We’ve just upgraded to 5.6 and we’re having massive trouble with it, we’re running it on a six core system. There are 3 key points that broke down really bad.
On the router in question we’re currently running the following “services”:
L7 firewall
queueing / packet marking
7 bgp full table peers
1 igp peer
some other stuff…
Problems as follow:
New Terminal → console has crashed we’re getting this more and more
New rule in Route Filters → does not work in WinBox, it simply does nothing, the new rule window does not close, after trying to add a new rule /routing filter print locks up and the system has to be rebooted
L7 filtering does not work anymore we’re getting WARN_: layer 7 match failed, regexp too complex for any L7 string
Has anyone experienced similar issues or has any idea on how to fix these issues?
Thanks!
EDIT: and localpref does not get set anymore…
EDIT2: and setting mutiple nexthop entries for BGP incoming routes does not work anymore. The forced load balancing feature provided by this parameter is not working anymore.
Yes but it seems there are even bigger issues. Route filters simply do not work, and this is the most serious of all: prepends, weights, communities, and the whole filtering process simply does not apply the filters for incoming bgp routes or outgoing bgp advertisments.
This is actually tragic. I’ve had to contact our peers and do the filtering on the other end as we were filtering out transit, and the router simply advertised everything nomatter what the filters said (no, we did not redistribute). We are still having massive issues because of this. This is turning into a big disappointment…
Yes but it seems there are even bigger issues. Route filters simply do not work, and this is the most serious of all: prepends, weights, communities, and the whole filtering process simply does not apply the filters for incoming bgp routes or outgoing bgp advertisments.
Working fine for me on 5.6. Can you post your configuration?
it was discussed too: when you create Routing Filter via WinBox, it sets Prefix to 0.0.0.0 (empty, but active field in WinBox). if you do that in Terminal, all is fine. is fixed in 5.7 =)
Is there a way to fix it in 5.6? I’ve downgraded to 5.4 and still same issues (I’m lucky vrrp is still working)
Will upgrading to 5.7 fix this issues?
One other big issue is the fact that if we set multiple NextHops for different ISP sessions the gateways do not show up in the routing table as they used to in 4.16. Basicly we used this system to control our upstream traffic which in this case is not working anymore.
I’d appreciate any thoughts on these key points, thanks.
It would be great if the Winbox console wouldn’t lock up every time after I set the new parameters. I can’t get it working right… even in ssh, same problem, it just locks up. (resource usage is in normal limits, +5% increase after setting new parameters for filter but it’s just locked).
I guess I’ll just have to wait for the new release. I’ll get back if I manage to find a way to fix it, maybe script it or something so I won’t have to go through 400 filters manually from the CLI.
If the issue is simply that the ‘prefix’ parameter has a value of ‘0.0.0.0’ where it shouldn’t be set at all the below script should fix all those entries:
Ok, I can now confirm that manually setting the filters by CLI works accordingly for the 0.0.0.0 bug by recreating the rule. Haven’t got to communities yet, but I can also confirm that multiple next-hops, set-bgp-weight, set-bgp-local-pref also work and that they work accordingly tot the described BGP algo at:
Tested some myself now and you can’t even manually unset it by index number. Setting it to “” generates an error. I can’t think of any other way to programmatically change lots of broken rules at once.
[user@rb750g] /routing filter> print where chain=test
Flags: X - disabled
3 chain=test prefix=0.0.0.0 invert-match=no action=accept
[user@rb750g] /routing filter> unset 3 prefix
[user@rb750g] /routing filter> print where chain=test
Flags: X - disabled
3 chain=test prefix=0.0.0.0 invert-match=no action=accept
[user@rb750g] /routing filter> set 3 prefix=""
value of ip6 expects IPv6 prefix
[user@rb750g] /routing filter>
Auto does not seem to work. Manual mode is working though. As we’ve got a lot of dynamic filters adding rules to the end of the routing filter getting updated at 3, 6 and 10 seconds intervals, the best way I’ve come to so far is print (visually get the id and rule parameters); remove ; add ; print (visually get the id as it sometimes is not the last rule) ; move the rule back in place. It’s not the most beautiful way to do it, but it’s simple and working.
Unset is not working as it does not show prefix as a valid option.
you could set 0.0.0.0/0 and prefix length and do not touch though GUI that rule at the moment till 5.7 is released. Or i am missing something terribly?
usually that is done using unset command where available. As someone stated it does not work in this case. i checked that 5.7 is fixed (unset is not touched)
I had to remove the rule and recreate it via CLI 
:D:D
As someone stated it does not work in this case. i checked that 5.7 is fixed (unset is not touched)