There has been releases with more changes :)That is a terrifyingly large amount of changes.
train count
6.43 459
6.42 433
6.47 416
6.46 414
6.39 399
7.2 392
6.40 376
6.38 365
6.44 361
6.48 357
6.45 351
7.16 322
6.41 287
7.15 276
7.14 267
Have you set fixed Admin MAC Address on the bridge for these devices?All my static leases for other Mikrotik devices got messed up after update to 7.16.
*) console - fixed negative values for gmt-offset clock property;
:global intGoff [:tonum [get gmt-offset]]
:if ($intGoff > 0x7FFFFFFF) do={:set intGoff ($intGoff - 0x100000000)}
It would be even nicer when the matcher could match other DHCP request fields than options...*) dhcpv4-server - added matcher ability to match substring;
MT has not released a Long Term version in the 7 series yet.With all those change, is like a long-term release........
Missing (CLI only) on changelog...*) ip - added max-sessions property for services;
Have admin MAC only on router.Have you set fixed Admin MAC Address on the bridge for these devices?All my static leases for other Mikrotik devices got messed up after update to 7.16.
For me, upgrade went well on all devices (coming from either 7.16 RC5 or 7.15.3):
RB4011
hEX S
hAP AX 2
cAP AX
cAP XL ac
wAP ac
I don't see that issue here. MAC on bridges is still the Admin MAC that was set all the time (I think defconf now sets it as well).All my static leases for other Mikrotik devices got messed up after update to 7.16. Switches and APs .Looks like the MAC on the bridges got reset somehow.
they have always been there since 6.xI noticed an issue with WDS. there are two fields "WDS default cost" and "WDS cost range" that may be new
The changelog is massive, so it's possible that one of those many changes fixes the issue even if it doesn't explicitly mention ax wifi anywhere. Maybe it's a problem with bridges or drivers, or who knows whatIf it's not written, it's not written, so it wasn't done.
By what logic should it have been done, if it's not written?
Hello, could someone explain where we can find or print about?*) console - added "about" filters for "find" and "print where" commands;
*) qos-hw - added H and I flags to queues;
*) qos-hw - added new monitoring properties for ports and global QoS stats;
It worked on 7.16 rc5?I have a device ax3 with power supply via PoE in Ether1.
Today on version rc5 and after updating to 7.16 also problems appeared “ether1 link down” -> “ether1 link up” -> “ether1 link down” and so it repeats continuously.
Upgraded a single hAP ac2 so far to check if (hopefully) OOM reboots are really fixed with this one...*) wifi-qcom-ac - improved memory allocating process;
That is not an answer to the question above.I have downgraded to version 7.15.3 and still the same problem
If wifiwave2 capsman, that's already the case since start of wave2 capsman, many, MANY moons ago ...Is it normal for CAPSMAN not to show traffic from the CAPs? I've upgraded, things work but I only see traffic on the individual CAPs but not on CAPSMAN.
Sorry, in my case I upgraded from 7.15.3 to 7.16That is not an answer to the question above.I have downgraded to version 7.15.3 and still the same problem
Did you upgrade from 7.15.3 to 7.16 or did you try 7.16x versions in between? (beta,rc)
There have been changes to PoE and they affect the programming of a PoE controller, downgrading does not downgrade that programming.
For me on an RB5009 it fixed a bug, but apparently on the ax3 it introduces a new bug...
You need to file a bug in the support system: https://help.mikrotik.com/servicedeskSorry, in my case I upgraded from 7.15.3 to 7.16
I have a device ax3 with power supply via PoE in Ether1.
Today on version rc5 and after updating to 7.16 also problems appeared “ether1 link down” -> “ether1 link up” -> “ether1 link down” and so it repeats continuously.
A good statistic would be a graphic timeline of releases.
There has been releases with more changes :)
Code: Select alltrain count 6.43 459 6.42 433 6.47 416 6.46 414 6.39 399 7.2 392 6.40 376 6.38 365 6.44 361 6.48 357 6.45 351 7.16 322 6.41 287 7.15 276 7.14 267
Yeah I get that, but it minimizes the risks.There's no guarantee that if someone can do it, you can do it too.
I don't think there's any real reason why you should update them, do you?
This statistic is wrong. There aren't 322 change in 7.16. There are many changes already published by 7.15.x.There has been releases with more changes :)That is a terrifyingly large amount of changes.
Code: Select alltrain count 6.43 459 6.42 433 6.47 416 6.46 414 6.39 399 7.2 392 6.40 376 6.38 365 6.44 361 6.48 357 6.45 351 7.16 322 6.41 287 7.15 276 7.14 267
So, it seems to be a bug affecting “ether1” as I have tested that port as POE=Off and the same thing happens again.
Edit: I have downgraded to version 7.15.3 and still the same problem: “ether1 link down” -> “ether1 link up” -> “ether1 link down” ...etc. Any solution from Support ?
Thanks for the feedback!So, it seems to be a bug affecting “ether1” as I have tested that port as POE=Off and the same thing happens again.
Edit: I have downgraded to version 7.15.3 and still the same problem: “ether1 link down” -> “ether1 link up” -> “ether1 link down” ...etc. Any solution from Support ?
I've got an HAP AX3 on (7.15.3) ROS 7.16 now connected via POE on eth1 and everything works fine, there is no connection or disconnection. But I had a similar problem with the net metal ac2 connected via poe where there was a connection and disconnection (link up, link down ), changing the poe adapter solved the problem.
In ROS 7.16, DNS resolution uses the cache and does not seem to query server (10.9.91.200 does not exist in test LAN)::resolve "www.google.com" server=<DNS server>
:put [:resolve domain-name="www.google.com" server=10.1.91.200 ]
172.217.20.164
Opened SUP-166143:put [:resolve domain-name="www.google.com.br" server=10.90.90.200 ]
failure: dns server failure
Hi, can you explain the purpose of this new setting?/ip/dns/set mdns-repeat-ifaces=bridge,vlan-iot
and I'm happy! Dead simple... Thanks!
see https://help.mikrotik.com/docs/display/ROS/DNSmdns-repeater-ifaces (list of interfaces; Default: )
Once an interface in this list receives an mDNS packet, it will forward it to all other interfaces in this list. Only supports IPv4.
/routing rip instance
add disabled=no name=rip-instance-4 originate-default=if-installed redistribute=connected,static route-gc-timeout=60 route-timeout=30 routing-table=main \
update-interval=5
/routing rip interface-template
add disabled=no instance=rip-instance-4 interfaces=bridge-local poison-reverse=yes split-horizon=yes use-bfd=yes
4 IsH dst-address=0.0.0.0/0 routing-table=main gateway=10.100.6.5
immediate-gw="" distance=1 scope=30 target-scope=10
vrf-interface=MGMT
probably your vrf routes are inactive, right?Has anyone elses setup with VRF's just stopped working ? Mine appears completly broken after the update. I use a VRF to connect to a VPN service for a VLAN.
do a complete new configI have downgraded to version 7.15.3 and still the same problem
*) wifi - added "slave-name-format";
*) wifi - adjusted virtual interface naming when provisioning local radios;
Config looks to be incorrect, either you use routing-table to determine to which vrf this route should belong or you use vrf-interfce. But not the both especially if routing table config does not match the vrf to which vrf-inteface belongs to.it seems vrf-routing is trouble, coming from 7.15.3 static vrf routes were marked inactive and we found no way to get those active, neither deleting, adding new ones, basically all vrf-routes are inactive and show things like:
in addition to static routes within vrfs not working also dynamic routes (added by pppoe client) were inactive within vrfs. this is seriously messed up.Code: Select all4 IsH dst-address=0.0.0.0/0 routing-table=main gateway=10.100.6.5 immediate-gw="" distance=1 scope=30 target-scope=10 vrf-interface=MGMT
finally had to downgrade to 7.15.3 to get this working again.
Oh yeah, I really hate that behavior. And I see no possibility to turn that off.".home.arpa" DNS queries are still being leaked to the WAN network and is not conform to rfc8375. Can it be fixed ASAP please?
That is only a "proposed standard", one of several that were made with the same objective.".home.arpa" DNS queries are still being leaked to the WAN network and is not conform to rfc8375. Can it be fixed ASAP please?
What Mikrotik probably should implement is DNS forwarders so one could host those local domain zones locally...That is only a "proposed standard", one of several that were made with the same objective.".home.arpa" DNS queries are still being leaked to the WAN network and is not conform to rfc8375. Can it be fixed ASAP please?
When you want to use that domain and don't want to leak it you can easily configure that yourself using a static record in the DNS resolver.
# local-zone: "localhost." nodefault
# local-zone: "127.in-addr.arpa." nodefault
# local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
# local-zone: "home.arpa." nodefault
# local-zone: "onion." nodefault
# local-zone: "test." nodefault
# local-zone: "invalid." nodefault
# local-zone: "10.in-addr.arpa." nodefault
# local-zone: "16.172.in-addr.arpa." nodefault
# local-zone: "17.172.in-addr.arpa." nodefault
# local-zone: "18.172.in-addr.arpa." nodefault
# local-zone: "19.172.in-addr.arpa." nodefault
# local-zone: "20.172.in-addr.arpa." nodefault
# local-zone: "21.172.in-addr.arpa." nodefault
# local-zone: "22.172.in-addr.arpa." nodefault
# local-zone: "23.172.in-addr.arpa." nodefault
# local-zone: "24.172.in-addr.arpa." nodefault
# local-zone: "25.172.in-addr.arpa." nodefault
# local-zone: "26.172.in-addr.arpa." nodefault
# local-zone: "27.172.in-addr.arpa." nodefault
# local-zone: "28.172.in-addr.arpa." nodefault
# local-zone: "29.172.in-addr.arpa." nodefault
# local-zone: "30.172.in-addr.arpa." nodefault
# local-zone: "31.172.in-addr.arpa." nodefault
# local-zone: "168.192.in-addr.arpa." nodefault
# local-zone: "0.in-addr.arpa." nodefault
# local-zone: "254.169.in-addr.arpa." nodefault
# local-zone: "2.0.192.in-addr.arpa." nodefault
# local-zone: "100.51.198.in-addr.arpa." nodefault
# local-zone: "113.0.203.in-addr.arpa." nodefault
# local-zone: "255.255.255.255.in-addr.arpa." nodefault
# local-zone: "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
# local-zone: "d.f.ip6.arpa." nodefault
# local-zone: "8.e.f.ip6.arpa." nodefault
# local-zone: "9.e.f.ip6.arpa." nodefault
# local-zone: "a.e.f.ip6.arpa." nodefault
# local-zone: "b.e.f.ip6.arpa." nodefault
# local-zone: "8.b.d.0.1.0.0.2.ip6.arpa." nodefault
# And for 64.100.in-addr.arpa. to 127.100.in-addr.arpa.
7.16 solve it wifi-qcom-ac memory leak?hAP ac3 + wifi-qcom-ac - NO PROBLEM
@rextendedip - added max-sessions property for services;
no factory resetting production systems is not an option, sorry - neither do I think this is a good idea to suggest to anyone.do a complete new config
[...]
try factory reset on stable 7.16 and new config
i dont now7.16 solve it wifi-qcom-ac memory leak?hAP ac3 + wifi-qcom-ac - NO PROBLEM
/system/package/downgrade
More and more people coming here who don't know how to use Google.
