MikroTik

pukkita

Just tested (6.40.2) on a 951Ui model and doesn't reboot.

Does it happen with a different USB device? Does it happen with no USB device?

I would netinstall it to 6.40.2. If problem persists, generate a supout and email support linking to this post.

pukkita

Never mind

I cleared it anyway, as if you had that doubt, so could future users browsing the thread.

pukkita

Guess with "transparent" you mean a bridged scenario: just use a bigger subnet. You will have a bridged (switched) network. To achieve this, instead of using 192.168.0.0/24, use 192.168.0.0/23: Network: 192.168.0.0/23 HostMin: 192.168.0.1 HostMax: 192.168.1.254 Broadcast: 192.168.1.255 Hos...

pukkita

Something's not quite right there. Have you used .backup files to move configs between routers? Try this: Go to the bridge, and blank Admin. MAC Address (click on upward pointing triangle on its right, then apply) Run (you will temporarily lost the connection) /interface ethernet reset-mac-address [...

pukkita

If you create a Netwatch monitor that reaches out to 8.8.4.4 and if it can't reach that address is disable the main route until reachable again, won't that IP become instantly reachable when it fails over to the second backup default route, causing it to fail back over to the failed line? No, becau...

pukkita

Follow the presentation mangle to the letter until you get a solid grasp on it, before jumping into customizations.

Order, and following it to the utmost detail is really important.

pukkita

No, not for the local address, but for remote-address of the specific customer needing it. Local address should/could be the same for all pppoe users on a given router, and it's usually a private one as it won't be using by anything else than local traffic between its pppoe users and the router.

pukkita

Follow the same logic/instructions on the presentation, it's wonderfully covered there.

pukkita

- MKT2 LAN IP? 172.10.0.0/16 that's not an RFC1918 range, you're using a public Internet range (belongs to AT&T in the US) for a private network. Proper range is 172.16.0.0/12 In any case: Captura de pantalla 2017-08-29 a la(s) 12.36.42.png MKT1: ether3 shouldn't be a port of a bridge, or switc...

pukkita

I am doing this with PPPoE and running PPPoE at each relay rather than centrally (I have reasons for doing it like this). I have a /25 public IP range that I wish to use as sparingly as possible. As some sites might only need 1 or 2 CPE with public IPs, how is best to achieve this without wasting p...

pukkita

to next device connected to the suspect port ether1, if it's the internet router, then the internet router IP facing the mikrotik device. What's the ROS version and System > Routerboard firmware versions? I would netinstalll, reset to no defaults and restore the config on the RB2011 in any case, as ...

pukkita

Glad it helped

Those lists are created to help mangle determine kind of traffic:

- Local networks to local networks
- Local networks to internet
- Internet to local networks

As depending on that rerouting should be done or not, etc.

pukkita

I suggested supout/support route because looks like a bug and Mikrotik would better know...

pukkita

Omnitik has single radio (5GHz) it doesn't have 2.4GHz.

pukkita

Set the internet router LAN ip for watch address and check if supout is generated after such 30s connectivity loss.

pukkita

Check on System > Routerboard Current Firmware is 3.41, upgrade and reboot if isn't.

pukkita

Every time I connect ether1 to my switch (C5G124-48P2) ~30 seconds later the router turns off.. Unplug the cable from either end, and the router will boot back up. My initial thought was the 802.3at switch port might be causing issues with the passive PoE input on ether1.. It shouldn't, but I disab...

pukkita

Double check Fimrware is up to date. If it is, generate a supout and email support linking to this post.

pukkita

What are:

- MKT1 LAN IP
- MKT1 PTP IP
- MKT2 PTP IP?
- MKT2 LAN IP?

mockup.jpg

pukkita

No, not directly from ROS.

Closest feature is the IP > Hotspot >User Profiles, create new one, Advertise tab, which most probably won't work as most websites nowadays are HTTPS, whose traffic you cannot intercept to play man-in-the-middle.

pukkita

Do you have any insight into how to make both WAN's accessible? The problem I assume I am running into is when traffic comes in to the new fiber it is going back out the comcast line so it is never making the complete connection. For example, I can ping the public IP of the comcast line but not the...

pukkita

ether 2 and ether 4 on the RB 1200 are damaged so are unusable. with your diagram and suggested setup could i say ether 6-9 be used for connecting any devices that need to intercommunicate amongst theirselves and use ether 1,3,5 for the fibre link with the valns? No, 1,3,5 are still the best ports ...

pukkita

MANGLE chain: prerouting, src. address 192.168.32.3, in. interface:lan bridge, action: mark routing, new routing mark to_cable When mangle rule is disabled everything is working fine, when is enabled NAS is no longer available over VPN. Where is the problem? As you have guessed, on that mangling: y...

pukkita

This matter is not suited for a short explanation on a forum thread, Have a look at Tomas Kirnak's Load Balance / Mangle Deep Dive presentation.

The fact of your WAN interfaces being VLANs doesn't change a thing, just use them as WANs.

pukkita

PS. I also can't ping 10.0.0.253 or 10.0.3.253, strangly enough... /ip address add address=10.0.0.253 interface=02-pfSense network=10.0.0.0 add address=10.0.3.253 interface=02-GUEST-pfSense-VLAN200 network=10.0.3.0 Once you add ports to a bridge, any IPs should be assigned on the bridge itself: /ip...

pukkita

Have a look at Tomas Kirnak's Load Balance / Mangle Deep Dive presentation.

