ROS > 4.5 bug? Cannot Access IP management

Hi All,
I have a problem with ROS4.5-ROS4.10, ip management device can not be accessed via the management VLAN. The device has two vlans (one management, one data) and has a ip address for each VLAN. Management VLAN static ip address (10.10.10.x/24). PPPoE (dynamic IP) in the data VLAN.

The problem is when the “ip route print”:

DST-ADDRESS GATEWAY Distance pref-SRC

1 S 10.0.0.0/8 10.10.10.1 1
“Gateway 10.10.10.1 not ACTIVE”,
because network 10.10.10.0/24 does not appear on the ip route list.

To enable ip management, I delete ip management and then make it again, but when the system reboot, it’s can not be accessed again. Before ROS4.5-ROS4.10 no problem (ROS 2.9.x, 3.x, 4.x-4.4 OK).

We downgrade ROS4.5 devices to the older version, of course, is inefficient/risky and have difficulty if the device has been installed at the customer. Is there a solution to this problem? :confused: :confused: :confused: :confused:

Configuration:
WLAN: mode=station-WDS, wds-mode=dynamic default-bridge = bridge1

BRIDGE: name=“bridge1” protocol-mode=none
BRIDGE PORT: interface=wlan1 bridge=bridge1

VLAN:
VLAN-DATA: vlan-id=241 name=vlan-data interface=bridge1
VLAN-MANAGEMENT: vlan-id = 220 name=vlan-mgmt interface=bridge1

IP ADDRESS:
IP Management: address=10.10.10.29/24 interface=vlan-mgmt
IP Ether1: address=192.168.1.1/24 interface=ether1

IP ROUTE
GATEWAY: dst-address=10.0.0.0/8 gateway=10.10.10.1

PPPoE Client
Dial: name=“pppoe-out1” interface=vlan-data user=“xxxx” password=“xxxx” add-default-route=yes use-peer-dns=yes

NAT firewall
NAT: chain=srcnat action=masquerade src-address=192.168.1.0/24 interface-out=pppoe-out1

What are the states of the vlan interfaces and the ip addresses when its not working? does anything show invalid (have an i in the leftmost column in winbox, or possibly be colored red)?

What about the bridge?

Can you ping the 10.10.10.29 address from the routerboard itself?

Hi xxiii,

“VLAN-data” and “VLAN-MGMT” are running (R) at the interface = bridge1

There are no invalid or disabled status at the IP address, there are three IP address (192.168.1.1/24 at the interface = ether1, 10.10.10.29/24 at the interface = “VLAN-MGMT” and an IP address dynamically (D) at the interface = pppoe -out1)

Bridge1 status is Running.

yes, I can ping the 10.10.10.29 address from the routerboard itself.

Can you please post the exact output of “/interface export”, “/interface print”, “/ip address export” and “/ip route print”?

Hi fewi,
(sorry some of the contents are edited for confidentiality)

