v6.36.2 [current] is released!

Wed Aug 24, 2016 1:36 pm

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

What's new in 6.36.2 (2016-Aug-22 12:54):

*) arm - show cpu frequency under resources menu;
*) capsman - fixed upgrade policy;
*) ccr/crs - fixed SFP+ interface ddmi info reporting function. Info is now refreshed on regular intervals;
*) conntrack - fixed ipv6 timeout display;
*) conntrack - fixed removing icmpv6 connections;
*) dns - avoid unnecessary dynamic server address saving in storage;
*) dns - allow to set query-server-timeout and query-total-timeout only greater than 0s;
*) dns - fixed lockup when dynamic dns server address 0.0.0.0 was received;
*) export - updated default values in /system routerboard settings menu;
*) partitions - fixed crash on repartition when there is not enough free space;
*) sstp - fixed disconnects on transmit for multicore systems;
*) switch - fixed configuration reload on CRS switches;
*) winbox - make queue tree default queue type default-small;

What's new in 6.36.1 (2016-Aug-05 09:39):

*) address-list - allow DNS names with "_" symbol;
*) address-list - check for duplicates when domain name is used in address field;
*) bridge - fixed kernel failure when set-priority action was used in bridge firewall;
*) dns - avoid unnecessary static entry saving in storage;
*) email - increased time which email tool can spend while sending message;
*) export - removed unnecessary "log-prefix" on firewall export;
*) firewall - fixed time based rules on time/timezone changes;
*) log - logs loaded from disk after reboot didn't have correct topics;
*) lte - fixed access technology update;
*) ovpn - add special exception route for tunnel itself when using add-default-route;
*) ping - fixed freezing on "not running" interfaces;
*) resource - fixed free-memory reporting after disk eject;
*) snmp - fixed packet corruption when multiple trap-targets were used;
*) tile - fixed rare kernel crash when fastpath is being active;
*) traffic-flow - fixed kernel failure when traffic-flow target uses small mtu;
*) upnp - fixed nat rule dst-port by making it visible again;
*) upnp - updated to make it work with more UPnP implementations (for example, latest Skype);
*) vrrp - fixed transition to backup state when ipv6 mode and equal priorities are used;
*) webfig - allowed user password changing (broken in v6.36);
*) x86 - fixed crash when igmp-proxy interface becomes "not running" while passing traffic;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after crash.

pe1chl · Wed Aug 24, 2016 3:23 pm

6.36.1 wasn't released as clickable update, right?
I check for updates regularly but always saw 6.36 and now suddenly 6.36.2 with releasenotes for a 6.36.1 that is supposed to be released 2 weeks before...

Wed Aug 24, 2016 3:25 pm

This is not a release date. It is a date when version was built.

Wed Aug 24, 2016 3:25 pm

Yes, .1 release was released only for 9 minutes.

Wed Aug 24, 2016 4:27 pm

*) partitions - fixed crash on repartition when there is not enough free space;

Well - that would explain my bricked 2011 when I tried to repartition to remove a DD-WRT image that I wasn't using.....
If only I'd waited two more days to mess with it.

Wed Aug 24, 2016 5:49 pm

*) partitions - fixed crash on repartition when there is not enough free space;

Well - that would explain my bricked 2011 when I tried to repartition to remove a DD-WRT image that I wasn't using.....
If only I'd waited two more days to mess with it.

This change was in RC for some time already!.