Your problem comes from the fact you're not marking on input chain.

pukkita

I changed the cost to 10 both of them and now traffic goes both interface.. is this correct implementation ? Yes, that's ECMP in action. should i change the gateway on router-2 or any extra setting ? No need to do anything for failover, test that for yourself by disabling any of radio link interfac...

pukkita

The quid here is playing with radio links interface costs in order to achieve ECMP . add authentication=simple authentication-key=xxxx interface=ether10-11Ghz network-type=broadcast priority=14 add authentication=simple authentication-key=xxxx cost=20 interface=ether11-5GhzLink network-type=broadcas...

pukkita

All mikrotik devices sport all ROS features, so for lab use almost any device will allow you to setup labs. Unlicensed CHR will be limited to 1Mbps, but again, for a Lab this still allows to setup any scenario, and you can get an unlimited temporary license for 60 days. You can run user-manager or d...

pukkita

locodog already said how would that be accomplished. I stand by my advise, RB1200 will be probably the best performing board of the three. Let's look at it's block diagram: Captura de pantalla 2017-08-27 a la(s) 12.08.08.png If you were to use just the RB1200 without an additional switch, most optim...

pukkita

Ok, then if those are PTPs, lock down the highest stable, low RTT datarate on the AP radio.

Be sure to pass traffic while evaluating highest stable datarate with low RTT. If RTT goes nuts on a given datarate, select the next lower one.

pukkita

It definitely looks like some sort of L2 issue is happening, broadcast storm, network loop or similar.

Try logging into an affected powerbox via mac-winbox or RoMON, and have a look at /tool profile, and interfaces looking for saturated ethernets.

pukkita

Look like the rebuild was not successful, the database possibly got corrupted due to lack of space.. You may need to clear it out and start from scratch, or have someone knowledgeable to inspect it if it contains useful accounting data.

pukkita

The only issue is that I need to add a L2TP Server binding and a new Interface List item for every L2TP client. Do all remote users need access to the router itself?? In such case it will be easier to change the firewall logic, instead of /ip firewall filter add action=drop chain=input comment=&quo...

pukkita

That looks much better. I have 3 links, all 5 ghz, all with cm9 cards. On the same RB433? There's where your problem probably comes. Specially if at any given moment two of them need to Tx and Rx simultaneously. I'd rather seperate radios on different RBs, and go straight to integrated units (SXTs, ...

pukkita

There's relevant info lacking from your post, so speaking out of my guessings... Firstly, if local VPN IP on router is 192.168.99.1, you should use it to access it; otherwise, you need to do some adjustments on the remote PC connecting via VPN: - Make your VPN connection the default route (making al...

pukkita

BR433 on my side with cm9 cards

Cards? There's more than one? What's at the other side? A sector (PtMP)?

pukkita

Doesn't look so stable. Which devices are you using? Is this a PTP or a PtMP? What's the System > RouterBoard Current vs Upgrade Firmware on both? If this is a PTP, for 3km link, signal levels are really unleveled, assuming both AP and station are the same model, I'd bet you have either fresnel or l...

pukkita

There are several possible ways of doing this. One of them is setting default route through an Internet host like 8.8.8.8 by using recursivity, so that the "ping gateway" ROS feature controls the failover. I have had issues with this, and wouldn't be surprised if your ISP, or further up th...

pukkita

Your radius is not responding.

Check the hotspot router reaches the radius ip.

Check Radius service is not failing due to database problems, high load, or that it doesn't have accounting enabled.

Is radius an external radius host, or user-manager running on the same device?

pukkita

Post a diagram, depìcting devices, interfaces and IPs. Hand drawn is perfectly fine.

pukkita

Difficult to provide more specific instructions due to the scarce information, but: Assuming there's one router with one WAN connection which routes 6 public IP addresses, in order to masquerade outgoing Internet connections you only need: - Have all the IPs assigned on the router. I assume the 12.1...

pukkita

What's on System > License?

It doesn't have to be related to license, there are other settings that may cause this, like bad ip pool, inconsistent settings, etc.

Watch out the log when that happens, and post it here. Posting an export of your config is a good idea also.

pukkita

It was introduced on 6.40.2, but can be used on any fasttrack enabled ROS version.

pukkita

You're welcome!

pukkita

You could use a RB912 with a 2nd radio installed + 2 external antennas, but it won't be neither less bulkier nor cheaper, and way less reliable (pigtails). I understand Mikrotik philosophy is providing flexible building blocks at disruptive prices, that's why no too-scenario-specific devices are rel...

pukkita

Yes, looks like some kind of ethernet problem with that laptop.

pukkita

If I do that, broadcast a client SSID and connect as a client, on the same 5GHz radio I'd imagine I'll suffer from the common problem of wireless mesh and I could see a reduction in performance. Does the MIMO (triple chain) of the product off-set the loss of air-time in this case Yes, it does suffe...

pukkita

No need for the second mangle on output chain. This rule alone should be enough: /ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark=VPN_Gateway passthrough=no protocol=tcp src-address=192.168.168.101 dst-address=!192.168.168.0/24 dst-port=80 log=no log-prefix="" ...

pukkita

Which interface? do you refer to a laptop?

