cAP ax, ax2, ax3 no PMKSA error when using WPA2/WPA3 for now, tested with Samsung S10, 2 x Xiaomi 11 Lite 5G NE, Laptop with Intel AX200 WiFi card.
Cheers thats helpful!
Same here on AX2, AX3, AXLite.
Noticed one thing on AX3 …
HP printer Officejet Pro 8715 directly connected to AX3 starts up with 100M link, after 5 minutes the link shuts down and comes back up with 10M.
Disabling interface and enabling again, brings it back to 100M. But after 5 minutes … 10M again.
From what I can remember I never saw that happening before.
Supout created and send to support - SUP-117505.
any news on fixing issues with iscsi from QNAP/Synology target ?
SUP-109114 opened since April on this issue…
And case closed after further investigation.
Someone here at home changed the power settings on the printer so it went to power safe mode after 5 minutes.
Time to set an admin passwd on that device too and have a chat about changing settings for material which is not your own.
I implore MikroTik to please reconsider the extremely jarring webfig UI changes (placing item edit boxes in middle of window, forcing scroll bars and hiding config items under collapsed “drop-down” menus by default).
Given previous comments from 7.10beta thread I know I am not the only one that really dislikes this webfig change. Please revert these changes as I fail to see ANY benefit from it whatsoever. Can someone from MikroTik explain how this is at all better than the original design, or how it helps usability in any way?
If this is going to be forced upon us for some stupid reason, please give us an option to toggle back to the webfig UI we all know and love for years now. Or, is that too difficult?
*) mpls - added FastPath support;
how to activate this feature?
thx
Has the “can’t verify peer’s certificate from store” error been fixed? I need IKEv2/IPsec VPN.
(continuation of discussion in beta topic that has been locked)
I found a temporary way to log something when BFD detects a link loss.
I added a logging entry with topics=bgp,debug,!packet,!timer
That logs a “Entering OpenConfirm state BgpStarter …” message every time BGP is restarted. Of course this is logged at the re-start of the session, rather than at the time it is lost.
(still a bit sad that BGP log messages do not contain the connection or session name they refer to, and also of course it would be nice to have a log from BFD rather than this BGP message that does not point back to the cause for the state change)
*) snmp - added BGP peer table support IPv4 only (1.3.6.1.2.1.15.3.1);
Can we get this for IPv6 as well PLEASE?
And if I may ask for two things: OSPF(v3) monitoring via SNMP… would be great as well.
I run several networks, some with RoS v6, some with v7, monitoring them with prometheus and haven’t found a well working API based prometheus exporter working with both versions. SNMP support would be a bliss!
Thanks! 
Will not be fixed in 7.10. This is a RC and will only fix broken stuff that prevents if from being a stable release.
Add it as a Support request to MT
Maybe it is enabled by default like in ROSv6.
Hello,
Any updates on SUP-88676 (MPLS EXP bits not being properly set from “set priority” bridge filter rule on VPLS ingress)? I just tested on rc1 and it is still broken. This single issue is preventing is from upgrading the vast majority of routers on our network to v7.x.
please check SUP-117545
[RouterOS 7.10rc1] In DNS, dynamic servers will randomly disappear, regardless of whether the DNS is obtained from dhcp-client or pppoe-client.
Not OK. Tunnel goes down every time phase 2 soft timer expires:
05-26 10:29:16 ipsec,info new ike2 SA (I): VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:d0e0179f2f304a52:5081e1b29ca93dc1
05-26 13:44:44 ipsec,info killing ike2 SA: VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:d0e0179f2f304a52:5081e1b29ca93dc1
05-26 13:44:50 ipsec,info new ike2 SA (I): VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:19469d770f08c0dd:2a6beb49e3fc2c36
05-26 20:17:14 ipsec,info killing ike2 SA: VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:19469d770f08c0dd:2a6beb49e3fc2c36
05-26 20:17:19 ipsec,info new ike2 SA (I): VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:435c3f670c5a0328:f6e6769578dc20ca
05-26 23:31:38 ipsec,info killing ike2 SA: VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:435c3f670c5a0328:f6e6769578dc20ca
05-26 23:31:44 ipsec,info new ike2 SA (I): VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:0d9eaff9aaff9aee:764f48b7288dcb6c
05:59:06 ipsec,info killing ike2 SA: VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:0d9eaff9aaff9aee:764f48b7288dcb6c
05:59:10 ipsec,info new ike2 SA (I): VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:0922b6366ad53caa:17f7edd4f22a8c42
09:15:24 ipsec,info killing ike2 SA: VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:0922b6366ad53caa:17f7edd4f22a8c42
09:15:30 ipsec,info new ike2 SA (I): VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:1c48bbc08437db42:a0ea029a768ae75c
12:32:31 ipsec,info killing ike2 SA: VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:1c48bbc08437db42:a0ea029a768ae75c
12:32:37 ipsec,info new ike2 SA (I): VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:72df9f2aa01726cd:056a54fbb76bc21f
15:50:58 ipsec,info killing ike2 SA: VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:72df9f2aa01726cd:056a54fbb76bc21f
15:51:03 ipsec,info new ike2 SA (I): VPN 192.168.100.13[4500]-X.X.X.X[4500] spi:d361c5539db98db6:a7c45904db0d823f
Tested on hAP ac2 agains a Cisco Router. Version 7.9.1 worked fine, had tunnel up for days. I hope you can review and correct this.
For my monitoring system I am used to retrieve these values via SNMP, but for “new” devices CubeG-5ac60ay + SA this does not work. Can you add it?
frequency 1.3.6.1.4.1.14988.1.1.1.8.1.6.1 GHz
phy rate iso.3.6.1.4.1.14988.1.1.1.8.1.13.1 Gbps
rssi 1.3.6.1.4.1.14988.1.1.1.8.1.12.1 dB
signal quality iso.3.6.1.4.1.14988.1.1.1.8.1.8.1 %
tx sector iso.3.6.1.4.1.14988.1.1.1.8.1.9.1
Thanks
SNMP is fine for a lot of stuff, but if there are not SNMP for what you like to monitor but you can see the value via CLI, you can send it out using Syslog and a sylog receiver like Splunk or Kiwi and the graph it there.
For anyone wondering, wireguard - retry “endpoint-address” DNS query on failed resolve;
Does nothing to help with dynamic peers, i had to re-enable script to fix peer after IP changes because tunnel died.
That’s not the intention of the fix, failed resolve isn’t the same thing as what you describe.
As for your issue, it is easy fixable by setting persistent keepalive on both peers.
Failed resolve fix is only there to fix cases where wireguard tries to bring up the peers but the rest of the networking stuff isn’t operational yet (dns resolver, wan etc) and resolving of the endpoint fails because of that.
persistent keepalive doesnt help with that…and yeah i have it both ends, moments IP changes on server peers never reconnect until i disable/enable peer.