/interface export

jan/03/1970 06:34:43 by RouterOS 4.10

software id = ELRV-XXXX

/interface bridge
add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes
comment=“” disabled=no forward-delay=15s l2mtu=2290 max-message-age=20s
mtu=1500 name=bridge1 priority=0x8000 protocol-mode=none
transmit-hold-count=6
/interface ethernet
set 0 arp=enabled auto-negotiation=yes comment=“” disabled=no full-duplex=yes
l2mtu=1526 mac-address=00:0C:42:13:E5:56 mtu=1500 name=ether1 speed=
100Mbps
/interface vlan
add arp=enabled comment=“” disabled=no interface=bridge1 l2mtu=2286 mtu=1500
name=vlan-mgmt use-service-tag=no vlan-id=220
add arp=enabled comment=“” disabled=no interface=bridge1 l2mtu=2286 mtu=1500
name=vlan-data use-service-tag=no vlan-id=241
/interface pppoe-client
add ac-name=“” add-default-route=yes allow=pap,chap,mschap1,mschap2 comment=
“” dial-on-demand=no disabled=no interface=vlan-data max-mru=1480 max-mtu=
1480 mrru=disabled name=pppoe-out1 password=xxxxx profile=default
service-name=“” use-peer-dns=yes user=xxxxx
/interface wireless security-profiles
set default authentication-types=“” eap-methods=passthrough group-ciphers=“”
group-key-update=5m interim-update=0s management-protection=disabled
management-protection-key=“” mode=none name=default
radius-eap-accounting=no radius-mac-accounting=no
radius-mac-authentication=no radius-mac-caching=disabled
radius-mac-format=XX:XX:XX:XX:XX:XX radius-mac-mode=as-username
static-algo-0=none static-algo-1=none static-algo-2=none static-algo-3=
none static-key-0=“” static-key-1=“” static-key-2=“” static-key-3=“”
static-sta-private-algo=none static-sta-private-key=“”
static-transmit-key=key-0 supplicant-identity=MikroTik tls-certificate=
none tls-mode=no-certificates unicast-ciphers=“” wpa-pre-shared-key=“”
wpa2-pre-shared-key=“”
/interface wireless
set 0 ack-timeout=dynamic adaptive-noise-immunity=none allow-sharedkey=no
antenna-gain=0 antenna-mode=ant-a area=“” arp=enabled band=5ghz
basic-rates-a/g=6Mbps basic-rates-b=1Mbps burst-time=disabled comment=“”
compression=no country=no_country_set default-ap-tx-limit=0
default-authentication=yes default-client-tx-limit=0 default-forwarding=
yes dfs-mode=none disable-running-check=no disabled=no
disconnect-timeout=3s frame-lifetime=0 frequency=5100 frequency-mode=
superchannel frequency-offset=0 hide-ssid=no hw-fragmentation-threshold=
disabled hw-protection-mode=none hw-protection-threshold=0 hw-retries=4
l2mtu=2290 mac-address=00:80:48:7F:F2:92 max-station-count=2007 mode=
station-wds mtu=1500 name=wlan1 noise-floor-threshold=default
on-fail-retry-time=100ms periodic-calibration=default
periodic-calibration-interval=60 preamble-mode=both
proprietary-extensions=post-2.9.25 radio-name=CPE100 rate-set=
configured scan-list=5100-5500 security-profile=default ssid=LOG1
station-bridge-clone-mac=00:00:00:00:00:00 supported-rates-a/g=
6Mbps,9Mbps supported-rates-b=1Mbps,2Mbps,5.5Mbps,11Mbps tx-power-mode=
default update-stats-interval=disabled wds-cost-range=50-150
wds-default-bridge=bridge1 wds-default-cost=100 wds-ignore-ssid=no
wds-mode=dynamic wmm-support=disabled
/interface wireless nstreme
set wlan1 comment=“” disable-csma=no enable-nstreme=yes enable-polling=yes
framer-limit=3200 framer-policy=none
/interface wireless manual-tx-power-table
set wlan1 comment=“” manual-tx-powers=“1Mbps:17,2Mbps:17,5.5Mbps:17,11Mbps:17,
6Mbps:17,9Mbps:17,12Mbps:17,18Mbps:17,24Mbps:17,36Mbps:17,48Mbps:17,54Mbps
:17,HT20-0:0,HT20-1:0,HT20-2:0,HT20-3:0,HT20-4:0,HT20-5:0,HT20-6:0,HT20-7:
0,HT40-0:0,HT40-1:0,HT40-2:0,HT40-3:0,HT40-4:0,HT40-5:0,HT40-6:0,HT40-7:0”
/interface bridge port
add bridge=bridge1 comment=“” disabled=no edge=auto external-fdb=auto
horizon=none interface=wlan1 path-cost=10 point-to-point=auto priority=
0x80
/interface bridge settings
set use-ip-firewall=no use-ip-firewall-for-pppoe=no use-ip-firewall-for-vlan=
no
/interface l2tp-server server
set authentication=pap,chap,mschap1,mschap2 default-profile=
default-encryption enabled=no max-mru=1460 max-mtu=1460 mrru=disabled
/interface ovpn-server server
set auth=sha1,md5 certificate=none cipher=blowfish128,aes128 default-profile=
default enabled=no keepalive-timeout=60 mac-address=FE:FD:89:4C:C3:9F
max-mtu=1500 mode=ip netmask=24 port=1194 require-client-certificate=no
/interface pptp-server server
set authentication=mschap1,mschap2 default-profile=default-encryption
enabled=no keepalive-timeout=30 max-mru=1460 max-mtu=1460 mrru=disabled
/interface wireless align
set active-mode=yes audio-max=-20 audio-min=-100 audio-monitor=
00:00:00:00:00:00 filter-mac=00:00:00:00:00:00 frame-size=300
frames-per-second=25 receive-all=no ssid-all=no
/interface wireless sniffer
set channel-time=200ms file-limit=10 file-name=“” memory-limit=10
multiple-channels=no only-headers=no receive-errors=no streaming-enabled=
no streaming-max-rate=0 streaming-server=0.0.0.0
/interface wireless snooper
set channel-time=200ms multiple-channels=yes receive-errors=no

