Community discussions

 
matnur
just joined
Topic Author
Posts: 5
Joined: Wed Dec 16, 2015 5:12 pm

Feature or bug? SSTP not working between RouterOS versions

Wed Dec 16, 2015 5:22 pm

Hi,

I've been using MikroTik for quite a while now and have a great amount of customers that uses SSTP for connecting to their devices out on the field.

One thing I've noticed while creating new SSTP tunnels to our endpoint is that somewhere after RouterOS v6.30, you are no longer able to establish a tunnel from a device using an earlier version like for example v6.26. I even tried going back to legacy just to try it out but no change.

Current RouterOS is v6.33.3.

Am I missing some new feature or is this a new bug?

Kind regards,
Mattias
 
User avatar
ConnectivityEngineer
Frequent Visitor
Frequent Visitor
Posts: 57
Joined: Sat Dec 19, 2015 10:57 pm
Location: Ohio, USA
Contact:

Re: Feature or bug? SSTP not working between RouterOS versions

Sun Dec 20, 2015 12:12 am

Perhaps we do not have enough information to help you with the request...
I do know in the past I personally had issues with a client after an upgrade.
I ended up increasing the time outs and voila - worked like a champ.

Quick ? Are you using sstp-server interface bindings on server's side, or do you have dynamic sstp-server interfaces only?

In early 2014 there was a similar issue - Might do a ticket to Mikrotik as well if all worked until the upgrade.
Glenn Kelley | MCTNA, MTCWE, MTCTCE, RHCE, RHCSS
http://Connectivity.Engineer
USA Based 24x7x365 Mikrotik, Juniper, Ubiquiti TAC & WISP / ISP Blind Label Support Call Center
 
matnur
just joined
Topic Author
Posts: 5
Joined: Wed Dec 16, 2015 5:12 pm

Re: Feature or bug? SSTP not working between RouterOS versions

Tue Dec 22, 2015 10:38 am

Hi CE and thank you for answering my post.

I understand that it can be hard to understand the problem if you have not experienced it yourself and my description is not much to go on.

With that information, I tried to setup a new lab at the office with 2pcs of hEX routers (RB750Gr2) to simulate the problem and post some screenshots - but while trying to downgrade to v6.25 (that we have running on some sites), I never reached the router and had to do a Netinstall to a later version.

Hopefully - I will get my hands on some RB750/RB750G to try this older firmware on, maybe the newer routers are not compatible with the older software?

What I can say at the moment is that from v6.28 and up, an SSTP connections is successfully established and working and it seems like earlier versions than 6.28 and everything above is not working together.

I'll post the results after I get v6.25 or earlier working.

Kind regards,
Mattias
 
jarda
Forum Guru
Forum Guru
Posts: 7604
Joined: Mon Oct 22, 2012 4:46 pm

Sat Dec 26, 2015 9:46 am

It is very old and known thing.
http://forum.mikrotik.com/viewtopic.php ... tp#p448208
You should search the forum before you ask.
I suggest to update to 6.32.3 on involved devices. And to use l2tp instead sstp as it is much faster, if you can.
 
matnur
just joined
Topic Author
Posts: 5
Joined: Wed Dec 16, 2015 5:12 pm

Re: Feature or bug? SSTP not working between RouterOS versions

Tue Jan 05, 2016 10:25 am

Hi Jarda,

Thank you for the reply. I have searched (probably not with the right keywords..) but did not find anything that would explain the problem, that is why I registered a new account (lost the old one for a couple of years ago) just to post a new question.

Even if this has been on topic before - the thread you are pointing to does not have a real answer to the problem and using RouterOS version 6.18 and 6.19. I am today having the same problem between RouterOS before 6.27 and after 6.28.

We cannot just move all customers to L2TP (as some are behind firewalls that blocks that kind of traffic) and an upgrade remote is as you probably know a bit dangerous and can result in a lot of consulting hours. I know that an upgrade is the recommended way of doing things from MikroTik but things like this should just work and not need an upgrade of the whole customer network just because we upgrade our VPN endpoint.

It's easy to just say "upgrade to latest version" and "you should search before you ask" but I would appreciate if you would be so kind to give it a bit of thought before you write that kind of answer.

Kind regards,
Mattias
 
jarda
Forum Guru
Forum Guru
Posts: 7604
Joined: Mon Oct 22, 2012 4:46 pm

Re: Feature or bug? SSTP not working between RouterOS versions

Wed Jan 06, 2016 7:52 pm

Hi, sorry for short answer before.

I had quite long time discussion with mikrotik about this topic around version 6.25 and maybe also earlier around version 6.17-6.19 if I remember well. This was never enough enlighted by them, but they are still breaking something during they tryouts to make other things better. Sometimes fiddling with "PFS" and "Force AES" setting helped a bit, sometimes the sstp connections needed to be disabled for some time to get it working. It also depends if you are adding IP addresses to the clients by server, as they could be sometimes stated to be invalid on clients side while server looked correctly. Hard to say.

Even I know how problematic and risky is to update to newer versions, I cannot suggest you anything better than to use 6.32.3 and to use l2tp, because you cannot get any support to old versions and I know for sure that with this version it works correctly. At least for me.

Its maybe more safe approach to select one version that is good for you and use it everywhere. And do not touch it until you have real reason to update. Thank make enough tests in laboratory to see the newer version fulfills all your needs and has no hidden bug for you. After that roll this version and be prepaired to get back in case of any problems.
 
matnur
just joined
Topic Author
Posts: 5
Joined: Wed Dec 16, 2015 5:12 pm

Re: Feature or bug? SSTP not working between RouterOS versions

Fri Jan 08, 2016 1:37 pm

Hi Jarda,

Thank you - This discussion has been interesting and given me some thoughts to think about in the future. In the end, it seems that I must upgrade all customer units to get this to work seamlessly with our new endpoints. It's a risky task, but may be the best way to do it.

I suggest that MikroTik put some more resources on testing every release (even if this new system of stable, current and testing exists) to get backwards compatibility and ensure that things will continue working safely (I know that this is not an easy task and that releases sometimes contains bug fixes that differ between versions, but still).

Except the fast releases and some bugs, MikroTik is doing a great job of delivering both great hardware and software to a good price.

Best regards,
Mattias
 
jarda
Forum Guru
Forum Guru
Posts: 7604
Joined: Mon Oct 22, 2012 4:46 pm

Mon Jan 11, 2016 6:35 pm

We were giving these suggestions to mikrotik many times during last few years. After that they came with multiple release streams. It's not working perfectly, but at least they are adding less errors in higher bugfix releases than before because they are trying not to add new features within one minor version. But they are trying to do their best.

Who is online

Users browsing this forum: ste and 66 guests