 support in current v7.1beta is still unstable, even for switching. Actually I have moved my main router from Mikrotik to Ubiquiti Edgerouter for IPv6 :( I would def love to see IPv6 stabilize in ROSv7 but I've had even more issues with...

StubArea51

The CCR1036 is going to be the most stable option. As much as I love the idea of the CCR2004, it's still going through some growing pains.

StubArea51

Thanks for the shout out to my blog in the Newsletter MikroTik :)

StubArea51

SwOS is designed for very basic switching use cases - i'd be very surprised if MLAG and L3 made it in there. It might not be the best use of development resources considering it's going to take a lot of work to get those features tested and stable in RouterOS.

StubArea51

One of our engineers did something similar.....you could try this # PEER NAME :local peer "HE" # PREFIXES - SET A COMMENT TO KNOW WHICH ONES SHOULD BE ENABLE :local peerOutFilterIdentifier "HE-OUT-PREFIXES" # UPTIME IN MKT FORMAT :local enoughUptime 10m # GET CURRENT UPTIME :loca...

StubArea51

I agree, this is a really good idea - not sure if MikroTik can make it work on every model but this would be an incredibly helpful feature to have.

StubArea51

Just curious - why not change weight or localpref to accomplish this?

StubArea51

A 1G SFP between the two switches works with no problem. Be sure to set the speed on both sides.

You may find this helpful for configuration:

https://stubarea51.net/2019/02/06/cisco ... and-vlans/

StubArea51

The CCR2004 is a router and not a switch so that wouldn't be the ideal choice.

The CRS317 has been used as a SAN switch successfully for IP based storage protocols like iSCSI, NFS, Ceph, etc

StubArea51

Hi.
The RouterOS v6 routing implementation is not suitable for this type of deployment

Agree with nz_monkey 100% on this.

If you're trying to bring routes from an IX across an MPLS network, maybe consider VPLS between PEs - from the IX port to the peering router.

StubArea51

Worth of mention that we have received user complaints that the new filtering rule format looks terrible. We have agreed that rule definitions are over-complicated, so the developers are working on (yet another) new syntax, which is supposed to be much simpler. I would definitely agree. It's very h...

StubArea51

What is the configuration for each device - MikroTik and Cisco?

StubArea51

Check to see if VLAN 1 is the native (untagged) VLAN on the Cisco switch. It's possible that the Cisco side is untagged for VLAN1 and the MikroTik side is tagged. In that case you can set the native VLAN on that port in the Cisco switch to a placeholder VLAN like 777. That will force VLAN 1 to be ta...

StubArea51

One thing I noticed is that the documentation says "The MLAG requires enabled STP or RSTP protocol" - does MLAG not work with MSTP? I just tried using MSTP on the Bridge the MLAG ports are on, it definitely does not support that version of STP. https://stubarea51.net/wp-content/uploads/20...

StubArea51

Have you considered e.g. using a GRE tunnel interface as the peer-port to be able to ensure IP multi-path redundancy in your test topology? Thereby avoiding relying on the physical peer interface not being interrupted during normal operations. (e.g. cable unplugged by accident, optic/port hw failur...

StubArea51

The short answer is yes, you can use the same config on a CCR2004 but there are a few caveats 1) The CCR2004 just had several bugs patched for performance issues and random reboots - while these issues seem to be vastly improved, I would be careful about putting it in prod in your network without te...

StubArea51

Traffic engineering in OSPF is a losing battle. You can either use MPLE TE as previously stated or consider an eBGP design which gives you hop-by-hop control over routes and path selection. Here is a MUM presentation I gave on that design: https://mum.mikrotik.com/presentations/US17/presentation_451...

StubArea51

What version of RouterOS are you running? This sounds like the behavior from exploits that were patched a couple of years ago.

This MUM presentation has an extensive overview of the vulnerabilities and remediation

https://mum.mikrotik.com/presentations/ ... 679994.pdf

StubArea51

Did some testing with the new MLAG feature and wrote a blog post on it.

https://stubarea51.net/2021/06/04/mikro ... -switches/

StubArea51

If you're going to redesign, it's better to use OSPF, MPLS and BGP together in a design like this: - Much better scale - Summarization without area constraints - Putting only ptp and loopbacks into OSPF improves convergence time sigificantly - MPLS can be used to aggregate PPPoE sessions to fewer lo...