==========================
/interface print
Flags: D - dynamic, X - disabled, R - running, S - slave

NAME TYPE MTU L2MTU

0 R ether1 ether 1500 1526
1 R wlan1 wlan 1500 2290
2 R bridge1 bridge 1500 2290
3 R vlan-data vlan 1500 2286
4 R vlan-mgmt vlan 1500 2286
5 R pppoe-out1 pppoe-out 1480

========================
/ip add export

jan/03/1970 06:46:44 by RouterOS 4.10

software id = ELRV-XXXX

/ip address
add address=192.168.1.1/24 broadcast=192.168.1.255 comment=“” disabled=no interface=ether1 network=192.168.1.0
add address=10.10.10.29/24 broadcast=10.10.10.255 comment=“” disabled=no interface=vlan-mgmt network=10.10.10.0

========================
/ip rou pr
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit

DST-ADDRESS PREF-SRC GATEWAY DISTANCE

0 ADS 0.0.0.0/0 202.xxx.xxx.xxx 1
1 S 10.0.0.0/8 10.10.10.1 1
2 ADC 192.168.1.0/24 192.168.1.1 ether1 0
3 ADC 202.xxx.xxx.xxx/32 202.xxx.xxx.xxx pppoe-out1 0

Can you try assigning an administrative mac address to bridge1, and see what happens (particularly if DAC entry(s) appears for your vlans in /ip route)

Hi xxiii,
The result is still the same.

/in br export

jan/02/1970 07:01:37 by RouterOS 4.11

software id = ELRV-XXXX

/interface bridge
add admin-mac=00:80:48:7F:F2:9F ageing-time=5m arp=enabled auto-mac=yes
comment=“” disabled=no forward-delay=15s l2mtu=2290 max-message-age=20s
mtu=1500 name=bridge1 priority=0x8000 protocol-mode=none
transmit-hold-count=6
/interface bridge port
add bridge=bridge1 comment=“” disabled=no edge=auto external-fdb=auto
horizon=none interface=wlan1 path-cost=10 point-to-point=auto priority=
0x80
/interface bridge settings
set use-ip-firewall=no use-ip-firewall-for-pppoe=no use-ip-firewall-for-vlan=
no

/in br pr
Flags: X - disabled, R - running
0 R name=“bridge1” mtu=1500 l2mtu=2290 arp=enabled
mac-address=00:80:48:7F:F2:92 protocol-mode=none priority=0x8000
auto-mac=yes admin-mac=00:80:48:7F:F2:9F max-message-age=20s
forward-delay=15s transmit-hold-count=6 ageing-time=5m

/ip rou pr
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit

DST-ADDRESS PREF-SRC GATEWAY DISTANCE

0 ADS 0.0.0.0/0 202.xxx.xxx.xxx 1
1 S 10.0.0.0/8 10.10.10.1 1
2 ADC 192.168.1.0/24 192.168.1.1 ether1 0
3 ADC 202.xxx.xxx.xxx/32 202.xxx.xxx.xxx pppoe-out1 0

if anything to do with

What’s new in 4.5:

*) IPSec - added Blowfish, Twofish, and camellia encryption algorithms;
*) Fixed removing static route;
*) Fixed compatibility with DHCP client Some DHCP servers;
*) Added static route support multi-cast;
*) Fixed RB800 and temperature monitors on RB450G;
*) User manager - payment bug fix - Able to buy now
without extending credits specified price;

since ROS4.5 associated with default routing problems.

Hi All,
I searched on the wiki, I get this article. :slight_smile:
http://wiki.mikrotik.com/wiki/Manual:Using_scope_and_target-scope_attributes
But after I try is not successful. :confused: