v6.43.1 [stable] and v6.43.2 [stable] are released!

OndrejHolas · Sun Sep 23, 2018 11:57 am

It is probably not the 43 to 43.2 upgrade that did it, but instead, the routerboot firmware upgrade for 43. If you didn't reboot a second time after 6.43, the routerboot upgrade would not take place until the following reboot, which is probably by happenstance when you rebooted to upgrade to 6.43.2.

My RB912UAG-2HPnD (cpu: MIPS 74Kc V4.12, fw type: ar9340) was bricked by ROS update from 6.43.1 to 6.43.2:

ROS 6.42.7, fw 6.42.7: uploaded 6.43 packages, /sys reb - OK
ROS 6.43, fw 6.42.7: /sys rou up, /sys reb - OK
...a few days later...
ROS 6.43, fw 6.43: uploaded 6.43.1 packages, /sys reb - OK
ROS 6.43.1, fw 6.43: /sys rou up, /sys reb - OK
...a few days later...
ROS 6.43.1, fw 6.43.1: uploaded 6.43.2 packages, /sys reb - BRICKED

Recovered the box by Netinstall (installed 6.43.2 packages), then completed the firmware upgrade, downgraded both ROS and fw back to 6.43.1 and repeated the failed step:

ROS 6.43.2, fw 6.43.1: /sys rou up, /sys reb - OK
ROS 6.43.2, fw 6.43.2: uploaded 6.43.1 packages, /sys pack down - OK
ROS 6.43.1, fw 6.43.2: /sys rou up, /sys reb - OK
ROS 6.43.1, fw 6.43.1: uploaded 6.43.2 packages, /sys reb - BRICKED

Netinstall again, 6.43.2 packages. Another experiment:

ROS 6.43.2, fw 6.43.1: /sys rou up, /sys reb - OK
ROS 6.43.2, fw 6.43.2: uploaded 6.43.1 packages, /sys pack down - OK
(contrary to the first experiment, here I skipped firmware downgrade 6.43.2->6.43.1)
ROS 6.43.1, fw 6.43.2: uploaded 6.43.2 packages, /sys reb - OK

Thus in my case the problem occurs when upgrading ROS packages and the firmware is exacly 6.43.1.

Ondrej

CZFan · Mon Sep 24, 2018 4:21 pm

Note sure if someone has mentioned this before, if so, apologies for reposting

Current TX Power = 0dBm

board-name: hAP ac^2
model: RBD52G-5HacD2HnD
firmware-type: ipq4000L
factory-firmware: 3.43
current-firmware: 6.43.1
upgrade-firmware: 6.43.1

Current TX Power.JPG

Mon Sep 24, 2018 7:24 pm

Current TX Power = 0dBm

Current TX power readings are not supported for 802.11ac-capable wireless cards. That's a known (and documented!) limitation that has always been there.

CZFan · Mon Sep 24, 2018 7:40 pm

Current TX Power = 0dBm
Current TX power readings are not supported for 802.11ac-capable wireless cards. That's a known (and documented!) limitation that has always been there.

My post is on the 802.11b/g/n WLAN card

Can you provide link to the documentation, want to go read up a bit more

Mon Sep 24, 2018 7:57 pm

Can you provide link to the documentation

Look at the very bottom of this wiki page (in the "Winbox" section).

CZFan · Mon Sep 24, 2018 8:02 pm

Can you provide link to the documentation
Look at the very bottom of this wiki page (in the "Winbox" section).

Got it, thx.

I think it should rather be placed under headings for TX power, not right, right at the bottom of the document under some willy nilly comment about Winbox.

bennyh · Tue Sep 25, 2018 8:54 am

I have MTU problem with IPIPv6 in these and older ROS releases too. There is IPsec encrypted IPIPv6 tunnel between 3011 and 750gr3, if I change the proposal auth method from SHA1 to SHA256, the MTU is changing, but the clamp MSS option doesnt work and all TCP connection is broken (HTTP, Winbox) till I make postrouting TCP MSS changing rules, where I lower the MSS, then It semms the TCP connections ar workable again (but IPV6 stay broken, because a cant made IPv6 change MSS rules, no options to check the MSS value in IPv6 firewall, there are greyed sections at rules).

Tue Sep 25, 2018 10:10 am

Rather then doing MSS clamping you'd better fix your firewall to allow PMTUD to function properly across your tunnel...

kos · Tue Sep 25, 2018 10:26 am

Since ROS 6.43 there are entries setting ethernet speed to 100Mbps for every cooper not auto negotiated interface on every MT device. Is it normal?
.....
set [ find default-name=ether5 ] speed=100Mbps
set [ find default-name=ether6 ] speed=100Mbps
set [ find default-name=ether7 ] speed=100Mbps
.....

bennyh · Tue Sep 25, 2018 10:40 am

Rather then doing MSS clamping you'd better fix your firewall to allow PMTUD to function properly across your tunnel...

And how? There is nothing blocked between two router and two sites, ICMP goes trough freely from one site to other. What sould I do? It looks like, the PMTU discovers wrong MTU value.

saaremaa · Tue Sep 25, 2018 2:06 pm

Is there any information on correcting the error "Delegated-IPv6-Prefix" attribute for PPPoE?
viewtopic.php?f=1&t=89443&start=100#p687190
viewtopic.php?f=1&t=89443&start=100#p687516
viewtopic.php?f=1&t=89443&start=100#p687867

thg3x · Tue Sep 25, 2018 4:40 pm

Is there any information on correcting the error "Delegated-IPv6-Prefix" attribute for PPPoE?
viewtopic.php?f=1&t=89443&start=100#p687190
viewtopic.php?f=1&t=89443&start=100#p687516
viewtopic.php?f=1&t=89443&start=100#p687867

Waiting too !

mducharme · Tue Sep 25, 2018 8:22 pm

Is there any information on correcting the error "Delegated-IPv6-Prefix" attribute for PPPoE?

The problem is bigger than just the Delegated-IPv6-Prefix - from my testing, DHCPv6 prefix delegation is basically entirely broken, at least with PPP connections, whether or not RADIUS is used. Only if there is a static DHCPv6 binding will DHCPv6 prefix delegation work with PPP connections in 6.43.xx. We can't really tell if there is a problem with the Delegated-IPv6-Prefix RADIUS attribute until this issue is fixed.

mkx · Tue Sep 25, 2018 9:11 pm

Since ROS 6.43 there are entries setting ethernet speed to 100Mbps for every cooper not auto negotiated interface on every MT device. Is it normal?
.....
set [ find default-name=ether5 ] speed=100Mbps
set [ find default-name=ether6 ] speed=100Mbps
set [ find default-name=ether7 ] speed=100Mbps
.....

This was always set like this (you could verify it by checking output of /interface ethernet print). It is now shown in export because default setting starting with 6.43 is 1Gbps ... upgrade does not change settings and export shows differences from default. The value does not apply when autonegotiation is enabled... which is default as well.

BTW you can set speed to 1Gbps even if underlying interface hardware is 100Mbps only (e.g. on hAP ac lite).

bennyh · Wed Sep 26, 2018 11:46 am

Rather then doing MSS clamping you'd better fix your firewall to allow PMTUD to function properly across your tunnel...

Today I checked all my firewall rules (IPv6 and IPv4 too), I disabled some rules, that may have negative aftermaths, but these rules only touched that interfaces between them the tunnel is created on (end interfaces of 2 WWAN connection bridged trough unsafe switch in a tower). Inside the tunnel and on tunnel interfaces there is no blocking rules, all input output and forward allowed.
The problem still exists.
If I change the keying method from SHA1 to SHA256, the IPIPv6 reconnect and after thet the new TCP connections are broken, but ping works.
What next now?

Kraken2k · Wed Sep 26, 2018 12:36 pm

I found a strange behavior about bridges - might be only WinBox issue but still...

I have two bridges in my config - when I create bridge, MAC address is automatically assigned (I never use administrative MACs, or create bridges by Copy) and these are unique. But since the moment, when I assign a port to the bridge, Winbox shows the same MAC for both bridges.

in configuration, there is no sign of that addresses (not even in the whole device config export):

/interface bridge
add arp=proxy-arp comment=LAN fast-forward=no name=bridge-lan
add fast-forward=no name=bridge1

Device is RB1100AHx2 with RoS and RB firmware upgraded to 6.43.2

Wed Sep 26, 2018 12:48 pm

If I change the keying method from SHA1 to SHA256, the IPIPv6 reconnect and after thet the new TCP connections are broken, but ping works.
What next now?

Check if the MTU settings on your tunnel interfaces are correct. In case you rely on RouterOS to calculate it automatically try setting it to the correct value manually (I'm not even sure RouterOS can calculate it correctly in all possible tunneling/encapsulation scenarios).

bennyh · Wed Sep 26, 2018 2:29 pm

If I change the keying method from SHA1 to SHA256, the IPIPv6 reconnect and after thet the new TCP connections are broken, but ping works.
What next now?
Check if the MTU settings on your tunnel interfaces are correct. In case you rely on RouterOS to calculate it automatically try setting it to the correct value manually (I'm not even sure RouterOS can calculate it correctly in all possible tunneling/encapsulation scenarios).

Which values are correct for IPIPv6 MTU trough 802.11 with SHA256+AES256 IPSec? Now there is nothing set for MTU, the Actual MTU with SHA1 is 1414, with SHA256 is 1410 .

pe1chl · Wed Sep 26, 2018 2:52 pm

You can always set it lower than strictly required, e.g. 1400 or 1300

mkx · Wed Sep 26, 2018 3:12 pm

I found a strange behavior about bridges - might be only WinBox issue but still...

Can you post output of command /interface bridge export? Just to check if there's something weird.

Kraken2k · Wed Sep 26, 2018 4:04 pm

I found a strange behavior about bridges - might be only WinBox issue but still...
Can you post output of command /interface bridge export? Just to check if there's something weird.

Here is the output - bridge1 was only created to demonstrate this, and there is only one interface included atm. Yes, I'm aware that vlan filtering is inactive in this configuration - the thing is that after upgrade and removing the second bridge the vlan filtering rules (that so far worked as expected) suddenly blocked all traffic, even if removing second bridge should not definitely affect the operation of the first one:

/interface bridge
add arp=proxy-arp comment=LAN fast-forward=no name=bridge-lan
add fast-forward=no name=bridge1
/interface bridge port
add bridge=bridge-lan interface=ether2
add bridge=bridge-lan interface=ether4
add bridge=bridge-lan interface=ether5
add bridge=bridge-lan interface=ether1
add bridge=bridge-lan interface=ether6
add bridge=bridge1 interface=vlan100-remote1
add bridge=bridge-lan frame-types=admit-only-vlan-tagged interface=ether3-tst pvid=10
add bridge=bridge-lan interface=ether7 pvid=20
add bridge=bridge-lan interface=ether8 pvid=10
add bridge=bridge-lan interface=ether9 pvid=10
/interface bridge settings
set allow-fast-path=no
/interface bridge vlan
add bridge=bridge-lan comment=A tagged=ether1,ether2,ether6,ether4,ether5 vlan-ids=30
add bridge=bridge-lan comment=M tagged=ether4,ether5,ether1,ether2,ether6,ether3-tst vlan-ids=10
add bridge=bridge-lan comment=S tagged=ether6 untagged=ether7 vlan-ids=20
add bridge=bridge-lan comment=G tagged=ether4,ether5,ether2 vlan-ids=60
add bridge=bridge-lan comment=TST tagged=ether6 vlan-ids=70
add bridge=bridge-lan comment=R1 tagged=ether6-server vlan-ids=100

mkx · Wed Sep 26, 2018 4:33 pm

I was hoping to see actual configuration ... better yet, post output of /inteface bridge print, /interface bridge port print and /interface ethernet print ... it would be interesting to see where MAC of both bridges comes from.

Kraken2k · Wed Sep 26, 2018 5:58 pm

I was hoping to see actual configuration ... better yet, post output of /inteface bridge print, /interface bridge port print and /interface ethernet print ... it would be interesting to see where MAC of both bridges comes from.