How do I go back to 7.15.3? I assume it's not as simply as simply clicking downgrade?
I actually had that weak signal issue last week out of the blue on 7.15.3. Most IoT stuff on 2.4ghz just failed. My ring cameras couldn't see the APs at all, or briefly with very low signal. I didn't actually do anything or changed anything. I loaded the most recent backup and rebooted and it was ok sinceConfirming DHCP issues specifically with AX3 and static addresses being ignored after upgrade to 7.16
Also noticed some of my home automation lights no longer connecting via 2ghz band to my AX2 after upgrade(weak signal). Downgraded and everything is back to "normal"
Why always 1 step forward and two steps back with each upgrade. Some consistency would be nice for a change.
I wonder if that's the same issue causing my wireguard and DoH issues, but I don't see cert errors in the logs.Issue with OpenVPN and Certificat/date times.
When connecting with freshly created cert
disconnected <TLS error: ssl: cert not valid (before: Wed Sep 25 12:57:45 2024 > now: Wed Sep 25 11:09:03 2024)
Wed Sep 25 12:57:45 2024 is the correct current time on devices connecting and the mikrotik itself.
The phenomenon of "not using google before asking" is probably as old as internet search engines. lmgtfy.com exist for a reason. But more and more people use AI. https://letmegpt.com/?q=how%20to%20down ... version%3F
Possible i suspect its cause of the GMT Offset fix they pushed through cause it seems the time diff is exactly off by 2 hours for me (I'm GMT+2)I wonder if that's the same issue causing my wireguard and DoH issues, but I don't see cert errors in the logs.Issue with OpenVPN and Certificat/date times.
When connecting with freshly created cert
disconnected <TLS error: ssl: cert not valid (before: Wed Sep 25 12:57:45 2024 > now: Wed Sep 25 11:09:03 2024)
Wed Sep 25 12:57:45 2024 is the correct current time on devices connecting and the mikrotik itself.
Good spot. I'm off by 1. Will give that a try later.Possible i suspect its cause of the GMT Offset fix they pushed through cause it seems the time diff is exactly off by 2 hours for me (I'm GMT+2)
I wonder if that's the same issue causing my wireguard and DoH issues, but I don't see cert errors in the logs.
I don't see any memory leak.7.16 solve it wifi-qcom-ac memory leak?
I think this answers my question about"free-hdd-space" shrinked by ~50kb on "cAP ac":
7.15.3: 780KiB
7.16: 736KiB
Proposed? Wow...That is only a "proposed standard"
Maybe with regex in DNS it is possible...How?
I did packet captures on WAN interface and did not manage to find anything related to that (only *.arpa requests appearing were related to public IP addresses).".home.arpa" DNS queries are still being leaked to the WAN network and is not conform to rfc8375. Can it be fixed ASAP please?
That would make DNS way more havier in resources than it is expected. CPU, Memory.What Mikrotik probably should implement is DNS forwarders so one could host those local domain zones locally...
Also to avoid bogus DNS queries to internet name servers as is strongly advised (https://www.rfc-editor.org/rfc/rfc6303) maybe filter all these local zones by default as Unbound and BIND are doing:
Stan Marsh says:
"Oh my god! They used extra 1,49MB of RAM..."
Kyle Broflovski says:
"You Bastards! Grrr!"
/ipv6 dhcp-client add add-default-route=yes interface=IP-Maxnet-VLAN-130 pool-name=ipv6-maxnet pool-prefix-length=66 rapid-commit=no request=address,prefix use-interface-duid=yes use-peer-dns=no
/ipv6 dhcp-client add add-default-route=yes disabled=yes interface=IP-Triolan-VLAN-131 pool-name=ipv6-triolan pool-prefix-length=66 rapid-commit=no request=prefix use-interface-duid=yes use-peer-dns=no
#error exporting "/ipv6/dhcp-client" (timeout)
/ipv6/pool/add name=link-local prefix=fe80::/56 prefix-length=64
/ipv6/address/add from-pool=link-local advertise=no address=::1 interface=bridge
Yes, it is. But I find this coincidence quite weird. Exactly when something like this is announced, You see a small shrinkage on disk space? Looks like to me either a wrong changelog (would affect ARM32 too), or a bug on the code (someone forgot to check the ARM architecture before changing the partition size).cAP ac is "arm" not "arm64" ...
So, things are much better with clocks properly set. DoH and Wireguard working again. Will hold off a rollback for now.Possible i suspect its cause of the GMT Offset fix they pushed through cause it seems the time diff is exactly off by 2 hours for me (I'm GMT+2)
I wonder if that's the same issue causing my wireguard and DoH issues, but I don't see cert errors in the logs.
/certificate/print detail proplist=issuer,country,organization,common-name,serial-number,fingerprint,akid,skid,invalid-before,invalid-after where common-name=R10
Flags: K - private-key; L - crl; C - smart-card-key; A - authority;
I - issued, R - revoked; E - expired; T - trusted
1 L T issuer=C=US,O=Internet Security Research Group,CN=ISRG Root X1
country="US" organization="Let's Encrypt" common-name="R10"
serial-number="4ba85293f79a2fa273064ba8048d75d0"
fingerprint="9d7c3f1aa6ad2b2ec0d5cf1e246f8d9ae6cbc9fd0755ad37bb974b1
f2fb603f3"
akid=79b459e67bb6e5e40173800888c81a58f6e99b6e
skid=bbbcc347a5e4bca9c6c3a4720c108da235e1c8e8
invalid-before=2160-04-18 23:28:16
invalid-after=2163-04-18 23:28:15
*) certificate - show validity beyond year 2038;
That is all already available.What Mikrotik probably should implement is DNS forwarders so one could host those local domain zones locally...
That is only a "proposed standard", one of several that were made with the same objective.
When you want to use that domain and don't want to leak it you can easily configure that yourself using a static record in the DNS resolver.
You don't know what it means? Read RFC 2026.Proposed? Wow...That is only a "proposed standard"
Anyone can implement it, but it is not mandatory.And why other recursive engines implement that?
Are bind, unbound, knot, and others wrong following those recomendations?
Of course it is. Someone can publish a cut-and-paste config, and it could even be added to default config.Maybe with regex in DNS it is possible...
But it is the thing that should come in default-config template...
And being possible to be disabled.
I'm seeing that with 7.16 on 3 different CRS devices:I do not see this issue with certificates. Possibly an issue with specific architecture? What device is that?
[myuser@MikroTik] > /export
# 1970-01-02 00:20:33 by RouterOS 7.16
# software id = VJPT-SQGP
#
# model = C52iG-5HaxD2HaxD
# serial number = HG209NTVAFV
/interface bridge
add name=bridge
/interface list
add comment="allow macwinbox on all" include=all name=macwinbox
/interface wifi security
add authentication-types=wpa2-psk disabled=no name=mywifi
/interface wifi
set [ find default-name=wifi2 ] configuration.mode=station .ssid=mywifi\
disabled=no name=wifi-2ghz security=osmium
set [ find default-name=wifi1 ] configuration.mode=station .ssid=mywifi\
disabled=no name=wifi-5ghz security=osmium
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface list member
add interface=bridge list=macwinbox
/system note
set show-at-login=no
/tool mac-server mac-winbox
set allowed-interface-list=macwinbox
Do you have VLAN ID 1 configured?Can have someone any solution for this?
/export file=anynameyoulike
This is my configuration:Do you have VLAN ID 1 configured?Can have someone any solution for this?
Anything in the logging?
Or better, share your config?
Remove serial and any other private info.Code: Select all/export file=anynameyoulike
I have the same MikroTik and this didn't happen for me.
/interface bridge
add dhcp-snooping=yes frame-types=admit-only-vlan-tagged name=bridge1-MAIN \
vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment="XXXXXXXX"
set [ find default-name=ether2 ] comment="XXXXXXXX"
set [ find default-name=ether3 ] comment="XXXXXXXX"
set [ find default-name=ether4 ] comment="XXXXXXXX"
set [ find default-name=ether5 ] comment="XXXXXXXX"
set [ find default-name=ether6 ] comment="XXXXXXXX"
set [ find default-name=ether7 ] comment="XXXXXXXX"
set [ find default-name=ether8 ] comment="XXXXXXXX"
set [ find default-name=ether10 ] comment="XXXXXXXX"
set [ find default-name=sfp-sfpplus1 ] comment="XXXXXXXX"
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface vlan
add interface=bridge1-MAIN name=vLAN10-Public_IP vlan-id=10
add interface=bridge1-MAIN name=vLAN20-SRV-MGMT vlan-id=20
add interface=bridge1-MAIN name=vLAN80-iSCSI-vMotion vlan-id=80
add interface=bridge1-MAIN name=vLAN93-Private_IP vlan-id=93
add interface=bridge1-MAIN name=vLAN100-Guest_LAN vlan-id=100
/interface list
add name=WAN
add name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/ip firewall layer7-protocol
add name=facebook.com regexp="^.+(facebook.com).*\$"
/ip ipsec policy group
add name=ike2-policies
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5 \
enc-algorithm=aes-256,aes-192,aes-128
add dpd-interval=2m dpd-maximum-failures=5 enc-algorithm=aes-256,aes-128 \
hash-algorithm=sha256 name=ike2
/ip ipsec peer
add exchange-mode=ike2 name=ike2 passive=yes profile=ike2 \
send-initial-contact=no
/ip ipsec proposal
add auth-algorithms=sha256,sha1 name=ike2 pfs-group=none
/ip pool
add name=Main-DHCP ranges=XXXXXXXX
add name=Local-DHCP ranges=XXXXXXXX
add name=VPN-Pool ranges=XXXXXXXX
add name=Guest-Pool ranges=XXXXXXXX
/ip dhcp-server
add address-pool=Local-DHCP interface=ether10 lease-script=dhcp2dns \
lease-time=1d name=Local-DHCP
add address-pool=Main-DHCP interface=vLAN93-Private_IP lease-time=1d name=\
Main-DHCP
add address-pool=Guest-Pool interface=vLAN100-Guest_LAN name=Guest-DHCP
/interface bridge port
add bridge=bridge1-MAIN ingress-filtering=no interface=ether2 \
internal-path-cost=10 path-cost=10 pvid=93 trusted=yes
add bridge=bridge1-MAIN ingress-filtering=no interface=ether3 \
internal-path-cost=10 path-cost=10 pvid=93 trusted=yes
add bridge=bridge1-MAIN ingress-filtering=no interface=ether4 \
internal-path-cost=10 path-cost=10 pvid=93 trusted=yes
add bridge=bridge1-MAIN ingress-filtering=no interface=ether5 \
internal-path-cost=10 path-cost=10 pvid=93 trusted=yes
add bridge=bridge1-MAIN ingress-filtering=no interface=ether6 \
internal-path-cost=10 path-cost=10 pvid=93 trusted=yes
add bridge=bridge1-MAIN ingress-filtering=no interface=ether7 \
internal-path-cost=10 path-cost=10 pvid=93 trusted=yes
add bridge=bridge1-MAIN ingress-filtering=no interface=ether8 \
internal-path-cost=10 path-cost=10 pvid=93 trusted=yes
add bridge=bridge1-MAIN interface=ether9 pvid=93 trusted=yes
add bridge=bridge1-MAIN frame-types=admit-only-vlan-tagged interface=\
sfp-sfpplus1 trusted=yes
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
/ip firewall connection tracking
set enabled=yes udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=none
/ip settings
set max-neighbor-entries=8192 tcp-syncookies=yes
/ipv6 settings
set max-neighbor-entries=8192
/interface bridge vlan
add bridge=bridge1-MAIN tagged=bridge1-MAIN,ether3,ether4,ether7,sfp-sfpplus1 \
vlan-ids=10
add bridge=bridge1-MAIN tagged=bridge1-MAIN,ether3,ether4,ether7,sfp-sfpplus1 \
vlan-ids=20
add bridge=bridge1-MAIN tagged=bridge1-MAIN,sfp-sfpplus1 vlan-ids=93
add bridge=bridge1-MAIN tagged=bridge1-MAIN,sfp-sfpplus1 vlan-ids=80
add bridge=bridge1-MAIN tagged=bridge1-MAIN,sfp-sfpplus1 vlan-ids=100
/interface l2tp-server server
set allow-fast-path=yes default-profile=VPN enabled=yes use-ipsec=required
/interface list member
add interface=bridge1-MAIN list=LAN
add interface=ether1 list=WAN
add interface=ether10 list=LAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
/ip address
add address=XXXXXXXX interface=vLAN93-Private_IP network=XXXXXXXX