Upgraded few routers from 6.36, all seems to be in order.

benesm1 · Wed Aug 24, 2016 6:52 pm

Hello,
I have three issues with 6.36 and 6.36.2

1) Winbox disconnects after a random interval
2) Can't ping hostname with aaaa record, for example:

/ping thangorodrim.benesovi.eu                       
invalid value for argument address:
    invalid value of mac-address, mac address required
    invalid value for argument ipv6-address
    failure: dns name exists, but no appropriate record

3) Can't add EoIP tunnel with IPv6 remote endpoint:

/interface eoip> add remote-address=2a00:1028:8386:8c5e::1 tunnel-id=0
failure: 2a00:1028:8386:8c5e::1 is not a valid dns name

This works on 6.34.6

patrick7 · Wed Aug 24, 2016 7:02 pm

Maybe you should use eoipv6?

irghost · Wed Aug 24, 2016 7:14 pm

Hello,
I have three issues with 6.36 and 6.36.2

1) Winbox disconnects after a random interval
2) Can't ping hostname with aaaa record, for example:
Code: Select all
/ping thangorodrim.benesovi.eu                       
invalid value for argument address:
    invalid value of mac-address, mac address required
    invalid value for argument ipv6-address
    failure: dns name exists, but no appropriate record
3) Can't add EoIP tunnel with IPv6 remote endpoint:
Code: Select all
/interface eoip> add remote-address=2a00:1028:8386:8c5e::1 tunnel-id=0
failure: 2a00:1028:8386:8c5e::1 is not a valid dns name
This works on 6.34.6

same here

[admin@MikroTik-Amir] > ping ipv6.mikrotikfa.com
invalid value for argument address:
    invalid value of mac-address, mac address required
    invalid value for argument ipv6-address
    failure: dns name exists, but no appropriate record

105547111 · Wed Aug 24, 2016 8:11 pm

One small bug - Upon updating from 6.36 to 6.36.2 on CCR-1016-12G I lost all ipv6. Seems the package was disabled. Had to re-enable and reboot then all the network on ipv6 started to work again.
Nothing else effected only CCR

Wed Aug 24, 2016 9:01 pm

Ping is known to resolve only A records (there are other threads here about that)
It works if you use this syntax:
ping [:resolve ipv6host.example.com]

Wed Aug 24, 2016 10:42 pm

Yes, .1 release was released only for 9 minutes.

What sense does it have?

micromaxi · Wed Aug 24, 2016 11:48 pm

@jarda probably a bug was noticed and that made mikrotik pull the update from production.

proximus · Thu Aug 25, 2016 1:09 am

*) address-list - properly remove unused address-lists from drop-downs;
This issue had been fixed in 6.32.4, but has now returned in 6.36.2.

Thu Aug 25, 2016 10:15 am

benesm1 - Winbox disconnects will be fixed in upcoming Winbox versions.
105547111 - Please write to support@mikrotik.com and report this issue. Tell us exactly how did you perform an upgrade step-by-step.
jarda, micromaxi - We were preparing 6.36.1 for release, had some more fixes already, added them to version, tested and released 6.36.2. 6.36.1 was released only to save it in archive.
proximus - Please write to support@mikrotik.com and report this issue. I am not being able to reproduce issue like this right away.
benesm1, irghost, ZeroByte - Ping issue is reported to our developers. However it is not related to 6.36.2 RouterOS version.

patrick7 · Thu Aug 25, 2016 11:09 am

export verbose in /ip(v6) firewall does not work since 6.36.2 (output is the same as export compact)

Thu Aug 25, 2016 11:58 am

patrick7 - This is working in such way already since 6.36rc8. At that point extra firewall features were added and export will in future work in verbose mode same as in compact mode.

rpingar · Thu Aug 25, 2016 1:35 pm

any update about [Ticket#2016080366000756]

regards
Ros

proximus · Thu Aug 25, 2016 2:04 pm

proximus - Please write to support@mikrotik.com and report this issue. I am not being able to reproduce issue like this right away.
.

Hum, the issue seems to have resolved itself. An old empty address-list from several months ago started showing up in the drop downs. It disappeared right after I generated a supout.rif. Oh well, it's ok now.

benesm1 · Thu Aug 25, 2016 2:55 pm

benesm1 - Winbox disconnects will be fixed in upcoming Winbox versions.
105547111 - Please write to support@mikrotik.com and report this issue. Tell us exactly how did you perform an upgrade step-by-step.
jarda, micromaxi - We were preparing 6.36.1 for release, had some more fixes already, added them to version, tested and released 6.36.2. 6.36.1 was released only to save it in archive.
proximus - Please write to support@mikrotik.com and report this issue. I am not being able to reproduce issue like this right away.
benesm1, irghost, ZeroByte - Ping issue is reported to our developers. However it is not related to 6.36.2 RouterOS version.