StubArea51

The very first step in the BGP best path algorithm before getting into attributes is checking next hop reachability....typically when weight and local pref are higher than another route but that route isn't selected, there is a problem with reachability of the next hop for that route.

StubArea51

I believe you are referring to the 'auto-cost reference-bandwidth' command in Cisco. There is no equivalent MikroTik command, so you'll need to implement costs to align with the current speeds in your network and give yourself some room to grow. if 10G is the fastest, consider using 10 or 100 for co...

StubArea51

If you want to minimize the traffic over the tunnel between the two peering points, you will need to work on reallocating the subnets so that a block is assigned to each location and preferred via that location - a less specific prefix advertisement or BGP community can be used to failover to the ot...

StubArea51

Dear user or company. I am looking for Mikrotik router expert to support our network. Interested parties please send email to me, gerald@igarment.net. Our company is located in Hong Kong, UTC time +8 hours. We run the largest MikroTik consulting firm in the world at IP ArchiTechs with engineers in ...

StubArea51

The amount of IPv6 work we have done as MikroTik consultants in the last year has been staggering. We rarely build a new network without designing for IPv6.

This is a critical feature, please give it priority.

StubArea51

There are two ways to help with inbound traffic when you only have a /24 1. Use BGP communities with your upstream providers if they support it to adjust the local pref of your prefix within the peer ASN 2. Deploy IPv6 - use communities and adjust prefix advertisements (once you have IPv6, large sec...

StubArea51

Thank you again very much!

You're welcome! MTU math takes a while to understand so don't feel bad :)

Don't forget to mark the solution as "solved"

StubArea51

Strange, works fine for me.

What hw platform are you using or is it CHR?

StubArea51

This sounds like a classic MTU issue with MPLS transport. Your configs show MPLS MTU at 1530 which is the minimum for tagged VPLS but your VPLS MTUs for mtu and l2mtu as higher (1598 and 2028). You can't transport MTUs in VPLS higher than the underlying MPLS transport of 1530 or you need a higher MP...

StubArea51

Thanks for the new features like MLAG!

Were the issues with OSPFv3 checksum fixed?

StubArea51

Glad you figured it out.

As a general rule, you don't want to use redistribute with OSPF except for actual external routes like Static, BGP, etc. It breaks the area boundaries and obscures the SPF topology info.

StubArea51

Do you have Hyperthreading disabled?

StubArea51

You're likely hitting the limitation of running MPLS in a CHR that's not running on Hyper-V. Proxmox deals with MTU differently. https://mum.mikrotik.com/presentations/EU19/presentation_6291_1554448059.pdf There was supposedly a fix for this issue a few months back in ROS but I haven't tried it. Als...

StubArea51

A few questions... What hardware and long term version? Are you running VPLS? Are your OSPF and LDP timers matched? CCR-1036-8G-2S+ 6.46.8 OSPF/LDP Timers default: OSPF: 5/1/10/40 LDP: 5/15 VPLS: yes (This is our reason to use MPLS). I have seen this kind of behaviour at differnet sites over the ye...

StubArea51

A few questions...

What hardware and long term version?

Are you running VPLS?

Are your OSPF and LDP timers matched?

StubArea51

Running on 6.48.1 on all. You need to be running at least 6.48.2 because it has specific fixes for packet loss and reboots for the 2004 series. Normally I run Long Term on everything, but for the 2004, it needs to be this specific version for now. What's new in 6.48.2 (2021-Apr-09 10:17): ###clippe...

StubArea51

If you want to use a routing protocol, you'll need an interface and using ipsec by itself won't give you that. There are several good options to consider which you can secure with ipsec 1. L2TP with IPSEC 2. GRE over ISEC 3. EoIP over IPSEC It really depends on the traffic between branch sites as to...

StubArea51

What type of hypervisor are you using for the CHR? There are some known issues with MPLS and the CHR.

The 2004 has certainly had some issues - what version of ROS are you running on it?

StubArea51

Well I knew this day will come. FW version 6.48.x seems to me that is having some kind of VPLS issue. So, we're stuck in older FW. I did the check even in emulated environment. But this is another fight that we delayed for too long right now because we focused in another ROS issue on PPPoE with hig...