add address=XXXXXXXX interface=ether10 network=XXXXXXXX
add address=XXXXXXXX interface=ether1 network=XXXXXXXX
add address=XXXXXXXX interface=vLAN10-Public_IP network=\
XXXXXXXX
add address=XXXXXXXX interface=wireguard1 network=XXXXXXXX
add address=XXXXXXXX interface=vLAN20-SRV-MGMT network=XXXXXXXX
add address=XXXXXXXX interface=vLAN80-iSCSI-vMotion network=\
XXXXXXXX
add address=XXXXXXXX interface=vLAN100-Guest_LAN network=XXXXXXXX
/ip dhcp-server network
add address=XXXXXXXX comment=Guest-DHCP dns-server=XXXXXXXX gateway=\
XXXXXXXX
add address=XXXXXXXX comment=Local-DHCP dns-server=\
XXXXXXXX gateway=XXXXXXXX
add address=XXXXXXXX comment=Main-DHCP dns-server=XXXXXXXX \
gateway=XXXXXXXX
/ip dns
set allow-remote-requests=yes cache-max-ttl=3d servers=1XXXXXXXX
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip ipsec identity
add auth-method=eap-radius certificate=sslcert-autogen_2024-09-06T07:44:00Z \
generate-policy=port-strict mode-config=ike2-conf peer=ike2 \
policy-template-group=ike2-policies
/ip ipsec policy
add dst-address=XXXXXXXX group=ike2-policies proposal=ike2 \
src-address=XXXXXXXX template=yes
/ip route
add disabled=no distance=1 dst-address=XXXXXXXX gateway=XXXXXXXX \
routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www-ssl certificate=*5
set api disabled=yes
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/ipv6 address
add address=2a02:2f0f:312::2/48 advertise=no interface=*11
/ipv6 firewall filter
add action=accept chain=input comment="accept established,related,untracked" \
connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=accept chain=input comment="accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="accept UDP traceroute" port=\
33434-33534 protocol=udp
add action=accept chain=input comment=\
"accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp \
src-address=fe80::/10
add action=accept chain=input comment="accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="accept all that matches ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=input comment="allow wireguard VPN (12321/udp)" \
dst-port=13231 in-interface-list=WAN protocol=udp
add action=drop chain=input comment=\
"drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment=\
"accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop packets with bad src ipv6" \
src-address-list=bad_ipv6
add action=drop chain=forward comment="drop packets with bad dst ipv6" \
dst-address-list=bad_ipv6
add action=drop chain=forward comment="rfc4890 drop hop-limit=1" hop-limit=\
equal:1 protocol=icmpv6
add action=accept chain=forward comment="accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="accept HIP" protocol=139
add action=accept chain=forward comment="accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=forward comment="accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment=\
"accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Europe/Bucharest
/system logging
set 0 action=disk
add topics=ipsec,!debug
add disabled=yes topics=wireguard,!debug
/system note
set show-at-login=no
/system resource irq rps
set sfp-sfpplus1 disabled=no
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=LAN
/user-manager
set certificate=sslcert-autogen_2024-09-06T07:44:00Z enabled=yes \
require-message-auth=no
/user-manager router
add address=127.0.0.1 comment=localhost name=local
I had not, and now that I have upgraded it (from 7.15.3 to 7.16) the red warning indeed disappears. Thanks for the hint.@pe1chl
Did you also upgrade FW on that device ?
I've seen a similar report, I think, which was solved when fw was upgraded.
Router - RB4011iGS+
I have two entries for DHCPv6 client in my settings: active and disabled.Before ROS 7.16 these two entries did not interfere with each other and everything worked.Code: Select all/ipv6 dhcp-client add add-default-route=yes interface=IP-Maxnet-VLAN-130 pool-name=ipv6-maxnet pool-prefix-length=66 rapid-commit=no request=address,prefix use-interface-duid=yes use-peer-dns=no /ipv6 dhcp-client add add-default-route=yes disabled=yes interface=IP-Triolan-VLAN-131 pool-name=ipv6-triolan pool-prefix-length=66 rapid-commit=no request=prefix use-interface-duid=yes use-peer-dns=no
With the upgrade to ROS 7.16, trying to enter the IPv6-DHCP Client menu results in an error:
- this menu item appears empty
- an error appears in the logs that there cannot be two pools with the same name.
Attempting to export IPv6 settings to a text file saves an error in the result file:Rollback to 7.15.3 restores functionality.Code: Select all#error exporting "/ipv6/dhcp-client" (timeout)
Deleting the “disabled” DHCPv6 client entry and upgrading to 7.16 - the system works fine.
#error exporting "/ipv6/dhcp-client" (timeout)
failed to add ipv6 pool ipv6-pool: two pools cannot have the same name! (6)
i spoke too soon, MVRP still does not correctly distribute vlan ids from a port's pvid. opened SUP-166289 for this.MVRP seems to work much better (7.15.3 had some problems with certains ports not joining vlans properly)
In this case WinBox visually outputs "short-circuit" warning only after PoE FW upgrade, where upgrade is automatic on boot if versions differ. On next boot, the warning will disappear. We will try to fix it in upcoming releases, but this is an visual issue only.I had not, and now that I have upgraded it (from 7.15.3 to 7.16) the red warning indeed disappears. Thanks for the hint.
What remains confusing is that in the log it says "ether5 detected poe-out status: wait_for_load" which is fine, but in the ethernet interface table it still says "short circuit". For an open port is shows "wait for load" and for 803.af/at PoE that should also be the status when a non-PoE device is connected.
(I can understand that it can detect short circuit and display that when the PoE is "forced on" for passive PoE but a short circuit is detected)
Maybe in addition to "off", "auto on" and "forced on" there should be a "802.3af/at" mode where it strictly uses that protocol and is not worried about shorts.
I didn't see anything strange in your configuration, except for this line:This is my configuration:
/interface bridge settings set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
I didn't need that option, maybe was activated when i upgrade to v7.16@mendarkI didn't see anything strange in your configuration, except for this line:This is my configuration:
Why do you need it?Code: Select all/interface bridge settings set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
Ok thanks. But please also explain if "short circuit" is an undesirable condition for the router, or if it can just be in that state forever without any risk of damage, overheating, etc.In this case WinBox visually outputs "short-circuit" warning only after PoE FW upgrade, where upgrade is automatic on boot if versions differ. On next boot, the warning will disappear. We will try to fix it in upcoming releases, but this is an visual issue only.I had not, and now that I have upgraded it (from 7.15.3 to 7.16) the red warning indeed disappears. Thanks for the hint.
What remains confusing is that in the log it says "ether5 detected poe-out status: wait_for_load" which is fine, but in the ethernet interface table it still says "short circuit". For an open port is shows "wait for load" and for 803.af/at PoE that should also be the status when a non-PoE device is connected.
(I can understand that it can detect short circuit and display that when the PoE is "forced on" for passive PoE but a short circuit is detected)
Maybe in addition to "off", "auto on" and "forced on" there should be a "802.3af/at" mode where it strictly uses that protocol and is not worried about shorts.
Please also read my post above: we use PoE out on "user ports" where either a PC or a VoIP phone (with through connection to PC) is connected. It is not convenient to have to configure the port differently for the different usages.Regarding "wrong detection of short-circuit on non-poe PD's", it is not wrong as it's simply a measurement issue. Resistance-detection measurement results show really low resistance that cannot be differenced from a real short-circuit. If you don't want port to perform resistance-detection, turn off PoE on it.
I don't think your question is specifically about ROS 7.16. Create a separate thread for your question. And attach the full text version of your configuration to your post there. I mean - do not hide IP addresses of internal subnets, pools and gateways. Otherwise, it's not clear what you have and where it should be directed.Another problem that i noticed is, i cannot ping any ip in C class, like: 10.x.x.x, even if i ping from router. i take timed out.
Ok, i understand.@mendarkI don't think your question is specifically about ROS 7.16. Create a separate thread for your question. And attach the full text version of your configuration to your post there. I mean - do not hide IP addresses of internal subnets, pools and gateways. Otherwise, it's not clear what you have and where it should be directed.Another problem that i noticed is, i cannot ping any ip in C class, like: 10.x.x.x, even if i ping from router. i take timed out.
Without knowing what you have and how it's set up, it's impossible to advise anything. Please attach a text version of your configurations. At the same time - remove “critical” information from these files before publishing them on the forum: serial numbers, external IP addresses and gateways, etc.Would appreciate if anybody could help me find clue what is happening.
/export file=file_name
/routing rip instance
add afi=ipv4 disabled=no name=rip
/routing rip interface-template
add disabled=no instance=rip interfaces=vlan-voip mode=passive
/ip dhcp-client
add add-default-route=no interface=vlan-voip use-peer-dns=no use-peer-ntp=no
Unsure why, my Chateau (D53G-5HacD2HnD) got hit differently:"free-hdd-space" shrinked by ~50kb on "cAP ac":
7.15.3: 780KiB
7.16: 736KiB
Experiencing lots of reboots (up to every 2-30 minutes) on a HAP AC2 working as a wireless trunk between two segments of the network, upgraded to v7.16, on logs I only get the "possible power outage" message.
Power supply has not failed before...
Similar devices with wired ethernet trunk connections are fine.
Downgraded the HAP AC2 and after a couple of hours no reboot has happened...
*) routerboard - improved Etherboot stability for IPQ-40xx devices ("/system routerboard upgrade" required);
Thank you I'm attaching configs from router and from one of the capax. Thank for help.@david99Without knowing what you have and how it's set up, it's impossible to advise anything. Please attach a text version of your configurations. At the same time - remove “critical” information from these files before publishing them on the forum: serial numbers, external IP addresses and gateways, etc.Would appreciate if anybody could help me find clue what is happening.Code: Select all/export file=file_name
Sure, but Etherboot is used for Netinstall. I don't see how it could affect normal operation. But of course, it is a Mikrotik changelog, I agree: there may sneaked some other change into firmware which is necessary for 7.16 to operate normal. So every time one spots a "*) routerboard" changelog-line: UPGRADE regardless of what is written afterwards.Did you also upgrade the firmware (under System -> RouterBOARD, and then reboot). The hAP ac² has a IPQ-4018 CPU and according to the changelog, a firmware upgrade is required for IPQ-40xx
*) routerboard - improved Etherboot stability for IPQ-40xx devices ("/system routerboard upgrade" required);
I can't make my RB3011's mdns Repeater to work./ip/dns/set mdns-repeat-ifaces=bridge,vlan-iot
and I'm happy! Dead simple... Thanks!