Here - MACs seems to be originated from ether1 default MAC address:

/interface bridge> print
Flags: X - disabled, R - running 
 0 R ;;; LAN
     name="bridge-lan" mtu=auto actual-mtu=1500 l2mtu=1598 arp=proxy-arp arp-timeout=auto mac-address=D4:CA:6D:41:F5:CA protocol-mode=rstp fast-forward=no 
     igmp-snooping=no auto-mac=yes ageing-time=5m priority=0x8000 max-message-age=20s forward-delay=15s transmit-hold-count=6 vlan-filtering=no dhcp-snooping=no 

 1 R name="bridge1" mtu=auto actual-mtu=1500 l2mtu=1594 arp=enabled arp-timeout=auto mac-address=D4:CA:6D:41:F5:CA protocol-mode=rstp fast-forward=no igmp-snooping=no 
     auto-mac=yes ageing-time=5m priority=0x8000 max-message-age=20s forward-delay=15s transmit-hold-count=6 vlan-filtering=no dhcp-snooping=no 

/interface bridge port print
Flags: X - disabled, I - inactive, D - dynamic, H - hw-offload 
 #     INTERFACE                                              BRIDGE                                              HW  PVID PRIORITY  PATH-COST INTERNAL-PATH-COST    HORIZON
 0   H ether2                                                 bridge-lan                                          yes    1     0x80         10                 10       none
 1   H ether4                                                 bridge-lan                                          yes    1     0x80         10                 10       none
 2   H ether5                                                 bridge-lan                                          yes    1     0x80         10                 10       none
 3   H ether1                                                 bridge-lan                                          yes    1     0x80         10                 10       none
 4   H ether6                                                 bridge-lan                                          yes    1     0x80         10                 10       none
 5     vlan100-remote1                                        bridge1                                                    1     0x80         10                 10       none
 6   H ether3                                                 bridge-lan                                          yes   30     0x80         10                 10       none
 7   H ether7                                                 bridge-lan                                          yes   20     0x80         10                 10       none
 8   H ether8                                                 bridge-lan                                          yes   10     0x80         10                 10       none
 9   H ether9                                                 bridge-lan                                          yes   10     0x80         10                 10       none

/interface ethernet print
Flags: X - disabled, R - running, S - slave 
 #    NAME                                                             MTU MAC-ADDRESS       ARP             SWITCH                                                         
 0 RS ;;;  
      ether1                                                          1500 D4:CA:6D:41:F5:CA enabled         switch2                                                        
 1 RS ;;; 
      ether2                                                          1500 D4:CA:6D:41:F5:CB enabled         switch2                                                        
 2 RS ;;; 
      ether3                                                          1500 D4:CA:6D:41:F5:CC enabled         switch2                                                        
 3 RS ;;; 
      ether4                                                          1500 D4:CA:6D:41:F5:CD enabled         switch2                                                        
 4 RS ;;; 
      ether5                                                          1500 D4:CA:6D:41:F5:CE enabled         switch2                                                        
 5 RS ;;; 
      ether6                                                          1500 D4:CA:6D:41:F5:CF proxy-arp       switch1                                                        
 6 RS ;;; 
      ether7                                                          1500 D4:CA:6D:41:F5:D0 enabled         switch1                                                        
 7 RS ;;;
      ether8                                                          1500 D4:CA:6D:41:F5:D1 enabled         switch1                                                        
 8 RS ;;;
      ether9                                                          1500 D4:CA:6D:41:F5:D2 enabled         switch1                                                        
 9 X  ether10                                                         1500 D4:CA:6D:41:F5:D3 enabled         switch1                                                        
10 R  ;;; WAN
      ether11-wan                                                     1500 D4:CA:6D:41:F5:D4 enabled        
11 X  ether12                                                         1500 D4:CA:6D:41:F5:D5 enabled        
12 X  ether13                                                         1500 D4:CA:6D:41:F5:D6 enabled

Kraken2k · Wed Sep 26, 2018 6:30 pm

I was hoping to see actual configuration ... better yet, post output of /inteface bridge print, /interface bridge port print and /interface ethernet print ... it would be interesting to see where MAC of both bridges comes from.

It seems that bridge gets it's MAC automatically from the first port connected to it - dynamically changing this whenever the config change is made.... okay, tl;dr; probably my mistake with configuration.

I think I see the problem: routing vs. bridging configuration:

/interface vlan> print
Flags: X - disabled, R - running 
 #   NAME                                     MTU ARP             VLAN-ID INTERFACE                                 
(output omitted)
 7 R ;;; R1
     vlan100-remote1                         1500 enabled             100 bridge-lan

router interface vlan100-remote1 has been defined on bridge-lan in router configuration, but later added to bridge1 which caused strange behavior (including strange traffic flow over the LAN).

So "MAC flow" was ether1 -> bridge-lan -> vlan100-remote1 -> bridge1

*sigh* I need some rest.

Wed Sep 26, 2018 7:46 pm

It seems that bridge gets it's MAC automatically from the first port connected to it - dynamically changing this whenever the config change is made....

This is actually a documented behavior...

2jarek · Wed Sep 26, 2018 7:49 pm

Again in6.43.2 Nv2 frame priority qos works very poorly for dynamic downlink. For fixes downlink or sync master works fine.

Kraken2k · Wed Sep 26, 2018 8:59 pm

It seems that bridge gets it's MAC automatically from the first port connected to it - dynamically changing this whenever the config change is made....
This is actually a documented behavior...

Yes, it is... I just had no idea, how two bridges managed to get the same MAC dynamically. Now I know - my mistake, case closed.

arneh00 · Wed Sep 26, 2018 9:28 pm

Hello every one I just update my microtik os and i can not reach from outside to my internal network, actually when I trace my internal network address from outsite it comes till my internet ip address which is set on microtik but doesnt reach my local network, can any one help please.

ziegenberg · Wed Sep 26, 2018 9:47 pm

Hello every one I just update my microtik os and i can not reach from outside to my internal network, actually when I trace my internal network address from outsite it comes till my internet ip address which is set on microtik but doesnt reach my local network, can any one help please.

