Major Issue with Bridges in RouterOS 7.17

[xaviernuma]

Hello,

I recently updated to version 7.17 from 7.16.2 and encountered a major issue with bridges. Their MAC addresses keep changing continuously.

I’ve stripped down the configuration as much as possible, and the problem persists even with just the following minimal setup (tested on CCR, HEX, HAP, etc.):

# 1970-01-02 00:46:38 by RouterOS 7.17
# software id = XXXX-XXXX
#
# model = RB750Gr3
# serial number = XXXXXXXXXXXX
/interface bridge add name=VLAN10
/interface bridge add name=VLAN20
/interface bridge add name=bridge1
/interface vlan add interface=bridge1 name=vlan10 vlan-id=10
/interface bridge port add bridge=VLAN10 interface=vlan10
/system note set show-at-login=no
/system routerboard settings set auto-upgrade=yes

Here’s a screenshot showing the issue:

After rolling back to version 7.16.2, the problem disappears entirely.

After discussing with someone on the forum, it seems we’re not supposed to create multiple bridges. I don’t understand—why allow the possibility to do so then?

The default config creates a bridge and it has the admin-mac set correctly.
You should normally not create any additional bridges! The VLANs can (now) be added on the single bridge.
Open a new topic with your specific requirements and/or look in the existing topics about bridge and VLAN!

Indeed, I’ve seen that VLANs can be used directly within a single bridge. However, the issue is that some features only apply to bridges and not to VLANs, such as IGMP Snooping.

I’d like to remind you that before version 7.17, there was no such issue.

Thank you for your help.

[jaclaz]

But do you have the bridge(s) with auto-mac=yes?

I am asking as the usual recommendation is to have manually set admin-mac=xx:xx:xx:xx:xx:xx and auto-mac=no even in v6.x though maybe it is unrelated, that was because MAC could change on reboots or when adding/removing/disabling/enabling interfaces.

http://forum.mikrotik.com/t/new-mac-address-on-the-bridge-after-the-update/177812/1

BTW the MAC’s you have in the log seem “random” and out of the three bridges you have only bridge1 is affected.

Are you sure that your VLAN10/vlan10 configuration is correct?

[mkx]

After discussing with someone on the forum, it seems we’re not supposed to create multiple bridges. I don’t understand—why allow the possibility to do so then?

It is possible and legitimate to create multiple bridges … it’s just that since ROS version 6.42 or there abouts (which added vlan-filtering capability to bridges) there’s rarely a case where one absolutely needs more than one bridge.


But to your problem: bridge (since ages ago) assumed MAC address of first member port as its own MAC address. Which means that it can change with reboot (if ROS initializes bridge ports in different sequence) or if “MAC donor” port is removed/disabled from bridge.
But when bridge ports are VLAN interfaces, which by themselves don’t have MAC address but inherit it from underlying interface, then weird things can happen. Even if inheritsnce of MAC address works flawlessly, it can happen that multiple bridges end up with same MAC address. Which is probably fine in most cases, but …
It seems tgat with 7.17 there were some changes which broke inheritance.

But in any case, the right thing is to set bridge MAC address manually. As @pe1chl mentioned in the other thread, default bridge has it set … but manually created bridges don’t (since creator has to set MAC to some valid value).


Out of curiosity: can you identify those MAC addresses? Could they belong to actual devices, talking to bridge? You obscured obe octet too many (3 most significant octets identify MAC address block owner) for us to check.

[jaclaz]

Even with just two, 8631, EEB5, CA8E, 468F are nowhere to be found in this list:
https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd3e4

[xaviernuma]

After discussing with someone on the forum, it seems we’re not supposed to create multiple bridges. I don’t understand—why allow the possibility to do so then?

It is possible and legitimate to create multiple bridges … it’s just that since ROS version 6.42 or there abouts (which added vlan-filtering capability to bridges) there’s rarely a case where one absolutely needs more than one bridge.


But to your problem: bridge (since ages ago) assumed MAC address of first member port as its own MAC address. Which means that it can change with reboot (if ROS initializes bridge ports in different sequence) or if “MAC donor” port is removed/disabled from bridge.
But when bridge ports are VLAN interfaces, which by themselves don’t have MAC address but inherit it from underlying interface, then weird things can happen. Even if inheritsnce of MAC address works flawlessly, it can happen that multiple bridges end up with same MAC address. Which is probably fine in most cases, but …
It seems tgat with 7.17 there were some changes which broke inheritance.