Hi,
and what about the IPv6 EoIP?

Chupaka · Thu Aug 25, 2016 3:20 pm

and what about the IPv6 EoIP?

as it was said, just add eoipv6 tunnel, not eoip:

[admin@TestPlace] /interface eoipv6> add remote-address=2a00:1028:8386:8c5e::1 tunnel-id=0

paoloaga · Thu Aug 25, 2016 5:43 pm

6.36.1 was released only to save it in archive.

I am not the only one with OCD!

benesm1 · Thu Aug 25, 2016 6:35 pm

and what about the IPv6 EoIP?
as it was said, just add eoipv6 tunnel, not eoip:
Code: Select all
[admin@TestPlace] /interface eoipv6> add remote-address=2a00:1028:8386:8c5e::1 tunnel-id=0

Ha!
thank you, overlooked that. Works like a charm now.

105547111 · Thu Aug 25, 2016 6:49 pm

benesm1 - Winbox disconnects will be fixed in upcoming Winbox versions.
105547111 - Please write to support@mikrotik.com and report this issue. Tell us exactly how did you perform an upgrade step-by-step.
jarda, micromaxi - We were preparing 6.36.1 for release, had some more fixes already, added them to version, tested and released 6.36.2. 6.36.1 was released only to save it in archive.
proximus - Please write to support@mikrotik.com and report this issue. I am not being able to reproduce issue like this right away.
benesm1, irghost, ZeroByte - Ping issue is reported to our developers. However it is not related to 6.36.2 RouterOS version.

Hi Strods - Done

Ticket#2016082522001359

xavierbt · Thu Aug 25, 2016 8:21 pm

Since version 6.36 fasttrack breaks my dualwan setting. I must disable fattrack rule to get second wan working.
Same configuration works ok in previous version.

pennytone · Thu Aug 25, 2016 10:36 pm

I'm not sure if this was fixed in this release, but here is a (potential) bug I found in 6.36
I've noticed a problem with the RB2011 series routers. I offer a hosted VoIP solution to my customers.
All my customers have a Mikrotik router and cisco phones in their LAN
I vlan and prioritize all phones and voip protocols. All my customers are setup the same way, the only difference is the model mikrotik I install for them.
I've already had 3 customers with the same exact problem. Phones would drop connections to the VoIP server, reconnect and drop again.
I checked everything, dropped packets, TCP timeouts, UDP Timeouts, jitter, latency, server logs, error logs…. everything checked out fine….
I noticed the only customers that were having this problem were customers with an RB2011 on ver 6.36 (yes I made sure the routerboard version was also up to date)
How did I fix the problem?? I changed out their mikrotik rb2011 with a mikrotik RB951Ui-2HnD or Mikrotik RB750r2, anything other than the 2011 worked immediately after installing it. The phones have been rock solid and working flawlessly, like all my other customers.
I saw there is a Mikrotik update today, one of the fixes is IPV6 connection tracking, All my customers are on ipv4.
Any thoughts?

KennyPowers · Fri Aug 26, 2016 12:53 am

**Edit: Looks like this issue is something to do with the routing mark. Moved to bug fix 6.34.6 all working again.

I have a VPN client running for some devices in an address list all was working fine before the upgrade now none of the devices can connect to the internet.

The VPN is connected and if I torch the interface everything starts working again or if I set the VPN default route to 0 (But this stops everything else from connecting)

Anyone any ideas? I think I was on 6.24.. Before I upgraded I cant remember.