Indeed I had issues with that, but currently with 7.16 all works fine.I wonder, as there are some hints about this in the release notes.
Is Bridge IGMP/MLD snooping when using VLAN working now?
It was broken until 7.15.1, especially when using IPv6, multicast packets got dropped by the bridge breaking RA and IPv6 autoconfiguration.
this is broken since forever.It was broken until 7.15.1, especially when using IPv6, multicast packets got dropped by the bridge breaking RA and IPv6 autoconfiguration.
Ok I will reconfigure dhcp client on APs thank you. for the VLANs they are not in use currently but before they were working. I could potentialy remove them at all but do you think those could cause this issue? Basically Vlans were configured to the same port by which router is connected to switch so the same port is also for APs connection. Before it was working without issue.@david99
First: on wireless access points, configure the DHCP client correctly. The device to get the IP address is not ether1, but your bridge.
Second, figure out the VLANs on the router. Which ports on the router you have wireless access points connected to and which VLANs should be forwarded there through the router's bridge.
Yes I did upgrade the firmware, but had to downgrade till I have some more time to diagnose if it is a a bad power supply or if the v7.16 is demanding more power han before...
Did you also upgrade the firmware (under System -> RouterBOARD, and then reboot). The hAP ac² has a IPQ-4018 CPU and according to the changelog, a firmware upgrade is required for IPQ-40xx
*) routerboard - improved Etherboot stability for IPQ-40xx devices ("/system routerboard upgrade" required);
More info on this? Any doc?certificate - added support for cloud-dns challenge validation for sn.mynetname.net (CLI only);
ingress-filtering=no
STABLE IS IT!
09:19:57 wireless,info 6C:A1:00:23:77:DE@cap-wifi1 disconnected, SA Query timeout, signal strength -65
09:19:57 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:20:39 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
09:20:47 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:25:19 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -83
09:25:20 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:26:27 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -83
09:26:27 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:29:29 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -80
09:29:29 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
09:32:15 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -84
09:32:19 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -86
09:35:16 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
09:35:16 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
09:39:39 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
09:39:39 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:43:16 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
09:43:16 wireless,info 6C:A1:00:23:77:DE@cap-wifi1 connected, signal strength -54
09:45:29 wireless,info 6C:A1:00:23:77:DE@cap-wifi1 disconnected, SA Query timeout, signal strength -63
09:45:29 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:46:11 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -80
09:46:34 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
09:46:34 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, connection lost, signal strength -83
09:46:35 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:46:38 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, connection lost, signal strength -81
09:47:15 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
09:47:16 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, connection lost, signal strength -82
09:47:29 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -56
09:53:38 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -53
09:53:40 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -58
10:03:46 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -48
10:03:49 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -57
10:10:55 wireless,info 0A:BA:D7:A3:E6:19@wifi1 disconnected, connection lost, signal strength -56
10:11:11 wireless,info 0A:BA:D7:A3:E6:19@wifi1 connected, signal strength -58
10:13:56 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -52
10:13:57 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -57
10:24:00 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -54
10:24:04 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -59
10:34:09 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -49
10:34:12 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -57
10:44:19 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -51
10:44:21 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -57
10:54:29 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -51
10:54:38 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -56
10:57:50 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -49
10:57:51 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
10:59:01 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -83
10:59:01 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -56
11:09:07 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -51
11:09:07 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:12:14 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:12:32 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:14:39 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -81
11:14:39 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:17:28 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -81
11:17:28 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:20:30 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:20:39 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:20:40 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, connection lost, signal strength -83
11:20:40 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
11:26:51 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -80
11:26:53 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
11:30:23 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:30:23 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:34:22 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -81
11:34:22 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:36:30 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -80
11:36:31 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
11:39:19 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -81
11:39:26 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:41:28 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:41:28 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
11:44:39 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:44:41 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:47:57 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -81
11:47:57 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -82
11:50:07 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:50:07 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -82
11:52:30 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -83
11:52:30 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -52
12:02:40 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -51
12:02:41 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -56
REALLY!
Same issues here for a customer. Not acceptable, been same since 7.15.3, etc. We're starting to move to another WiFi vendor.STABLE IS IT!
09:19:57 wireless,info 6C:A1:00:23:77:DE@cap-wifi1 disconnected, SA Query timeout, signal strength -65
09:19:57 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:20:39 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
09:20:47 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:25:19 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -83
09:25:20 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:26:27 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -83
09:26:27 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:29:29 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -80
09:29:29 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
09:32:15 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -84
09:32:19 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -86
09:35:16 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
09:35:16 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
09:39:39 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
09:39:39 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:43:16 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
09:43:16 wireless,info 6C:A1:00:23:77:DE@cap-wifi1 connected, signal strength -54
09:45:29 wireless,info 6C:A1:00:23:77:DE@cap-wifi1 disconnected, SA Query timeout, signal strength -63
09:45:29 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:46:11 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -80
09:46:34 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
09:46:34 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, connection lost, signal strength -83
09:46:35 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
09:46:38 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, connection lost, signal strength -81
09:47:15 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
09:47:16 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, connection lost, signal strength -82
09:47:29 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -56
09:53:38 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -53
09:53:40 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -58
10:03:46 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -48
10:03:49 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -57
10:10:55 wireless,info 0A:BA:D7:A3:E6:19@wifi1 disconnected, connection lost, signal strength -56
10:11:11 wireless,info 0A:BA:D7:A3:E6:19@wifi1 connected, signal strength -58
10:13:56 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -52
10:13:57 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -57
10:24:00 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -54
10:24:04 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -59
10:34:09 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -49
10:34:12 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -57
10:44:19 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -51
10:44:21 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -57
10:54:29 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -51
10:54:38 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -56
10:57:50 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -49
10:57:51 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
10:59:01 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -83
10:59:01 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -56
11:09:07 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -51
11:09:07 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:12:14 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:12:32 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:14:39 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -81
11:14:39 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:17:28 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -81
11:17:28 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:20:30 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:20:39 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:20:40 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, connection lost, signal strength -83
11:20:40 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
11:26:51 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -80
11:26:53 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
11:30:23 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:30:23 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:34:22 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -81
11:34:22 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:36:30 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -80
11:36:31 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
11:39:19 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -81
11:39:26 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:41:28 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:41:28 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -84
11:44:39 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:44:41 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -83
11:47:57 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -81
11:47:57 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -82
11:50:07 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -82
11:50:07 wireless,info 6C:A1:00:23:77:DE@wifi2 connected, signal strength -82
11:52:30 wireless,info 6C:A1:00:23:77:DE@wifi2 disconnected, SA Query timeout, signal strength -83
11:52:30 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -52
12:02:40 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 disconnected, SA Query timeout, signal strength -51
12:02:41 wireless,info 6C:A1:00:23:77:DE@cap-wifi2 connected, signal strength -56
REALLY!
It's about LetsEncrypt certificate using DNS-01 challenge (https://letsencrypt.org/docs/challenge- ... -challenge) - implemented only for sn.mynetname.net. That's probably why the named it "type=cloud-dns". Maybe one day ROS supports DNS-01 for other domains as well ("type=dns-01" most probably then).More info on this? Any doc?certificate - added support for cloud-dns challenge validation for sn.mynetname.net (CLI only);
/certificate/enable-ssl-certificate type=cloud-dns
He is refering to SA query timeouts, and signal strength is not sh*t. He is getting that with signal stronger than -65.Well... No wonder you got disconnected... That signal strength is sh*t...
You might want to look a little harder!Well... No wonder you got disconnected... That signal strength is sh*t...
Just the 2 AP's you can see the Laptop trying all of the Radios it's allowed on with the same SSID so 3 ChoicesHow many AP's do u have?
It`s ok? No memory leak?I don't see any memory leak.7.16 solve it wifi-qcom-ac memory leak?
*) console - added "about" filters for "find" and "print where" commands;
What's new in 7.14beta7 (2024-Jan-15 11:37):
*) sms - moved LTE SMS read settings from "/tool/sms" to "/interface/lte" menu and migrate old configuration (CLI only);
i'm also seeing this on a hAP ac2 acting as CAP (wifi-qcom-ac, 5GHz only, Ceee).Experiencing lots of reboots (up to every 2-30 minutes) on a HAP AC2 working as a wireless trunk between two segments of the network, upgraded to v7.16, on logs I only get the "possible power outage" message.
2024-09-26 12:57:13 system,error,critical router rebooted without proper shutdown, probably power outage
2024-09-26 12:58:23 system,clock,critical,info ntp change time Sep/26/2024 12:57:50 => Sep/26/2024 12:58:23
2024-09-26 12:58:24 system,error,critical router rebooted without proper shutdown, probably power outage
2024-09-26 13:03:03 system,clock,critical,info ntp change time Sep/26/2024 12:59:01 => Sep/26/2024 13:03:03
2024-09-26 13:03:05 system,error,critical router rebooted without proper shutdown, probably power outage
2024-09-26 13:07:11 system,clock,critical,info ntp change time Sep/26/2024 13:03:41 => Sep/26/2024 13:07:11
2024-09-26 13:07:13 system,error,critical router rebooted without proper shutdown, probably power outage
2024-09-26 13:11:39 system,clock,critical,info ntp change time Sep/26/2024 13:07:51 => Sep/26/2024 13:11:39
PoE from a 4011.powered by power supply or Poe?
well, it was perfectly stable under 7.15.3, the only change i made recently was upgrading it to 7.16. but as i say i'll do some more testing later today (when users went to sleep) and we'll see.Maybe device needs more power on load which 4011 can't provide?
i was able to reproduce the problem with iperf3: under wireless load (~500Mbps) the device would reboot every few minutes. downgrading to 7.15.3 fixed the problem.well, it was perfectly stable under 7.15.3, the only change i made recently was upgrading it to 7.16. but as i say i'll do some more testing later today (when users went to sleep) and we'll see.
I understand that the name gives an idea, that something is wrong, but that is literally what it is. Any resistance detection device would show exactly the same. It can just be in that state forever without any risk of damage, overheating, etc.Ok thanks. But please also explain if "short circuit" is an undesirable condition for the router, or if it can just be in that state forever without any risk of damage, overheating, etc.
There is no need for poe-out to be turned off, suggestion simply implied "hides status that I don't like".Please also read my post above: we use PoE out on "user ports" where either a PC or a VoIP phone (with through connection to PC) is connected. It is not convenient to have to configure the port differently for the different usages.
Just because other vendors hide the state, does not mean they don't measure the same. Hook up oscilloscope to any vendor PSE and you will see that detection is ran always, otherwise it is impossible for PSE to know -> now turn on the power. For non-pd safety, resistance-detection is done with up to 10.1V and has a very small current-limit. Any PSE evaluation board would show you "short-circuit" against non-poe-devices in their resistance detection register, because as I mentioned, that is literally what physically is measured. What other vendors do is simply hide it, most likely checks that PoE-Out was not enabled, L2 link is on -> no-pd capable device connected, or something like thatAnd on any industrial standard PoE switch that is not required at all! You just have 802.3af/at PoE enabled on all ports (by default) and you can plugin any device. The status of the PoE will either be "delivering" or "searching". When there is a low resistance it does not satisfy the 802.3af/at conditions and the status remains "searching" (or "wait for load" or whatever you want to call it).