StubArea51

6.48.2 has specific fixes for stability and packet loss issues with the CCR2004. I'd upgrade to that version and see if it resolves the problem. What's new in 6.48.2 (2021-Apr-09 10:17): ###clipped### *) switch - improved resource allocation on 98PX1012 switch chip for CCR2004-1G-12S+2XS device; *) ...

StubArea51

That can be done. Here is an example config

/routing bgp peer
add name=peer1 out-filter=bgp-out remote-address=203.0.113.2 ttl=default

/routing filter
add action=accept bgp-communities="" chain=bgp-out prefix=192.168.1.0/24 set-bgp-communities=12345:777

StubArea51

Hello, 3 CCR2004 Here, we are experiencing packet loss issues :

What speeds are going through it...what protocols are you running?

StubArea51

Try unchecking the Cisco Style PW ID and use 1:1 for the PW ID on each side. https://wiki.mikrotik.com/wiki/Manual:Interface/VPLS vpls-id (AsNum | AsIp; Default: ) Unique number that identifies VPLS tunnel. Encoding is 2byte+4byte or 4byte+2byte number. Also be sure to specify the transport address ...

StubArea51

Cool...let us know how the testing goes with the new code! Our EU team has grown a lot since 2019 and we now have multiple engineers across western and eastern Europe that also help to cover time zones in Africa since they overlap a good bit. Just give us a shout if you need some help :) https://ipa...

StubArea51

IPANetEngineer - we also realised we did not have "force self" for next hop on the edges so that might have confused the RRs. Also, we plan to enable "if-installed" instead of "always" for "default originate". That way if a peer goes down it will not keep the...

StubArea51

The very first thing I would do is get both CCRs upgraded to the same version using the long term version of RouterOS and see if the behavior continues. Using a different version of RouterOS on each OSPF neighbor will sometimes result in instability due to unintended interop issues between versions ...

StubArea51

Assuming the router id for the other side is 192.168.11.2 , this should be all you need to match that config.

/routing ospf instance
set [ find default=yes ] router-id=192.168.11.2 redistribute-connected=as-type-1
/routing ospf network
add area=backbone network=192.168.11.0/24

StubArea51

It sounds like you need verify that your border routers are peered with each other and that both can route into the interior of the network. Here is a basic overview of a BGP border design that allows for load balancing over multiple peerings. https://stubarea51.net/wp-content/uploads/2020/10/eBGP-R...

StubArea51

You might find some of these Juniper to MikroTik articles we did helpful for the routing portion. Since Ubiquiti routers use VyOS syntax and that's taken from Juniper, a lot of the commands are the same. OSPF https://stubarea51.net/2021/01/31/juniper-to-mikrotik-ospf-commands/ BGP https://stubarea51...

StubArea51

Which hypervisor?

I'm not sure if it's been fixed, but MPLS was broken on ESXi and Proxmox and only worked on Hyper-V. I did a presentation on it back in 2019.

https://mum.mikrotik.com/presentations/ ... 448059.pdf

StubArea51

LOL - What RouterOS version does it run? 9.0beta0.1?

It's listed in the data sheet ;)

StubArea51

The data sheet is seriously impressive

https://stubarea51.net/2021/04/01/mikro ... 96s-8q-rm/

StubArea51

It is a bit harsh to recommend MikroTik Audience to someone who comes here because of stability problems with other manufacturer's devices... I run 3 Audience units in my home with OSPF/BGP and MPLS/VPLS for SSIDs with IPv4/IPv6. I use the long term versions (currently on 6.47.9) and i've not had a...

StubArea51

@mrz Do you know if there is any work done or planned to be done to enable transfer of path quality parameters from e.g. a WiFi link into a routing protocol? (or even to develop a new routing protocol that is able to handle auto routing in a network consisting of a partial mesh of WiFi links which ...

StubArea51

From reading the v7 documentation, it seems like this will require a route to exist at the exact prefix length of the network you are trying to advertise.

Is it still possible to announce an aggregate?

StubArea51

I think the reason we haven't seen the push for stateful DHCPv6 is because enterprises haven't adopted IPv6 in any kind of significant way. There are challenges with compliance standards like PCI, HIPAA, FIPS, etc in using SLAAC. Most security groups aren't equipped to manage a SLAAC environment. On...

