V7.21.4 [long-term] is released!

Before an upgrade:

  1. Remember to make backup/export files before an upgrade and save them on another storage device;
  2. Make sure the device will not lose power during upgrade process;
  3. Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 7.21.4 (2026-Apr-21 09:49):

  • bgp - fixed stability issue when non-existent output select-chain was specified;
  • bgp-vpn - allow modifying scopes with routing filters;
  • bgp-vpn - fixed non-working import filter after reboot;
  • bgp-vpn - use target scope for imported route;
  • bridge - fixed missing dynamic "switch-cpu" VLAN entry in WiFi setup;
  • bridge - fixed performance regression in complex setups with vlan-filtering (introduced in v7.20);
  • console - removed the "reset" command from shared settings menus (IP/IPv6/Bridge/L3HW/Neighbor-Discovery/Connection-Tracking);
  • container - fixed issue where the container might not start after upgrading if root-dir was not set;
  • container - improved error message if a container fails to start;
  • defconf - fixed L009 configuration (introduced in v7.21);
  • ethernet - fixed false excessive broadcast warning (introduced in v7.20);
  • firewall - improved system stability;
  • ipsec - improved aes256-ctr stability on L009;
  • ipsec - removed modp8192 proposal on MIPS architectures;
  • ipv6,ra - use received prefix when RA on-link flag is 0;
  • isis - improved stability with fragmented CSNP;
  • l2tp - improved system stability on TILE architecture;
  • l3hw - fixed missing VLAN counters after reboot (introduced in v7.21);
  • l3hw - fixed stability issue (introduced in v7.21);
  • leds - fixed default LED configuration for CCR2004-1G-12S+2XS;
  • log - do not provide non-existent logging topics for configuration;
  • lte - fixed framed route support for the first APN;
  • lte - fixed missing automatic redial when cellular connectivity is lost for R11e-LTE;
  • lte - fixed user set MTU not applied to LTE interface;
  • lte - override the "auto" or 0 MTU in "interface" menu to 1500;
  • ospf - fixed typos in log messages;
  • ospf - improved stability on configuration change;
  • ovpn - fixed OVPN push routes;
  • poe-out - firmware update for CRS354-48P-4S+2Q+ (the update will cause a brief power interruption to poe-out interfaces);
  • poe-out - fixed rare PoE-Out firmware upgrade failure on CRS354-48P-4S+2Q+;
  • ptp - allow manual domain configuration for 802.1AS profile;
  • ptp - set DSCP (EF) for the default profile when using IPv4;
  • qos-hw - display queue0 limits for CPU port;
  • qos-hw - fixed "offline" tx-manager ability to queue at least one packet (introduced in v7.21);
  • qos-hw - prohibit setting CPU port with "offline" tx-manager;
  • route - added SLAAC route redistribution for IPv6 capable routing protocols;
  • route - do not set blackhole flag for synthetic routes;
  • route - improved service stability when removing routes;
  • routerboard - fixed applying settings via WinBox on devices with fixed CPU frequency;
  • routing-filter - added possibility to match SLAAC and bgp-mpls-vpn route types;
  • ssh - make login process asynchronous;
  • switch - fixed stability issue when changing bridge multicast-router property on CRS1xx/2xx (introduced in v7.19);
  • system - added FCC Part 15 Compliance label to "System/Regulatory" menu;
  • system - improved stability for internal RouterOS service communication;
  • system - improved system stability;
  • system - improved upgrade service stability when the server is unreachable;
  • system - included full certificate chain to Windows executables;
  • user - properly apply login delay (introduced in v7.20);
  • wifi-mediatek - fixed communication issues on 802.11ax access points with Intel clients;
  • wifi-mediatek - fixed HE capabilities IE on 2GHz band;
  • winbox - fixed "Remote AS" setting under the "Routing/BGP/Connections" menu;
  • winbox - fixed "Src/Dst Address Type" under the "IP/Firewall/NAT" menu;
  • winbox - fixed L3HW default value for VLAN interface (introduced in v7.21);
  • winbox - properly display multiple bands for multi-link interface clients under registration table;
  • winbox - rearrange filter wizard parameters in tabs;
  • www - improved service stability when cancelling REST API sessions;

