v6.43rc [release candidate] is released!

pe1chl · Wed Aug 22, 2018 5:04 pm

hi guys, it seems to me that it is still not possible to change the date format in dd / mm / yyyy. It would be very useful as I also work with userman reports.
Does anyone have a solution?
thank you
Valerio

I agree with that, it should be possible to have a system setting that changes the date format everywhere, but it would be feature request not something for the v6.43rc topic.

tigro11 · Wed Aug 22, 2018 5:09 pm

very strange, now all the devices have the ability to change the format of the date ....
I am amazed that until now nobody has raised the problem

S4bulba · Thu Aug 23, 2018 12:07 am

Version 6.43rc56 as well as version 6.43rc51 are good builds for 951Ui-2nD.WAN PPPoE stability , good wireless signal for what i use in my house.No problems for a casual SOHO user.

diablothebest · Thu Aug 23, 2018 8:15 pm

I lose my UserManager database on last RC!

diablothebest · Thu Aug 23, 2018 8:17 pm

Lost all userman data on last RC...

freemannnn · Thu Aug 23, 2018 8:52 pm

very strange, now all the devices have the ability to change the format of the date ....
I am amazed that until now nobody has raised the problem

viewtopic.php?t=134098

emils · Fri Aug 24, 2018 10:12 am

Version 6.43rc64 has been released.

Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

MAJOR CHANGES IN v6.43:
----------------------
!) api - changed authentication process (https://wiki.mikrotik.com/wiki/Manual:API#Initial_login);
!) backup - do not encrypt backup file unless password is provided;
!) btest - requires at least v6.43 Bandwidth Test client when connecting to v6.43 or later version server except when authentication is not required;
!) cloud - added IPv6 support;
!) cloud - added support for licensed CHR instances (including trial);
!) cloud - reworked "/ip cloud ddns-enabled" implementation (suggested to disable service and re-enable after installation process);
!) mac-telnet - require at least v6.43 MAC Telnet client when connecting to v6.43 or later version server;
!) radius - use MS-CHAPv2 for "login" service authentication;
!) romon - require at least v6.43 RoMON agent when connecting to v6.43 or later RoMON client device;
!) security - fixed vulnerabilities CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159;
!) webfig - improved authentication process;
!) winbox - improved authentication process excluding man-in-the-middle possibility;
!) winbox - minimal required version is v3.15;
----------------------

Other changes in this release:

*) bridge - added an option to manually specify ports that have a multicast router (CLI only);
*) bridge - added a warning when untrusted port receives a DHCP Server message when DCHP Snooping is enabled;
*) bridge - added more options to fine-tune IGMP Snooping enabled bridges (CLI only);
*) bridge - added support for DHCP Option 82 (CLI only);
*) bridge - added support for DHCP Snooping (CLI only);
*) bridge - added support for IGMP Snooping fast-leave feature (CLI only);
*) cloud - close local UDP port if no activity;
*) console - made "once" parameter mandatory when using "as-value" on "monitor" commands;
*) console - removed automatic swapping of "from=" and "to=" in "for" loops;
*) crs326/crs328 - fixed packet forwarding when port changes states with IGMP Snooping enabled;
*) crs3xx - added hardware support for DHCP Snooping and Option 82;
*) crs3xx - fixed packet forwarding when "frame-type" is changed (introduced in v6.43rc51);
*) crs3xx - fixed SwOS config import;
*) defconf - fixed default configuration for RBSXTsq5nD;
*) dhcpv6-client - fixed false invalid flag (introduced in v6.43rc56);
*) fetch - added "as-value" output format;
*) fetch - fixed address and DNS verification in certificates;
*) health - added missing parameters from export;
*) ipsec - added warning messages for incorrect peer configuration;
*) ipsec - improved stability when using IPsec with disabled route cache;
*) leds - fixed LED behaviour when bonding is configured on SFP+ interfaces;
*) lte - added "sector-id" to info command;
*) lte - fixed SIM7600 series module support with newer device IDs;
*) ppp - added support for Alfa Network U4G modem;
*) rb3011 - added IPsec hardware acceleration support;
*) snmp - added EAP identity to CAPsMAN registration table;
*) supout - added monitored bridge VLAN table to supout file;
*) switch - added CPU Flow Control settings for devices with a Atheros8227, QCA8337, Atheros8327, Atheros7240 or Atheros8316 switch chips;
*) tr069-client - use SNI extension for HTTPS;
*) ups - improved UPS serial parsing stability;
*) w60g - added "beamforming-event" stats counter;
*) w60g - fixed random disconnects;
*) w60g - general stability and performance improvements;
*) wireless - accept only valid path for sniffer output file parameter;
*) wireless - added "czech republic 5.8" regulatory domain information;
*) wireless - added "etsi2" regulatory domain information;
*) wireless - added option to disable PMKID for WPA2;
*) wireless - updated "czech republic" regulatory domain information;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as expected or after crash.