pukkita

Try upgrading to 6.40.2, per its changelog : *) pppoe-client - fixed wrong MRU detection over VLAN interfaces; Not all Movistar ONTs expose VLANs anymore, that could be the reason others not experiencing problems if this fixes it. Have seen some Movistar ONTs change from exposing VLANs to not exposi...

pukkita

ROS version? Firmware version? (System > Routerboard Current Firmware ) Looks like MTU problem. Does your pppoe-out1 enter Running state? Open a New Terminal and issue the following commands, posting them back here: /ip address print /ip route print /interface print Have you had a look at the WAN st...

pukkita

Reset it to no defaults (connect to it via winbox neighbors tab afterwards, no need for ip settings) Station: - Setup it as wireless-mode=station-bridge - Create a bridge - Add wlan1 and ether1 to the bridge. AP: -wireless mode is AP-bridge or bridge - Create a bridge - Add wlan1 and ether1 to it Do...

pukkita

At this point, I would save an export (.rsc file) for backup, then:

- netinstall the router.
- Reset it to no defaults
- Connect to it from Winbox Neighbors tab, then import or copy & paste backup. rsc file contents.

Post a System > Routerboard screenshot. Current firmware should be 3.35.

pukkita

Try keeping the reset button pressed until you see the hAP appear in netinstall. Have you played with protected RouterBoot features in the past? When you say winbox doesn't detect it, do you refer to Neighbors tab? Even with a laptop with its ethernet as only network active interface? (all the rest ...

pukkita

Yes. Despite being a tiny device, it supports all ROS features (CPU allowing).

pukkita

NAT is the last step in traffic manipulation, unless routing steers traffic via a specific WAN, where NAT is set, NAT is not going to happen.

Please post

/ip route print detail
/ip address print
/ip firewall address-list print

pukkita

Check the reset switch is not damaged and is shorting itself even w/o pressing it. That may cause the reboot loop.

pukkita

Try setting src-address in radius to 127.0.0.1.

I assume both user-manager and hotspot are installed on the same router.

pukkita

Yes, it's a new optimization to default firewall filter rules. Yes, it has to do with fasttrack.

pukkita

Have you done an spectral scan? You'll need a non AC Mikrotik radio (or other brand) to carry it out. Specific scenario 5GHz Spectrum is what will dictate what speeds can be achieved, regardless of equipment used. If there's 40MHz contiguous spectrum available, you may get near those 200Mbps. If the...

pukkita

Thanks very much indeed for the clarification about IPTV and the QOS configuration!! Have you any thoughts about the make, model, and performance of a suitable load balancer which we will need if we go for 2 uplinks? The already deployed RB850G can cope with the two. Do you think that speed limitat...

pukkita

You're not doing any load balancing, and steering all LAN - > Internet traffic towards WAN1: add action=mark-connection chain=prerouting comment=LAN->WAN connection-mark=no-mark dst-address-list=!local-lan dst-address-type=!local \ new-connection-mark=LAN->WAN passthrough=yes src-address-list=local-...

pukkita

Depends on expected customer distance, I'd recommend mANTBox 19S for >800m customers, and 15S or SXT-SA for closer customers. You need to study the terrain, then deploy sectors estrategically depending on surrounding conditions and customer density; typical setup 3 x 19S to cover 360 for mid-long di...

pukkita

Are you using hotspot? Or plain DHCP?

pukkita

Don't think that's possible, because there's only one switch chip. FYI, 6.41RC has a new bridge/switch chip implementation, where hardware offloading is used to accelerate switching/bridging when possible. Haven't tested it yet, and don't know which specific circumstances need to be met for HW offlo...

pukkita

I was referring to setup your own IPTV streaming server. When I refer to multicast, I refer to stream IPTV via multicast, i.e. users will be connected to the server and will "fetch" the same stream from the network, i.e., if 5 users are watching a given channel, and such channel is 3Mbps, ...

pukkita

Check updates from SwOS GUI

pukkita

As it's a CRS, i.e. a switch, it has one switch chip.

All ports are connected to this switch chip:

Captura de pantalla 2017-08-24 a la(s) 18.26.40.png

pukkita

Does it appear in red?

So far cannot spot anything, which ROS version? Could you export it again using /export compact this time?

pukkita

It may, depending on other factors, but I think there are more suitable options. What's the available Internet bandwidth? In any case, for a network of that size, I'll use a RB3011 minimum. If budget allows, investing on a RB1100AHx2 or CCR from starters will better protect the investment and allow ...

pukkita

Yes, is it possible to change default configuration.

You need to use netinstall Configure Script feature.

pukkita

The question is Omnitik the right decision for a base spot in this situation?! No. Stay away from Omnis. Basebox would be a good choice if only a handful, similar distance customers will use it, or to use it (PoE version) as a PoE Switch and reserve radio to carry out spectrum scans w/o disturbing ...

pukkita

which routerboard out of the 3 i have is better suited to handle a high user load? The RB1200 im looking at roughly a user load of anywhere from 20 users up top 600 connectedf at any given time. What's the internet bandwidth? Are you running queues? I would invest straight on a RB1100AHx2 or a CCR.

pukkita

I think there's a 99.9% probability of the problems being due to the Tenda switches. Probably a bug or limitation in its arp'ing scheme. Avoid Tenda and Whatever-link (D, TP, LR...) brand crappy switches. Netgear is usually fine, and so are CRS routerboards. You can try setting proxy-arp or local-pr...

pukkita

No problem either. I found the power rating of a RB2011UiAS-2HnD-IN as 11W, yours is the non Wireless version, so max power will be less.