Do you have an public IPv4 address for your internal network?

arneh00 · Thu Sep 27, 2018 7:21 am

My internal network ip rage is 192.168.1.x , I dont know what you mean by public IPV4 address

sindy · Thu Sep 27, 2018 8:52 am

Did it work before upgrade to 6.43.2? If not, create a new topic and export your configuration there; if it did, create a new topic with a configuration export anyway and place a link to it here. Accessing the (private) address range which you use on LAN via the Internet is normally only possible by means of VPN, so something important must be missing in your description.

bennyh · Thu Sep 27, 2018 8:59 am

You can always set it lower than strictly required, e.g. 1400 or 1300

Ok, it seems work with 1400 (I tried with Actual MTU 1410 too but TCP failure trough tunnel), if I set this value at booth ends, but with SHA1 such thing didnt need, it looked like actual MTU worked right without MTU settings.

pe1chl · Thu Sep 27, 2018 9:07 am

Well, when you think the default values are not good enough for you it always could mean you need to study the matter to
know the result of changing encryption lengths or hash methods. I happily run everything at the default SHA1/AES128 and
I am not too worried that the theoretical weaknesses will actually be exploited by someone...

bennyh · Thu Sep 27, 2018 9:59 am

Well, when you think the default values are not good enough for you it always could mean you need to study the matter to
know the result of changing encryption lengths or hash methods. I happily run everything at the default SHA1/AES128 and
I am not too worried that the theoretical weaknesses will actually be exploited by someone...

For SHA256: A clever latin guy said once in the far past: Si vis pacem, para bellum, and Google said, SHA1 is breakable (but expensive), so If the HW engine can accelerate SHA256, why we dont use?
The ROS is changing the actual MTU if I change the method, but it semms there is some sh*t in pancake, as we say it. Ok I am not a professionel in tunnelling and crypting techniques, but If a Mikrotik document doesnt write other (please link it for me if exists), It should work, but it doesnt. Thats it, should be fix.

Thu Sep 27, 2018 12:14 pm

The ROS is changing the actual MTU if I change the method, ... , but If a Mikrotik document doesnt write other (please link it for me if exists), It should work, but it doesnt.

The IPIP wiki page says the default is 1500. Nothing is said about MTU being automatically/dynamically adjusted, so I assume no automatic adjustment ever happens. Though I'd still expect it to work happily (though not fully efficiently) even with the default MTU of 1500, unless you set dont-fragment interface property to yes.

pe1chl · Thu Sep 27, 2018 12:44 pm

The tunnel interfaces have a manually adjustable MTU that may default to 1500, but once they are installed and up they have an "actual MTU" which is automatically set to 1500 minus the tunnel overhead for that type of tunnel (sometimes a bit lower: when the header actually has a variable size it is set according to the maximal size of that header, even when it really cannot increase to that size with the functionality that RouterOS offers).
So when you create an IPIP tunnel and don't set the MTU, it will set an actual MTU of 1480 (correct).

However, this calculation apparently fails when IPsec is configured with nondefault hash/encrypt selection. So the "overhead of IPsec" was likely only calculated for the default case.
Note that it fails as well when the outer packets are routed through an interface that does not have MTU 1500 (e.g. PPPoE).
There is apparently no dynamic adjustment of the "actual MTU" based on MTU of the outgoing route, or returned ICMP "size exceeded" messages.
So in such cases you need to manually set a lower MTU on the tunnel interface.

andronovDmitriy · Fri Sep 28, 2018 3:57 am

Problem firmware 6.43 - 6.43.2.
Multiple gre with ipsec unreachable with new dynamic peer.
Because router os no distinction is made between peers with different
local addresses to one remout address.

I was able to start gre from the second local address only manually create peer and set passive mode.

sindy · Fri Sep 28, 2018 11:46 am

Problem firmware 6.43 - 6.43.2.
Multiple gre with ipsec unreachable with new dynamic peer.
Because router os no distinction is made between peers with different local addresses to one remout address.

Dmitriy, are you 100% sure that it did work different before 6.43? If yes, send your observations to support@mikrotik.com together with a supout.rif file; if not, create a separate topic in General section of the forum because in such case this one would not be the right topic to discuss it.

kelner · Fri Sep 28, 2018 2:18 pm

On v.6.43.[12] RADIUS authentication at login does not work on my routers. It worked well on v.6.42 though. Does anybody has such problem too?

Fri Sep 28, 2018 2:19 pm

search.php?keywords=radius+6.43

kelner · Fri Sep 28, 2018 2:50 pm

search.php?keywords=radius+6.43

Thank you!
Adding "mschap" into freeradius' config file radiusd.conf looks like the solution.

authorize {
files
mschap
}

authenticate {
mschap
}

mducharme · Fri Sep 28, 2018 11:41 pm

It has now been nearly three weeks since 6.43 was released and DHCPv6 PD server over PPP is still completely broken, preventing all PPP clients from getting IPv6. Is a fix coming soon? It is a rather critical issue.

jasonx · Sat Sep 29, 2018 3:54 pm

the problem with the ipv6 dhcp server continues, in bindings does not work in version 6.43.2

sophitus · Sun Sep 30, 2018 2:01 pm

My hap ac has still memory leak and crashes even in 6.43.2 not really stable

kernel failure in previous boot
out of memory condition was detected

mducharme · Mon Oct 01, 2018 2:46 am

My hap ac has still memory leak and crashes even in 6.43.2 not really stable

kernel failure in previous boot
out of memory condition was detected

I also have instabilities with my hap AC, crashing every week, although I wasn't graphing memory usage before so I can't be sure there is a leak on mine. I've just set up the graphing to try to see.

sophitus · Mon Oct 01, 2018 3:00 pm

My hap ac has still memory leak and crashes even in 6.43.2 not really stable

kernel failure in previous boot
out of memory condition was detected
I also have instabilities with my hap AC, crashing every week, although I wasn't graphing memory usage before so I can't be sure there is a leak on mine. I've just set up the graphing to try to see.