To upgrade, click Check For Updates under System/Packages menu and select the long-term Channel in RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

  • Everything went smoothly
  • I encountered an issue after the update (please post about the device, configuration, and unexpected symptoms)
  • I encountered an issue, but solved it (please post the solution)
0 voters

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. The file must be generated while a router is not working as suspected or after some problem has appeared on the device

Please keep this forum topic strictly related to this particular RouterOS release.

Ah, the confusing changelog is back!
Is this the changelog between 7.20.8, last release in long-term channel (doesn't look like it), or the changelog since 7.21.3 from the stable channel? So someone tracking changes from long-term to long-term needs to go from 7.20.8 -> 7.21 -> 721.1 -> 7.21.2 -> 7.21.3 -> 7.21.4 release? :face_with_spiral_eyes:

Does 7.21.4 lts supercede 7.20.8 lts, or will both lts branches continued to be maintained in parallel?

Given that it refers to issues introduced in 7.21, I’d say that it’s a comparison to 7.21.3. I can’t actually seem to find the change log for 7.21.0 on the download page, though.

That version was just "7.21". There never was a version ending in ".0".

If you select the “Stable” channel, the changelogs for the intermediate versions become visible.

This is confusing indeed!

Only 96.0KiB free HDD on hAP ac^2 after upgrade, so be careful on devices with 16MB and wifi- qcom-ac...

               uptime: 1m52s              
              version: 7.21.4 (long-term) 
           build-time: 2026-04-21 06:49:05
     factory-software: 6.45.9             
          free-memory: 30.8MiB            
         total-memory: 128.0MiB           
                  cpu: ARM                
            cpu-count: 4                  
        cpu-frequency: 448MHz             
             cpu-load: 2%                 
       free-hdd-space: 96.0KiB            
      total-hdd-space: 16.0MiB

This already happened in 7.23rc1. But without mention in changelog like here in long-term (I always suspected changes without changelog entry). What's the reason behind it?

why list of changes 7.21.4 long term not contain many changes from the list 7.21-7.21.3 stable? or is it 7.21.3 stable + changes 7.21.4 long term? or is it a continuation of 7.20.8?

Hi,

I have two problems since the upgrade.

  1. WiFi problem
    hAP ac2 + wifi-qcom-ac

    after the upgrade from RouterOS 7.20.8 to 7.21.4 my wifi2 (5 GHz) interface does not bond/initialize.
    It’s like, my 5 GHz interface never exists.
    my wifi1 (2.4 GHz) interface bonds/works as accepted.
    Please, fix 5 GHz interface issues.

  2. Tool e-mail
    In the export, the parameter certificate-verification=no does show despite the fact, that it’s default value is “no”, according to the MikroTik documentation.

Please, do not show certificate-verification=no parameter, if it’s default value is “no”

Besides these two problems, I do not notice any other issues so far.

Best regards,
trador34

Update 1# on 5 GHz WiFi issues: my 5 GHz WiFi interface failure happens after DFS channel availability check. After restarting my hAP ac2, the 5 GHz DFS channel availability check always starts, but from 4 restarts, my 5 GHz started working after DFS check only once, 3 times my 5 GHz interface stopped working after DFS check.

Same here,

hAP ac2 + qcom-ac - before the upgrade 204 KiB free space, after the upgrade only 108 KiB free space left.

