Did you use beta10 before? Did you restart the TV? The latter helped in my case after update from beta10 to rc1.
I don’t know enough about your network infrastructure, but those protocols are more complimentary than “either/or.” They can both be CPU intensive; it really depends on how much is changing in the network.
With L3HW offloading enabled, my border routers (2116) are about 5% CPU load with full BGP routes (filtering out all but 1 AS-path away), feeding into an internal BGP router (also 2116) which is at 0-2%. Profiler shows mostly “routing,” leading me to believe that the CPU’s are handling the changes in the full BGP table and doing nothing else, since OSPF states are stable between the routers.
IP Architects has a good blog write-up on using iBGP with loopback IP’s over OSPF, where OSPF handles only the subnets needed for routers to talk to each other, and the subnets going to customers advertised via BGP. Route recursion points BGP-learned routes to OSPF-learned destinations, and it works very well, despite the lack of BFD on the v7 routers.
That all said, I still would like to see some attention paid to BFD. I do have to say I’m happy to see 7 come together and 7.4 is running smoothly on my production 2116’s, 5009’s, and a few CRS3xx’s.
Well, my understanding was that the CPU usage for recalculating of the optimal paths is a lot more in OSPF than in BGP.
In one network, we have a lot of 2011-class (600 MHz MIPSBE) and RB750Gr3 routers in the network. They have to be able to keep up. There are ~100 routers and paths, many of the paths are WiFi links that sometimes can disconnect for different reasons, and the routing has to be re-calculated. That happens several times per day, sometimes a link can be flapping.
So a lot smaller scale than the typical use of BGP for internet routing at a multi-homed company or ISP.
We also need a simple configuration that can be managed in a distributed way. So each operator manages a couple of routers that talk to other such areas. There is not a single authority that manages the whole network and decides on global changes.
That is why we now use mainly eBGP, which works OK in this scenario (sometimes there is iBGP when there are multiple routers at a single site).
As the situation is now, we cannot migrate the network to v7 and when some islands do that, there are problems as a result. We want that to come to an end.
Another scenario is at my workplace where we have ~10 routers to interconnect branch offices and other small locations. GRE and GRE6 tunnels are used between the locations, and several of them have L2TP/IPsec over LTE in addition. We use BGP to select the working tunnel (GRE, then GRE6, then LTE). The users need quick switchover as this network is used for Citrix, VoIP, etc. This setup could in theory be converted to OSPF. All routers are running v6 due to the lack of BFD which is a requirement for quick switchover, which does not happen that frequently but users are in panic when their connection dies for 3 minutes.
Something’s not kosher with the way CNAME DNS results are handled in this version.
On FreeBSD, I’m only getting results on the first lookup:
$ ping -4c1 www.yahoo.com
PING new-fp-shed.wg1.b.yahoo.com (74.6.231.21): 56 data bytes
64 bytes from 74.6.231.21: icmp_seq=0 ttl=31 time=57.504 ms
--- new-fp-shed.wg1.b.yahoo.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 57.504/57.504/57.504/0.000 ms
$ ping -4c1 www.yahoo.com
ping: cannot resolve www.yahoo.com: Unknown server error
$ ping -4c1 www.yahoo.com
ping: cannot resolve www.yahoo.com: Unknown server error
$ dig www.yahoo.com @192.168.0.1
; <<>> DiG 9.18.7 <<>> www.yahoo.com @192.168.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6448
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.yahoo.com. IN A
;; ANSWER SECTION:
new-fp-shed.wg1.b.yahoo.com. 29 IN A 98.137.11.163
new-fp-shed.wg1.b.yahoo.com. 29 IN A 98.137.11.164
new-fp-shed.wg1.b.yahoo.com. 29 IN A 74.6.231.20
new-fp-shed.wg1.b.yahoo.com. 29 IN A 74.6.231.21
www.yahoo.com. 32 IN CNAME new-fp-shed.wg1.b.yahoo.com.
;; Query time: 0 msec
;; SERVER: 192.168.0.1#53(192.168.0.1) (UDP)
;; WHEN: Thu Oct 06 06:14:49 PDT 2022
;; MSG SIZE rcvd: 133
If I flush the static dns cache on the router, it’ll work again for the first request. FreeBSD doesn’t cache dns results.