Reverted to 6.42.7 and no related crashes anymore, with 6.43.2 I had daily out of memory crashes....

Vovanys · Mon Oct 01, 2018 11:28 pm

hAP ac
After update to 6.43.2 (stable)
system,error,critical router was rebooted without proper shutdown by watchdog timer
This happened several times already.
Before this year no reboots

dziku2 · Wed Oct 03, 2018 9:44 pm

On hAP ac2 is similar problem. Unexpected reboots every 2h to 48h. I sent description of problem to Mikrotik support.

mkx · Wed Oct 03, 2018 9:52 pm

My experience on hAP ac2: very unstable, plenty of watchdog reboots (most of them due to ping timeouts, pinged address is linux server on LAN).
For me instability is regression from 6.42.9.

mducharme · Thu Oct 04, 2018 5:14 am

My hap ac has still memory leak and crashes even in 6.43.2 not really stable

kernel failure in previous boot
out of memory condition was detected
I also have instabilities with my hap AC, crashing every week, although I wasn't graphing memory usage before so I can't be sure there is a leak on mine. I've just set up the graphing to try to see.

Update: I do not seem to have a memory leak, graphing the memory usage over the past few days has shown no changes, but my device is still crashing about once a week since the new versions.

grawerpl · Thu Oct 04, 2018 1:20 pm

After upgrade can't make to work EoIP over IPSec (IPIP over IPSec works but not without issue) and not working IPSec witch older firmware. What is even more disturbing it shows that established tunnel but no traffic pass and that same with EoIP over IPsec. Configuration was restored from backup, and i try everything but still nothing helps.
Ooo and another thing is that every change in ipsec is done, it not reset tunnel i must reset it manual :/

Davis · Fri Oct 05, 2018 1:30 am

On hAP ac2 is similar problem. Unexpected reboots every 2h to 48h. I sent description of problem to Mikrotik support.

I have the same issue - one of my hAP ac2 is rebooting from time to time (looks like it usually reboots within 24 hours and then works properly till I reboot it manually - however this most likely is pure coincidence). My hAP ac2 also stuck/crashed without rebooting once (it resumed working after unplugging+replugging power).
For me the issue started after upgrade from 6.43.1 to 6.43.2. Router was working on 6.43.1 for around 48 hours without a single reboot. Then router was upgraded to 6.43.2 and after around 6 hours it rebooted for the first time.
Resource graphing is enabled on the router and memory usage was always below 17% (so memory leak should NOT be the cause of reboot, at least a memory leak that grows longer than 5 minutes).

Has MikroTik support replied to you?

sophitus · Fri Oct 05, 2018 9:57 am

As it looks like I have again mem leak reboots on hap ac with RouterOS 6.42.9. Just before reboot IPSEC failure show up in logs. 6.42.7 seemed to be ok, but 6.42.9 is again bad even on bugfix!

mkx · Fri Oct 05, 2018 7:09 pm

My experience on hAP ac2: very unstable, plenty of watchdog reboots (most of them due to ping timeouts, pinged address is linux server on LAN).
For me instability is regression from 6.42.9.

I take my words back. Instability is not a regression from 6.42.9, my hAP ac2 was not completely stable while running 6.42.7 (but much more stable than any of 6.43.x). Two days ago I downgraded to 6.42.9 and so far it's stable.

Some statistics:

while running 6.43 for 7d21h it rebooted 13 times due to "watchdog cannot ping address W.X.Y.Z, reboting". So it had average uptime of 14.5 hours.
while running 6.43.1 for 15d4h it rebooted 48 times, so it had average uptime of 7.6 hours
while running 6.42.9 for 1d21h it never rebooted (current uptime 1d21h16m57s)

Every time I installed another version of ROS I also upgraded (or downgraded) firmware. Next I'll try to upgrade only ROS to determine if source of instability is ROS or firmware.

N.b.: my hAP ac2 doesn't seem to suffer of memory leaks, memory usage graph shows more or less steady usage of less that 1/4 of available RAM.

dziku2 · Fri Oct 05, 2018 8:43 pm

On hAP ac2 is similar problem. Unexpected reboots every 2h to 48h. I sent description of problem to Mikrotik support.
I have the same issue - one of my hAP ac2 is rebooting from time to time (looks like it usually reboots within 24 hours and then works properly till I reboot it manually - however this most likely is pure coincidence). My hAP ac2 also stuck/crashed without rebooting once (it resumed working after unplugging+replugging power).
For me the issue started after upgrade from 6.43.1 to 6.43.2. Router was working on 6.43.1 for around 48 hours without a single reboot. Then router was upgraded to 6.43.2 and after around 6 hours it rebooted for the first time.

Has MikroTik support replied to you?

It's the reply from Mikrotik support:

Right now I do not see where is the issue.
Try to turn of watchdog timer:
"/system watchdog set watchdog-timer=no"
And after device freeze, reboot or powercycle it and then manually create new supout.rif file. Send it to us.

Cha0s · Fri Oct 05, 2018 10:53 pm

After upgrading to 6.43.2 from 6.42.7 you can no longer have multiple IPsec peers to the same destination IP but with different source addresses.

Screenshot_17.png

This worked fine on 6.42.7.

What's the reasoning behind this restriction?
I need multiple peers to the same destination but using different gateways (source addresses).

Please revert this change.

sophitus · Fri Oct 05, 2018 11:02 pm

Appearently there is a memory leak since changelog 6.44beta17 (2018-Oct-04 09:42) states:

"*) bridge - fixed possible memory leak when VLAN filtering is used;"

I had VLAN filtering turned on... on my hap ac

The ones who monitored stable memory usage, did you have VLAN filtering on?
6.42.7 is still the best release for me so far and not 6.42.9.

mducharme · Fri Oct 05, 2018 11:32 pm

Appearently there is a memory leak since changelog 6.44beta17 (2018-Oct-04 09:42) states:

"*) bridge - fixed possible memory leak when VLAN filtering is used;"

I had VLAN filtering turned on... on my hap ac

The ones who monitored stable memory usage, did you have VLAN filtering on?
6.42.7 is still the best release for me so far and not 6.42.9.