For 12V: 11W=12V*I; I = 0.91A. So you have enough margin even with the 1.3A limitation.

pukkita

I would directly write support in this case. BTW, There's a SwOS 2.5rc2 release candidate version, not sure if would help in your case.

pukkita

As long as the PSU provides enough amps, you won't have any underpowering or other problems in your scenario (would be different if you powered the 2011 via PoE-In using a long cable). RB2011 original power adapter is 24V @ 1.2A, i.e. Maximum Power = 24V * 1.2A = 28.8W. I doubt maximum power draw fr...

pukkita

Have a look at this presentation by Tomas Kirnak.

On dual WAN setups means should be deployed so that traffic entering by a given wan leaves by the same one.

Double check you're actually masquerading on the secondary WAN too, when it's the default route hosts from internet should ping too.

pukkita

double check the ROS or SwOS version and firmware, from SwOS changelog : What's new in v2.4: *) CSS106: fixed upgrade over PoE ports when PoE stopped working; *) CRS326: fixed port in disabled VLAN mode to forward untagged packets; What's new in v2.3: *) fixed CRS317: make 10G links more stable; *) ...

pukkita

The solution to this is placing more APs on each floor, at a minimum another RB951 at third floor, wiring it to the main RB951. This RB will need to be wired to the main RB951, configuration needed: On third floor RB951: setup wireless, create a bridge and add the wireless interface and the ether po...

pukkita

Have done some integrations, mostly using hardware DVB-S or DVB-C streamers.

There's a very interesting software project for this: stalker-portal

pukkita

(netinstall can run under wine but it would be better when it could run from commandline) It would be actually really nice , as it would be possible to setup tftp/dhcp netinstall servers on the network. I haven't fully reverse engineered what netinstall does exactly, wonder what's the reason (apart...

pukkita

1. Is there a way of automating the process of getting into netinstall mode? For example, is there a command that can be issued 'reboot into boot loader mode' so I can write a script to automate that part (eg tied to a DHCP lease event that would spot the router grabbing an IP) /system routerboard ...

pukkita

You can follow a more general approach, and mark regular HTTP/S, and HTTP/HTTPs "downloads" (more than X Mb on a given established connection, 5MB in this example) using mangle connection-bytes : add action=mark-connection chain=prerouting dst-port=80,443 new-connection-mark=HTTP packet-ma...

pukkita

In that case you can add a second antena/internet uplink, and make the main router load balance the connections through the two internet uplinks. No need for a second routerboard. QoS plus second internet uplink and load balancing should provide a smoother experience for all users. Third possible en...

pukkita

Plug yours directly to the 3011 and test if you have same problems.

pukkita

Firmware is not up to date, note Upgrade Firmware = 3.36 while Current Firmware=3.26.

To upgrade:

1.- Click on Log.

2.- Go to System > Routerboard and click the Upgrade button.

Watch out log, when you see a message stating upgrade was successful, reboot the router.

pukkita

Are there any PCs directly connected to the 3011? Do those ping internet?

pukkita

can you ping those?

- 82.114.64.3
- 82.114.64.4
- 192.168.1.1

instead of traceroute do a

tracert -d 8.8.8.8

pukkita

What's the ROS version?

What's in System > Routerboard, can you post a screenshot?

pukkita

Which devices are broadcasting the wireless signal? How are they connected to the mikrotik RB951 router?

Is the RB951 the only AP?

pukkita

Post an export, and some description on how the 750 is wired to the rest of the network.

Depending on that, it may be possible to leverage bridge filters to isolate those rogue DHCP servers from the 750.

pukkita

Can you tell me how to do that, im not expert for mikrotik. Copy and paste this onto a New Terminal: /ip firewall filter add chain=input action=accept protocol=icmp comment="defconf: accept ICMP" add chain=input action=accept connection-state=established,related comment="defconf: acc...

pukkita

post an

ipconfig /all

on your PC, I assume you run windows.

BTW, your router is exposed to the internet, you should add firewall rules to prevent anyone from bruteforcing your router.

pukkita

You need to make masquerade more specific: /ip firewall nat add action=masquerade out-interface=ether1 chain=srcnat comment="Masquerade WAN" src-address=192.168.1.0/24 Apart from that everything looks fine, the arp problem doesn't seem to be related to 3011 config. Do PCs connected to swit...

pukkita

Which ports are those switches connected to? A hand drawn diagram depicting what's connected and where on the 3011 would be essential.

Connect to it using winbox, open a New Terminal and issue

/export

Pasting the output here.

pukkita

In my case, DHCP server should run on VLAN interface, which is part of a bridge "trunk". Not quite... vlan is "hanging" from bridge-trunk. The only interfaces which are part of bridge-trunk, i.e. are bridge ports, are ether4 and ether5. I don't understand why vlan102 is "sl...

pukkita

Looks like an arp problem. Check Arp setting of LAN interface.

pukkita

On average there are between 30 and 80 devices online at any given time. Bandwidth from wisp is stated as 60 mbs download and 40mbs upload. [...] Unfortunately although the speed is now expected by provider to be between 4 and 7 megabits we sometimes get dips down to as low as 1megabit although at ...

pukkita

What are your firewall filter rules?

