v7.9beta [testing] is released!

EdPa · March 24, 2023, 8:08am

RouterOS version 7.9beta has been released on the “v7 testing” channel!
Before an upgrade:

Remember to make backup/export files before an upgrade and save them on another storage device;
Make sure the device will not lose power during upgrade process;
Device has enough free storage space for all RouterOS packages to be downloaded.

What’s new in 7.9beta4 (2023-Mar-23 15:01):
Changes in this release:

*) bgp - improved BGP VPN selection;
*) bridge - added warning log when “ageing-time” exceeds supported hardware limit for 98DX224S, 98DX226S, and 98DX3236 switch chips;
*) bridge - fixed FastPath when setting “use-ip-firewall-for-vlan” or “use-ip-firewall-for-pppoe” without enabled “use-ip-firewall”;
*) certificate - fixed bogus log messages;
*) chr - fixed public SSH key pulling when running on AWS;
*) console - added “/task” submenu (CLI only);
*) console - added option to create new files using “/file add” command (CLI only);
*) console - improved stability when doing “/console inspect” in certain menus;
*) console - improved stability when editing long strings;
*) console - improved system stability;
*) console - removed bogus “reset” command from “/system resource usb” menu;
*) console - rename flag “seen reply” to “seen-reply” under “/ipv6 firewall connection” menu;
*) console - show Ethernet advertise, speed and duplex settings depending on configured auto-negotiation;
*) container - fixed invoking “container shell” more than once;
*) container - improved “container pull” to support OCI manifest format;
*) detnet - fixed interface state detection after reboot;
*) dhcp - changed the default lease time for newly created DHCP servers to 30 minutes;
*) dhcpv4-server - release lease if “check-status” reveals no conflict;
*) disk - improved system stability when removing USB while formatting;
*) ethernet - fixed half-duplex forced mode at 10Mbps and 100Mbps on ether1 for RB5009, Chateau 5G ax and hAP ax3 devices;
*) filesystem - fixed partition “copy-to” function;
*) firewall - added “connection-nat-state” to IPv6 mangle and filter rules;
*) health - added limited manual control over fans for CRS3xx, CRS5xx, CCR2xxx devices;
*) ipsec - fixed packet processing by hardware encryption engine on RB850Gx2 device;
*) ipsec - refactor X.509 implementation;
*) ipv6 - added “valid” and “lifetime” parameters for SLAAC IPv6 addresses;
*) ipv6 - send out RA packet with “preferred-lifetime” set to “0” when IPv6 address is deactivated;
*) l3hw - improved route offloading for 98DX224S, 98DX226S, and 98DX3236 switch chips;
*) leds - disable LEDs after “/system shutdown”;
*) lte - capped maximum lifetime of SLAAC address to 1 hour;
*) lte - fixed CA band clearing on RAT mode change;
*) lte - fixed duplicate IPv6 route for lte interface when “ipv6-interface” setting is used;
*) lte - fixed LTE interface not showing up when resetting RouterOS configuration;
*) lte - fixed passthrough mode when used together with another APN for Chateau 5G;
*) lte - fixed R11-LTE-US in LTE passthrough mode;
*) lte - fixed R11e-LTE-US reporting of RSSI in LTE mode;
*) lte - fixed re-attach in some cases where module would stay in not-running state after network detach;
*) lte - fixed second modem halt on dual R11e-LTE6 setup;
*) mpls- fixed LDP “preferred-afi” parameter;
*) netwatch - added “startup-delay” setting (CLI only);
*) netwatch - improved ICMP status evaluation when no reply was present;
*) netwatch - limit “start-delay” range;
*) ospf - fixed processing of fragmented LSAs;
*) ovpn - added support for OVPN server configuration export and client configuration import from .ovpn file;
*) quickset - fixed displaying of “SINR” when value is 0;
*) rose-storage - added option to nvme-discover with hostname (CLI only);
*) rose-storage - fixed crash on nvme-tcp disable;
*) rose-storage - fixed rsync transfer permissions;
*) rose-storage - various stability fixes;
*) route - fixed “dynamic-id” for VRF tables;
*) route - improved system stability when making routing decision;
*) route - show SLAAC routes under the “/routing route” menu;
*) route-filter - improved stability when matching blackhole routes;
*) routerboot - added “preboot-etherboot” and “preboot-etherboot-server” settings (“/system routerboard upgrade” required) (CLI only);
*) sfp - added log warning about failed auto-initialization on RB4011, RB5009, CCR2004-1G-12S+2XS, CCR2004-16G-2S+, CCR2116-12G-4S+, CCR2216-1G-12XS-2XQ devices;
*) sfp - allow modules that hold “TX_FAULT” high signal all the time on RB4011, RB5009, CCR2004-1G-12S+2XS, CCR2004-16G-2S+, CCR2116-12G-4S+, CCR2216-1G-12XS-2XQ devices;