StubArea51

[They have changed the syntax again. router-id for OSPF is now expecting the name of one of the ID's in /routing/id instead of an IP address. That might be your issue. I tried it using the /routing/id syntax and got the same result. Just to see if it was an issue specific to CHR on Qemu in EVE-NG, ...

StubArea51

There is definitely a quirk with routing filters - typically if you copy and edit an existing one instead of adding a new line and then drag it into the numerical order that you want, you don't have to shut the peering and can do a soft resend to the peer.

StubArea51

OSPFv3 is still broken in beta5 - getting "wrong checksum" from everything, same as in beta4. Is there any chance of getting RDNSS search list option added? https://tools.ietf.org/html/rfc8106#section-5.2 What configuration are you using for OSPFv3 ? Whenever I try to add the interface-te...

StubArea51

We have solved similar challenges for client WISP networks using this design...

https://mum.mikrotik.com/presentations/ ... 062656.pdf

StubArea51

The syntax for routing filters has changed:

Details here:

viewtopic.php?f=1&t=173567#p848792

I'd expect something like:

/routing/filter/rule/add chain=ospf-redist rule={if [protocol connected] then={action do=accept}}

StubArea51

I just uploaded it to EVE-NG and am working through adding some config I used with previous beta versions. It looks like the routing filters have changed slightly. What string value is expected? This is what I see in beta5....the only option is "rule=" that I can see, I can't add match-prf...

StubArea51

I would be using Free Range Routing in 2021 as opposed to Quagga and see if the issue persists

StubArea51

Is this a full table or IX peering? When you say "working" routes, what do you mean exactly?

StubArea51

Yes, essentially IGMP snooping exists to determine which ports on a LAN segment need to participate in multicast streams and prevents the flooding of traffic to ports that don't need it.

StubArea51

Great to know that it can be done!

I would love to see stacking on MikroTik switches as well. It's something I brought up at every MUM (back when we did those) with the developers as it would solve a lot of problems in ISP, DC and Enterprise use cases.

StubArea51

Looks like something to support LORAWAN

StubArea51

Setup a packet capture if the message is occurring frequently.

Things to check:

Duplicated router ids
Areas and types
Network Type

StubArea51

I think /31 support is important. As much as I push for IPv6, the world is still operating IPv4 and will be for a while. I've run into the problem more and more where we have to use Cisco or Juniper due to lack of official /31 support. (many orgs do not want to use the /32 workaround)

StubArea51

I've been testing the 2004 with the 25G interfaces only on an fs.com 5860-20SQ switch stack in our lab and haven't seen the same issues as people using the 10G ports, so i'll be interested to load this version and try the 10G interfaces.

StubArea51

instance=default area=backbone type=router id=172.16.0.5 originator=172.16.0.5 sequence-number=0x80000CD5 age=1389 checksum=0xD2FC options="E" body= flags= links (type, id, data, metric) Stub 10.0.15.253 255.255.255.255 10 Transit 172.16.1.28 172.16.1.28 50 Stub 10.0.12.0 255.255.252.0 10...

StubArea51

What's the output of

ip route print

and

routing ospf lsa print detail

on the AS_Router ?

StubArea51

That's definitely not normal, when I issue the same command on my home or office router which are both dual stack, I get the global unicast addresses and the default route.

I would recommend downgrading to the LTS version 6.47.9 and see if the issue persists.

StubArea51

These two should get you what you need. Most of what you're looking for will be in the ipv6 menu

ip dns print

and

ipv6 address print

StubArea51

Recursive routing for iBGP next hops in MikroTik only works with IGPs (OSPF and RIP) and static routes.

StubArea51

Normally, you only want the default to originate at the border router where you are peering or have DIA with an upstream.

Then:

Default Originate (if installed) on all eBGP peerings

Permit it via all other eBGP peers in

StubArea51

Is this an eBGP design where every tower is a separate ASN? From reading the notes, it seems that way If so, you'll want to default originate if-installed for every ebgp peering, You also need to make sure that you have a valid and active default route for it to pick up and make sure your in and out...

StubArea51

We've also found that in addition to higher clock speeds, the amount of cache in the CPU helps with performance. Get more if you can afford it.

StubArea51

Probably need more details, I've used 172.16.0.0/12 without issue for years in RouterOS...what's the specific configuration giving you issues?

StubArea51

This is a good idea...would like to see this.