Open a New Terminal and issue:

/export

Then copy and paste the output here.

Your port forwarding is apparently fine.

pukkita

Tx goes from router to client. So client download is Tx rate on router.

pukkita

Only first one (prerouting) is needed.

You can add the address-list mangle rule after the existing one, as long as the existing one has passthrough enabled, mangle proccessing won't stop there and will reach the one adding to the address list.

pukkita

Higher OSI layers depend lower ones for everything to work, in your scenario: Layer 1 - Fiber runs and SFPs linking / running properly Layer 2 - Proper Switches master/slave ports configuration (fine as per your export) Layer 3 - Proper IP range assignment Layer 1 I am able to link sfp1-0 to sfp1-1 ...

pukkita

Question. Instead of the whole dedicated PC thing, could I use a hAP ac lite tower since it says it has "USB port for 3G/4G modem "?? I'm just wondering before I buy one if I plugged my cell phone with tethering into the usb port that it would then work. I already own 7 tiks so i dont wan...

pukkita

I would rather use the add dst to address list action in mangle.

Easier, and you can get a text output at any later stage.

pukkita

Poor wireless link would be the first thing I would check, look for OSPF flapping.

Which equipment is used on the PTP? are there switches between the two routers running the VPLS tunnel??

pukkita

There's no way of fixing it, HTTPS protocol is designed to prevent exactly that, i.e. the user connecting to a different server from the legit one.

pukkita

What was the router uptime when you posted that status screenshot? Doesn't look like unresponsive radius on that screenshot; I thought it was actually an external radius server, not user-manager running on the same router. Yes, you should upgrade to current 6.40.1, check System > Routerboard afterwa...

pukkita

Should work as you have it configured, if that same config is on rest of switches. I assume switches are daisy chained, ie floor 0 SFP+1 |====| SFP+1 floor 1 SFP+2 |====| SFP+1 floor 3 SFP+2 |====| SFP+1 floor 4 Are you sure SFP modules are linking right? post screenshots of sfp interfaces SFP tab o...

pukkita

Are PC dedicated for internet, and internet/ lan backbone 750 routers connected to a switch? or are they interconnected by point to point connections (directly between them)? Do all network equipment (but radios on 10.10.10.0/24) use 192.168.1.116 as default gateway? It should, then you need to add ...

pukkita

After Changes. undid the 192.168.1.0 address because it over-rode my dhcp client and lost my address of 192.168.1.17 to it. Applied NAT Missed that. If it's getting a 192.168.1.x address then nothing else should be required, neither dst or src-nat; for routing to work, both parties (routers) have t...

pukkita

You need to add an ip address from 192.168.1.0/24 on ether1.

As soon as you do that, ROS will have a directly connected route towards 192.168.1.0/24 and it will start to route.

pukkita

You need to make both SFP ports slaves of the master port the switch chip is setup to.

Open a New Terminal, and issue

/export

Pasting the output here.

pukkita

post the sxt export...

pukkita

No. CCR is a multi core device, optimized to run simple queues by spreading them along available cores.

pukkita

Yes, from ROS 6.x onwards, and specially on multi-core devices.

pukkita

See this post

pukkita

Hi All, Last week we had 2 routers on our network compromised. Both were running 6.29.1 (yes I know its not the latest but ive been through the changelog and cant see anything relevant). Have a closer look at the changelog archive : Release 6.38.5 2017-03-09 What's new in 6.38.5 (2017-Mar-09 11:32)...

pukkita

I have read through mikrotik wiki and doesn't have full understand how simple queue and pcq works. Mayb that 's because my bad english and not native. I am currently limiting download and upload speed of Hotspot user by specfying limit in Hotspot profile rate limit. I can see that this limit show i...

pukkita

Simple queues are processed sequentially, once a packet matches one, it won't proceed to the next same-level simple queue. That's the reason why Simple queues have a strict order - each packet must go through every queue until it reaches one queue which conditions fits packet parameters or until th...

pukkita

To fix whatever is happening to the radius server, if you're using SQL backend the problem is usually there. How many users? Alternatively, to alleviate the problem, if radius is being "overloaded", you can try to ease the load on it, by: - setting the Hotspot server profile interim update...

pukkita

It's a little swiss-army knife wireless access point and router of sorts The condo complex has shared wifi throughout (similar to a hotel, where you go to a URL and input your room number). I doubt it was left there, is it probably the AP providing wireless coverage to your condo when you enter your...

pukkita

Yes. You don't want to disable them, isn't it? After doing it, you can test by disabling one of the interfaces, more specifically the one with 192.168.1.x/24 addressing, as I assume LAN PCs are in the 192.168.10.x range. As long as you set the default gateway on M$ as 192.168.10.254 M$ will reach In...

pukkita

Now for clients connected to the tower router they are unable to get this, they get only what their subscribed plan is, how can we offer the same cache services? Difficult to say anything specific without knowing your network with more detail, guess you'll need to deploy same mangle / top queues st...

pukkita

We afraid a little to remove routing from M$ cause we don't have spare domain controller and we don't know how to M$ behave after remove routing and second networkcard .. In that case: 1.- Connect M$ 192.168.10.1 ethernet card to a Mikrotik ether port, say etherX 2.- Create a bridge, and add: ether...