Note that release candidate versions are published strictly for testing purposes and should not be used on production routers.

nescafe2002 · Fri Aug 24, 2018 11:07 am

*) rb3011 - added IPsec hardware acceleration support;

That was.. unexpected!

zyzelis · Fri Aug 24, 2018 11:26 am

Dear Mikrotik stuff,
please add dhcp option82 to dhcp server

Fri Aug 24, 2018 11:32 am

Already possible with RADIUS server.

bennyh · Fri Aug 24, 2018 12:23 pm

*) rb3011 - added IPsec hardware acceleration support;
That was.. unexpected!

very-very-very-very big thanks for the Miki stuff if it works

If they fix the web proxy ipv6 website support too that will makes me very happy

nkourtzis · Fri Aug 24, 2018 12:55 pm

*) rb3011 - added IPsec hardware acceleration support;

That was.. unexpected!

And VERY VERY welcome! Thanks Mktik!

zyzelis · Fri Aug 24, 2018 1:01 pm

Already possible with RADIUS server.

Yes i know that.
But to keep radius only for option82 not very smart. isn't?

nkourtzis · Fri Aug 24, 2018 1:20 pm

The winbox behaviour where winbox closes upon reconnecting to a previously broken connection, is again here since v3.16. It occurs not always, but quite often. Mktik, can you please look into it?

Another issue: I am trying to connect to a device via RoMON which runs over a EoIP connection (L2 only, not bridged, no IPs) which is established over a L2TP tunnel. Even though the L2TP tunnel is quite stable, winbox cannot stay connected for more than a few seconds at a time. Actually, winbox opens the RoMON connection, but any list (say, interfaces) shows up empty and after a few seconds the window closes. Any ideas?

gwartass · Fri Aug 24, 2018 3:13 pm

*) wireless - added "czech republic 5.8" regulatory domain information;
*) wireless - updated "czech republic" regulatory domain information;

Is it what I mean? So now we'll have two czech 5GHz ranges now - one for traditional channels and second for channels over 5700 which can have max transmit power 20dBi only?
If yes, It's great! Because now I have big problem if I have the wireless link calculated for 30dBi and DFS switches to channel over 5700 and 20dBi..

eworm · Fri Aug 24, 2018 3:33 pm

[admin@MikroTik] > :put [/tool fetch https://www.eworm.de/ip/ output=user as-value ]
data=80.133.168.147;downloaded=0;duration=00:00:01;status=finished

Finally we can fetch data without writing and reading a file. Thanks a lot!

Looks like it's required to cut the data part, though... Or is there a way to put the data only into a variable?

Jotne · Fri Aug 24, 2018 3:34 pm

*) rb3011 - added IPsec hardware acceleration support;

Maybe we could have some hope that RB750Gr3 would get HW support sooooon.

eworm · Fri Aug 24, 2018 3:36 pm

*) rb3011 - added IPsec hardware acceleration support;
Maybe we could have some hope that RB750Gr3 would get HW support sooooon.

It has support for harware ipsec for a long time...

sindy · Fri Aug 24, 2018 3:38 pm

Maybe we could have some hope that RB750Gr3 would get HW support sooooon.

RB750 Gr3 does have hardware acceleration of IPsec ever since the first release. What it does not have is "hardware acceleration" of VLAN handling on the switch chip.

mkx · Fri Aug 24, 2018 3:55 pm

What it does not have is "hardware acceleration" of VLAN handling on the switch chip.

Unfortunately this is true for most devices, some of them have quite a decent switch chip built in.

eworm · Fri Aug 24, 2018 3:56 pm

Code: Select all
[admin@MikroTik] > :put [/tool fetch https://www.eworm.de/ip/ output=user as-value ]
data=80.133.168.147;downloaded=0;duration=00:00:01;status=finished
Finally we can fetch data without writing and reading a file. Thanks a lot!

Looks like it's required to cut the data part, though... Or is there a way to put the data only into a variable?

[admin@MikroTik] > :global test
[admin@MikroTik] > :set test [ / tool fetch https://www.eworm.de/ip/ output=user as-value ]
[admin@MikroTik] > :put [ :pick $test 0 ]
80.133.168.147

Works!
Thanks Mikrotik!