Thanks.

pe1chl · Fri Aug 26, 2016 10:31 am

Turn off fasttrack/fastpath.

hashbang · Sun Aug 28, 2016 12:28 pm

Hi,
I"m having high cpu usage on CCR-1072 when using torch. It consumes all the cpu available. Normally its 20-30% but using torch it goes upto 100%

doneware · Sun Aug 28, 2016 1:37 pm

well, it just "bricked" my rb2011 in a weird way. did a

/sys pack up up

remotely, then the router never recovered.
arrived later on site, LCD show the router working, but it wasn't accessible from the "WAN (dhcp over DOCSIS)" neither via SSH
from the local network.

i had capsman, ipv6 running on the box from the base image and ntp as a separate package. but otherwise nothing serious.

luckily www was enabled among "/ip services" so i was able to get in via browser. i know, console is there but i had to find my
console cable, and was too lazy. otherwise even telnet wasn't working (not even after i enabled under /ip services via webfig),
nor was the "new terminal" link in webfig.

the thing was that auto-update installed only "routeros-6.36.2.npk", so i checked the logs:
- it said that "ntp-x.xx" cannot be installed because system-x.xx is missing.
wow, i checked /sys pac print, and it wasn't very crowded

just routeros-6.32-mipsbe was there.
the box was not able to connect to the internet as "dhcp-x.xx" was missing.

so i enabled ftp, as https/ssh does not work w/o security.npk, uploaded a local copy of the "base" image, rebooted, but the router did not install it cause "routeros-x.xx is already installed"
then i downloaded the "extra" zip, and individually uploaded the packages (system, routing, ppp and so on), reboot and voila, stuff works as expected, all config was there, i only had
to reconfigure local wireless to be cap again as without "wireless.npk" the wlan1 interface assigned to cap wasn't there and cap was disabled by the OS.

i had recent routerboot on the device, no complex config whatsoever, and honestly it did not ever happen before with me, not even with major release updates.
kind of strange though.

for less experienced users it could have been really frustrating to get into and recover from such situation.

nishadul · Sun Aug 28, 2016 5:18 pm

RouterOS X86: Show R before interface name of interface list but this interface not connected with any device, why?

hatred · Sun Aug 28, 2016 5:30 pm

Prerouting mangle broken in 6.36 is still broken for me.

skillful · Sun Aug 28, 2016 5:35 pm

RouterOS X86: Show R before interface name of interface list but this interface not connected with any device, why?

This will occur if :

1. the interface is a "Master Port" for another interface that is connected to a device,

Or

2. If the interface is a Bridge Interface

pe1chl · Sun Aug 28, 2016 5:48 pm

Prerouting mangle broken in 6.36 is still broken for me.

Does it work when you disable fastpath/fasttrack?

Chupaka · Sun Aug 28, 2016 6:27 pm

RouterOS X86: Show R before interface name of interface list but this interface not connected with any device, why?

/interface ethernet set etherX disable-running-check=no

hatred · Mon Aug 29, 2016 12:16 am

Prerouting mangle broken in 6.36 is still broken for me.
Does it work when you disable fastpath/fasttrack?

Well, it works that way. But CPU usage has grown significantly.

nishadul · Mon Aug 29, 2016 7:15 am

RouterOS X86: Show R before interface name of interface list but this interface not connected with any device, why?
This will occur if :

1. the interface is a "Master Port" for another interface that is connected to a device,

Or

2. If the interface is a Bridge Interface

This interface is not a Master port and I have not configure it as a bridge interface (it is unused interface), I think maybe it is a bug for x86, so pl check it thoroughly.
Please not I have not find this problem in router board with same ROS v6.36.2

Mon Aug 29, 2016 9:12 am

FastPath/FastTrack is not working while Torch is running. It is completely normal that load on CPU is much higher while Torch is running.