pukkita

If you want 10G, then you'll need a different router, with 10G (SFP+) interfaces and power suitable for 10G, a CCR1009-7G-1C-1S+ as bare minimum. If you're an (W/F)ISP and not a "power user", then I'll skip straight to a CCR1036-8G-2S+ as it's the sweet spot in terms of price/performance, ...

pukkita

I don't know either, where is 192.168.20.2 supposed to be? I am afraid you need to do some cleanup. Cannot understand either why the need of the M$ routing at all, you'd better have one single router to act as default gateway for all the network, it will simplify management and avoid routing loops. ...

pukkita

In the past I did a couple of "reset configuration" with "keep user configuration", "no default configuration" and "run after reset" pointing to a /exported file that was slightly edited. This was on RB2011 routers and it worked fine every time. I did it to m...

pukkita

Post an unedited (but from passwords) export.

pukkita

RB3011 has an SFP port (1.25G), not SFP+ (10G).

What do you want to link by fiber? what's the distance?

pukkita

Then you need to assign one, eg 192.168.10.254/24 on ether interface facing SG500. Any host having just one connection in the 192.168.10.x/24 range will need 192.168.10.254 as default gateway, so you'll need to modify DHCP Server at 192.168.10.1 to hand out 192.168.10.254 as gateway.

pukkita

Have a look at this post.

pukkita

You can't, as the pinged ip is that of the gateway.

If you want to use 8.8.4.4 to monitor this, you'll need to resort to use Tools > Netwatch along with up and down scripts.

pukkita

That is probably changing every now an then... another approach would be importing an Address list with IPs from Skype (AS198015): 91.190.216.0/23 though that will prevent also from accessing Skype website, etc.

pukkita

post an export.

Does the mikrotik router has an 192.168.10.x/24 ip address assigned?

pukkita

There's some kind of problem with your radius server when receiving accounting, that's what first error points to (are you using radius?). Second message, logging failing due to simultaneous session limit reached could mean (if you're using radius), your radius server or service is not being notifie...

pukkita

Post an /export

pukkita

I have problem to reach 192.168.10.X from 192.168.20.X without connected 192.168.10.246 Link
But from 192.168.10.X i can reach 192.168.20.X ewen without 246 link

This doesn't make sense, first sentence contradicts second... please review your post and try to be more specific...

pukkita

In your scenairo it will be even simpler thant that, you don't need any kind of EoIP tunnels, just set up bonding. and use arp monitoring.

pukkita

If with passive you mean that there will be only antennas (no radios) at middle point, no, that's not possible. You need radios on all Antennas. Assumming all antennas have their radios (4 antennas + 4 radios total) it will work between A and B (middle point) but won't work very well between B and C...

pukkita

Difficult to say unless you post an export.

Are you using fasttrack? (you should)

As a side note: using DMZ is far from optimal, you'd better put the AT&T router in bridge mode, and setup the RB750Gr3 so that it takes the public ip, i.e. ATT will be a mere modem.

pukkita

You'd better post those logs and more information, as I can be just guessing without that. That may happen if accounting data already in radius triggers it; but no new accounting is being sent by the NAS if Use Accounting is not enabled, that's for sure. Regarding failed auths, that means radius rej...

pukkita

When you enable accounting, the NAS tracks and sends accounting information about every authenticated user to radius: time connected, bandwidth consumed, etc. one year ago I started to have a problem in the log: RADIUS accounting request not sent: no response. the users have to try several times in ...

pukkita

Did you use .backups from one radio to setup the rest of the radios? if so, that would be where your problem lies. .backups are only intended for a given device with a given ROS version. They're not meant for configuration mass deployment as it contains MAC addresses from specific device it was take...

pukkita

With all due respect, my advice is hiring a consultant for this migration. Additionaly, you're wasting precious and scarce public ip addressing space.

OSPF won't ever change an IP, as JimmyNyHolm pointed, your edge router is masquerading connections from that customer.

pukkita

Looks like the USB card/ROS USB has issues, which is the ROS version AND firmware version? (System > Routerboard Firmware versions listed)

What's CPU load when doing this test?

Wouldn't it be easier (and more optimal) to connect a second switch to the 2011 LAN ports?

pukkita

so each of this connections from the central building to the other 15 ones must have at least around 150MB throughput That's not going to happen with 802.11A/N/ac PTMP and 15 stations. In that case, you'd better either create a PTP for each. You'll need minimum 40MHz for each to exceed 100Mbps, whi...

pukkita

bitorrent needs to establish incoming connections also. Check that: - Your mikrotik router has the public IP assigned, i.e. set your provider router as a mere modem (bridge mode) - Setup uPnP on mikrotik specifying WAN and LAN ports, and activate uPnP on the client, you should see D flagged (dynamyc...

pukkita

Generate a supout and email support. If device is under warranty, it will be covered.

pukkita

From RB260GSP manual: Note: SwOS uses a simple algorithm to ensure TCP/IP communication - it just replies to the same IP and MAC address packet came from. This way there is no need for Default Gateway on the device itself. If edgerouter is routing to carry your packets to the RB260GSP, you'll experi...

pukkita

Glad to hear that

pukkita

It depends, for non Mikrotik hardware, see supported hardware.

