*) bridge - improved performance when bridge VLAN filtering is used without hardware offloading;

So bad you cannot use switch chip together with bridges anymore

*) winbox - fixed "sfp-connector-type" value presence under "Interface/Ethernet";

L2TP/IPsec works properly for me on 6.42.7 and 6.43, must be something specific to your configuration or network. Have you sent a supout.rif file to support@mikrotik.com?

After updating CCR1009 to 6.43 there is a problem with port stability! Has anyone else encountered such a problem?

I updated my hAP ac^2 from 6.42.7 and upgraded firmware
after update my cpu usage rise from 2% to 30% and dhcp stopped working. export also hang out after /interface wireless. reboots doesn't helps. Downgraded to 6.42.7 now is working fine again.
I updated it again with same result.

So bad you cannot use switch chip together with bridges anymore

You can definitely use VLANs in "hybrid" mode ... do the VLAN filtering on switch chip (/interface ethernet switch) and "new bridge" (without using bridge vlan functionality) with individual ports as members.

Regarding low speed: I suspect your configuration is not optimal. I conducted some tests using VLANs on bridge (SW implementation) and I could achieve wire speed for port-to-port transfers (without any filtering) while CPU utilization was around 30% of a single core (8% overall CPU utilization).

After updating CCR1009 to 6.43 there is a problem with port stability! Has anyone else encountered such a problem?

"DHCPv6 PD Pool (PPP Profile) not work anymore."
i'v got this problem too.
When connection established, dinamic DHCPv6 server creating, but client not get address from pool.

You can definitely use VLANs in "hybrid" mode ... do the VLAN filtering on switch chip (/interface ethernet switch) and "new bridge" (without using bridge vlan functionality) with individual ports as members.

Not sure if I understand you correctly - using bridge with hw offloading, then bridging vlan interfaces of 'switch bridge' to new plain bridges? I am using this config on my rb2011, but I thought it is blacklisted by Mikrotik?!?

Regarding low speed: I suspect your configuration is not optimal. I conducted some tests using VLANs on bridge (SW implementation) and I could achieve wire speed for port-to-port transfers (without any filtering) while CPU utilization was around 30% of a single core (8% overall CPU utilization).

Not sure if we are talking about the same here - I am doing real world tests with tcp and smb reaching 114MB/s when switching or bridging, but I need the filtering. So at the moment you turn on IP filtering with some rules present, performance breaks down to ~50% while cpu on hap ac2 is maxed out. Using VLAN aware bridges is even worse.

WinPC <-- access port with PVID=42 --> RBD52G <-- trunk port --> RB951G <-- access port with PVID=42 --> LinPC

bridge - add dynamic CAP interface to tagged ports if "vlan-mode=use-tag" is enabled;

Great work MT team!

I was wondering if you could elaborate on the dynamic vlan function? I can see that the Caps interfaces are included in the bridge and that the active interfaces are tagged in the dynamic vlan entry for PVID 1. I would expect that the dynamic caps interfaces are dynamically added to all the bridge vlan entries. I have also tried to add the Capsman interfaces in their own interface list. However the newly created interface list woith all the dynamic caps interfaces can not be selected in the bridge vlan entry.

Below the config for my test setup on 6.43

Code: Select all

/interface bridge
add fast-forward=no name=Lo0 protocol-mode=none
add fast-forward=no name=bridge protocol-mode=none vlan-filtering=yes
/interface bridge port
add bridge=bridge interface=ether1
add bridge=bridge interface=ether2 pvid=666
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
/interface bridge settings
set allow-fast-path=no
/interface bridge vlan
add bridge=bridge tagged=bridge,ether1 untagged=ether2 vlan-ids=666
add bridge=bridge tagged=bridge,ether1 vlan-ids=200
add bridge=bridge tagged=bridge,ether4,ether5 vlan-ids=10,20,30,667

/caps-man datapath
add bridge=bridge client-to-client-forwarding=yes local-forwarding=no name=vl10-data vlan-id=10 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes local-forwarding=no name=vl20-data vlan-id=20 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes local-forwarding=no name=vl30-data vlan-id=30 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes local-forwarding=no name=radius-data vlan-mode=use-tag
/caps-man security
add authentication-types=wpa2-eap disable-pmkid=yes eap-methods=passthrough encryption=aes-ccm group-encryption=aes-ccm group-key-update=1h name=Radius-Sec
/caps-man configuration
add country=netherlands datapath=radius-data distance=indoors hide-ssid=no mode=ap name=DynVlan security=Radius-Sec ssid=AllVlan
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes package-path=/upgrade upgrade-policy=require-same-version
/caps-man manager interface
set [ find default=yes ] forbid=yes
add disabled=no interface=vl667
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=ac master-configuration=DynVlan name-format=prefix-identity name-prefix=5Ghz-
add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=DynVlan name-format=prefix-identity name-prefix=2.4Ghz-

I updated my hAP ac^2 from 6.42.7 and upgraded firmware
after update my cpu usage rise from 2% to 30% and dhcp stopped working. export also hang out after /interface wireless. reboots doesn't helps. Downgraded to 6.42.7 now is working fine again.
I updated it again with same result.