Hopefully at some time we get that dynamic changelist webpage where you can just select two version numbers and see all changes between those versions minus the fixes for problems introduced inbetween.

my assumption is, they test certain features in the stable for “stableness” and if they do not return a lot support-cases, they move these features into the long-term. the version numbering is completely random, 7.21.4 can contain features from 7.22.x, 7.23.x and so on but is an own “flavour” of feature-bugfix-set. that is just imho :grinning_face_with_smiling_eyes:

We have the algorithm used for generating the random number of the subversion:

https://xkcd.com/221/

:wink:

Well, my @tikoci/rosetta MCP server has a CLI/TUI for doing same queries as robots can against MikroTik docs/tests/changelogs/etc. See rosetta — tikoci.github.io for details. But you can do structured queries of the change log, so here is the TUI with a version range and topic "bgp"

You can also use CLI to grab it for cut-and-paste (pipx install term2md; :

bunx @tikoci/rosetta browse --once cl 7.20.8..7.21.4 | term2md | pbcopy

which get you the following (output is ANSI, so has to be converted to markdown for forum):

**Changelogs**


**7.20.8** 2026-Jan-30 11:17
  1  bgp            fixed route refresh subcode 0 warning;
  2  bgp            implement revised input error handling per RFC 7606;
  3  bridge         fixed dynamic switch-cpu VLAN creation (introduced in…
  4  container      fixed nftables/iptables not working with "Message too…
  5  health         fixed fan and PSU state logging for MIPSBE devices;
  6  poe-out        firmware update for 802.3bt capable boards (the updat…
  7  poe-out        fixed PSU state recovery upon unplug/replug on CRS320;
  8  ppp            added initial support for BG770A-GL modem firmware up…
  9  route          prevent creating routing tables with the same name;

**7.21** 2026-Jan-12 14:56
 10  arm64          allow enabling receive packet steering on /system/res…
 11  bgp            allow duplicate router-ids for eBGP sessions (RFC 628…
 12  bgp            always advertise extended nexthop cap for all support…
 13  bgp            do not allow iBGP with non-equal ASNs;
 14  bgp            fixed l2vpn-cisco decoding (introduced in v7.20);
 15  bgp            fixed occasional corruption of MPLS labels in BGP VPN…
 16  bgp            fixed route refresh subcode 0 warning;
 17  bgp            fixed selection of received BGP VPN routes;
 18  bgp            implement RFC 9234 route leak prevention and detectio…

**7.21.1** 2026-Jan-19 17:09
 19  bridge         fixed dynamic switch-cpu VLAN creation (introduced in…
 20  bridge         improved stability when using MVRP (introduced in v7.…
 21  certificate    fixed empty trust store handling in certain cases (in…
 22  container      changed app auto update to be off by default;
 23  container      fixed issue where containers may not start with large…
 24  health         fixed fan and PSU state logging for MIPSBE devices;
 25  leds           fixed power LED behavior for hAP ax S;
 26  lte            fixed APN configuration for QMI modems in a 3G networ…

**7.21.2** 2026-Jan-29 11:54
 27  app            added "media-path" and "download-path" setting in /ap…
 28  app            added shm_size parameter to apps that require it;
 29  app            calibre-web app auto add db if none exists;
 30  app            fixed Firefox and Webtop to work with https-proxy;
 31  app            fixed fossil app login typo;
 32  bgp            implement revised input error handling per RFC 7606;
 33  container      added support for the shm_size setting;
 34  container      allow non-root user write to SMB share;

**7.21.3** 2026-Feb-12 15:10
 35  bridge         fixed dhcp-snooping incorrectly disabling HW offloadi…
 36  certificate    fixed initial certificate creation using SCEP (introd…
 37  console        improved service stability when processing files over…
 38  dhcpv4-server  append "s" after lease-time value in setup command;
 39  gps            fixed port configuration for CubeG-5ac60ay;
 40  hotspot        rename totp-secret to otp-secret;
 41  ipv6           do not invalidate router if RA without included prefi…
 42  ipv6           fixed "on-link" and "autonomous" flag detection (intr…