On a different system behind ROS 7.5:
$ ping -4c1 www.yahoo.com
PING new-fp-shed.wg1.b.yahoo.com (74.6.231.20): 56 data bytes
64 bytes from 74.6.231.20: icmp_seq=0 ttl=51 time=58.902 ms
--- new-fp-shed.wg1.b.yahoo.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 58.902/58.902/58.902/0.000 ms
$ ping -4c1 www.yahoo.com
PING new-fp-shed.wg1.b.yahoo.com (98.137.11.163): 56 data bytes
64 bytes from 98.137.11.163: icmp_seq=0 ttl=51 time=30.100 ms
--- new-fp-shed.wg1.b.yahoo.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 30.100/30.100/30.100/0.000 ms
$ ping -4c1 www.yahoo.com
PING new-fp-shed.wg1.b.yahoo.com (74.6.231.20): 56 data bytes
64 bytes from 74.6.231.20: icmp_seq=0 ttl=51 time=58.882 ms
--- new-fp-shed.wg1.b.yahoo.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 58.882/58.882/58.882/0.000 ms
$ dig www.yahoo.com
; <<>> DiG 9.18.7 <<>> www.yahoo.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11813
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.yahoo.com. IN A
;; ANSWER SECTION:
www.yahoo.com. 31 IN CNAME new-fp-shed.wg1.b.yahoo.com.
new-fp-shed.wg1.b.yahoo.com. 31 IN A 98.137.11.164
new-fp-shed.wg1.b.yahoo.com. 31 IN A 74.6.231.20
new-fp-shed.wg1.b.yahoo.com. 31 IN A 74.6.231.21
new-fp-shed.wg1.b.yahoo.com. 31 IN A 98.137.11.163
;; Query time: 23 msec
;; SERVER: 192.168.125.1#53(192.168.125.1) (UDP)
;; WHEN: Thu Oct 06 06:16:42 PDT 2022
;; MSG SIZE rcvd: 133
I noticed that the CNAME always comes first in the answer section of ROS 7.5, but it only comes first if results aren’t cached in 7.6rc1. If I query 8.8.8.8 or 1.1.1.1 directly, the CNAME result is always first as well, so I’m guessing returning the CNAME last isn’t kosher?
I noticed the same. The 7.6rc1 behaviour of putting extra A response records in responses for AAAA queries for CNAMEs confuses some common DNS client implementations. Windows and dig are not affected, but glibc and it seems FreeBSD are.
/routing/stats/adverts/print detail
/routing/stats/adverts/show publisher=
Running a pihole and hitting dns issues, not sure this is isolated to just dns hosted on the mikrotik. Same thing if I spam resolutions, it will eventually succeed.
Update: no seems to be isolated to mikrotik. Found out pihole was falling back to querying mikrotik due to an amiss DHCP option 
On that note apparently unselecting allow remote requests does nothing.
on v7.6rc1 mpls L3vpn still broken, eventhough PE - CE using static
Thx
The “communities” values shown by “/routing/stats/adverts/show publisher=xxx” are completely wrong!
Maybe an endianness issue? (this is on a 4011)
DNS issue addressing is not success in 7.6rc1. It doesn’t work most of the times. I created a bash oneliner to test it with 7.6rc1 and after downgrade to 7.6beta8 it works fine as you can see in the second case:
$ while true; do i=0; while [ $i -lt 20 ]; do getent hosts web.facebook.com > /dev/null && echo -n "!" || echo -n "."; ((i+=1)); sleep 3; done; echo ""; done
....!.!.............
...!................
......!!............
......!!............
......!!............
.......!............
..!...!.............
..!!................
.!!.................
!!.................!
.!.................!
..................!.
!...................
!.................!.
!.................!.
.................!!.
.................!!.
.................!..
.................!!.
.................!!.
................!!..