I seen the issue with dhcp stop working. check in dhcp server if you have dhcp server configured with unknown interface, if you have remove that and upgrade to 6.43. When you have dhcp-server configured with unkwnon interface and upgrade to 6.43 will cause dhcp to stop working

Changing the identity on hAp ac² crashes the router with an error: "kernel failure in previous boot".

/system identity set name="some other name"

Changing the identity on hAp ac² crashes the router with an error: "kernel failure in previous boot".

You mean changing identity name as in

Code: Select all

/system identity set name="some other name"

The above command doesn't crash my hAP ac² ... running ROS 6..43.

Changing the identity on hAp ac² crashes the router with an error: "kernel failure in previous boot".

I can not reproduce this issue on my hAP ac^2 with ROS 6.43 (both CLI and WinBox).

Hi,

on 6.43 current.

dhcp server bindings not working

ip pool used prefix shows pppoe's ipv6

but on dhcp server bindings don't received ipv6 pppoe

somebody with this problem?

Hello , i am having difficuties about ccr1036-12g-4s when get udp attack with 0 length .

Using RouterOS 6.4 and here is the tcp dump of attack :

21:10:26.299021 IP 132.155.220.60.39812 > x.x.x.x.44710: UDP, length 0
21:10:26.299034 IP 180.19.33.203.lxi-evntsvc > x.x.x.x.2342: UDP, length 0
21:10:26.299035 IP 56.24.15.219.6200 > x.x.x.x.1234: UDP, length 0
21:10:26.299036 IP 11.90.77.183.23051 > x.x.x.x.44710: UDP, length 0
21:10:26.299057 IP 28.110.53.197.28188 > x.x.x.x.44710: UDP, length 0
21:10:26.299062 IP 215.92.148.235.23767 > x.x.x.x.3453: UDP, length 0
21:10:26.299064 IP 0.19.41.141.4864 > x.x.x.x.80: UDP, length 0
21:10:26.299065 IP 137.132.25.40.33929 > x.x.x.x.44710: UDP, length 0
21:10:26.299065 IP 49.38.104.169.9777 > x.x.x.x.110: UDP, length 0
21:10:26.299067 IP 203.183.15.186.47051 > x.x.x.x.44710: UDP, length 0
21:10:26.299185 IP 51.163.222.160.41779 > x.x.x.x.44710: UDP, length 0
21:10:26.299191 IP 0.33.48.114.8448 > x.x.x.x.4432: UDP, length 0
21:10:26.299193 IP 143.96.62.38.24719 > x.x.x.x.447: UDP, length 0

I have added many rule like :

0 chain=forward action=drop connection-state=invalid protocol=udp log=yes
log-prefix="log-paket"

1 chain=forward action=drop protocol=udp connection-bytes=0-10 log=yes
log-prefix="udp-attack"


It makes routerboard freeze and unaccesible, please help me to solve that.

No logs.

How does on obtain the default settings for menu items?

The '/system default-configuration print' command details the default initialisation script and does not show default values.

How does on obtain the default settings for menu items?

The '/system default-configuration print' command details the default initialisation script and does not show default values.

1. Backup or export current config.
2. Disconnect router from internet and reset config without applying default configuration.
3. Connect to router via MAC.
3. /export verbose file=all_defaults, save this file for future reference
4. Restore backup or import config from step 1.

I cannot upgrade to 6.43. I think something messed up with packets installed

1. uninstall the extra wireless package, the lower one on your screenshot.
2. install separate packages - get ZIP file from download section of mikrotik pages. Upload all needed packages except wireless. After reboot CCR will be running ROS 6.37. I guess you don't need wireless package at all, but if you feel like installing it, install it after ROS is already running upgraded.
3. netinstall CCR

We have a huge memory leak on the new 6.43 code running on our CRS326's. We use vlan. Within 12hrs the device reboots due to low memory.

CCR1009, just found out all the "last link up time" is the current time in winbox (except those have link down will be in future), anyone have the same issue?