I have stable memory usage on my hAP AC and no VLAN filtering, but unexplained reboots approximately once a week.

mkx · Sat Oct 06, 2018 11:14 am

As I noted memory usage on my hAP ac2 is stable and I don't have VLAN filtering enabled (I'm dealing with VLANs on switch chip).

Sat Oct 06, 2018 1:41 pm

After upgrading to 6.43.2 from 6.42.7 you can no longer have multiple IPsec peers to the same destination IP but with different source addresses.

This regression is said to be fixed in 6.44beta14. Please check the change log in the post here. And I'd expect this kind fix to be merged to 6.42.x later as well.

Cha0s · Sat Oct 06, 2018 1:56 pm

After upgrading to 6.43.2 from 6.42.7 you can no longer have multiple IPsec peers to the same destination IP but with different source addresses.

This regression is said to be fixed in 6.44beta14. Please check the change log in the post here. And I'd expect this kind fix to be merged to 6.42.x later as well.

Thanks. I totally missed that entry in the changelog.

narian · Mon Oct 08, 2018 2:42 pm

Just upgraded RB951Ui-2nD from 6.42.7 to 6.43.2 and it's bricked. Netinstall does not see it.
I've upgraded it from winbox system -> packages -> download and install.

What could be a reason and is there any way to ressurect bricked device?

draguzet · Mon Oct 08, 2018 10:13 pm

Just upgraded RB951Ui-2nD from 6.42.7 to 6.43.2 and it's bricked. Netinstall does not see it.
I've upgraded it from winbox system -> packages -> download and install.

What could be a reason and is there any way to ressurect bricked device?

Same here, repeated on 4 devices

, copy paste .npk file, reboot...device DEAD, it make beep beep, but is not live, no winbox, no IP access, no wifi powered on ??
Something are bad with 6.43.2 ? Mikrotik ?

mkx · Mon Oct 08, 2018 10:32 pm

My experience on hAP ac2: very unstable, plenty of watchdog reboots (most of them due to ping timeouts, pinged address is linux server on LAN).
For me instability is regression from 6.42.9.
I take my words back. Instability is not a regression from 6.42.9, my hAP ac2 was not completely stable while running 6.42.7 (but much more stable than any of 6.43.x). Two days ago I downgraded to 6.42.9 and so far it's stable.

Some statistics:
while running 6.43 for 7d21h it rebooted 13 times due to "watchdog cannot ping address W.X.Y.Z, reboting". So it had average uptime of 14.5 hours.

while running 6.43.1 for 15d4h it rebooted 48 times, so it had average uptime of 7.6 hours

while running 6.42.9 for 1d21h it never rebooted (current uptime 1d21h16m57s)

Every time I installed another version of ROS I also upgraded (or downgraded) firmware. Next I'll try to upgrade only ROS to determine if source of instability is ROS or firmware.

N.b.: my hAP ac2 doesn't seem to suffer of memory leaks, memory usage graph shows more or less steady usage of less that 1/4 of available RAM.

So I upgraded ROS to 6.43.2 while leaving firmware at 6.42.9 ... instability came back, in 2d10h it rebooted 8 times with average uptime of 7.3 hours. Memory usage (as charted by graphing tool) never raised above 40MB (out of 240MB), so this clearly is not the reason for reboots.

I hope MT will improve on stability of 6.43 branch ... or launch better (and more stable) 6.44 soon.

draguzet · Mon Oct 08, 2018 10:50 pm

Just upgraded RB951Ui-2nD from 6.42.7 to 6.43.2 and it's bricked. Netinstall does not see it.
I've upgraded it from winbox system -> packages -> download and install.

What could be a reason and is there any way to ressurect bricked device?

Narian, what is the behavior of bricked device ? I have sveral with same problem.

1. After upgrade to 6.43.2 device are unreachable, boot up properly but not working.
2. I try to reset on default, and is passed, but same problem
3. Wifi are powered on with default SSID, after I try to connect to wifi stop working
4. LAN led are green even I disconnect LAN cable from that port
5. Netinstall not working

FiREWiRE · Tue Oct 09, 2018 1:27 am

I've just upgraded my good old RB750G from 6.42.7 to 6.43.2 using check for updates and then download and install. The front LEDs of the router went out, as they usually do when it reboots, but they never came back. Winbox (latest version) couldn't connect to the router, no DHCP, no internet, nothing, the router was stuck. I've waited for about 5 minutes and decided to disconnect and reconnect the power cord. The router came back to life. I've checked the package list and version 6.43.2 was installed.

I've then upgraded the firmware using /system routerboard upgrade
After the firmware update a reboot is required so I've used system reboot and again the router was stuck.

I've waited a couple minutes and did the same disconnect and reconnect of the power cord to fix it.

There is a serious problem happening when rebooting the router using 6.43.2
I'm wondering if this has anything to do with it:

What's new in 6.43.2 (2018-Sep-18 12:12):
Changes in this release:
*) routerboot - fixed RouterOS booting on devices with particular NAND memory (introduced in v6.43);

UpRunTech · Tue Oct 09, 2018 1:34 am

Seeing as 6.44 will be a while can you please put any wireless patches from 6.44RC into the 6.43 branch? I have had CAPAC and HAPAC units stop registering clients on 6.43.2 until they were rebooted even though the interface was running.

*) wireless - improved stability for 802.11ac;

dasiu · Wed Oct 10, 2018 2:40 pm

On mipsbe devices with AR8227 switch chipset (100 Mbps 5-port routers like hAP, hAP ac lite, hEX lite, hEX PoE lite, RB951Ui-2Hnd, OmniTik 5) it seems you can damage the routerboard after upgrading it to 6.43.2 and using no-default settings...

Anyone experienced physical Ethernet port problems after upgrade to 6.43.2? Port not linking or port showing false link without any cable connected (and looping traffic)?