Mangle will not work if FastTrack is enabled. It also means that policy routing will not work. Maybe in past you had FastTrack and everything was working correctly if some interface did not support FastTrack on older version. If we add support to, for example, PPPoE and you upgrade device ,then FastTrack will start to work and firewall will not.

http://wiki.mikrotik.com/wiki/Manual:Wiki/Fasttrack
"Note that not all packets in a connection can be fasttracked, so it is likely to see some packets going through slow path even though connection is marked for fasttrack. This is the reason why fasttrack-connection is usually followed be identical action=accept rule. Fasttracked packets bypass firewall, connection tracking, simple queues, queue tree with parent=global, ip traffic-flow(restriction removed in 6.33), ip accounting, ipsec, hotspot universal client, vrf assignment, so it is up to administrator to make sure fasttrack does not interfere with other configuration; "

Requirements

IPv4 FastTrack is active if following conditions are met:

no mesh, metarouter interface configuration;
sniffer, torch and traffic generator is not running;
/tool mac-scan is not actively used;
/tool ip-scan is not actively used;

hatred · Mon Aug 29, 2016 9:49 am

Mangle will not work if FastTrack is enabled. It also means that policy routing will not work. Maybe in past you had FastTrack and everything was working correctly if some interface did not support FastTrack on older version. If we add support to, for example, PPPoE and you upgrade device ,then FastTrack will start to work and firewall will not.

Sounds reasonable, because I have Dual WAN setup and mangles belong to second WAN interface.
What should I do? Move all firewall mangles to raw section?

Mon Aug 29, 2016 11:54 am

I'm not sure if this was fixed in this release, but here is a (potential) bug I found in 6.36
I've noticed a problem with the RB2011 series routers. I offer a hosted VoIP solution to my customers.
All my customers have a Mikrotik router and cisco phones in their LAN
I vlan and prioritize all phones and voip protocols. All my customers are setup the same way, the only difference is the model mikrotik I install for them.
I've already had 3 customers with the same exact problem. Phones would drop connections to the VoIP server, reconnect and drop again.
I checked everything, dropped packets, TCP timeouts, UDP Timeouts, jitter, latency, server logs, error logs…. everything checked out fine….
I noticed the only customers that were having this problem were customers with an RB2011 on ver 6.36 (yes I made sure the routerboard version was also up to date)
How did I fix the problem?? I changed out their mikrotik rb2011 with a mikrotik RB951Ui-2HnD or Mikrotik RB750r2, anything other than the 2011 worked immediately after installing it. The phones have been rock solid and working flawlessly, like all my other customers.
I saw there is a Mikrotik update today, one of the fixes is IPV6 connection tracking, All my customers are on ipv4.
Any thoughts?

Was this all working fine before you upgraded? Have you tried to downgrade and check if it works again after that? Which version is it working on?

Deantwo · Mon Aug 29, 2016 2:06 pm

http://wiki.mikrotik.com/wiki/Manual:Wiki/Fasttrack

You should maybe move that wiki page to "Manual:Fasttrack" instead, the multiple instances of the word "wiki" looks silly. Or maybe "Manual:Firewall/Fasttrack" would be better?

Also, why doesn't the page explain how to disable fasttrack?

Mon Aug 29, 2016 2:10 pm

Not sure how that happened, it was a mistake. Now it will be here:
http://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack

notToNew · Mon Aug 29, 2016 3:04 pm

benesm1 - Winbox disconnects will be fixed in upcoming Winbox versions.

Hm, that's quiet annoying. It was stable before... Is there any workaround?

Chupaka · Mon Aug 29, 2016 4:09 pm

This interface is not a Master port and I have not configure it as a bridge interface (it is unused interface), I think maybe it is a bug for x86, so pl check it thoroughly.
Please not I have not find this problem in router board with same ROS v6.36.2

have you read my answer? http://forum.mikrotik.com/viewtopic.php ... 40#p554440
on routerboards this parameter does not exist and works as it is set to 'no'

DuduZZZ · Mon Aug 29, 2016 10:34 pm

Platform: CRS125-24G-1S-RM
Software: 6.32.2

After upgrade in the log flooded with that: "OSPF discarding packet, no neighbor with this source address"
This is two switch using VRRP, OSPF, and VLANs. So this is a tipical Layer 3 switch. They see each other in Port-Channel and VLAN interfaces. After I set passive-interface default, the problem is gone. (passive all interface expect the Port-Channel)

/routing ospf interface
add network-type=broadcast passive=yes

I think this is a cosmetic issue.