......^C
$ while true; do i=0; while [ $i -lt 20 ]; do getent hosts web.facebook.com > /dev/null && echo -n "!" || echo -n "."; ((i+=1)); sleep 3; done; echo ""; done
!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!^C
In this version will be implemented the Router Advertisement Guard (RA Guard)?
https://www.rfc-editor.org/rfc/rfc6105
It is a very important security feature, because a hacked PC can advertise a fake router, it is an easy way to middle-of-man attack.
All of other smartswitch (Cisco, HP, Juniper, TP-Link) known this basic security feature.
This is an RC, no new feature are added in RC. Its just releases to make sure its stable enough to become stable version.
[admin@MikroTik] > /certificate/import file-name="r1-ca.crt" name="r1-ca.crt" passphrase=""
certificates-imported: 1
private-keys-imported: 0
files-imported: 1
decryption-failures: 0
keys-with-no-certificate: 0
[admin@MikroTik] > /certificate/import file-name="r1.p12" name="r1.p12" passphrase="passphrase"
certificates-imported: 1
private-keys-imported: 1
files-imported: 1
decryption-failures: 0
keys-with-no-certificate: 0
[admin@MikroTik] > /caps-man/manager/set ca-certificate=r1-ca.crt certificate=r1.p12 enabled=yes require-peer-certificate=yes
input does not match any value of ca-certificate
[admin@MikroTik] >
With a new installation of 7.5beta5 and 7.5beta8, this works, on 7.6rc1 it does not. What are the requirements for certificates now? SUP-94536
Well… this is MikroTik, so version naming conventions do not really apply.
I have to a agree to you Chaos. Here are a list of what that has been added to various 7.x release candidates.
There should be none, if you ask me.
7.6rc1 lte - added support for Neoway N75-EA
7.6rc1 winbox - added "Reset Traffic Counters" button for all interfaces
7.5rc1 capsman - added randomized range option for "reselect-interval" parameter (CLI only)
7.5rc1 container - added tun/tap support for containers
7.5rc1 dns - added "address-list" parameter for static DNS entries (CLI only)
7.5rc1 dns - added "match-subdomain" option for static entries (CLI only)
7.5rc1 firewall - added support for RTSP helper
7.5rc1 lte - added "SIM not inserted" and "SIM failure" messages to "status" and "monitor" commands for AT modems
7.5rc1 lte - added at-chat and NMEA port support for Simcom modems, USB composition (device id - 0x9003)
7.5rc1 lte - added at-chat support for Simcom modems, USB composition (device id - 0x9005)
7.5rc1 port - added support for D-Link DWM-222 in serial/PPP mode (device id - 0xac01/0x7e3d)
7.5rc1 port - added support for Huawei/ZTE K5006z in serial/PPP mode (device id - 0x1017/0x1018)
7.5rc1 routerboard - added "reset-button" script feature for TILE devices
7.5rc1 ssh - added AES support for PEM decryption
7.5rc1 traceroute - added "do-not-fragment" parameter support (CLI only)
7.5rc1 vrrp - added "sync-connection-tracking" compatibility with preemption-mode
7.5rc1 wifiwave2 - added "sae-pwe" parameter with hash-to-element mechanism for SAE PWE derivation
7.5rc1 wifiwave2 - added support for 802.11k
7.4rc2 chr - fixed booting with added additional SCSI disk
7.4rc2 container - added support for running Docker (TM) containers on ARM, ARM64 and x86 (containers created before v7.4 must be recreated)
7.4rc2 netwatch - added support for more advanced probing
7.4rc2 wifiwave2 - added initial support for roaming (802.11r) between local AP interfaces
7.4rc1 netwatch - added support for more advanced probing
7.4rc1 ntp - added VRF support for client and server
7.4rc1 ovpn - added "AUTH_FAILED" control message sending
7.4rc1 radius - added VRF support for RADIUS client
7.4rc1 system - added "shutdown" parameter for reset-configuration (CLI only)
7.4rc1 wifiwave2 - added initial support for roaming (802.11r) between local AP interfaces