Happened to me few days ago and to my friend yesterday:
Me: RB951Ui-2HnD. After upgrade - ports 2,3 stopped working. First they were just off (not reacting to the cable), then they started showing link (one - 10 Mbps, other one - 100 Mbps). Then port ether5 also stopped working (no reaction to link, showing inactive all the time). Additionally - I can use ether1, but when I add ether1 to the bridge (even if it's the only port in the bridge and regardless of hw-offload on or off) I have packet losses on the port.
My friend - 2 hAP ac lite devices. After upgrade - few Ethernet ports are just down (not showing link with cable connected), while others work (you can log in, etc.) with the same config.

The same architecture, the same chipset (AR8227), the same software version and problem after upgrade, both of us using "no-defaults" reset. Different devices with different configs on different continents. Is it possible, that the upgrade "destroyed" something physically? Or is it really just that strange coincidence only 2 of us had?

draguzet · Wed Oct 10, 2018 3:20 pm

On mipsbe devices with AR8227 switch chipset (100 Mbps 5-port routers like hAP, hAP ac lite, hEX lite, hEX PoE lite, RB951Ui-2Hnd, OmniTik 5) it seems you can damage the routerboard after upgrading it to 6.43.2 and using no-default settings...

Anyone experienced physical Ethernet port problems after upgrade to 6.43.2? Port not linking or port showing false link without any cable connected (and looping traffic)?

Same situation, described below:

1. After upgrade to 6.43.2 device are unreachable, boot up properly but not working.
2. I try to reset on default, and is passed, but same problem
3. Wifi are powered on with default SSID, after I try to connect to wifi stop working
4. LAN led are green even I disconnect LAN cable from that port
5. Netinstall not working

dasiu · Wed Oct 10, 2018 3:35 pm

Same situation, described below:

1. After upgrade to 6.43.2 device are unreachable, boot up properly but not working.
2. I try to reset on default, and is passed, but same problem
3. Wifi are powered on with default SSID, after I try to connect to wifi stop working
4. LAN led are green even I disconnect LAN cable from that port
5. Netinstall not working

Thank you, draguzet!
I reported it, Ticket#2018101022006114.
Can you, please, also share if you did firmware (RouterBoot) upgrade on it (System -> Routerboard -> Upgrade)? Or did it stay on older firmware? Also - what is the device model?
BTW - wifi is available, but "not working", the same for me. Reason is - the wifi is in the same bridge as the faulty ports, and is getting a broadcast storm (the ports are doing loop), and after connecting to wifi I'm getting the MNDP broadcast packets multiplied thousands times.
BTW2 - Netinstall not working also for me...

draguzet · Wed Oct 10, 2018 4:54 pm

Same situation, described below:

1. After upgrade to 6.43.2 device are unreachable, boot up properly but not working.
2. I try to reset on default, and is passed, but same problem
3. Wifi are powered on with default SSID, after I try to connect to wifi stop working
4. LAN led are green even I disconnect LAN cable from that port
5. Netinstall not working
Thank you, draguzet!
I reported it, Ticket#2018101022006114.
Can you, please, also share if you did firmware (RouterBoot) upgrade on it (System -> Routerboard -> Upgrade)? Or did it stay on older firmware? Also - what is the device model?
BTW - wifi is available, but "not working", the same for me. Reason is - the wifi is in the same bridge as the faulty ports, and is getting a broadcast storm (the ports are doing loop), and after connecting to wifi I'm getting the MNDP broadcast packets multiplied thousands times.
BTW2 - Netinstall not working also for me...

It is on old Firmware, because first boot are not successful and I did not have a way to upgrade firmware (Routerboard - Upgrade).
Device models with problems are: RB951Ui-2HnD , RBDynaDishG-5HacDr3, RB921GS-5HPacD-19S, and for now we stop to upgrade !
I have successful Netinstall (on DynaDish for now) on following way:

1) Power your device off;
2) Power device on;
3) Press and hold the reset button (hold about 1m and relese reset button).
4) Device are detected on Netinstall, and DO NOT install 6.43.2 because same problem are present again !

owsugde · Thu Oct 11, 2018 1:51 pm

Changes in this release:

*) routerboot - fixed RouterOS booting on devices with particular NAND memory (introduced in v6.43);

I suspect this fix to be incomplete, to say the least. Several of my wAP ac's in the field have become quite unstable, especially on reboots. Not sure if by .43.x or specifically .43.2 though.

schadom · Thu Oct 11, 2018 5:03 pm

We encountered an issue with the /routing bgp advertisements print detail where ... command which seems to crash/reboot our CCR1009-7G-1C-1S+s running on 6.43.1. We have two BGP full feeds with each approx. 720k IPv4 and 58k IPv6 routes, Cymru feed with 105k bogon prefixes and we redistribute a full feed to a single customer. Free Memory is at 840/1968MB, CPU usage average at 12%.

Generally stability of the BGP implementation and routing-related commands seems to have gotten much worse following the 6.43 release. Peering sessions terminate randomly, CMDs like /ip route print sporadically return false double results for the same dynamic route with same origin/path or even fail entirely, causing the terminal to freeze. With a (Cisco) peer we even encountered "AFI invalid address family" errors on the peers-side recently which all of a sudden disappeared again without any changes on the MT- nor Cisco-side.

Before opening a support ticket with MT, is anyone else seeing this (or similar) behaviour recently?

Thu Oct 11, 2018 5:55 pm

schadom - Please send supout file and problem description to support@mikrotik.com. Please provide precise command that you use in order to filter print command output.

ssbaksa · Fri Oct 12, 2018 11:07 am

I've just upgraded my good old RB750G from 6.42.7 to 6.43.2 using check for updates and then download and install. The front LEDs of the router went out, as they usually do when it reboots, but they never came back. Winbox (latest version) couldn't connect to the router, no DHCP, no internet, nothing, the router was stuck. I've waited for about 5 minutes and decided to disconnect and reconnect the power cord. The router came back to life. I've checked the package list and version 6.43.2 was installed.
----snip-----

What's new in 6.43.2 (2018-Sep-18 12:12):
Changes in this release:
*) routerboot - fixed RouterOS booting on devices with particular NAND memory (introduced in v6.43);

The same here. My RB750GL is gone. Bricked. LED is blinking as it should but Netinstall never gets anything from RB750GL.
That's third time in 7 years of working with various MT's but this time I just can't do a thing.

