please at it in WinboxCode: Select all*) radius - added IPSec service (cli only);
Why? Bondings with 2x1Gbps are now shown as 1Gbps which is not true.*) snmp - always report bonding speed as speed from first bonding slave;
Any chance to get some documentation for those features?*) arp - added "local-proxy-arp" feature;
*) bonding - added "forced-mac-address" option;
What was wrong with it?*) traffic-flow - fixed flow sequence counter and length;
Can't see anything in Resources...*) winbox - allow to run profile from "/system resources" menu;
At least it was because ether6 cannot be renamed to ether2: ether2 already exists and will be renamed laterAfter upgrading my CCR1009-8G-1S-1S+ from 6.37.3 to 6.38 the exported config mixed up the interface IDs:
/interface ethernet
set [ find default-name=ether5 ] l2mtu=1520 name=ether1-kbd
set [ find default-name=ether6 ] l2mtu=1520 name=ether2
set [ find default-name=ether7 ] l2mtu=1520 name=ether3
set [ find default-name=ether8 ] l2mtu=1520 name=ether4-inl
set [ find default-name=ether1 ] name=ether5-wan-lacp1-1
set [ find default-name=ether2 ] name=ether6-wan-lacp1-2
set [ find default-name=ether3 ] name=ether7-wan
set [ find default-name=ether4 ] name=ether8-wan
This was definitely NOT the actively running config since i did not rename the interfaces that crappy
Just to make sure that the export was wrong tried to load this config into the zeroed device but it failed.
Is it working out of box? Or need I configure this?
!) ipsec - added support for unique policy generation;
*) ipsec - added ability to specify static IP address at "send-dns" option;
*) ipsec - added ph2 accounting for each policy "/ip ipsec policy ph2-count";
*) ipsec - allow to specify explicit split dns address;
*) ipsec - changed logging topic from error to debug when empty pfkey messages are received;
*) ipsec - do not auto-negotiate more SAs than needed;
*) ipsec - ensure generated policy refers to valid proposal;
*) ipsec - fixed camellia crypto algorithm module loading;
*) ipsec - fixed IPv6 remote prefix;
*) ipsec - fixed kernel failure on tile with sha256 when hardware encryption is not being used;
*) ipsec - fixed peer configuration my-id IPv4 address endianness;
*) ipsec - fixed ph2 auto-negotiation by checking policies in correct order;
*) ipsec - load ipv6 related modules only when ipv6 package is enabled;
*) ipsec - make generated policies always as unique;
*) ipsec - non passive peers will also establish SAs from policy without waiting for the first packet;
*) ipsec - optimized logging under ipsec topic;
*) ipsec - show active flag when policy has active SA;
*) ipsec - show SA "enc-key-size";
*) ipsec - split "mode-config" and "send-dns" arguments;
.
? There is special loopback interface now? Can't find it.*) interface - changed loopback interface mtu to 1500;
For LACP that is Totally Wrong. In protocol less bonding this may be acceptable Something I never Use.patrick7 - Bonding in past reported 2Gbps always. It did not matter if bonding had 2,3,4,5, etc. slave interfaces. Now it will simply report single link speed:
*) snmp - always report bonding speed as speed from first bonding slave;
Correct me if I'm incorrect here but, I don't believe LACP bundles are something that RouterOS does. They haven't implemented that to my knowledge. It's been asked (a lot) and now maybe since they are not focusing on the current routing stack they might do it...For LACP that is Totally Wrong. In protocol less bonding this may be acceptable Something I never Use.patrick7 - Bonding in past reported 2Gbps always. It did not matter if bonding had 2,3,4,5, etc. slave interfaces. Now it will simply report single link speed:
*) snmp - always report bonding speed as speed from first bonding slave;
A bond with LACP have prerequisites that states that all members should be same link speed.
The snmp value for speed on a bond interface with LACP should be speed from first link (all is same) times number of link that have an active partner and is currently Aggregating and Hashing. This is how we can monitor if a fault is bound to happen.
edit:
I was wrong, Mikrotik does support LACP/802.3ad
I'm sorry
Did you read the release notes?I use some tagged VLANs between a RB3011 and the CRS box. When I upgrade the CRS box, the interfaces are not useable and the CRS box is not reachable.
Hello!