**7.21.4** 2026-Apr-21 09:49
 43  bgp            fixed stability issue when non-existent output select…
 44  bgp-vpn        allow modifying scopes with routing filters;
 45  bgp-vpn        fixed non-working import filter after reboot;
 46  bgp-vpn        use target scope for imported route;
 47  bridge         fixed missing dynamic "switch-cpu" VLAN entry in WiFi…
 48  bridge         fixed performance regression in complex setups with v…
 49  console        removed the "reset" command from shared settings menu…
 50  container      fixed issue where the container might not start after…

[cl breaking] breaking only  [cl <ver>] specific version  [b] back

Now of course we do not actually know if all those changes made into 7.21.4, because the release process schemes are not documented anywhere...

But that's what I (or "rosetta") can tell you. Or you can let an AI assistant do the query for you which also has the docs to cross-ref, since the main use case for rosetta. But it was exactly these types of "changelog" (or "test results" which rosetta also collects) that built the non-AI "1980s library card catalog" TUI that does not require a LLM.

Also on web...

Use RouterOS Schema — Side-by-Side Diff webpage, select two versions (so 7.20.8 and 7.21.4 for long-term to long-erm), then open the "Show CHANGELOGs", which show the entire changelog history.

7.21.4 = 7.20.8 + bugfixes (mainly from 7.22 and 7.23). IMHO the version should have been 7.20.9.

I have an issue on my RB3011 where all ports go down once and hour and immediately come back up again.

You mention system stability improvements, but it’s the reverse for me. Had to go back to 7.20.8 to fix it…

Nope. 7.21.4 = 7.21.3 plus minor bug fixes

in general, long term versions with different "minor" version numbers (as in numbering scheme of "major"."minor"."patch", e.g. 7.21.4 v.s. 7.20.8) are not directly related.

In this case:

  • 7.21 alpha was forked from then current code base (probably 7.20 testing) sometime before 2025-10-07 (that's the earliest change log related to 7.21 branch available, referring to 7.21beta2). It is possible that his happened as early as in August of 2025 (or September of 2025 at latest)
  • 7.21 alpha branch proceeded with (more or less) independent development of new features, some bugs might have been fixed. Some of those fixes were simultaneously done in 7.20 series, some (most severe) possibly also in 7.19 series.
  • 7.20rc5 was released into testing channel as last testing release on 2025-09-26
  • 7.20 was released into stable on 2025-09-30
  • 7.21beta2 was released into testing on 2025-10-07
  • 7.20.1 was released into stable on 2025-10-10
  • 7.20.2 was released into stable on 2025-10-22
  • 7.20.3 was released into stable on 2025-11-06
  • 7.20.4 was released into stable on 2025-11-06
  • 7.20.5 was released into stable on 2025-11-28
  • 7.21rc1 was released into testing on 2025-12-03
  • 7.20.6 was released into stable on 2025-12-05
  • 7.20.7. was released into long-term on 2026-01-08
  • 70.21rc6 was released into testing on 2026-01-09
  • 7.20.8 was released into long-term on 2026-02-02
  • 7.21 was released to stable on 2026-01-13
  • 7.21.1 was released to stable on 2026-01-21
  • 7.21.2 was released to stable on 2026-01-29
  • 7.21.3 was released to stable on 2026-02-13
  • 7.21.4 was released to long-term on 2026-04-21

Again: "long-term" or "stable" are not version series, they are only (temporary) labels. Version series are "major"."minor".

And thus the change log relation: change log of 7.21.4 is relative to 7.21.3 (because that's the version preceeding 7.21.4) and not relative to 7.20.8 (which was previously active long-term version).

And this is the way Mikrotik did versions for at least last decade (I wasn't Mikrotik user before that so I don't know how they did it in 5.X times or before) and I don't expect them to change it any time soon.

Does not really change the fact, though. 7.21.0 is a better way to distinguish it from any patch version.