After upgrading RB3011 (Used as Dude Server) the client no longer working.

nishadul · Tue Aug 30, 2016 5:04 am

This interface is not a Master port and I have not configure it as a bridge interface (it is unused interface), I think maybe it is a bug for x86, so pl check it thoroughly.
Please not I have not find this problem in router board with same ROS v6.36.2
have you read my answer? http://forum.mikrotik.com/viewtopic.php ... 40#p554440
on routerboards this parameter does not exist and works as it is set to 'no'

Thank you Sir, your command is working, I have apply your command to all interface of my router

105547111 · Tue Aug 30, 2016 9:05 pm

Not sure how that happened, it was a mistake. Now it will be here:
http://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack

Hey Normis,

What about in the wireless section it says:

All devices wireless interfaces, if wireless-fp or wireless-cm2 package used

Now with 6.37 all wireless is dropped except for wireless-rep so does wireless-rep support fasttrack? If yes then another revision is needed, if not when will it work in time for 6.37 release?

Cheers!

kewlgai · Thu Sep 01, 2016 7:15 am

v6.36.2 /wireless access-list - mac blocking not working. please resolve issue ty

Rudios · Fri Sep 02, 2016 2:01 pm

and what about the IPv6 EoIP?
as it was said, just add eoipv6 tunnel, not eoip:
Code: Select all
[admin@TestPlace] /interface eoipv6> add remote-address=2a00:1028:8386:8c5e::1 tunnel-id=0
Ha!
thank you, overlooked that. Works like a charm now.

If there are specific IPv6 related interfaces to be created, why are there no tabs on the interface window for these IPv6 tunnels?
If you would go the EoIP tunnel tab on the interfaces window, you could only add 'normal' IPv4 tunnels, no IPv6. The only way to add such IPv6 tunnel is via the main interface tab

dadoremix · Fri Sep 02, 2016 10:00 pm

v6.36.2 /wireless access-list - mac blocking not working. please resolve issue ty

How not?
Im using 6.32.2 and mac acess
Workng all good
See in ap interface, remove check from default authenticate
And now mac filter is working

Sent from my iPhone using Tapatalk

synnest · Sat Sep 03, 2016 1:32 am

zte mf831 is not detected as lte interface on mAP, downgrading to 6.35 solved the problem.

elgrandiegote · Sun Sep 04, 2016 5:02 am

SSL > 50, CPU 100%, low and low memory quickly....
any ideas?
Release 6.35.4 works fine!!!

Chupaka · Mon Sep 05, 2016 4:03 pm

If there are specific IPv6 related interfaces to be created, why are there no tabs on the interface window for these IPv6 tunnels?
If you would go the EoIP tunnel tab on the interfaces window, you could only add 'normal' IPv4 tunnels, no IPv6. The only way to add such IPv6 tunnel is via the main interface tab

well, this part should be fixed somehow

you may write to support@ with this inconsistency

elgrandiegote · Tue Sep 06, 2016 12:04 am

Hello, I see that the problem 100% CPU utilization comes by the side of the email, and imagine the ssl process for the TLS ...
Attached images with crazy error messages.
observe CPU utilization and increases in seconds the memory usage..
if downgrade to 6.35.4 works fine!
any idea about it?

and seconds later....

emils · Tue Sep 06, 2016 1:13 pm

Version 6.36.3 has been released. If you experience any issues with 6.36.2, please upgrade your router and if the problem persists, report to support@mikrotik.com.
http://forum.mikrotik.com/viewtopic.php?f=21&t=111901

Who is online