hEX PoE Switch Rule for sfp1

RouterOS General
1

Hi all,

I just received my Mikrotik hEX PoE to replace my current Orange Livebox for a 1Gb/s Fiber access with Orange in France.
I did the following : Orange OLT → Huawei ONT → Mikrotik SFP RJ45 → sfp1 on hEX PoE

Orange is doing some twist on DHCP v4 request and DHCP v6 where you need to use a specific vlan 832 but the most important is to have CoS to 6 on DHCP Request for IPv4 et also for IPv6.
Due to this requirements I did a bridge to handle the sfp1, vlan832, DHCP client.
But the result is impossible to use Switch Rules on sfp1, any ideas to avoid the bridge and/or increase performance to reach 1Gbs/s and not half-1/3 actually?!

Thanks in advance.

Nicolas

For information on a default config reset, here is my setup added:

/interface vlan add interface=sfp1 loop-protect-disable-time=00:05:00 loop-protect-send-interval=00:00:05 name=VLAN832 vlan-id=832
/interface bridge add name=Bridge-Wan
/interface bridge port add bridge=Bridge-Wan interface=VLAN832
/interface bridge filter add action=set-priority chain=output dst-port=67 ip-protocol=udp log=yes log-prefix=“Set CoS6 on DHCP IPv4 request” mac-protocol=ip new-priority=6 out-interface=VLAN832 passthrough=yes
/ip dhcp-client option add code=60 name=vendor-class-identifier value=0x736167656d
/ip dhcp-client option add code=77 name=userclass value=0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7834
/ip dhcp-client option add code=90 name=authsend value=0x00000000000000000000001a0900000558010341010d6674692FXXXXXXXXXXXXXX
/ip dhcp-client add interface=Bridge-Wan dhcp-options=vendor-class-identifier,userclass,authsend add-default-route=yes default-route-distance=1 use-peer-dns=yes use-peer-ntp=yes disabled=no
/ip firewall nat add action=masquerade chain=srcnat comment=“NAT LAN to WAN” out-interface=Bridge-Wan

/interface bridge filter add action=set-priority chain=output dst-port=547 ip-protocol=udp log=yes log-prefix=“Set CoS6 on DHCP request” mac-protocol=ipv6 new-priority=6 out-interface=VLAN832 passthrough=yes
/ipv6 settings set accept-router-advertisements=yes
/ipv6 dhcp-client option add code=11 name=authentication value=0x00000000000000000000001a0900000558010341010d6674692FXXXXXXXXXXXXXX
/ipv6 dhcp-client option add code=15 name=user-class value=0x002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e6c697665626f7834
/ipv6 dhcp-client option add code=16 name=vendor-class value=0x0000040e0005736167656d
/ipv6 dhcp-client add interface=Bridge-Wan dhcp-options=authentication,user-class,vendor-class request=prefix pool-name=pool_REN_6 pool-prefix-length=64 add-default-route=yes disabled=no
/ipv6 address add address=::1/64 from-pool=pool_REN_6 interface=bridge no-dad=no advertise=yes
/ipv6 firewall filter add action=accept chain=input comment=“accept ICMPv6” protocol=icmpv6
/ipv6 firewall filter add action=accept chain=input comment=“accept established, related, untracked” connection-state=established,related,untracked
/ipv6 firewall filter add action=accept chain=forward comment=“accept ICMPv6” protocol=icmpv6
/ipv6 firewall filter add action=accept chain=forward comment=“accept established, related, untracked” connection-state=established,related,untracked
/ipv6 firewall filter add action=drop chain=forward comment=“forward drop everything else” in-interface=Bridge-Wan
/ipv6 firewall filter add action=drop chain=input comment=“input drop everything else” in-interface=Bridge-Wan

2

Finally I got Ipv4 working with a switch rule but nothing for IPv6 !!
I don’t use anymore sfp1 because switch rule are not available for sfp1 and switch to ether1.