StubArea51

This is a known limitation of ROSv6. Recursive routing doesn't work in IPv6. This is fixed in v7, but it's still in beta.

Some notes about this are in this article:

https://stubarea51.net/2020/12/30/mikro ... spfv3-bgp/

StubArea51

What are the firewall rules/config? Even one rule can make a difference if a large volume of packets hits it.

StubArea51

It would be helpful to see your configuration

StubArea51

Try adding

add stp-type=config

to your filter rule and then create another filter rule for TCN. This should match and only drop BPDUs and not all outbound traffic.

StubArea51

Really excited to see a REST API in this release. Thanks MT!

StubArea51

Continuing the Juniper to MikroTik series. It translates MikroTik CLI into Juniper to make things easier to learn as well as build multi-vendor networks. This post that will show you basic OSPFv2 commands for config and troubleshooting in both ROS and Junos syntax. Enjoy! https://stubarea51.net/2021...

StubArea51

This depends on whether you want full tables or not.

If you don't need full tables, i'd recommend a CCR1036-8G2S+ , if you are going to do full tables, a hypervisor and the CHR will give you the best performance until v7 is out as stable code.

StubArea51

Continuing the tradition with a series that I've had out for several years now. It translates MikroTik CLI into other popular network vendors like Cisco to make things easier to learn as well as build multi-vendor networks. This time we are diving into Juniper. Here is a post that will show you basi...

StubArea51

You don't need to remove it from the bridge, it can be set and changed. However, if spanning tree is running on the bridge and this is a prod network, be mindful of changes that can cause the STP topology to reconverge.

StubArea51

I'd use the CHR for this task...easy to scale for growth as needed. As the CCR2xxx series matures and they release more models, I expect it will be a good choice as well.

StubArea51

IS-IS and Segment Routing (SR-MPLS)

Discussion is here:

viewtopic.php?f=1&t=171278&p=837339#p837339

StubArea51

There were problems with using the SFP+ port on the 4011 with DAC cables in the past. The issue has been fixed in RouterOS, but we still use optical connections on 4011s and have no issues.

I would change to optical and see if the FCS errors continue.

StubArea51

Here is an article I wrote to make Cisco to MikroTik VLAN trunking easier.

https://stubarea51.net/2019/02/06/cisco ... and-vlans/

StubArea51

Sooooo move away from PPPoE to what exactly? We are talking 15.000 CPEs, I’m open to suggestions. Movistar, my home fibre ISP, with millions of customers, runs PPPoE... This really depends on why you want PPPoE. In 2021, PPPoE is typically deployed because you want: 1) Traffic accounting via RADIUS...

StubArea51

The software quality of major network vendors like Cisco/Juniper has gone down in the last 5 years as they lean more on customers for QA.

We've been incredibly successful using the long term version of RouterOS in production networks for both enterprise and service provider.

StubArea51

ASN isn't a piece of information carried in the packet header - only the routing table of a BGP border router.

Do you have a border router with a full table and no default route?

StubArea51

If there are specific ASNs you want the list of prefixes for to then add to a FW rule, the easiest way would probably be a route-set query

https://www.arin.net/resources/manage/irr/

StubArea51

Try setting the speed explicitly on each end to be 10G or 1G and see if that resolves the issue.

StubArea51

At some point in the future, you'll be able to use the CRS354 to route between VLANs without using CPU. The functionality is there in many of the CRS3xx switches in the v7 beta software. However it's not production ready yet. Capabilities are here: https://help.mikrotik.com/docs/display/ROS/CRS3xx+s...

StubArea51

What is the output of the following command?

interface bridge port print where hw-offload=yes

StubArea51

I would ask your provider to send you a full table + default so that you can discard the full table. However, if you decide to leak specific routes or allow the full table in the future, it doesn't require a change by the upstream provider.

StubArea51

It totally stinks and that's great. I hate these broken MTU promoters. My primary uplink provider still caps MTU at 1460 on their so-called "next-gen" fibre infrastructure. Some people never graduated 1500 ethernet MTU basics. First day on the Internet with MTU? :-) His effective MTU was ...

StubArea51

Kicking off the new year to reiterate my MikroTik wish list....while there are many things i'd love to see in ROSv7, these are my top 2. 1) Segment Routing - In the service provider and data center space, MPLS is rapidly moving over to SR-MPLS because it simplifies both label exchange and traffic en...