As I understand that it is different for "passive PoE" (where you just need to try to deliver power and shut off when there is a short circuit to protect your equipment), I suggest (as above) to have a separate 802.3af/at mode where it does not even try to detect short circuit when it does not detect the correct resistance of an 802.3af/at device, just like everyone else does.
DNS-01 support for LE would be amazing. I’m not punching holes for port 80 from the world to internal gear but I already use DNS-01 to handle internal certificates for k8s. This is definitely the right path forward.It's about LetsEncrypt certificate using DNS-01 challenge (https://letsencrypt.org/docs/challenge- ... -challenge) - implemented only for sn.mynetname.net. That's probably why the named it "type=cloud-dns". Maybe one day ROS supports DNS-01 for other domains as well ("type=dns-01" most probably then).
More info on this? Any doc?
You do not need a public facing HTTP server on port 80 for the .well-known challenge.
To create a certificate for the "your-device-serial.sn.mynetname.net" you just need this:
This is pretty cool. Good job, Mikrotik!Code: Select all/certificate/enable-ssl-certificate type=cloud-dns
Wifi signal strength is certainly affected (again) with 7.16. A lot of my home automation lights on 2.4ghz lost connectivity after the upgrade to 7.16 - after downgrade to 7.15.3 they are all connecting fine again. I recall when AX3 was launched all the complaints with weak wifi signal but Mikrotik in their usual denial said it was a configuration issue. Then around 7.13 they updated the driver and suddenly signal strength was much better. Up to 7.15.x signal strength has been fine but with 7.16 it seems this has changed once again. Crazy inconsistency with updates.Well... No wonder you got disconnected... That signal strength is sh*t...
Updated device FW as well to 7.16 ?PoE from a 4011.powered by power supply or Poe?
yes. i don't usually upgrade firmware but i noticed some firmware-related PoE issues with 7.16, so i upgraded firmware on both hAP ac2 and RB4011 to current 7.16. the problem still occurred.Updated device FW as well to 7.16 ?
Already 2 users with POE issues which were solved after performing FW upgrade as well.
Ok thanks for that info (and the other things in the reply)! I will keep the ports on "auto on", I was only worried that it would be trying to put "passive PoE" on the port and detect the short circuit, possibly damaging something.I understand that the name gives an idea, that something is wrong, but that is literally what it is. Any resistance detection device would show exactly the same. It can just be in that state forever without any risk of damage, overheating, etc.Ok thanks. But please also explain if "short circuit" is an undesirable condition for the router, or if it can just be in that state forever without any risk of damage, overheating, etc.
No, don't have that problem. Routers (and memory usage) are stable.Hi
We have updated all routers to 7.16 since Wednesday.
Now we have the problem that the routers hang up after a while and no longer allow connections. The only thing that helps is a restart.
Both CHR version and hardware such as RB5009UPr+S+.
Does anyone have the same problem?
*) ike2 - improved performance by balancing multicore CPU usage for key exchange calculation;
*) ipsec - changed default dpd-interval from 2 minutes to 8 seconds and dpd-maximum-failures from 5 to 4;
*) ipsec - improved installed SA statistics update;
Wait for RFC-2136 supportThis is pretty cool. Good job, Mikrotik!
More info on this? Any doc?
/ip dhcp-server lease
add address=10.X.X.X comment=hostname lease-time=1h mac-address=XX:XX:XX:XX:XX:XX server=default
I had to find out by myself. Very cool feature, I have written blog post about it https://blog.erben.sk/2024/09/27/mikrot ... e-feature/More info on this? Any doc?certificate - added support for cloud-dns challenge validation for sn.mynetname.net (CLI only);
add action=drop chain=forward comment="Drop traffic to vlan99 from non-managem\
ent interfaces contained in non-mgmt interface list" in-interface-list=\
non_mgmt_int out-interface=vlan99
add action=drop chain=forward comment=\
"Drop traffic from vlan29 to vlan199 (main)" in-interface=vlan29 \
out-interface=vlan199
You can have a couple of .home.arpa records in the DNS and at the end a *.home.arpa$ record with NXDOMAIN.
The server is also capable of resolving DNS requests based on POSIX basic regular expressions so that multiple requests can be matched with the same entry. In case an entry does not conform with DNS naming standards, it is considered a regular expression. The list is ordered and checked from top to bottom. Regular expressions are checked first, then the plain records.
Oh the answer is a complex, it depends. But if you have a static entry using .home.arpa it will resolve in my test, unless some regex does some match.From the docs:You can have a couple of .home.arpa records in the DNS and at the end a *.home.arpa$ record with NXDOMAIN.I never tried that, but doesn't that mean all *.home.arpa recrods going to be effectively NXDOMAIN'd?[...] In case an entry does not conform with DNS naming standards
... so you can see how it kinda strange.dig soa home.arpa
[...]
home.arpa. 86400 IN SOA HOME.ARPA. . 0 28800 7200 604800 86400
Performing DNS-based Service Discovery using purely Unicast DNS is more efficient and doesn't require large multicast domains [that mDNS discovery would] but does require [...] data be available in the Unicast DNS namespace. The Unicast DNS namespace in question could fall within a traditionally assigned globally unique domain name, or it could be within a private local unicast domain name such as ".home.arpa"
09-28 00:04:07 dns,error cache full, not storing
09-28 00:04:07 dns,error cache full, not storing [ignoring repeated messages]
09-28 00:04:09 dns,warning DoH max concurrent queries reached, ignoring query
09-28 00:04:09 dns,warning DoH max concurrent queries reached, ignoring query [ignoring repeated messages]
09-28 00:04:19 dns,error cache full, not storing
09-28 00:04:19 dns,error cache full, not storing [ignoring repeated messages]
09-28 00:04:29 dns,error cache full, not storing
09-28 00:04:29 dns,error cache full, not storing [ignoring repeated messages]
09-28 00:04:40 dns,error cache full, not storing
09-28 00:04:40 dns,error cache full, not storing [ignoring repeated messages]
09-28 00:04:50 dns,error cache full, not storing
09-28 00:04:50 dns,error cache full, not storing [ignoring repeated messages]
09-28 00:05:00 dns,error cache full, not storing
09-28 00:05:00 dns,error cache full, not storing [ignoring repeated messages]
09-28 00:05:10 dns,error cache full, not storing
09-28 00:05:10 dns,error cache full, not storing [ignoring repeated messages]
09-28 00:05:20 dns,error cache full, not storing
09-28 00:05:20 dns,error cache full, not storing [ignoring repeated messages]
09-28 00:05:30 dns,error cache full, not storing
09-28 00:05:30 dns,error cache full, not storing [ignoring repeated messages]
09-28 00:05:41 dns,error cache full, not storing
09-28 00:05:41 dns,error cache full, not storing [ignoring repeated messages]
09-28 00:05:57 dns,error cache full, not storing
09-28 00:05:57 dns,error cache full, not storing [ignoring repeated messages]
09-28 00:06:10 dns,error cache full, not storing
[foo@bar] /ip/dns/cache/all> print count-only
133
/ip/dns/cache/flush
/ip/dns/cache/all/print count-only
12
cache-size: 2048KiB
cache-used: 2048KiB
I encountered a similar issue with version 7.15.3, and there is currently no solution available. The only approach you can try is to continuously increase the size of the DNS cache.My log is flooding with messages of dns cache full:
I never seen or had this before. But 132 cache entries seem not much. But use up all 2mib of cache? These "cache full" messages I see for several hours now. So it seems the cache entries do not expire or free.Code: Select all09-28 00:04:07 dns,error cache full, not storing 09-28 00:04:07 dns,error cache full, not storing [ignoring repeated messages] 09-28 00:04:09 dns,warning DoH max concurrent queries reached, ignoring query 09-28 00:04:09 dns,warning DoH max concurrent queries reached, ignoring query [ignoring repeated messages] 09-28 00:04:19 dns,error cache full, not storing 09-28 00:04:19 dns,error cache full, not storing [ignoring repeated messages] 09-28 00:04:29 dns,error cache full, not storing 09-28 00:04:29 dns,error cache full, not storing [ignoring repeated messages] 09-28 00:04:40 dns,error cache full, not storing 09-28 00:04:40 dns,error cache full, not storing [ignoring repeated messages] 09-28 00:04:50 dns,error cache full, not storing 09-28 00:04:50 dns,error cache full, not storing [ignoring repeated messages] 09-28 00:05:00 dns,error cache full, not storing 09-28 00:05:00 dns,error cache full, not storing [ignoring repeated messages] 09-28 00:05:10 dns,error cache full, not storing 09-28 00:05:10 dns,error cache full, not storing [ignoring repeated messages] 09-28 00:05:20 dns,error cache full, not storing 09-28 00:05:20 dns,error cache full, not storing [ignoring repeated messages] 09-28 00:05:30 dns,error cache full, not storing 09-28 00:05:30 dns,error cache full, not storing [ignoring repeated messages] 09-28 00:05:41 dns,error cache full, not storing 09-28 00:05:41 dns,error cache full, not storing [ignoring repeated messages] 09-28 00:05:57 dns,error cache full, not storing 09-28 00:05:57 dns,error cache full, not storing [ignoring repeated messages] 09-28 00:06:10 dns,error cache full, not storing
Anyone a clue?Code: Select all[foo@bar] /ip/dns/cache/all> print count-only 133
Another finding:
After a
there are only 12 cache items left:Code: Select all/ip/dns/cache/flush
But the cache is still utilized to the full 2048kib.Code: Select all/ip/dns/cache/all/print count-only 12
And I still get the "cache full" errors.Code: Select allcache-size: 2048KiB cache-used: 2048KiB
Holy chick.
And another finding: viewtopic.php?t=209252
And another finding: viewtopic.php?t=208218#p1085660
What's wrong? This cna't be a bug known and reported months ago.
2024-09-28_00-11.png
When you have behavior like that, the internal filesystem used to store configuration is probably corrupted, e.g. due to the flash having been completely filled at some time. Do a netinstall to recover from that.My RouterOS 7.15.3 was upgraded to version 7.16, and DNS functionality encountered issues:
1. Upgraded from version 7.15.3 to 7.16 using the /system package check-for-upgrade by winbox.
2. After the automatic reboot, an autoupgrade was generated, but the DNS dynamic servers were empty. However, both ip-dhcp-client and ipv6-dhcp-client were able to retrieve DNS information.
3. After a manual reboot, the DNS configuration was completely lost, including the "allow remote requests" setting, which was reset to its default (disabled). Manually configured DNS servers were empty, and the dns-static entries were cleared.
Does not sound normal. I have about 1050 cache entries and cache uses about 500 kB of RAM for this......
Another finding:
After a
there are only 12 cache items left:Code: Select all/ip/dns/cache/flush
But the cache is still utilized to the full 2048kib.Code: Select all/ip/dns/cache/all/print count-only 12
And I still get the "cache full" errors.Code: Select allcache-size: 2048KiB cache-used: 2048KiB
Holy chick.