S+31DLC10D is the Mikrotik product for 10G - 10Km (single mode).

CRS317 hasn't been included yet on Mikrotik SFP Compatibility Matrix, but being both Mikrotik products I bet it will support it.

pukkita

Check first the usual suspects: cable, injector... If those are fine, AF's are known to inject its own radio tx signal back into ether if there are obstacles in front or near it, causing these FCS problems. Lower Tx power if possible and check; if these go away, that's your problem. Has any radio be...

pukkita

Yes the premises is rectangle 4m x 10m the gaming computers will be in 2 lines of 10 units back to back. Then the Hap ac will be all you need for wireless coverage. Oh yes i forgot to mention i want to install at least 4 cctv security cameras Are they PoE-In? (they should) if so, I'll use a a Hex P...

pukkita

Ouch... I'd swear I read RB1100AHx2... :D So there is no difference in this case, all ports are equal... Not exactly... In this case, optimal ports would be ether11-13 leaving one unocuppied if possible; rationale: they won't be sharing as many ports (5) into the 2,5Gb/s switch chip uplink towards t...

pukkita

RB260GSP is a PoE-out switch, it doesn't even run RouterOS but SwOS. For your application minimum I would pick is a RB3011 , it will be able to "move" 2x200Mbps fine. Assuming premises are square, or rectangular, as AP a Hap ac placed on the center will allow you to use the rest of the por...

pukkita

pukkita

I'd write support, including a supout and linking to this thread.

pukkita

No, PowerBox Pro won't handle 500 simultaneous users, PowerBox Pro has a L4 license which limits simultaneous hotspot users to 200. Apart from that, it won't have enough CPU power. In any case, you'd be already limited by the SXTs, there's no way each would be able to handle 250 users, I'd say 50 ma...

pukkita

In that case the optimal pick for the AP is wAP ac : - Weather Proof - Tamper Proof - Already conceived to be fixed on Walls, Ceilings or Poles. To fill-in shadow indoor areas, or small non-crowded spaces you could use cAPs For big outdoors areas, you can resort to: - SXTG-2HnD (60 Degrees sector wi...

pukkita

Sorry, this is an user-supported forum, there's a Scripting forum where you can post more specific questions.

pukkita

Could be Energy Efficient Ethernet setting ( RFC 802.3az ) on the i350-t4, according to Intel : Link flap when Energy Efficient Ethernet is enabled --------------------------------------------------- Some switches do not support Energy Efficient Ethernet (EEE) correctly. Make sure your switch is loa...

pukkita

I have DHCP server on the CCR bridge, which connects a few of the wired ports to ether2 What's on ether2? (ether port where the AP connects should be added to DHCP bridge). Post an export... but get no IPs on wireless devices connecting to the 2nd router. That means there's no layer2 continuity fro...

pukkita

No need for EoIP tunnels, just set the Hap lite as a simple wired/wireless switch

No need to use wireless repeater, as both will be already connected via ethernet which is also the optimal approach.

pukkita

If you want to enable/disable then and are using local user accounts, then you'll need to program a script to do so, and use the scheduler. Another possible approach would be using time feature on simple queues, not to disable them, but to apply restrictive speed limits to them: you can use IP addre...

pukkita

Yes and no. :D No, you can't add a physical WLAN card to it. Wouldn't be really practical as the place where this router belongs is inside a rack anyway, while optimal AP placement are ceilings and walls usually. But... Yes, there's even a better way: any routerboard with wireless can work as a CAP ...

pukkita

This is most probably hardware-specific, so doubt RB2011 issues could be related.

Post an screenshot of System > Routerboard, does Current Firmware match Upgrade Firmware?

pukkita

Have you ticked Bridge > [Settings] Use IP Firewall ?

Traffic flowing through the bridge won't pass through the firewall unless that's enabled.

pukkita

Captura de pantalla 2017-08-09 a la(s) 10.23.49.png

Typically, ether11 and ether12, as they're out of the switch chips (better for LAN) and have direct CPU connection.

pukkita

Is it new or does it started to behave like this recently after working for some time? Asking this because It could be either the reset button is damaged, or rust has shorted out its PCB pads, effectively acting as if reset button was constantly pressed, inducing a constant reboot/reset to defaults ...

pukkita

You only need firewall protection on the device facing internet; per your post looks like that duty is already being carried away on the Hap ac, so no, you don't need any firewall on the wAP ac.

In fact best practice is having that AP doing as little as possible for the best AP performance.

pukkita

Depends on:

- What's your house floor size? does it have multiple stories?
- Routerboard model?

pukkita

Check SSTP service is enabled. Check also your ISP is actually forwarding those ports by doing a simple redirection to an internal webserver or RDP host, To debug what's happening, have a look at Log while trying to connect from outside, paste a screenshot here. Are you trying to connect from a smar...

pukkita

Have a look at Tomas Kirnak's Mangle deep dive Presentation.

pukkita

Glad it helped.

You probably exceeded syslog's packet requirements by using multiple topics.

pukkita

Have a look at Janis Megis' Most underused and overused RouterOS features Presentation, specifically Queues don’t work properly

pukkita

Use radtest or radclient to check if radius server is returning Framed-Pool attribute, and if so, same name ip pool is defined on the RB.