(BTW, what the hell make the formatting go nuts?)

mkx · Fri Aug 24, 2018 3:59 pm

Never mind.

emils · Fri Aug 24, 2018 4:00 pm

eworm, proper syntax would be:

:local test ([tool fetch url="https://www.eworm.de/ip" output=user as-value]->"data");
:put $test;

https://wiki.mikrotik.com/wiki/Manual:T ... a_variable

eworm · Fri Aug 24, 2018 4:03 pm

eworm, proper syntax would be:
Code: Select all
:local test ([tool fetch url="https://www.eworm.de/ip" output=user as-value]->"data");
:put $test;
https://wiki.mikrotik.com/wiki/Manual:T ... a_variable

Even better! Thanks a lot!

osc86 · Fri Aug 24, 2018 4:04 pm

I lost all ipsec connections after updating to rc64 because of a bug in peer profiles.

emils · Fri Aug 24, 2018 4:12 pm

osc86, we are aware of the issue. It will be fixed until 6.43 is released in current release channel.

sindy · Fri Aug 24, 2018 4:18 pm

(BTW, what the hell make the formatting go nuts?)

You have to use preview and add some empty lines before the [code] ones where necessary.

osc86 · Fri Aug 24, 2018 8:07 pm

osc86, we are aware of the issue. It will be fixed until 6.43 is released in current release channel.

Something must have been changed with ipsec processing in rc64. No traffic is passing through the tunnels.
I moved back to 56, where everything works fine.

msatter · Fri Aug 24, 2018 8:27 pm

osc86, we are aware of the issue. It will be fixed until 6.43 is released in current release channel.

It would be nice if that would also be communicated in the changelog if something gets broken in the process and there is knowledge about that. Preferable also in red to warn.
Saves downgrades for some who are using that specific feature.

Fri Aug 24, 2018 8:50 pm

osc86, we are aware of the issue. It will be fixed until 6.43 is released in current release channel.
Something must have been changed with ipsec processing in rc64. No traffic is passing through the tunnels.
I moved back to 56, where everything works fine.

Contact support with attached supout file.

JimmyNyholm · Fri Aug 24, 2018 9:10 pm

And what about making radius login scheme selectable. chap for people who use static shit that can be challenged pap for us who only use one time passwords.

JimmyNyholm · Fri Aug 24, 2018 9:12 pm

And what about making radius login scheme selectable. chap for people who use static shit that can be challenged pap for us who only use one time passwords. And therefore Inherrently dosen't have anything to do a challenge on. (CHAP is unusable in this case)

kometchtech · Sat Aug 25, 2018 3:53 am

I updated to rc64, but it seems I can not communicate with ipv6. There was no problem with at least rc56.
We used netinstall to reintroduce rc64, but the situation has not changed.

nicob · Sun Aug 26, 2018 2:06 pm

I updated to rc64, but it seems I can not communicate with ipv6. There was no problem with at least rc56.

Same problem here, I updated from rc51 to rc64 and now the mikrotik does not seems to forward ipv6 packets anymore.

huntermic · Mon Aug 27, 2018 12:10 pm

I updated to rc64, but it seems I can not communicate with ipv6. There was no problem with at least rc56.
Same problem here, I updated from rc51 to rc64 and now the mikrotik does not seems to forward ipv6 packets anymore.

Strange, all works fine here after upgrading to rc64

Aytishnikcom · Mon Aug 27, 2018 9:47 pm

*) rb3011 - added IPsec hardware acceleration support;

VERY VERY welcome! Thanks Mktik!

bennyh · Tue Aug 28, 2018 7:57 am

*) rb3011 - added IPsec hardware acceleration support;
VERY VERY welcome! Thanks Mktik!

Has anybody tried it? Any positive changes? Are CPU loads lower? Is it stable?

emils · Tue Aug 28, 2018 12:05 pm

Has anybody tried it? Any positive changes? Are CPU loads lower? Is it stable?

IPsec throughput test results will be published on the RB3011 product page in the next few days. Currently one user has reported a kernel failure caused by the new hardware acceleration. We are looking into it and hopefully will be able to fix it in the next release candidate version. Initial tests show approximately 4 times higher throughput compared to software encryption.

ivicask · Tue Aug 28, 2018 10:42 pm

I cant update CCR1009-7G-1C from 6.43rc51 to 6.43rc64, i click check for updates, download&install, after reboot i still have old version.Tried also manually downloading the file and puting into root and rebooting, same thing.

EDIT:I figured it , i had other router package so it failed to select proper one to install.

emils · Thu Aug 30, 2018 8:34 am

Version 6.43rc66 has been released.

Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

MAJOR CHANGES IN v6.43:
----------------------
!) api - changed authentication process (https://wiki.mikrotik.com/wiki/Manual:API#Initial_login);
!) backup - do not encrypt backup file unless password is provided;
!) btest - requires at least v6.43 Bandwidth Test client when connecting to v6.43 or later version server except when authentication is not required;
!) cloud - added IPv6 support;
!) cloud - added support for licensed CHR instances (including trial);
!) cloud - reworked "/ip cloud ddns-enabled" implementation (suggested to disable service and re-enable after installation process);
!) mac-telnet - require at least v6.43 MAC Telnet client when connecting to v6.43 or later version server;
!) radius - use MS-CHAPv2 for "login" service authentication;
!) romon - require at least v6.43 RoMON agent when connecting to v6.43 or later RoMON client device;
!) security - fixed vulnerabilities CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159;
!) webfig - improved authentication process;
!) winbox - improved authentication process excluding man-in-the-middle possibility;
!) winbox - minimal required version is v3.15;
----------------------

Changes in this release:

*) bridge - added support for BPDU Guard;
*) bridge - added support for DHCP Snooping;
*) bridge - ignore tagged BPDUs when bridge VLAN filtering is used;
*) certificate - fixed RA "server-url" setting;
*) console - added "dont-require-permissions" parameter for scripts;
*) dhcpv6-client - improved dynamic IPv6 pool addition process;
*) ipsec - added "responder" parameter for "mode-config" to allow multiple initiator configurations;
*) ipsec - fixed AES-192-CTR fallback to software AEAD on ARM devices with wireless and RB3011UiAS-RM;
*) ipsec - fixed "static-dns" value storing;
*) ipsec - improved invalid policy handling when a valid policy is uninstalled;
*) ipsec - separate phase1 proposal configuration from peer menu;
*) l2tp - allow setting "max-mtu" and "max-mru" bigger than 1500;
*) lte - fixed LTE registration in 2G/3G mode;
*) ppp - added support for Telit LM940 modem;
*) rb3011 - added IPsec hardware acceleration support;
*) snmp - fixed interface speed reporting for predefined rates;
*) supout - added "files" section to supout file;
*) switch - added CPU Flow Control settings for devices with a Atheros8227, QCA8337, Atheros8327, Atheros7240 or Atheros8316 switch chip;
*) tr069-client - allow editing of "provisioning-code" attribute;
*) userman - fixed "shared-secret" parameter requiring "sensitive" policy;
*) webfig - fixed www service becoming unresponsive;
*) winbox - added "tag-stacking" option to "Bridge/Ports";
*) winbox - fixed "bad-blocks" value presence under "System/Resources";
*) winbox - fixed "IP/IPsec/Peers" section sorting;
*) winbox - renamed "VLAN Protocol" to "EtherType" under bridge interface "VLAN" tab;
*) winbox - show "System/RouterBOARD/Mode Button" on devices that has such feature;
*) wireless - accept only valid path for sniffer output file parameter;
*) wireless - require "sniff" policy for wireless sniffer;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as expected or after crash.

Note that release candidate versions are published strictly for testing purposes and should not be used on production routers.

freemannnn · Thu Aug 30, 2018 9:47 am

just installed latest rc to test dhcp snooping and was amazed how fast winbox connects remotely to my rb at office that i upgraded.

eworm · Thu Aug 30, 2018 10:07 am

I updated a system from 6.42.7 to 6.43rc66, now my ipsec connections are broken... Peer configuration had a comment about wrong parameter (can't give the exact wording). Switched mode-config to "none", now setting it to "request-only" fails:

[admin@Mikrotik] > / ip ipsec peer set mode-config=request-only [ find where !dynamic ]
failure: Wrong mode-config

emils · Thu Aug 30, 2018 10:09 am

Send a supout.rif file to support@mikrotik.com

eworm · Thu Aug 30, 2018 10:41 am

Send a supout.rif file to support@mikrotik.com

Done, Ticket#2018083022003478

kometchtech · Thu Aug 30, 2018 10:50 am

As usual, client PC under Routerboard can not connect with IPv6.
Also, if you try to disable dhcp-snooping or option 82 again and enable it again, it is confirmed that the command times out.

[Ticket#2018083022003334]

eworm · Thu Aug 30, 2018 10:54 am

I updated a system from 6.42.7 to 6.43rc66, now my ipsec connections are broken... Peer configuration had a comment about wrong parameter (can't give the exact wording). Switched mode-config to "none", now setting it to "request-only" fails:
Code: Select all
[admin@Mikrotik] > / ip ipsec peer set mode-config=request-only [ find where !dynamic ]
failure: Wrong mode-config

Worked around the issue:

/ ip ipsec mode-config add name=request responder=no system-dns=no
/ ip ipsec peer set mode-config=request [ find where !dynamic ]

So my system is up and running, but I suppose this is not how things are supposed to work.

kometchtech · Thu Aug 30, 2018 8:21 pm

As usual, client PC under Routerboard can not connect with IPv6.
Also, if you try to disable dhcp-snooping or option 82 again and enable it again, it is confirmed that the command times out.