And another finding: viewtopic.php?t=209252
And another finding: viewtopic.php?t=208218#p1085660
What's wrong? This cna't be a bug known and reported months ago.
2024-09-28_00-11.png
If the DNS server run by RouterOS has two /ip/dns/static records (in that order):But I don't know why you'd get NXDOMAIN back if there was /ip/dns/static using it....
The issue occurred on multiple devices running version 7.15.3. Are you suggesting that all the storage devices have failed?When you have behavior like that, the internal filesystem used to store configuration is probably corrupted, e.g. due to the flash having been completely filled at some time. Do a netinstall to recover from that.My RouterOS 7.15.3 was upgraded to version 7.16, and DNS functionality encountered issues:
1. Upgraded from version 7.15.3 to 7.16 using the /system package check-for-upgrade by winbox.
2. After the automatic reboot, an autoupgrade was generated, but the DNS dynamic servers were empty. However, both ip-dhcp-client and ipv6-dhcp-client were able to retrieve DNS information.
3. After a manual reboot, the DNS configuration was completely lost, including the "allow remote requests" setting, which was reset to its default (disabled). Manually configured DNS servers were empty, and the dns-static entries were cleared.
Also, it is completely useless to complain about behavior of some subsystem like DNS without at least showing how you configured it.
E.g. I never use DoH and adlist, only have static and sometimes automatic DNS resolver entries, and maybe some static records, and for me it all works fine. But I do increase the default cache size, no idea why it is so small by default, most devices have ample RAM memory.
Yes, you're wrong. The regex entry matches instead.If the DNS server run by RouterOS has two /ip/dns/static records (in that order):But I don't know why you'd get NXDOMAIN back if there was /ip/dns/static using it....
Then, per my understanding of the docs, client’s request for nas.home.arpa is going to match [2].
- nas.home.arpa A 192.168.1.101
- *.home.arpa$ NXDOMAIN
Am i wrong?
All my dynamic IP list entries are missing after the upgrade. I had to add them again from backup.
No, don't have that problem. Routers (and memory usage) are stable.Hi
We have updated all routers to 7.16 since Wednesday.
Now we have the problem that the routers hang up after a while and no longer allow connections. The only thing that helps is a restart.
Both CHR version and hardware such as RB5009UPr+S+.
Does anyone have the same problem?
These reports are not very useful when there is no information at all about how the routers are used.
Suspect areas include the DNS resolver. Remove your "adlist", "doh" configuration, set a reasonable cache size (for the device memory) and see if it still occurs.
DNS-01 with LE would be awesome!! had to setup cloudflare for a nginx reverse wildcard cert last week
DNS-01 support for LE would be amazing. I’m not punching holes for port 80 from the world to internal gear but I already use DNS-01 to handle internal certificates for k8s. This is definitely the right path forward.
FWIW, I think that's what he meant by [2]. (it's a bug in the forum... if you use a "numbered list button", it does not create a numbered list, you need a "list=1" not just "list=")Yes, you're wrong. The regex entry matches instead.If the DNS server run by RouterOS has two /ip/dns/static records (in that order):Then, per my understanding of the docs, client’s request for nas.home.arpa is going to match [2]. Am i wrong?
- nas.home.arpa A 192.168.1.101
- *.home.arpa$ NXDOMAIN
/ip/dns/static/add name=nas.home.arpa type=A address=192.168.88.100 match-subdomain=yes
/ip/dns/static/add name=home.arpa type=NXDOMAIN match-subdomain=yes
Pretty sure you created an export, just in case this happens!? Especially after previous event...I really hope this doesn't mean I once again have to set up everything from scratch.
What includes "the packages" exactly?This morning I started upgrading my cAP ac by updating the packages. Now the device seems to be in a boot loop, from my router I can see it disconnecting and connecting constantly and it is not possible to access the UI using WinBox.
I really hope this doesn't mean I once again have to set up everything from scratch.
The basic ones to make things work, nothing extra added there. I don't remember by heart which two there are installed (and cannot check because the thing is bricked).What includes "the packages" exactly?This morning I started upgrading my cAP ac by updating the packages. Now the device seems to be in a boot loop, from my router I can see it disconnecting and connecting constantly and it is not possible to access the UI using WinBox.
I really hope this doesn't mean I once again have to set up everything from scratch.
I did use the built-in functionality. That's what bugs me, MT is really flaky at times.why update packages manually and not use the built-in update functionality?
I'm afraid this is not fixed yet.*) wifi-qcom-ac - improved memory allocating process;
/system/resource/print
uptime: 4d1h43m31s
version: 7.16 (stable)
build-time: 2024-09-20 13:00:27
factory-software: 6.44.6
free-memory: 32.5MiB
total-memory: 128.0MiB
cpu: ARM
cpu-count: 4
cpu-frequency: 672MHz
cpu-load: 1%
free-hdd-space: 736.0KiB
total-hdd-space: 16.0MiB
write-sect-since-reboot: 493
write-sect-total: 32280
architecture-name: arm
board-name: cAP ac
platform: MikroTik
DNS :resolve command is not working as intended.
In ROS 7.15.3, DNS resolution works correctly and queries DNS server:In ROS 7.16, DNS resolution uses the cache and does not seem to query server (10.9.91.200 does not exist in test LAN)::resolve "www.google.com" server=<DNS server>:put [:resolve domain-name="www.google.com" server=10.1.91.200 ]
172.217.20.164Opened SUP-166143:put [:resolve domain-name="www.google.com.br" server=10.90.90.200 ]
failure: dns server failure
Hi
We have updated all routers to 7.16 since Wednesday.
Now we have the problem that the routers hang up after a while and no longer allow connections. The only thing that helps is a restart.
Both CHR version and hardware such as RB5009UPr+S+.
Does anyone have the same problem?
Even on my CCR1009, connections suddenly stopped working after approx. 1d of uptime.Confirm a similar behaviour of 5009 and hap ac3. WAN has an IP address assigned and suddenly stops passing connections. There is no useful info in the log. It happened 2 or 3 times during the last 24 hours. Restart is the only way to make WAN work again.
Before 7.16 the routers had 7.15.3 and worked stable for a couple of weeks without a reboot.
Today the model hex with routeros 7.16 has already failed to respond 3 times and had to be restarted.Even on my CCR1009, connections suddenly stopped working after approx. 1d of uptime.Confirm a similar behaviour of 5009 and hap ac3. WAN has an IP address assigned and suddenly stops passing connections. There is no useful info in the log. It happened 2 or 3 times during the last 24 hours. Restart is the only way to make WAN work again.
Before 7.16 the routers had 7.15.3 and worked stable for a couple of weeks without a reboot.
-faxxe
# 2024-09-30 16:10:18 by RouterOS 7.16
# software id = XXXXXXX
#
# model = RB5009UG+S+
# serial number = HFXXXXXXXXX
/interface bridge
add admin-mac=78:9A:18:61:C7:D5 auto-mac=no comment=BR-CUST name=BR-CUST port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=1-AP
set [ find default-name=ether2 ] name=2-Uplink
set [ find default-name=ether3 ] name=3-Uplink
set [ find default-name=ether4 ] name=4-Uplink
set [ find default-name=ether5 ] name=5-Uplink
set [ find default-name=ether6 ] name=6-Uplink
set [ find default-name=ether7 ] name=7-Uplink
set [ find default-name=ether8 ] name=8-Internet
/interface wireguard
add listen-port=13231 mtu=1420 name=WG01
add listen-port=13232 mtu=1420 name=WG02
/interface vlan
add interface=BR-CUST name=VLAN20-PublicInternet vlan-id=20
/interface list
add name=WAN
add name=LAN
add name=VPN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool-CUSTBusiness ranges=192.168.11.120-192.168.11.150
add name=pool-CUSTGuest ranges=172.18.2.100-172.18.2.200
/ip dhcp-server
add address-pool=pool-CUSTGuest interface=VLAN20-PublicInternet name=CUST-Guest server-address=172.18.2.1
/ip smb users
set [ find default=yes ] disabled=yes
/interface pppoe-client
add add-default-route=yes disabled=no interface=8-Internet name=PROVIDER profile=default-encryption use-peer-dns=yes user=*******************************
/routing bgp template
set default address-families=ip,ipv6 as=65506 disabled=no output.redistribute=connected,bgp router-id=10.0.251.130 routing-table=main
/snmp community
set [ find default=yes ] authentication-protocol=SHA1 security=authorized
/system logging action
set 3 remote=10.15.90.5 src-address=192.168.11.100 syslog-facility=syslog
/interface bridge port
add bridge=BR-CUST comment=defconf interface=2-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=3-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=4-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=5-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=6-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=7-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=sfp-sfpplus1 internal-path-cost=10 path-cost=10
add bridge=BR-CUST interface=1-AP internal-path-cost=10 path-cost=10
add bridge=BR-CUST interface=VLAN20-PublicInternet internal-path-cost=10 path-cost=10 pvid=20
/ip firewall connection tracking
set udp-stream-timeout=5m udp-timeout=5m
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=BR-CUST tagged=1-AP,BR-CUST vlan-ids=20
add bridge=BR-CUST vlan-ids=1
/interface list member
add interface=BR-CUST list=LAN
add interface=8-Internet list=WAN
add interface=WG02 list=VPN
add interface=WG01 list=VPN
/interface wireguard peers
add allowed-address=::/0,0.0.0.0/0 endpoint-address=XXXXXXXXXXXXX endpoint-port=51823 interface=WG01 name=peer1 persistent-keepalive=10s public-key=\
"XXXXXXXXXXXXXXXXXXXXXXX"
add allowed-address=::/0,0.0.0.0/0 endpoint-address=XXXXXXXXXXXXXX endpoint-port=13239 interface=WG02 name=peer2 persistent-keepalive=10s public-key=\
"XXXXXXXXXXXXXXXXXXXXXXXXXX="
/ip address
add address=192.168.11.100/24 interface=BR-CUST network=192.168.11.0
add address=172.20.254.2/28 interface=8-Internet network=172.20.254.0
add address=10.21.255.38/30 interface=WG01 network=10.21.255.36
add address=10.21.252.34/30 interface=WG02 network=10.21.252.32
add address=172.18.2.1/24 interface=VLAN20-PublicInternet network=172.18.2.0
/ip dhcp-client
add comment=defconf interface=8-Internet
/ip dhcp-server network
add address=172.18.2.0/24 dns-server=172.18.2.1 gateway=172.18.2.1
add address=192.168.11.0/24 dns-server=192.168.11.100 gateway=192.168.11.100
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=10.18.0.0/16 list=XXXXXXXXX
add address=10.15.200.0/24 list=XXXXXXXXX
add address=10.15.91.0/24 list=XXXXXXXXX
add address=10.15.90.32 list=YYYYYYYYYYY
add address=10.15.90.68 list=YYYYYYYYYYY
add address=10.1.252.0/24 list=YYYYYYYYYYY
add address=10.0.0.0/8 list=RFC1918
add address=172.16.0.0/12 list=RFC1918
add address=192.168.11.0/16 list=RFC1918
add address=XXXXXXXXXX/27 list=XXXXXXXXX
/ip firewall filter
add action=accept chain=forward in-interface-list=VPN out-interface-list=VPN
add action=accept chain=forward src-address-list=XXXXXXXXX
add action=accept chain=input src-address-list=XXXXXXXXX