Sorry, what mean? There is special loopback interface now? Can't find it.*) interface - changed loopback interface mtu to 1500;
Regards,
Boris
jan/03 00:43:12 ipsec,info respond new phase 1 (Identity Protection): x.x.x.x
2[500]<=>y.y.y.y[500]
jan/03 00:43:13 ipsec,info ISAKMP-SA established x.x.x.x[4500]-y.y.y.y[
4500] spi:zzzz
jan/03 00:43:13 ipsec,info acquired 192.168.23.250 address for y.y.y.y[4500]
jan/03 00:43:13 ipsec,info Xauth login succeeded for user: giomac
jan/03 00:43:14 ipsec,error y.y.y.y[ failed to pre-process ph2 packet.
jan/03 00:43:17 ipsec,error y.y.y.y[ peer sent packet for dead phase2
jan/03 00:43:20 ipsec,error y.y.y.y[ peer sent packet for dead phase2
jan/03 00:43:23 ipsec,error y.y.y.y[ peer sent packet for dead phase2
jan/03 00:43:26 ipsec,error y.y.y.y[ peer sent packet for dead phase2
jan/03 00:43:29 ipsec,error y.y.y.y[ peer sent packet for dead phase2
jan/03 00:43:32 ipsec,error y.y.y.y[ peer sent packet for dead phase2
jan/03 00:43:35 ipsec,error y.y.y.y[ peer sent packet for dead phase2
jan/03 00:43:38 ipsec,error y.y.y.y[ peer sent packet for dead phase2
jan/03 00:43:41 ipsec,error y.y.y.y[ peer sent packet for dead phase2
jan/03 00:43:44 ipsec,info purging ISAKMP-SA x.x.x.x[4500]<=>y.y.y.y[45
00] spi=jjjj.
jan/03 00:43:45 ipsec,info ISAKMP-SA deleted x.x.x.x[4500]-y.y.y.y[4500
] spi:wwww rekey:1
jan/03 00:43:45 ipsec,info releasing address 192.168.23.250
Yes I have. But I'm not using STP and bridges only for the WiFi interfaces. Or have I made a mistake with my thinking?Did you read the release notes?I use some tagged VLANs between a RB3011 and the CRS box. When I upgrade the CRS box, the interfaces are not useable and the CRS box is not reachable.
Hello!
Sorry, what mean? There is special loopback interface now? Can't find it.*) interface - changed loopback interface mtu to 1500;
Regards,
Boris
+1 What does it say? Do we have Loopback Interface Now? Cant seem to find either in winbox nor in cli.
Did you read the release notes?I use some tagged VLANs between a RB3011 and the CRS box. When I upgrade the CRS box, the interfaces are not useable and the CRS box is not reachable.
Bridges have STP enabled by default. Did you set "protocol: none" on your bridges? If not, they have STP.Yes I have. But I'm not using STP and bridges only for the WiFi interfaces. Or have I made a mistake with my thinking?Did you read the release notes?I use some tagged VLANs between a RB3011 and the CRS box. When I upgrade the CRS box, the interfaces are not useable and the CRS box is not reachable.
On the CRS the bridges are disabled, on the RB3011 not of course. I have enabled RSTP on CRS for testing, but same problem.Bridges have STP enabled by default. Did you set "protocol: none" on your bridges? If not, they have STP.Yes I have. But I'm not using STP and bridges only for the WiFi interfaces. Or have I made a mistake with my thinking?Did you read the release notes?I use some tagged VLANs between a RB3011 and the CRS box. When I upgrade the CRS box, the interfaces are not useable and the CRS box is not reachable.
This is well known to all of us this is why we are asking this question.There is no Loopback interface added. If you need loopback interface simply create bridge and do not add any ports to it. (MTU of 1500 is for that empty bridge used as loopback).*) interface - changed loopback interface mtu to 1500;
I have the same problem on two different RouterBOARD 911 Lite5 after the upgrade. I didn't do any overclocking on the devices. Apart from the message I didn't noticed any problems - everything works fine.Hello,
After upgrade in the log appear: system, info, critical - memory overclocked. All device which is contain 128 MB memory.
Devices affected in my network:
1x RB2011UiAS
2x CRS109-8G-1S-2HnD
2x CRS125-24G-1S
Devices not affected in my network:
2x RB3011UiAS
Thanks & Regards,
David
jan/03/2017 11:08:24 system,info,critical memory overclocked
[admin@xxx] > /system routerboard print
;;; Warning: memory overclocked
...
It happens me too - on SXT lite5 with 64MB memory...Hello,
After upgrade in the log appear: system, info, critical - memory overclocked. All device which is contain 128 MB memory.