Using a bridge for both IPv4 and IPv6 it was working perfectly but max speed top at 300Mb/s and CPU at 100%
Now with switch rule working for IPv4 only max speed top at 1Gb/s !!! Just missing IPv6 …
Here is the switch rules used and config :

For IPv4
/interface vlan add interface=ether1 loop-protect-disable-time=00:05:00 loop-protect-send-interval=00:00:05 name=VLAN832 vlan-id=832
/interface ethernet switch rule add dst-port=67 mac-protocol=ip new-vlan-priority=6 ports=switch1-cpu protocol=udp switch=switch
/ip dhcp-client option add code=60 name=vendor-class-identifier value=0x736167656d
/ip dhcp-client option add code=77 name=userclass value=0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7834
/ip dhcp-client option add code=90 name=authsend value=0x00000000000000000000001a0900000558010341010d6674692FXXXXXXXXXXXXXX
/ip dhcp-client add interface=VLAN832 dhcp-options=vendor-class-identifier,userclass,authsend add-default-route=yes default-route-distance=1 use-peer-dns=yes use-peer-ntp=yes disabled=no
/ip firewall nat add action=masquerade chain=srcnat comment=“NAT LAN to WAN” out-interface=VLAN832

For IPv6
/interface ethernet switch rule add dst-port=547 mac-protocol=ipv6 new-vlan-priority=6 ports=switch1-cpu protocol=udp switch=switch
/ipv6 settings set accept-router-advertisements=yes
/ipv6 dhcp-client option add code=11 name=authentication value=0x00000000000000000000001a0900000558010341010d6674692FXXXXXXXXXXXXXX
/ipv6 dhcp-client option add code=15 name=user-class value=0x002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e6c697665626f7834
/ipv6 dhcp-client option add code=16 name=vendor-class value=0x0000040e0005736167656d
/ipv6 dhcp-client add interface=VLAN832 dhcp-options=authentication,user-class,vendor-class request=prefix pool-name=pool_REN_6 pool-prefix-length=64 add-default-route=yes disabled=no
/ipv6 address add address=::1/64 from-pool=pool_REN_6 interface=bridge no-dad=no advertise=yes
/ipv6 firewall filter add action=accept chain=input comment=“accept ICMPv6” protocol=icmpv6
/ipv6 firewall filter add action=accept chain=input comment=“accept established, related, untracked” connection-state=established,related,untracked
/ipv6 firewall filter add action=accept chain=forward comment=“accept ICMPv6” protocol=icmpv6
/ipv6 firewall filter add action=accept chain=forward comment=“accept established, related, untracked” connection-state=established,related,untracked
/ipv6 firewall filter add action=drop chain=forward comment=“forward drop everything else” in-interface=VLAN832
/ipv6 firewall filter add action=drop chain=input comment=“input drop everything else” in-interface=VLAN832

3

I assume that you found fasttracking which is not available for IPv6.

or: https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Fast_Forward

4

Hi,

Is there any plan to have it ?
Also It seems that switch rules for IPv6 traffic to set Cos to 6 on DHCP solicit seems to be not working as it should be !

5

I think I identify my problem, just a summary about the config :
I have a RB960PGS (hEX PoE) connected to a 1Gb/s Fiber internet access with Orange Pro in France.

To be able to have a link we need :

  • for IPv4 set CoS to 6 on DHCP request + custom DHCP option code
  • for IPv6 set CoS to 6 on DHCP solicit + custom DHCP option code

For IPv4 I got the following switch rule and it works well :
/interface ethernet switch rule add dst-port=67 mac-protocol=ip new-vlan-priority=6 ports=switch1-cpu protocol=udp switch=switch1
I am catching correctly DHCP IPv4 client request.

For IPv6 I cannot have dst-port field available to catch port=547 for udp trafic, instead I have the following rule :
/interface ethernet switch rule add mac-protocol=ipv6 new-vlan-priority=6 ports=switch1-cpu src-mac-address=74:4D:28:6D:F7:AB/FF:FF:FF:FF:FF:FF switch=switch1
I apply it for all trafic impacting a lot IPv6 performance.

Why L4 conditions are not available for IPv6 trafic ?
According to the manual, it should be possible !
https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Rule_Table

Is it a bug, missing feature ?

Thanks in advance.

6

I did a couple of others tests and it seems impossible to have switch rules working correctly for IPv6 DHCP request and impossible to catch only UDP trafic on a specific port for IPv6 !
Any comments and/or suggestions ?
Is it a bug ? May I need to fill something ?
Sorry pretty new with a Mikrotik product who is fantastic…

7

Suggest you send a report to MT, supout etc explaining your issue,

8

Done.

9

Since they are all at home working in nothing but their underwear, it should get looked at really fast. Normally its a 2-3 day turn around depending upon other fires they are putting out.