add action=accept chain=forward src-address-list=YYYYYYYYYYY
add action=accept chain=input src-address-list=YYYYYYYYYYY
add action=accept chain=output
add action=drop chain=input in-interface=PROVIDER src-address-list=BL_LIST
add action=add-src-to-address-list address-list=BL_LIST address-list-timeout=4w2d10h chain=input dst-port=53,161,123 in-interface=PROVIDER protocol=udp src-address-list=!RFC1918
add action=add-src-to-address-list address-list=BL_LIST address-list-timeout=none-dynamic chain=input dst-port=53,161,123,5060,25,23 in-interface=PROVIDER protocol=tcp src-address-list=\
!RFC1918
add action=drop chain=input dst-port=53,161,123,5060 in-interface=PROVIDER log-prefix="DNS DROP" protocol=udp src-address-list=!RFC1918
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=accept chain=input comment=" accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=" accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="drop invalid" connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat comment=masquerade dst-address=172.20.254.0/24 ipsec-policy=out,none
add action=masquerade chain=srcnat comment=masquerade ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment=masquerade dst-address-list=!RFC1918 ipsec-policy=out,none
/ip firewall service-port
set sip disabled=yes
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set telnet disabled=yes
set ftp address=10.0.0.0/8,192.168.11.0/16,172.16.0.0/12
set www address=10.0.0.0/8,192.168.11.0/16,172.16.0.0/12
set ssh address=10.0.0.0/8,192.168.11.0/16,172.16.0.0/12
set api address=10.0.0.0/8,192.168.11.0/16,172.16.0.0/12
set winbox address=10.0.0.0/8,192.168.11.0/16,172.16.0.0/12
/ip smb shares
set [ find default=yes ] directory=/pub
/ipv6 address
add address=2003:a:a39:5300::1 interface=BR-CUST
/ipv6 dhcp-client
add add-default-route=yes interface=PROVIDER pool-name=PROVIDERV6 request=prefix
/ipv6 dhcp-server
add address-pool=PROVIDERV6 interface=BR-CUST lease-time=15m name=DHCP
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/routing bfd configuration
add disabled=no interfaces=WG02
add disabled=no interfaces=WG01
/routing bgp connection
add add-path-out=all address-families=ip,ipv6 as=65506 connect=yes disabled=no input.filter=BGP-01-IN listen=yes local.role=ebgp name=LOCATION01 output.filter-chain=BGP-01-OUT .redistribute=\
connected,bgp remote.address=10.21.255.37/32 .as=65505 router-id=10.0.251.130 routing-table=main templates=default use-bfd=yes
add add-path-out=all address-families=ip,ipv6 as=65506 connect=yes disabled=no input.filter=BGP-02-IN listen=yes local.role=ebgp name=LOCATION02 output.filter-chain=BGP-02-OUT .redistribute=\
connected,bgp remote.address=10.21.252.33/32 .as=65330 router-id=10.0.251.130 routing-table=main templates=default use-bfd=yes
/routing filter rule
add chain=BGP-02-OUT disabled=no rule="if (dst in 192.168.11.0/24 || dst in 172.18.2.0/24) {accept;} else { set bgp-path-prepend 3; accept}"
add chain=BGP-01-OUT disabled=no rule="if (dst in 192.168.11.0/24 || dst in 172.18.2.0/24) {accept;} else { set bgp-path-prepend 7; accept}"
add chain=BGP-01-IN disabled=no rule="if (dst in 10.18.0.0/16) {set bgp-path-peer-prepend 10; accept}"
add chain=BGP-01-IN disabled=no rule="if (dst in 10.0.0.0/8 || dst in 172.16.0.0/12 || dst in 192.168.11.0/16) {set bgp-path-peer-prepend 12; accept;} "
add chain=BGP-02-IN disabled=no rule="if (dst in 10.15.0.0/16) {set bgp-path-peer-prepend 12; set bgp-path-prepend 12;\r\
\n accept}"
add chain=BGP-02-IN disabled=no rule="if (dst in 10.0.0.0/8 || dst in 172.16.0.0/12 || dst in 192.168.11.0/16) {set bgp-path-peer-prepend 2; accept;} "
/snmp
set contact=MAILADRESS enabled=yes location="CUSTOMER"
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=GW01
/system logging
add action=remote prefix=SI-CUST01 topics=info
add action=remote prefix=SI-CUST01 topics=critical
add action=remote prefix=SI-CUST01 topics=error
add action=remote prefix=SI-CUST01 topics=warning
add prefix=SI-CUST01 topics=backup,bfd,bgp,dhcp,dns,firewall,interface,pppoe,wireguard,backup
/system note
set show-at-login=no
/system script
add dont-require-permissions=no name=AutomaticRestart owner=stc policy=reboot,read,write,test source=":local PingCount 300;\r\
\n:local stop false;\r\
\n:while ([/ping 8.8.8.8 count=1 interval=5]=0 && stop=false) do={\r\
\n :set PingCount (\$PingCount-5);\r\
\n #:log info \"Reboot after \$PingCount s\";\r\
\n :if (\$PingCount<=0) do={\r\
\n :set stop true;\r\
\n :log info \"NOT PING ON 8.8.8.8 - REBOOT!!!\";\r\
\n /system reboot;\r\
\n };\r\
\n};\r\
\n\r\
\n:set PingCount (300-\$PingCount);\r\
\n:if (stop=false) do={:log info \"Reboot stop after \$PingCount/300 s\";};"
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool netwatch
add disabled=no down-script=":log info \"Der Ping test war nicht erfolgreich. Der Router wird neu gestartet\";\r\
\n:if ([/system resource get uptime]>30) do={\r\
\n :log info \"Not ping on 8.8.8.8\";\r\
\n /system script run AutomaticRestart;\r\
\n}" host=8.8.8.8 http-codes="" name=RebootPing startup-delay=3m test-script="" thr-loss-count=20 type=icmp up-script=""
/user group
add name=backup policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,password,sensitive,!winbox,!web,!sniff,!api,!romon,!rest-api
Not good news....I'm afraid this is not fixed yet.*) wifi-qcom-ac - improved memory allocating process;
cAP AC, reboot after 2d22h due to kernel failure.
PRTG monitoring shows increasing memory usage until reboot happens.
Back to daily scheduled reboot for now 8)
I already have an open ticket, will send autosupout there.
I guess I was just impatient, I did eventually see them. So it's 3) none of the aboveThe firewall rules that I have added to catch such traffic still have hits, so I doubt it has been fixed...
bump. This is discussion strictly related to release 7.16How does this about parameter work? Can't figure it out. Docs unavailable.Code: Select all*) console - added "about" filters for "find" and "print where" commands;
It came from the supplier with that version. Going to 7.15.3 and then to 7.16 worked. I have no idea why it did that, I should have saved the log.1) Check the Log file and it will tell you why
2) Why this old version? You should be using 7.16
Most likely space issues because moving from 7.12.x going higher, will probably also install wireless. On a switch ...My CRS310-8G+2S+ simply refuses to upgrade from 7.12.2. The arm package is there, but it doesn't get picked up on reboot.
agreed. something is different since 14.3 that using multiple AX APs or some other similarity just doesnt work. going back to 14.3 and all is stable and good.Thanks @ToTheFull, on my hAP EX2 I had the same problem from v.15.x onwards.
I will stay with v.14.3.
Regards.
tried all ways imaginable - couldn't get it to work besides downgrading...Config looks to be incorrect, either you use routing-table to determine to which vrf this route should belong or you use vrf-interfce. But not the both especially if routing table config does not match the vrf to which vrf-inteface belongs to.it seems vrf-routing is trouble, coming from 7.15.3 static vrf routes were marked inactive and we found no way to get those active, neither deleting, adding new ones, basically all vrf-routes are inactive and show things like:
in addition to static routes within vrfs not working also dynamic routes (added by pppoe client) were inactive within vrfs. this is seriously messed up.Code: Select all4 IsH dst-address=0.0.0.0/0 routing-table=main gateway=10.100.6.5 immediate-gw="" distance=1 scope=30 target-scope=10 vrf-interface=MGMT
finally had to downgrade to 7.15.3 to get this working again.
revisited the issue - well - _before_ upgrading one has to remove the parameter "vrf-interface" from any static vrf routes that do typically carry routing-table=vrf and vrf-interface=NAME which obviously breaks the routes after v7.16 upgrade.tried all ways imaginable - couldn't get it to work besides downgrading...
Config looks to be incorrect, either you use routing-table to determine to which vrf this route should belong or you use vrf-interfce. But not the both especially if routing table config does not match the vrf to which vrf-inteface belongs to.
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=PPPoE-VRF@vrfO routing-table=vrfO scope=30 suppress-hw-offload=no target-scope=10
/system logging
add topics=bgp,debug,!packet,!timer
You are right, I hadn't noticed because this is a service line, not in production, (otherwise I wouldn't have installed the 7.16 that just came out...).No, that is a bug. It is not related to the logging, it is just that you now see what is happening.
Ever since using v7 connected to v6 I have seen those issues...
HI,
I was also hoping to resolve the problem with the Wifi:
SA Query timeout....
I keep having disconnections
Is the only solution to downgrade to 7.14.3?
Thanks
Can you export wireless config here?I have only hap AX3. I don't use Capsman
/interface wifi channel
add band=5ghz-ax disabled=no frequency=5660,5700,5680 name=5Ghz-Andrea \
skip-dfs-channels=10min-cac width=20/40/80mhz
add disabled=no frequency=2412,2437,2472 name=2Ghz-Default width=20mhz
add disabled=no frequency=5180,5260,5500 name=5Ghz-Default width=20/40/80mhz
/interface wifi configuration
add channel.frequency=5540,5500,5260 .width=20/40/80mhz disabled=no mode=ap \
name=5G-Andrea security.authentication-types=wpa2-psk,wpa3-psk ssid=\
Wifi-Andrea
add channel.frequency=2462,2437 .width=20/40mhz disabled=no mode=ap name=\
2G-Andrea security.authentication-types=wpa2-psk,wpa3-psk ssid=\
Wifi-Andrea
add channel.skip-dfs-channels=10min-cac .width=20/40/80mhz disabled=no mode=\
ap name=5Ghz security.authentication-types=wpa2-psk,wpa3-psk ssid=\
Wifi-Andrea
add channel.band=2ghz-ax .frequency=2426-2448,2401-2423,2451-2473 .width=\
20/40mhz-Ce disabled=no mode=ap name=2.4Ghz \
security.authentication-types=wpa2-psk,wpa3-psk ssid=Wifi-Andrea
/interface wifi
set [ find default-name=wifi1 ] configuration=5Ghz configuration.mode=ap \
disabled=no name=wifi1-5Ghz
set [ find default-name=wifi2 ] channel.frequency=\
2426-2448,2401-2423,2451-2473 configuration=2.4Ghz configuration.mode=ap \
disabled=no name=wifi2-2.4Ghz
/interface wifi datapath
add bridge=bridge_LAN disabled=no name=private-LAN
add bridge=bridge_LAN client-isolation=no comment=IoT disabled=no name=\
vlan80-IoT vlan-id=80
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=no disabled=no name=\
IoT wps=disable
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=Home wps=disable
/interface wifi configuration
add datapath=vlan80-IoT disabled=no hide-ssid=yes mode=ap name=IoT security=\
IoT ssid=IoT
/interface wifi
add channel.frequency=2412,2432,2472 configuration=IoT configuration.mode=ap \
disabled=no mac-address=4A:A9:8A:BC:A6:91 master-interface=wifi2-2.4Ghz \
name=wifi-IoT-2Ghz
add configuration=IoT configuration.mode=ap disabled=no mac-address=\
4A:A9:8A:BC:A6:90 master-interface=wifi1-5Ghz name=wifi-IoT-5Ghz
/interface wifi cap
set caps-man-addresses=127.0.0.1 certificate=request discovery-interfaces=all
/interface wifi capsman
set package-path="" require-peer-certificate=no upgrade-policy=none
Even with a fixed router-id set?You are right, I hadn't noticed because this is a service line, not in production, (otherwise I wouldn't have installed the 7.16 that just came out...).No, that is a bug. It is not related to the logging, it is just that you now see what is happening.