![]()
# jan/03/2017 21:28:33 by RouterOS 6.38
# software id = 6QRW-GN7H
#
/interface bridge
add admin-mac=00:0C:42:E1:C1:A7 auto-mac=no mtu=1500 name=bridge-local
/interface ethernet
set [ find default-name=ether1 ] advertise=10M-full,100M-full,1000M-full name=\
ether1-gateway rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether2 ] advertise=10M-full,100M-full,1000M-full name=\
ether2-gateway rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether3 ] advertise=10M-full,100M-full,1000M-full name=\
ether3-master-local rx-flow-control=auto speed=1Gbps tx-flow-control=auto
set [ find default-name=ether4 ] advertise=10M-full,100M-full,1000M-full master-port=\
ether3-master-local name=ether4-slave-local rx-flow-control=auto speed=1Gbps \
tx-flow-control=auto
set [ find default-name=ether5 ] advertise=10M-full,100M-full,1000M-full master-port=\
ether3-master-local name=ether5-slave-local rx-flow-control=auto speed=1Gbps \
tx-flow-control=auto
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface bridge port
add bridge=bridge-local interface=ether3-master-local
/interface bridge settings
set use-ip-firewall=yes
/ip settings
set rp-filter=strict tcp-syncookies=yes
/ip address
add address=x.x.x.x/x comment="default configuration" interface=ether3-master-local \
network=x.x.x.x
add address=x.x.x.x/x interface=ether1-gateway network=x.x.x.x
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid disabled=no interface=\
ether2-gateway use-peer-dns=no use-peer-ntp=no
/ip dhcp-server
add address-pool=default-dhcp lease-time=1h name=dhcp1
/ip dhcp-server network
add address=x.x.x.x/x comment="default configuration" dns-server=x.x.x.x \
gateway=x.x.x.x
/ip dns
set allow-remote-requests=yes max-udp-packet-size=512 servers=\
x.x.x.x,x.x.x.x
/ip dns static
add address=x.x.x.x name=router
/ip firewall filter
add action=accept chain=input comment="default configuration" disabled=yes protocol=icmp
add action=accept chain=input comment="default configuration" connection-state=established \
disabled=yes
add action=accept chain=input comment="default configuration" connection-state=related \
disabled=yes
add action=drop chain=input comment="default configuration" disabled=yes in-interface=\
ether1-gateway
add action=accept chain=input comment=Management dst-address=192.168.88.1 in-interface=\
bridge-local
add action=drop chain=input comment="Drop ICMP to gateway (OA)" in-interface=\
ether1-gateway protocol=icmp
add action=drop chain=input comment="Drop ICMP to gateway (Time)" in-interface=\
ether2-gateway protocol=icmp
add action=accept chain=input comment="Allow Established and related connections" \
connection-state=established,related
add action=accept chain=input comment="IPTV multicast forwarding" disabled=yes protocol=\
igmp
add action=accept chain=forward disabled=yes protocol=udp
add action=fasttrack-connection chain=forward comment=Fasttrack connection-state=\
established,related
add action=accept chain=forward connection-state=established,related
add action=jump chain=forward comment="Make jumps to new chains" jump-target=tcp protocol=\
tcp
add action=jump chain=forward jump-target=udp protocol=udp
add action=jump chain=forward jump-target=icmp protocol=icmp
add action=drop chain=input comment="Drop Invalid connections" connection-state=invalid
add action=drop chain=input comment="Drop everything else"
add action=drop chain=forward comment="Block \"bogon\" IP addresses" src-address=0.0.0.0/8
add action=drop chain=forward dst-address=0.0.0.0/8
add action=drop chain=forward src-address=127.0.0.0/8
add action=drop chain=forward dst-address=127.0.0.0/8
add action=drop chain=forward src-address=224.0.0.0/3
add action=drop chain=forward dst-address=224.0.0.0/3
add action=drop chain=tcp comment="deny TFTP" dst-port=69 protocol=tcp
add action=drop chain=tcp comment="deny RPC portmapper" dst-port=111 protocol=tcp
add action=drop chain=tcp comment="deny RPC portmapper" disabled=yes dst-port=135 \
protocol=tcp
add action=drop chain=tcp comment="deny NBT" disabled=yes dst-port=137-139 protocol=tcp
add action=drop chain=tcp comment="deny cifs" disabled=yes dst-port=445 protocol=tcp
add action=drop chain=tcp comment="deny NFS" dst-port=2049 protocol=tcp
add action=drop chain=tcp comment="deny NetBus" dst-port=12345-12346 protocol=tcp
add action=drop chain=tcp comment="deny NetBus" dst-port=20034 protocol=tcp
add action=drop chain=tcp comment="deny BackOriffice" dst-port=3133 protocol=tcp
add action=drop chain=tcp comment="deny DHCP" dst-port=67-68 protocol=tcp
add action=drop chain=udp comment="deny TFTP" dst-port=69 protocol=udp
add action=drop chain=udp comment="deny PRC portmapper" dst-port=111 protocol=udp
add action=drop chain=udp comment="deny PRC portmapper" dst-port=135 protocol=udp
add action=drop chain=udp comment="deny NBT" dst-port=137-139 protocol=udp