StubArea51

It seems to be pretty simple. Create an eBGP peering with the cache box using the ASN and IPv4/IPv6 space that Google allocates and then advertise all prefixes for customers that are normally advertised on transit peers. This is the way most content caches work. https://support.google.com/interconne...

StubArea51

Seems like they have an example of this in the new help docs.

If i'm reading it right, you'll need a bridge set with ether-type=0x88a8

https://help.mikrotik.com/docs/display/ ... VLAN+Table

StubArea51

I've been working on a lab for ROSv7 to provide examples for IPv6 config with OSPF and BGP. Details are in the blog post. Hope it's helpful! https://stubarea51.net/2020/12/30/mikrotik-routerosv7-first-look-dynamic-routing-with-ipv6-and-ospfv3-bgp/ https://stubarea51.net/wp-content/uploads/2020/10/im...

StubArea51

There are two different articles that I think would help you here: The first is an overview of migrating from bridged to routed for a WISP https://stubarea51.net/2019/09/15/wisp-design-migrating-from-bridged-to-routed/ The second addresses your concern of getting IPs from a /24 out to the towers. VP...

StubArea51

Large ISP often has several platforms for different workloads. They never do everything in one single platform. Even in smaller ISPs, this is how I design. Trying to fit every service into a couple of routers almost always ends up being more complex than splitting workloads out into Internet Edge, ...

StubArea51

If you're going x64, go for VyOS instead of RouterOS. RouterOS doesn't have many basic features such as NPTv6, Routing Marks for IPv6 etc and the fact that RouterOS v7 has been in development for a decade if not more. VyOS is enterprise-ready (go through their documentation and confirm yourself) an...

StubArea51

Here is a blog post I wrote on MikroTik and VPNv4. In this example, the P routers are Juniper but the PEs are MikroTik and using VPNv4 The lab config is included in the article. https://stubarea51.net/wp-content/uploads/2020/01/MikroTik-to-Juniper-MPLS-and-VPNv4.png https://stubarea51.net/2020/01/22...

StubArea51

The very best way to do this is with communities. With only two upstreams, you may need to break your /20 into a few smaller advertisements like /21s or /22s and then use the traffic engineering communities of your upstream provider to set preferences. Technically you can do this without communities...

StubArea51

VPNv4 requires an MPLS forwarding plane for prefixes to be reachable. Do you have LDP enabled?

StubArea51

This really depends on what your goals are for maintaining full tables. If you want all traffic to leave via Cogent and only the traffic local to Bulgaria to be sent to the local provider, you can take a default route from Cogent and then learn the ~7000 local routes over the other provider. If you ...

StubArea51

G.8032 is definitely the way to go....would love to see this in the CRS3xx series.

StubArea51

I wrote a blog article on this issue and a workaround when doing VPNv4 between MikroTik and Juniper.

https://stubarea51.net/2020/01/22/junip ... 4-interop/

StubArea51

I've done this quite a bit with MikroTik and Fortigate for Enterprise and Data Center networks. Typically I use a design that employs dynamic routing and L3 switch stacks for a few reasons 1) Failover isolation - the border routers can failover independently of the firewall pair if there is an inter...

StubArea51

The configuration example you need to do QinQ on a CRS3xx switch is in the MikroTik Wiki here:

https://wiki.mikrotik.com/wiki/Manual:I ... 8Q-in-Q.29

The support was added in 6.43rc13
*) crs3xx - added initial Q-in-Q hardware offloading support (CLI only)

StubArea51

Hi IPANet, I am in awe of your network designs........... I don't know or think I will ever need fz-codel or cake functionality but I can guarantee you I will probably be eating cake when I read your posts demonstrating such features !! :-) Thanks for the feedback, I appreciate it :-) We'll definit...

StubArea51

If you want to pass all VLANs like a trunk over VPLS without specifying each VLAN, here is a blog article I wrote with config examples on how to use S-Tag for this. https://stubarea51.net/2018/08/07/mikrotik-isp-design-building-an-802-1q-trunk-between-sites-using-vpls-and-s-tag/ https://stubarea51.n...

StubArea51

I am ***soo*** excited to finally see fq-codel and cake in RouterOS, this is going to be a game changer for shaping options in ISP networks.