Ever since using v7 connected to v6 I have seen those issues...
Apparently the session breaks if an IP changes or is added to any virtual interface.
In your config you haveThis is my export:
Code: Select all/interface wifi channel add band=5ghz-ax disabled=no frequency=5660,5700,5680 name=5Ghz-Andrea \ skip-dfs-channels=10min-cac width=20/40/80mhz add disabled=no frequency=2412,2437,2472 name=2Ghz-Default width=20mhz add disabled=no frequency=5180,5260,5500 name=5Ghz-Default width=20/40/80mhz /interface wifi configuration add channel.frequency=5540,5500,5260 .width=20/40/80mhz disabled=no mode=ap \ name=5G-Andrea security.authentication-types=wpa2-psk,wpa3-psk ssid=\ Wifi-Andrea add channel.frequency=2462,2437 .width=20/40mhz disabled=no mode=ap name=\ 2G-Andrea security.authentication-types=wpa2-psk,wpa3-psk ssid=\ Wifi-Andrea add channel.skip-dfs-channels=10min-cac .width=20/40/80mhz disabled=no mode=\ ap name=5Ghz security.authentication-types=wpa2-psk,wpa3-psk ssid=\ Wifi-Andrea add channel.band=2ghz-ax .frequency=2426-2448,2401-2423,2451-2473 .width=\ 20/40mhz-Ce disabled=no mode=ap name=2.4Ghz \ security.authentication-types=wpa2-psk,wpa3-psk ssid=Wifi-Andrea /interface wifi set [ find default-name=wifi1 ] configuration=5Ghz configuration.mode=ap \ disabled=no name=wifi1-5Ghz set [ find default-name=wifi2 ] channel.frequency=\ 2426-2448,2401-2423,2451-2473 configuration=2.4Ghz configuration.mode=ap \ disabled=no name=wifi2-2.4Ghz /interface wifi datapath add bridge=bridge_LAN disabled=no name=private-LAN add bridge=bridge_LAN client-isolation=no comment=IoT disabled=no name=\ vlan80-IoT vlan-id=80 /interface wifi security add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=no disabled=no name=\ IoT wps=disable add authentication-types=wpa2-psk,wpa3-psk disabled=no name=Home wps=disable /interface wifi configuration add datapath=vlan80-IoT disabled=no hide-ssid=yes mode=ap name=IoT security=\ IoT ssid=IoT /interface wifi add channel.frequency=2412,2432,2472 configuration=IoT configuration.mode=ap \ disabled=no mac-address=4A:A9:8A:BC:A6:91 master-interface=wifi2-2.4Ghz \ name=wifi-IoT-2Ghz add configuration=IoT configuration.mode=ap disabled=no mac-address=\ 4A:A9:8A:BC:A6:90 master-interface=wifi1-5Ghz name=wifi-IoT-5Ghz /interface wifi cap set caps-man-addresses=127.0.0.1 certificate=request discovery-interfaces=all /interface wifi capsman set package-path="" require-peer-certificate=no upgrade-policy=none
Hi,In your config you haveThis is my export:
Code: Select all/interface wifi channel add band=5ghz-ax disabled=no frequency=5660,5700,5680 name=5Ghz-Andrea \ skip-dfs-channels=10min-cac width=20/40/80mhz add disabled=no frequency=2412,2437,2472 name=2Ghz-Default width=20mhz add disabled=no frequency=5180,5260,5500 name=5Ghz-Default width=20/40/80mhz /interface wifi configuration add channel.frequency=5540,5500,5260 .width=20/40/80mhz disabled=no mode=ap \ name=5G-Andrea security.authentication-types=wpa2-psk,wpa3-psk ssid=\ Wifi-Andrea add channel.frequency=2462,2437 .width=20/40mhz disabled=no mode=ap name=\ 2G-Andrea security.authentication-types=wpa2-psk,wpa3-psk ssid=\ Wifi-Andrea add channel.skip-dfs-channels=10min-cac .width=20/40/80mhz disabled=no mode=\ ap name=5Ghz security.authentication-types=wpa2-psk,wpa3-psk ssid=\ Wifi-Andrea add channel.band=2ghz-ax .frequency=2426-2448,2401-2423,2451-2473 .width=\ 20/40mhz-Ce disabled=no mode=ap name=2.4Ghz \ security.authentication-types=wpa2-psk,wpa3-psk ssid=Wifi-Andrea /interface wifi set [ find default-name=wifi1 ] configuration=5Ghz configuration.mode=ap \ disabled=no name=wifi1-5Ghz set [ find default-name=wifi2 ] channel.frequency=\ 2426-2448,2401-2423,2451-2473 configuration=2.4Ghz configuration.mode=ap \ disabled=no name=wifi2-2.4Ghz /interface wifi datapath add bridge=bridge_LAN disabled=no name=private-LAN add bridge=bridge_LAN client-isolation=no comment=IoT disabled=no name=\ vlan80-IoT vlan-id=80 /interface wifi security add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=no disabled=no name=\ IoT wps=disable add authentication-types=wpa2-psk,wpa3-psk disabled=no name=Home wps=disable /interface wifi configuration add datapath=vlan80-IoT disabled=no hide-ssid=yes mode=ap name=IoT security=\ IoT ssid=IoT /interface wifi add channel.frequency=2412,2432,2472 configuration=IoT configuration.mode=ap \ disabled=no mac-address=4A:A9:8A:BC:A6:91 master-interface=wifi2-2.4Ghz \ name=wifi-IoT-2Ghz add configuration=IoT configuration.mode=ap disabled=no mac-address=\ 4A:A9:8A:BC:A6:90 master-interface=wifi1-5Ghz name=wifi-IoT-5Ghz /interface wifi cap set caps-man-addresses=127.0.0.1 certificate=request discovery-interfaces=all /interface wifi capsman set package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifi configuration
add channel.skip-dfs-channels=10min-cac .width=20/40/80mhz disabled=no mode=\
ap name=5Ghz security.authentication-types=wpa2-psk,wpa3-psk ssid=\
Wifi-Andrea
and then you have
/interface wifi
set [ find default-name=wifi1 ] configuration=5Ghz configuration.mode=ap \
disabled=no name=wifi1-5Ghz
You are missing the frequencies in the /interface wifi configuration
/interface wifi channel
add band=5ghz-ax disabled=no frequency=5660,5700,5680 name=5Ghz-Andrea \
skip-dfs-channels=10min-cac width=20/40/80mhz
add disabled=no frequency=2412,2437,2472 name=2Ghz-Default width=20mhz
add disabled=no frequency=5180,5260,5500 name=5Ghz-Default width=20/40/80mhz
/interface wifi configuration
add channel.frequency=5540,5500,5260 .width=20/40/80mhz disabled=no mode=ap \
name=5G-Andrea security.authentication-types=wpa2-psk,wpa3-psk ssid=\
Wifi-Andrea
add channel.frequency=2462,2437 .width=20/40mhz disabled=no mode=ap name=\
2G-Andrea security.authentication-types=wpa2-psk,wpa3-psk ssid=\
Wifi-Andrea
add channel=5Ghz-Andrea channel.skip-dfs-channels=10min-cac .width=\
20/40/80mhz disabled=no mode=ap name=5Ghz security.authentication-types=\
wpa2-psk,wpa3-psk ssid=Wifi-Andrea
add channel.band=2ghz-ax .frequency=2426-2448,2401-2423,2451-2473 .width=\
20/40mhz-Ce disabled=no mode=ap name=2.4Ghz \
security.authentication-types=wpa2-psk,wpa3-psk ssid=Wifi-Andrea
/interface wifi
set [ find default-name=wifi1 ] configuration=5Ghz configuration.mode=ap \
disabled=no name=wifi1-5Ghz
set [ find default-name=wifi2 ] channel.frequency=\
2426-2448,2401-2423,2451-2473 configuration=2.4Ghz configuration.mode=ap \
disabled=no name=wifi2-2.4Ghz
/interface wifi datapath
add bridge=bridge_LAN disabled=no name=private-LAN
add bridge=bridge_LAN client-isolation=no comment=IoT disabled=no name=\
vlan80-IoT vlan-id=80
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=no disabled=no name=\
IoT wps=disable
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=Home wps=disable
/interface wifi configuration
add datapath=vlan80-IoT disabled=no hide-ssid=yes mode=ap name=IoT security=\
IoT ssid=IoT
/interface wifi
add channel.frequency=2412,2432,2472 configuration=IoT configuration.mode=ap \
disabled=no mac-address=4A:A9:8A:BC:A6:91 master-interface=wifi2-2.4Ghz \
name=wifi-IoT-2Ghz
add configuration=IoT configuration.mode=ap disabled=no mac-address=\
4A:A9:8A:BC:A6:90 master-interface=wifi1-5Ghz name=wifi-IoT-5Ghz
SA Query timeout issue is still there unfortunately. I had my Zoom video meeting disconnected multiple times after the upgrade to 7.16.
I use hAP ax3 with WPA3 disabled (that kind of helped at 7.15.3) and the laptop with AX203 card running the latest drivers.
Interestingly my old hAP ac2 with wifi-qcom-ac worked fine with WPA3 enabled at 7.15.3...
hAP ax3 and hAP ac2 have the same configuration and I am a bit tired of swapping the devices when I need stable Wi-Fi connection.
But you could upgrade your 7 year old switch to newly developed software in 2024!Success: CRS326 upgrade from 7.13 -> 7.16
Took 4 minutes before switch started pinging again.
No, that is not true. The DNS resolver processes the entries from top to bottom (like the firewall) so you can have that config.
I am on 8+ days and RAM is declining indeed. I have not enabled graphing so I can't proof it. But 2 days ago it was 31 or 32MiB free-memory. Now it is down to 29.3MiB. Let's see where this is going.Not good news....
I use 44 piece cap AC with qcom-ac (more VLAN and ~70 piece wifi client with 802.11r fast BSS transitions ( roaming), routeros 7.15.3 and 7.16rc1-5).
After 7-10 days runs out the cap's memory.
/system/resource/print
uptime: 1w1d9m
version: 7.16 (stable)
build-time: 2024-09-20 13:00:27
factory-software: 6.44.6
free-memory: 29.3MiB
total-memory: 128.0MiB
cpu: ARM
cpu-count: 4
cpu-frequency: 448MHz
cpu-load: 1%
free-hdd-space: 736.0KiB
total-hdd-space: 16.0MiB
write-sect-since-reboot: 1128
write-sect-total: 32915
architecture-name: arm
board-name: cAP ac
platform: MikroTik