CCR reboots automatically

RouterOS General
1

Hello,

My CCR 1036 reboots automatically.

  1. It has latest routerOS.
  2. Watchdog disabled.
  3. SNMP disabled
  4. No Proxy Server
  5. admin password changed
  6. unwanted users disabled
  7. BW 450 meg
  8. connected users 1500
  9. default firewall with PPPoE and Hotspot
    10.DDoS and SYN attack rules

What could be the reason of automatic rebooting.

Thanks

2

And you’re sure it’s not power-related, right? (you didn’t mention that)
Also check for scheduler jobs.

Otherwise, look to see if autosupout files are being generated… if not, then turn that on and see if you get any crash files that you could send to support.

3

Thanks for quick response.

There is no power issue. Scheduler job is set up to reboot the CCR but the timing is different.

Will see if I can get auto supout file for further analysis.

4

Queue on 1500 users? Memory usage? Cpu usage, health of board?


Have a good day!

5

Have you run a memory test on it ?

6

CPU reaches to 90-95% when this issue occurs. When checked interface, I can see lot of traffic (150-200 meg) on lan side where users are connected. Rx of lan is about 150-200 meg but Tx of wan is normal. That means MT is not forwarding that unwanted (flooding) traffic to wan side. But CPU utilisation is very high and BW consumption comes down from 400-500 meg to 70-80 meg. This could be some kind of flood from users on lan side. Have setup DDoS rules but they do not take care of attack from lan side. At the same time this happens with other 2-3 CCRs but they don’t reboot. BW utilisation comes down significantly though.

Memory utilisation is normal.

Thanks

7

Can you analyze access level? 150-200mb/s not problem for ccr. Analyze connections tracker! Any log items present before reboot? 3 ccr??? Can you attach net scheme ?


Have a good day!

8

I remember some users complaining when pppoe server reaches some limit threshold (don’t recall now exactly), probably I’m wrong but maybe worth to search in old topics also..

9

When CPU load increases to 90-100%, FAN speed is about 25000RPM. In profile it shows queueing consumes 70-80% CPU. This setup was working fine for more than a year and of late we are seeing this issue.

10

what has changed during the year? more users? different queue? upgraded ros ?

11

Try to use other power supply.

12

Wah!! Good load, maybe ccr-1036 or 1072 help for your setup??


Have a good day!

13

He already has 1036…

14

Nothing has changed. This seems DDoS attack but MT not able to block despite filter rules.

Rx of lan side is more than normal when CPU load increases. May be because of sudden surge in BW on Rx of lan causing high CPU.

15

All such attacks ended sooner or later after the port 53 was effectively closed. Maybe it is still open.

16

Allowed remote request in DNS is ON but I have put filter rules to block external request directed to MT on port 53.

17

If you are sure that those rules work…

18

We have same setup for more than a year working fine. We didn’t notice high cpu usage in queueing. We have several CCRs deployed with same configuration except IPs.

Don’t understand what is causing high cpu utilisation by queueing.

If these rules are not working as expected, could you please let us know the rules to block UDP flood.

19

I have similar issue previously with the bad power supply on CCR1036. The voltage drop below 14volt when the CPU load increase. And subsequently it will reboot automatically.

Take a look of ur power voltage when it CPU load surge.

20

No power issue at all.

Queue consumes more cpu.