Nice work MikroTik :)

StubArea51

... the fact that using stateless address assignment means everyone on the Internet knows your device's MAC address. What's so special about my tablet's MAC address that nobody should know it? This is why RFC4941 exists - Windows, Mac and Linux all support privacy extensions to obscure the MAC addr...

StubArea51

Thank god for NAT and IPV4, not sure what disaster IPV6 will bring. ;-P IPv6 is faster than IPv4 and enables end to end connectivity. You *need* to be deploying IPv6 :-) https://www.zdnet.com/article/apple-tells-app-devs-to-use-ipv6-as-its-1-4-times-faster-than-ipv4/ We've run it in dual stack for ...

StubArea51

I need to upgrade the CCR2004 in my lab and see if the stability improves. We've used them for several clients but have also had some stability issues. I think this router will be amazing after a few more months of bug fixes from MikroTik. This is pretty typical of a new router release...it takes a ...

StubArea51

Set your IPv6 MTU to 1280 and see if that solves the issue as there are places on the internet that are still 1280 for IPv6. If that resolves it, you can slowly raise it until things break again to understand what your effective MTU is.

https://blog.cloudflare.com/increasing-ipv6-mtu/

StubArea51

Why not build LACP channels from the 4500X to two different MikroTiks and connnect the MikroTik routers together via BGP?

What role do the MikroTik routers and 4500X play in this network? what are their jobs?

StubArea51

In general, MikroTik does not care about which vendor made the SFP or DAC cable. I've used Cisco DACs and SFP Optics in MikroTik without issue. I've also had a lot of success with FiberStore SFPs and DAC cables. They work well with MikroTik and Cisco. If you have issues with the DAC cable working, t...

StubArea51

Having designed and built hundreds of WISPs, i've got a few things to share with you that may be helpful. We typically deploy a "switch-centric" design where all connections go into a switch because it lowers operational overhead. This is similar to your first design drawing. We've scaled ...

StubArea51

Earlier this year, a model number for a 100G router from MikroTik was leaked. That's about all we know. https://forum.mikrotik.com/viewtopic.php?p=819880 CCR2016-1G-12XS-2XQ is the model number which would have 2 x 100G interfaces and 12 x 25G interfaces The wiki was updated this year to reflect 100...

StubArea51

Can you share the community list for each of the peerings.?

Prepending isn't going to work if you only have one /24

StubArea51

Ideally, you'd push for another peering with your provider or get a second provider and peer with them. Have you asked your upstream if this is possible? I've seen many providers do this if asked by a customer. In that type of design, you'd want to build it like this: https://stubarea51.net/wp-conte...

StubArea51

It appears you are trying to build a mesh VPN where any site can reach any other site. Honestly, as much as I love MikroTik, ZeroTier is a better solution for this. https://www.zerotier.com/ If you're going to use MikroTik, I would consider using L2TP and build tunnels to/from all routers. You can b...

StubArea51

Can you post details of the config?

StubArea51

Nice summary of info...thanks!

StubArea51

Ever since I first started using MikroTik 10 years ago, I've been very impressed with how well they handle higher temperatures when a climate controlled environment is not available.

StubArea51

You cannot use subnets that are directly overlapped in different VRFs in RouterOS v6...this is fixed in RouterOSv7

StubArea51

You cannot use Winbox to manage an Arista device as winbox is specific to MikroTik. You can use it as a route reflector if you want though and that will give you some visibility....but is that a good fit for your network architecture? However, you can use programs like Unimus or Ansible to manage al...

StubArea51

Please post the output of the following commands

/routing ospf export

/routing ospf neighbor print detail

/routing ospf as-border-router print detail

StubArea51

mDNS would be a great addition to enable things like chromecast between subnets.

StubArea51

That's why we normally use the ptp OSPF type on RF links and it works very well with rapid convergence.

What radios are you using that don't support multicast?

StubArea51

Have you tried changing the interface queues for both ports from hardware-only to ethernet-default ? You need buffering when mixing interface speeds on any router and i'm not sure what the default buffer capabilities are for the CCR2004. I would at least try a few different queue types for the inter...

StubArea51

If you can plug into it locally, use mac-telnet with winbox which will bypass all L3 and login to the router

StubArea51

same problem as well

Search found 1749 matches