*) sfp - allow modules with bad or no EEPROM in forced mode on RB4011, RB5009, CCR2004-1G-12S+2XS, CCR2004-16G-2S+, CCR2116-12G-4S+, CCR2216-1G-12XS-2XQ devices;
*) sfp - fixed “rate-select” functionality on CCR2004-16G-2S+ and CCR2004-1G-12S+2XS devices (introduced in v7.8 );
*) sfp - fixed combo-ether link monitor for CRS328-4C-20S-4S+ switch;
*) sfp - improved module initialization and display more detailed initialization status on RB4011, RB5009, CCR2004-1G-12S+2XS, CCR2004-16G-2S+, CCR2116-12G-4S+, CCR2216-1G-12XS-2XQ devices;
*) sfp - improved SFP28 interface stability with some optical modules for CRS518 switch;
*) sfp - improved system stability with some SFP GPON modules on RB4011, RB5009, CCR2004-1G-12S+2XS, CCR2004-16G-2S+, CCR2116-12G-4S+, CCR2216-1G-12XS-2XQ devices;
*) socks - added VRF support;
*) ssh - added Ed25519 host key support;
*) ssh - do not allow SHA1 usage with strong crypto enabled;
*) ssh - improved service responsiveness when changing SSH service settings;
*) ssh - improved SSH key import process;
*) storage - mount RAM drive for devices with 32MB flash;
*) supout - added DHCP server network section;
*) switch - fixed ACL rules matching IPv6 packets when using only IPv4 matchers;
*) switch - improved system stability for 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98PX1012 switches;
*) vrrp - added “self” value for “group-master” setting;
*) vxlan - added forwarding table;
*) vxlan - fixed packet drops when host moves between remote VTEPs;
*) webfig - added inline comments;
*) webfig - fixed “Destination” value under “MPLS/Forwarding-Table” menu;
*) webfig - fixed issue where “Certificate” value disappears under “IP/Services” menu;
*) webfig - fixed issue where entries might be missing under “IP/DHCP-Server” menu;
*) webfig - various stability fixes;
*) wifiwave2 - added “radio/reg-info” command to show regulatory requirements (currently implemented for 802.11ac interfaces) (CLI only);
*) wifiwave2 - added ability to configure antenna gain;
*) wifiwave2 - added ability to configure beacon interval and DTIM period;
*) wifiwave2 - added information on additional interface capabilities to radio parameters;
*) wifiwave2 - automatically add a VLAN-tagged interface to the appropriate bridge VLAN;
*) wifiwave2 - exit sniffer command and return error when trying to sniff on an unsupported channel;
*) wifiwave2 - fixed 802.11r roaming for clients that performed initial authentication with an AP which has been restarted since;
*) wifiwave2 - fixed issue of some supported channels not being listed in the radio parameters;
*) wifiwave2 - fixed issue which lead to VLAN-tagged wireless clients receiving tagged traffic from other VLANs;
*) wifiwave2 - fixed VLAN tagging for unencrypted (open) APs;
*) wifiwave2 - improved general interface stability;
*) wifiwave2 - improved regulatory compliance for hAP ax^2, hAP ax^3 and Chateau ax;
*) wifiwave2 - increased maximum value for “channel.frequency” to 7300;
*) wifiwave2 - show information on captured packets and added ability to save them locally in a pcap file;
*) winbox - added “MTU” and “Hoplimit” properties under “IPv6/Routes” menu;
*) winbox - added “Preferred AFI” property under “MPLS/LDP-Instance” menu;
*) winbox - added “S” flag under “IPv6/Firewall/Connections” menu;
*) winbox - added “Tx Power” property under “Wifiwave2/Status” menu;
*) winbox - added “Tx Queue Drops” property under interface settings “Traffic” tab;
*) winbox - added “Username” and “Password” properties under “Container/Config” menu;
*) winbox - added “Valid” and “Preferred” properties under “IPv6/Address” menu;
*) winbox - added missing properties for “Remote ID Type” under “IP/IPsec/Identities” menu;
*) winbox - changed route flag name from “invalid” to “inactive”;
*) winbox - fixed “TLS” property under “Tools/Email” menu;
*) winbox - fixed “Type” property under “System/Disk” menu when “rose-storage” package is installed;
*) winbox - fixed default value for “Allow managed” property under “Zerotier” menu;
*) winbox - fixed duplicate “My ID” column under “IP/IPsec/Identities” menu;
*) winbox - fixed minor typo in “WifiWave2/Radios” menu;
*) winbox - fixed missing “Sector Writes” for certain devices under “System/Resources” menu (introduced in v7.8 );
*) winbox - improved Ethernet advertise, speed and duplex settings;
*) winbox - only show permitted countries for wifiwave2 interfaces;
*) winbox - show missing “Designated Bridge” and “Designated Port Number” monitoring data under "Bridge/Port menu;
*) www - allow unsecure HTTP access to REST API;
*) x86 - fixed changing software-id (introduced in v7.7);
*) zerotier - upgraded to version 1.10.3;