[Ticket#2018083022003334]

Problems were solved by netinstalling Routerboard, which can not be connected normally from client PC under Routerboard with ipv6.
However, it is unknown whether this correspondence is satisfactory.

grusu · Sat Sep 01, 2018 10:53 pm

I can't change the name of the admin user:

[admin@MikroTik] > /user set 0 name=test
failure: user name can't be changed

nor any other user.

dziku2 · Sun Sep 02, 2018 11:47 am

There is a problem with 6.43RC66 on hAP AC2. My router reboot itself with info in log file: system,error,critical System rebooted because of kernel failure every half hour to 6 hours.

nescafe2002 · Sun Sep 02, 2018 1:39 pm

Can you fetch autosupout.rif from the device and send it to support?

dziku2 · Sun Sep 02, 2018 9:12 pm

Sorry, I can't. I downgraded soft to 6.42.7

eworm · Thu Sep 06, 2018 4:46 pm

Technically this is not about the release candidate version, posting here because of changelog:

!) cloud - reworked "/ip cloud ddns-enabled" implementation (suggested to disable service and re-enable after installation process);

Me device is running current version 6.42.7 and I want to update the latest release candidate. Looks like disabling ddns fails:

[admin@MikroTik] > / ip cloud set ddns-enabled=no
[admin@MikroTik] > / ip cloud print
    ddns-enabled: no
     update-time: yes
  public-address: 198.51.100.65
        dns-name: xxxxxxxx.sn.mynetname.net
          status: Error: request timed out

I can still query dns for my address. This should remove the record from dns, no?

mkx · Thu Sep 06, 2018 5:47 pm

After a while ... depends on how often is RB supposed to renew the DDNS record. If you turn cloud off, cloud (hopefully) doesn't know it and records have to expire.

eworm · Thu Sep 06, 2018 5:55 pm

After a while ... depends on how often is RB supposed to renew the DDNS record. If you turn cloud off, cloud (hopefully) doesn't know it and records have to expire.

No. From https://wiki.mikrotik.com/wiki/Manual:IP/Cloud:

After router sends it's IP address to the cloud server, it will stay on the server permanently. DNS name (/ip cloud dns-name) will resolve to last sent IP address. When user set /ip cloud set ddns-enabled=no router will send message to server to disable DNS name for this routerboard.

juliokato · Thu Sep 06, 2018 6:16 pm

After a while ... depends on how often is RB supposed to renew the DDNS record. If you turn cloud off, cloud (hopefully) doesn't know it and records have to expire.
No. From https://wiki.mikrotik.com/wiki/Manual:IP/Cloud:

After router sends it's IP address to the cloud server, it will stay on the server permanently. DNS name (/ip cloud dns-name) will resolve to last sent IP address. When user set /ip cloud set ddns-enabled=no router will send message to server to disable DNS name for this routerboard.

eworm · Thu Sep 06, 2018 9:59 pm

Technically this is not about the release candidate version, posting here because of changelog:

!) cloud - reworked "/ip cloud ddns-enabled" implementation (suggested to disable service and re-enable after installation process);
Me device is running current version 6.42.7 and I want to update the latest release candidate. Looks like disabling ddns fails:
Code: Select all
[admin@MikroTik] > / ip cloud set ddns-enabled=no
[admin@MikroTik] > / ip cloud print
    ddns-enabled: no
     update-time: yes
  public-address: 198.51.100.65
        dns-name: xxxxxxxx.sn.mynetname.net
          status: Error: request timed out
I can still query dns for my address. This should remove the record from dns, no?

Works now, at least after some retries. Possibly the servers were too loaded?

telcouk · Fri Sep 07, 2018 9:24 pm

As usual, client PC under Routerboard can not connect with IPv6.
Also, if you try to disable dhcp-snooping or option 82 again and enable it again, it is confirmed that the command times out.

[Ticket#2018083022003334]

If IPv6 is configured on a bridge, you may need to mark the bridge port as "Trusted".
This resolved the issue for us.

risk · Sat Sep 08, 2018 4:40 pm

I can't change the name of the admin user:

[admin@MikroTik] > /user set 0 name=test
failure: user name can't be changed

nor any other user.

same here.

rc56 was fine.

Who is online