7.4rc1 winbox - added "VRF" parameter under "Tools/E-mail" menu
7.3rc1 l2tp - added VRF support for L2TP client
7.3rc1 profile - added "wireguard" process classificator
7.3rc1 profile - added "zerotier" process classificator
7.3rc1 snmp - added VRF support
7.3rc1 winbox - added "Default Cost" parameter under "Routing/OSPF/Area" menu
7.3rc1 x86 - added support for Solarflare SFC1920 NIC
7.2rc5 bgp - added BGP advertisements display (requires output.keep-sent-attributes to be set)
7.2rc5 dhcpv6 - added VRF support
7.2rc5 log - added warning message when connection tracking table is full
7.2rc5 lte - added support for Uplink CA reporting
7.2rc5 rip - added logging
7.2rc5 routing - added PCAP viewer tool for BGP advertisements debugging purposes
7.2rc5 switch - added "rx-overflow" counter for 88E6393X (RB5009) and 88E6191X (CCR2004-16G-2S+) switch chips
7.2rc5 tr069-client - added support for 5G band configuration
7.2rc5 tr069-client - added support for wireless "skip-DFS" configuration
7.2rc5 winbox - added missing "3GGP RAW" parameter under "Interface/Wireless/Interworking Profile" menu
7.2rc5 winbox - added missing "accounting", "interim-update" and "radius-password" parameters under "IP/DHCP Server" menu
7.2rc4 lte - added MAC address and IPv6 LL address persistence after reboot on EG12 and EG18 modems
7.2rc4 ppp - added "comment" option for PPPoE servers
7.2rc4 wifiwave2 - added "client-isolation" feature
7.2rc4 winbox - added "host-uniq" parameter to PPPoE client interface
7.2rc4 wireless - added "3gpp-info" parameter to interworking configuration
7.2rc4 wireless - added EAP-AKA to interworking's realm configuration
7.2rc2 bridge - added fast-path and inter-VLAN routing FastTrack support when vlan-filtering is enabled
7.2rc2 dot1x - added "server-fail-vlan-id", "guest-vlan-id" and "reauth-timeout" settings for dot1x server
7.2rc2 dot1x - added "src-address", "src-mac-address" and "src-port" settings for dynamic switch rules
7.2rc2 dot1x - added NAS-Port-ID attribute for RADIUS Access-Request
7.2rc2 l3hw - added HW offloaded FastTrack support for inter-VLAN routing
7.2rc2 lte - added 3 APN profile support and APN name re-using on R11e-LTE6
7.2rc2 lte - added MAC address and IPv6 LL address persistence after reboot on EG12 and EG18 modems
7.2rc2 lte - added class based support for configless RNDIS LTE modems
7.2rc2 ospf - added "ptmp-broadcast" interface type (compatible with RouterOSv6 PTMP type)
7.2rc2 snmp - added SFP vendor name to optical table
7.2rc2 snmp - added support for "ipv6AddrPrefixTable" and "ipv6RouteNumber" OID's
7.2rc2 winbox - added "Disconnect Notify" checkbox to "Interface/OVPN Client" menu
7.2rc2 winbox - added "Freq. Usage" and "Scan" buttons for WifiWave2 interfaces
7.2rc2 winbox - added "Ignore Missing" selector to "System/Packages" menu
7.2rc2 winbox - added "Routing Table" parameter for IPv6 routes
7.2rc2 winbox - added "VPN" tab to "Routing/BGP" menu
7.2rc2 winbox - added "VRF" parameter to "IP/Services" menu
7.2rc2 winbox - added "comment" parameter to "User Manager/Users" menu
7.2rc2 winbox - added MLAG support
7.2rc2 winbox - added SHA256 and SHA512 "Auth" values for OVPN menu's
7.2rc2 winbox - added ZeroTier support
7.2rc2 winbox - added explicit "Upload" and "Download" names for "Bucket Size" parameters under "Queues" menu
7.2rc2 x86 - added support for Intel E810 NIC
7.2rc1 backup - added "force-v6-to-v7-configuration-upgrade" option on backup load to clear RouterOS v7 configuration and trigger reimport of RouterOS v6 route configuration (CLI only)
7.2rc1 ipsec - added hardware acceleration support for CCR2116
7.2rc1 lte - added basic information support for Telit LM960 and LM940 in MBIM mode
7.2rc1 ovpn - added SHA2 authentication algorithm support