To upgrade, click “Check for updates” at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while a router is not working as suspected or after some problem has appeared on the device

Please keep this forum topic strictly related to this particular RouterOS release.

rushlife · March 24, 2023, 8:34am

nice work, thx

BartoszP · March 24, 2023, 8:35am

*) ipsec - fixed packet processing by hardware encryption engine on RB850Gx2 device;

What does it mean? What was the problem? Speedup in processing?

rpingar · March 24, 2023, 8:49am

Mellanox ConnectX-6 recognized (MT2892 Family [ConnectX-6 Dx] (rev: 0)) but not supported.
Any words on when will be added?

eworm · March 24, 2023, 8:54am

*) ssh - added Ed25519 host key support;

This does not work for me… Still uses RSA host key, even after regenerating key(s).

And public key authentication with ed25519 keys will come later?

eworm · March 24, 2023, 8:55am

Oh, it is a setting in /ip/ssh/… Why not support both at the same time? Just let the client decide.

pe1chl · March 24, 2023, 9:28am

Again no BFD. It is becoming more and more like a clown show.

osc86 · March 24, 2023, 9:31am

*) ipv6 - send out RA packet with “preferred-lifetime” set to “0” when IPv6 address is deactivated;
I hope this not only happens when the address is deactivated but also every time the address is changed, like when a new address from a pool is assigned.

colinardo · March 24, 2023, 9:38am

Yes it does.I have tested it successfully in my lab, changed the globally assigned prefix, router sends out RA with 0 to clients for old prefix.
Long story, but finally, no workaround scripts necessary anymore, Thanks Mikrotik!

Regards @colinardo

osc86 · March 24, 2023, 9:46am

Thanks for testing colinardo, this is very good news, thanks Mikrotik!

own3r1138 · March 24, 2023, 10:15am

Still, no OVPN fix on this release despite numerous reports about the instance kernel crashes from 7.8 RC to 7.9 B.

Babujnik · March 24, 2023, 10:37am

rose-manager still does not work with QNAP/Synology iscsi targets

colinardo · March 24, 2023, 10:42am

*) ssh - added Ed25519 host key support;

Tried this, but importing an ed25519 hostkey on 7.9 beta4 (x86 CHR Image) does not work, see images how i generated the key and tried to import it

Also tried a RFC4716 converted key file, but this one also refuses to import

ssh-keygen -e -f myhost.key >myrfc4716.key

RSA works as normal, so what’s the change here??

Regards @colinardo

eworm · March 24, 2023, 11:02am

As I wrote above… This is not (yet) about public key authentication. You now have the choice to use RSA or ed25519 host keys. You can see what host key type is used in the heading of randomart Image.

colinardo · March 24, 2023, 11:08am

I know, but this is the host key, i tried to import the hostkey for the router itself not for a user.

anav · March 24, 2023, 11:16am

Impressive amount of work done here, regardless if what anyone specifically wanted didnt get done. The paperwork alone is not trivial, just imagine the testing and integration involved. Kudos to the dev team and test team.

colinardo · March 24, 2023, 11:19am

Ahh found it, you have to set the key-type first:

/ip/ssh 
set host-key-type=ed25519
regenerate-host-key

But custom host keys in ed25519 format still will not import via import-host-key command after changing the setting above.

Larsa · March 24, 2023, 12:14pm

*) www - allow unsecure HTTP access to REST API;
Well, thank you very much! This will certenatly improve monitoring capabilities on all low-end devices like ap/lte/nr.

*) zerotier - upgraded to version 1.10.3;
That was very good news indeed!

However if I may make a suggestion, you should seriously consider bumping up to at least v1.10.6 since there are major problems in the previous versions regarding path-learning and max-paths with lingering dynamic addresss that may hit ipv6 usage.

normis · March 24, 2023, 12:38pm

When we upgraded to version 1.10.3 it was the latest one. We can’t upgrade and release on the same day. We need to test it too

anav · March 24, 2023, 12:42pm

So true, LARSA look at post #16 My impatient vampire mouse. That is why I am not clamouring for the ZeroTrust Cloudlfare Tunnel options package (for all mt users) on every beta release as I know these things take time. ;-))