Hi.

Disclaimer: I am very much a noob to commercial network switches. I'm just an engineer in a tiny company. The Mikrotik network we have was not set up by me and i'm trying to learn as i need to do perform updates/make changes.

We have a Windows Active Domain running on a network using Mikrotik switches - 1 routerboard and 3 access points. Since it is just a small company, we only have 1 server that handles the shared drive, Active Domain, DNS, and DCHP. Only about 2 dozen devices connect to the network, including personal mobile devices. We have an RB750Gr2 for the routerboard, and hAP AC lite for the access points.

Recently, we've been experiencing network/server drops. I've looked at the event viewer on the Windows server and i can't spot any warnings or errors relating to the network. I've also looked at the log on the Mikrotik routerboard and can't spot any issues around our recent drop. At the moment, i honestly don't have a clue at what might be causing the issue - it could be the switches or it could be the Windows Server. May someone help me/advise me on how to test our Mikrotik network to see if it's at fault please?

The issues we've experienced is that multiple devices were disconnected, whilst other devices remained connected, but the devices remain connected weren't able to read/write files on the shared drive. After a 10 minute period, everything returned back to normal. Nothing was power cycled or restarted to get the system to return to normal.


In the log, i see the following errors appear periodically throughout, but it did not appear anywhere near the most recent issue experienced. We don't have any connection to the IP address stated. I presume this is an intruder? How can i block the intruder from accessing the router?

216.218.206.122 failed to get valid proposal
216.218.206.122 failed to pre-process ph1 packet (side:1, status 1)
216.218.206.122 phase 1 negotiation failed