But in any case, the right thing is to set bridge MAC address manually. As @pe1chl mentioned in the other thread, default bridge has it set … but manually created bridges don’t (since creator has to set MAC to some valid value).


Out of curiosity: can you identify those MAC addresses? Could they belong to actual devices, talking to bridge? You obscured obe octet too many (3 most significant octets identify MAC address block owner) for us to check.

Hello mkx,

Thank you for your detailed explanation, especially the part about MAC inheritance and how this behavior might have changed in version 7.17—it aligns with what I’ve been observing.

To confirm, you’re suggesting that the proper solution would be to manually set a MAC address in the admin-mac field for each bridge via Winbox, correct?

Here’s a screenshot of my current configuration to help clarify:

Let me know if this approach is indeed the right one.

Thank you again for your help!

But do you have the bridge(s) with auto-mac=yes?

I am asking as the usual recommendation is to have manually set admin-mac=xx:xx:xx:xx:xx:xx and auto-mac=no even in v6.x though maybe it is unrelated, that was because MAC could change on reboots or when adding/removing/disabling/enabling interfaces.

New MAC address on the bridge after the update

BTW the MAC’s you have in the log seem “random” and out of the three bridges you have only bridge1 is affected.

Are you sure that your VLAN10/vlan10 configuration is correct?

Hello jaclaz,

Thank you for your input.

In my configuration, the bridges have the default auto-mac=yes setting, as I didn’t modify this parameter after resetting the device.

It’s fine for VLAN10/vlan10, it’s the same configuration I’ve been using for years without any issues.

Even with just two, 8631, EEB5, CA8E, 468F are nowhere to be found in this list:
List of MAC addresses with vendors identities · GitHub

Hi jaclaz,

That’s normal, the flood of changing MAC addresses is generated by RouterOS on the bridges when auto-mac is enabled.

[anav]

sure sounds like a bug, would take a supout of your router and report the issue to mikrotik ( go to support and register for an account and submit bug report)

[mkx]

Even with just two, 8631, EEB5, CA8E, 468F are nowhere to be found in this list:

Right, these are all locally administered MAC addresses. So it’s anybody’s guess where they are coming from, could be ROS as well.

@xaviernuma

Let me know if this approach is indeed the right one.

Yes, it is the right approach.

[jaclaz]

@xaviernuma
From what you report - it seems like the RouterOS is “inventing” random MACs (as opposed to randomly “inheriting” those of connected devices).
It is a different kind of random.
But - as mkx noticed - they could be locally generated from “base” real MACs.

I asked about VLAN10/vlan10 because - coming from a DOS/windows background I have been bitten so many times on Linux/unix CaSe SeNsItIvEnEsS …

[xaviernuma]

sure sounds like a bug, would take a supout of your router and report the issue to mikrotik ( go to support and register for an account and submit bug report)

Hi anav, it’s done : SUP-177482

@xaviernuma

Let me know if this approach is indeed the right one.

Yes, it is the right approach.

Thank you!

I’ll set fixed MAC addresses on the bridges across my fleet of Mikrotik devices and wait for a post-7.17 fix before updating RouterOS.

@xaviernuma
From what you report - it seems like the RouterOS is “inventing” random MACs (as opposed to randomly “inheriting” those of connected devices).
It is a different kind of random.
But - as mkx noticed - they could be locally generated from “base” real MACs.

I asked about VLAN10/vlan10 because - coming from a DOS/windows background I have been bitten so many times on Linux/unix CaSe SeNsItIvEnEsS …

Hi jaclaz,

I understand your point about case sensitivity, it can indeed cause issues, but in this case, there’s no problem with the configuration.

As for the MAC addresses, I now see what you mean. Thanks for clarifying.

[jaclaz]

… and I think I have Rule #7:
Rules of the Mikrotik Club:

1. You do not use VLAN1
2. You DO NOT use VLAN1
3. You remove default user admin and set a strong password before connecting to the internet.
4. You do not use Quickset.
5. You do not use detect internet.
6. You keep routerboard firmware upgraded to the same release as Ros software update

---

7. You manually set admin-mac= and auto-mac=no on bridge(s)
8. …

[mkx]

… and I think I have Rule #7:

I agree …