If not returning Framed-Pool, make sure there's a pool defined on whichever profile pppoe server is using.

pukkita

mmm that changes everything... so it does work with simple topics?? Have you tried setting multiple single topic entries with same remote?

pukkita

Can RB ping syslog server?

If RB has multiple IP ranges, try setting

/system logging action
set 3 remote=192.168.1.1 src-address=192.168.1.X

Where 192.168.1.x is the RB ip in that range.

pukkita

Bear in mind that on RB493G, ether3 and 4 are on the same switch group, so it may be switching or VLANs were implemented in hardware by using the switch chip features. CCR1009-7G-1C-1S+ doesn't have any switch chip, if you imported the RB493G configuration, anything related to switch chip won't be i...

pukkita

Check that remote syslog server actually allows RB IP to send logs.

pukkita

Oooh I understand but wheb we need to use bonding or ospf? Don't look at it as which or both would we deploy, but what's actually more suitable or comfortable for you; as both will aggregate both links. Bonding may not be seen as ideal, but as Cha0s wisely said: Implementation of a technology is on...

pukkita

Only one Power Source, less cabling. So less components to fail. That's one way to see it... it can be also be seen as single point of failure :D Unless that's deployed on really simple POPs without meshing or redundant links, I can't see the benefit... having power as a single point of failure wou...

pukkita

Start by posting routers exports, and the output of

/interface bonding monitor [find]

Did you watch out for CPU usage on the 750s while doing the tests?

How far apart are antennas from each other at each side?

pukkita

Judging a product from people having problems in the manufacturer forum isn't usually a reliable gauge... as those who don't have problems won't come to the forum to report theirs is working fine... Yes, Hap AC works really fine. And it's heaps ahead in radio performance from a RB2011UiAS-2HnD-IN. 2...

pukkita

Is there an AIrFiber on ether7?

pukkita

Not exactly... Nv2 is tightly bound to the radio chipset ROS driver, so if AP is AC it isn't the same as setting the radio in N mode, ROS drivers for AC chipsets are different than drivers for N chipsets. Analogy: you can make a spectral-scan on N hardware, but you can't on AC hardware, no matter if...

pukkita

This makes sense where you cascasde POE-Devices. E.g. HEX POE inside powering Omnitik POE Outside which powers sectors ... I see it now... agreed, this feature will provide more deployment flexibility. However I wouldn't personally deploy cascading PoE, not best practice IMHO in terms of resiliency.

pukkita

Let's say tunnels IPs are 10.1.1.1 on Fortigate side, and 10.1.1.2 on Mikrotik side.

You need to add routing on

Fortigate:
192.168.88.0/24 gateway 10.1.1.2

Mikrotik:
10.10.10.0/24 gateway 10.1.1.1

pukkita

ECMP is a feature of IP routing, OSPF is a dynamic routing protocol. ECMP : Equal-cost multi-path routing (ECMP) is a routing strategy where next-hop packet forwarding to a single destination can occur over multiple "best paths" which tie for top place in routing metric calculations. Multi...

pukkita

According to Mikrotik Wiki on PoE-IN : RouterBOARD devices with "poe" labeled ports, support powering by Passive PoE over spare pairs, except where notified otherwise. This table explains Ethernet cable pinout for RouterBOARD devices, and shows powered pins for PoE on 10/100 and 10/100/100...

pukkita

InoX, which kind of hardware? N or AC?

pukkita

You need to add routing to specify which destination addresses should be sent via the tunnel, on both mikrotik and juniper.

Unless you provide ip addressing details of both sites it won't be possible to provide especific advice/commands.

pukkita

@Kindis: Have to disagree... that's wrong. First, he's (rightly) already using the default firewall, so that won't happen: /ip firewall filter add action=drop chain=input comment="default configuration" in-interface=ether1-gateway Secondly, if he were being subjet to a DNS DDoS attack, Tx ...

pukkita

I meant I never have found 80MHz contiguos spectrum yet on any city. You're really lucky. I asked what is the throughtput of those QRTs AC linked at 80MHz, have you measured it?. You need a N device for spectral-history to work, setting an AC device to N mode won't work, because the limitation is in...

pukkita

Some enhancements to that config: 1.- Do not set 2.4GHz (wlan1) to 20/40MHz. Unless you live in the middle of the desert, 40MHz isn't usable in 2.4GHz. Leave it at 20MHz only. 2.- Go to Queues > Interface Queues and change Queue Type of wlan1 and wlan2 interfaces to only-hardware-queue . 3.- Disable...

pukkita

Let's say the setup is this: [HQ Router ether6] ----- Antenna (AP) ::::::::: Antenna (Station) ----- [Client PC ether] 1.- Set IP address on ether6: 192.168.3.1/24. ether3 shouldn't be neither slave of another ether port, or be inside any bridge. 2.- Set up antenas in transparent bridge mode. 3.- Se...

pukkita

routerboard: yes model: RouterBOARD 952Ui-5ac2nD serial-number: 66580588A2D2 firmware-type: qca9531L factory-firmware: 3.27 current-firmware: 3.27 upgrade-firmware: 3.41 You need to upgrade RouterBoard firmware: 1.- Click Log so that you see the log of the device 2.- Go to System > Routerboard and ...

pukkita

Open a New Terminal and issue

/export hide-sensitive=yes

That creates a config export in CLI commands syntax; copy & paste it here, along with the output of

/system routerboard print

Search found 3031 matches