7.2rc1 ovpn - added hardware acceleration support for IPQ4018/IPQ4019 and AL* series chipsets
7.2rc1 ovpn - added option to send disconnect message in UDP mode
7.2rc1 pppoe - added option to configure "host-uniq" parameter
7.2rc1 pppoe - added option to ignore PADI messages with empty service name
7.2rc1 pptp - added insecure connection warning
7.2rc1 supout - added "port-controller" bridge section
7.2rc1 tr069-client - added support for wireless client uptime reporting
7.2rc1 wifiwave2 - added support for handling disconnect request messages from RADIUS servers
7.2rc1 winbox - added "Mode" parameter under "Wireless" menu with WifiWave2 package
7.2rc1 winbox - added "TLS Version" parameter for "Interface/OVPN"
7.2rc1 winbox - added "VRF" parameter for "SSH" and "Telnet" menus
7.2rc1 winbox - added interface list support for "IP/Traffic Flow" menu
7.2rc1 winbox - added local/remote CPU load parameters for "Bandwidth Test"
7.2rc1 winbox - added support for "Tool/Speedtest" menu
7.2rc1 winbox - added support for W60G align tool
7.2rc1 wireless - added information about client signal strength to log messages about disconnections
7.1rc6 lte - added AT chat support for Telit LN960
7.1rc6 route-filters - added "suppress-hw-offload" parameter
7.1rc5 bonding - added warning when using 802.3ad mode without MII link monitoring
7.1rc5 bridge - added HW offload support for vlan-filtering on MT7621 switch chip (hEX, hEX S, RBM33G, RBM11G, LtAP)
7.1rc5 certificate - added ability to choose the digest algorithm when generating a certificate
7.1rc5 lte - added "at-chat" support in MBIM mode for Simcom modems in USB composition mode 9003
7.1rc5 mpls - added ICMP handler (send ICMP ttl exceed on MPLS ttl expiry)
7.1rc5 quickset - added 5G signal quality information
7.1rc5 rpki - added "rpki-query" command
7.1rc5 ssl - added support for additional GCM_SHA384 ciphers
7.1rc5 traffic-flow - added systematic count-based packet sampling support
7.1rc5 vxlan - added default L2MTU value for improved connectivity in bridged setups
7.1rc5 winbox - added "netmap" action to IPv6 NAT rules
7.1rc5 winbox - added IPv6 support for "Network" parameter under "Routing/OSFP/Interface Templates" menu
7.1rc5 winbox - added missing IPv6 mangle actions - "mark-routing", "sniff-tzsp", "sniff-pc", "snpt" and "dnpt"
7.1rc5 winbox - added option to upgrade LTE firmware
It seems like dns issue isn’t 100% solved. But I say this without concrete proof, so apologies in advance. In windows and ubuntu its working fine. But in android I’m getting random ERR DNS RESOLV FAIL in random apps. Not always, and not in all apps. So can’t really pinpoint it yet. So maybe most of the apps are compatible like glibc and windows, but some aren’t?
We are aware of the issues regarding the DNS cache and several LTE interfaces in this rc1 release. We are working on fixes and the rc2 release. So if your DNS service or LTE is failing, then we recommend downgrading your device to 7.5 until 7.6rc2 is released.
Strods when do you plan to increase shared memory for large bgp rotuing table?
thanks
I have a new Samsung Smart TV and the internet setup wouldn’t work. It was complaining about unstable internet connection, either wired or wireless. By changing the DNS server to something not-mikrotik (like 1.1.1.1) it immediately started working. I also have problems with MongoDB SRV records where golang is not able to resolve these entries (“cannot unmarshal”). Changing the DNS, again, solves the problem. This does not only seem to be a 7.6rc1 problem but something’s definitely wrong with the DNS resolver.
I wonder what was changed that caused such disruptions to dns operation? .. I’m sticking with 7.6beta4 / 7.6beta6 until these dns issues and container permissions problems are confirmed to be fixed. Hopefully we get a promising new build to test again soon