Any sugestion?

Br

Sasa

draguzet · Fri Oct 12, 2018 11:26 am

The same here. My RB750GL is gone. Bricked. LED is blinking as it should but Netinstall never gets anything from RB750GL.
That's third time in 7 years of working with various MT's but this time I just can't do a thing.
Any sugestion?

Try this:
1) Power your device off;
2) Power device on;
3) Press and hold the reset button (hold about 1m and relese reset button).
4) After board appears in Netinstall install version lower than 6.43.x !! (try different waiting time while holding reset button, 1 minute, 2 minute...)

I'm really strange when the Mikrotik will remove the 6.43.2 version and declare it unstable, since obviously the different boards are falling after the upgrade!

kris62 · Sun Oct 14, 2018 3:34 am

Connection between RB450GX4 and Winbox 3.18

Hi, guys: I just wanted to get help from this forum because my new device RB450GX4 has problem about connection to Winbox 3.18.
I need to close winbox for several times then it can be connected to RB450GX4... Very strange.

Have you guys with similar problem as mine ?

P.S.
The firmware in my RB450GX4 is mostly updated ~ 6.43.2.

Kris from Taiwan

Chupaka · Sun Oct 14, 2018 11:19 am

Was it working good in previous versions? If not, please create separate topic with more details.

denisun · Sun Oct 14, 2018 4:38 pm

In queue export file and full backup export file has separate queue tree statements.

If i have queue tree with parent and childs then i have:
first parent statements
then queue types
and final the rest statements of tree, that childs.

/queue tree
add bucket-size=0 max-limit=4500k name=pppoe-out1-UP parent=global
add bucket-size=0 limit-at=3M max-limit=4500k name=QoS_Low-UP parent=\
    pppoe-out1-UP
....
/queue type
...
/queue tree
add bucket-size=0 limit-at=500k max-limit=4500k name=QoS_1-UP packet-mark=\
    QoS_1-UP parent=pppoe-out1-UP priority=1 queue=fifo-UP-1
.....

If i have only childs and no parents (except that global) the i have all statements together:

/queue tree
add bucket-size=0 max-limit=50M name=pppoe-out1-DW parent=global queue=\
    default
add bucket-size=0 limit-at=500k max-limit=50M name=QoS_1-DW packet-mark=\
    QoS_1-DW parent=pppoe-out1-DW priority=1 queue=pcq-DW-1
...

ssbaksa · Tue Oct 16, 2018 8:36 am

The same here. My RB750GL is gone. Bricked. LED is blinking as it should but Netinstall never gets anything from RB750GL.
That's third time in 7 years of working with various MT's but this time I just can't do a thing.
Any sugestion?
Try this:
1) Power your device off;
2) Power device on;
3) Press and hold the reset button (hold about 1m and relese reset button).
4) After board appears in Netinstall install version lower than 6.43.x !! (try different waiting time while holding reset button, 1 minute, 2 minute...)

I'm really strange when the Mikrotik will remove the 6.43.2 version and declare it unstable, since obviously the different boards are falling after the upgrade!

Done all of this. As I have few more devices for testing purpose it will wait for having some spare time to fiddle with this but it is annoying problem.
In 30 years this is my second completely bricked device. First was Buffalo router without header.

BTW, Mikrotik, are those 3 hidden spots with Rx, Tx, and GND marking real serial port or just ...

Br

Sasa

pe1chl · Tue Oct 16, 2018 11:20 am

are those 3 hidden spots with Rx, Tx, and GND marking real serial port or just ...

TTL serial. Get a TTL serial to USB converter from aliexpress or similar, and you can connect it to a PC and watch the boot procedure.
(or even flash new firmware over serial when you are patient)

DummyPLUG · Tue Oct 16, 2018 7:50 pm

are those 3 hidden spots with Rx, Tx, and GND marking real serial port or just ...
TTL serial. Get a TTL serial to USB converter from aliexpress or similar, and you can connect it to a PC and watch the boot procedure.
(or even flash new firmware over serial when you are patient)

Speak about TTL serial to USB (and many serial to USB), beware that of them are using PL2303 series chipset and some of them are using fake PL2303 chipset, the latest driver and win10 driver will refuse to work with them. If you look for a Serial to USB cable better check if can work in win10 without manually install any driver.

p.s. I have one from UGreen which work in win10.

pe1chl · Tue Oct 16, 2018 8:00 pm

beware that of them are using PL2303 series chipset and some of them are using fake PL2303 chipset, the latest driver and win10 driver will refuse to work with them. If you look for a Serial to USB cable better check if can work in win10 without manually install any driver.

Could be, I never use Windows, and in Linux they all work without problem...

DummyPLUG · Thu Oct 18, 2018 3:50 am

beware that of them are using PL2303 series chipset and some of them are using fake PL2303 chipset, the latest driver and win10 driver will refuse to work with them. If you look for a Serial to USB cable better check if can work in win10 without manually install any driver.
Could be, I never use Windows, and in Linux they all work without problem...

I have a fake PL2302 cable which damage my old wifi AP

ssbaksa · Thu Oct 18, 2018 8:02 am

are those 3 hidden spots with Rx, Tx, and GND marking real serial port or just ...
TTL serial. Get a TTL serial to USB converter from aliexpress or similar, and you can connect it to a PC and watch the boot procedure.
(or even flash new firmware over serial when you are patient)

Ah, nice suggestion but, all my laptops are Pro type and I have real serial ports on them

Serial port is not a problem on computer side. Question is, are those 3 spots on MT board real serial connections or just some
relics from past.

Br

Sasa

Thu Oct 18, 2018 9:35 am

Ah, nice suggestion but, all my laptops are Pro type and I have real serial ports on them

The key here is that TTL serial and RS232 are somewhat different beasts- they differ at least in the voltage levels (while on the protocol level they must be compatible). You can easily damage TTL serial port by directly connecting it to a standard serial port on your laptop.

emils · Thu Oct 18, 2018 10:41 am

New version 6.43.4 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=140560

Who is online