add action=drop chain=udp comment="deny NFS" dst-port=2049 protocol=udp
add action=drop chain=udp comment="deny BackOriffice" dst-port=3133 protocol=udp
add action=drop chain=input comment="drop ftp brute forcers" dst-port=21 protocol=tcp \
src-address-list=ftp_blacklist
add action=accept chain=output content="530 Login incorrect" dst-limit=\
1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h \
chain=output content="530 Login incorrect" protocol=tcp
add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 protocol=tcp \
src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=\
input connection-state=new dst-port=22 protocol=tcp
add action=drop chain=forward comment="drop ssh brute downstream" dst-port=22 protocol=tcp \
src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input comment="Port scanners to list " protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input comment="NMAP FIN Stealth scan" protocol=tcp tcp-flags=\
fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input comment="SYN/FIN scan" protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input comment="SYN/RST scan" protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input comment="FIN/PSH/URG scan" protocol=tcp tcp-flags=\
fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input comment="ALL/ALL scan" protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input comment="NMAP NULL scan" protocol=tcp tcp-flags=\
!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="dropping port scanners" src-address-list=\
"port scanners"
add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=icmp
add action=accept chain=icmp comment="net unreachable" icmp-options=3:0 protocol=icmp
add action=accept chain=icmp comment="host unreachable" icmp-options=3:1 protocol=icmp
add action=accept chain=icmp comment="host unreachable fragmentation required" \
icmp-options=3:4 protocol=icmp
add action=accept chain=icmp comment="allow source quench" icmp-options=4:0 protocol=icmp
add action=accept chain=icmp comment="allow echo request" icmp-options=8:0 protocol=icmp
add action=accept chain=icmp comment="allow time exceed" icmp-options=11:0 protocol=icmp
add action=accept chain=icmp comment="allow parameter bad" icmp-options=12:0 protocol=icmp
add action=drop chain=icmp comment="deny all other types"
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address=10.0.0.0/8 new-routing-mark=OA \
passthrough=no
add action=mark-routing chain=prerouting dst-address=172.16.0.0/12 new-routing-mark=OA \
passthrough=no
add action=mark-routing chain=prerouting dst-address=192.168.100.0/24 new-routing-mark=OA \
passthrough=no
add action=mark-routing chain=prerouting disabled=yes dst-address=x.x.x.x \
new-routing-mark=VPN passthrough=no
add action=mark-routing chain=prerouting disabled=yes dst-address=x.x.x.x \
new-routing-mark=OA passthrough=no
add action=mark-routing chain=prerouting disabled=yes dst-address=x.x.x.x \
new-routing-mark=Time passthrough=no
add action=mark-routing chain=prerouting content=x.x.x.x disabled=yes \
new-routing-mark=OA passthrough=no
add action=mark-routing chain=prerouting new-routing-mark=Time passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" out-interface=\
ether1-gateway to-addresses=0.0.0.0
add action=masquerade chain=srcnat out-interface=ether2-gateway
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0
/ip pool
add name=default-dhcp next-pool=default-dhcp ranges=x.x.x.x/x
/ip route
add distance=1 gateway=x.x.x.x routing-mark=OA
add distance=1 gateway=ether2-gateway routing-mark=Time
/ip route rule
add dst-address=x.x.x.x/x table=main
add dst-address=x.x.x.x/x table=OA
add dst-address=x.x.x.x/x table=OA
add dst-address=1x.x.x.x/x table=OA
add routing-mark=OA table=OA
add routing-mark=Time table=Time
add routing-mark=VPN table=VPN
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
/ip smb shares
set [ find default=yes ] disabled=yes
/routing igmp-proxy
set quick-leave=yes
/routing igmp-proxy interface
add alternative-subnets=0.0.0.0/0 disabled=yes interface=ether2-gateway upstream=yes
add disabled=yes interface=bridge-local
/system leds
set 0 interface=wlan1
/system ntp client
set enabled=yes primary-ntp=x.x.x.x secondary-ntp=x.x.x.x
/system routerboard settings
set cpu-frequency=250MHz
/tool bandwidth-server
set enabled=no
/tool mac-server
add interface=ether2-gateway
add interface=ether3-master-local
add interface=ether4-slave-local
add interface=ether5-slave-local
add
add interface=bridge-local
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether2-gateway
add interface=ether3-master-local
add interface=ether4-slave-local
add interface=ether5-slave-local
add
add interface=bridge-local
Last month? Full version with this feature was released only this year.RE: Important note!!!
To avoid STP/RSTP compatibility issues with older RouterOS versions upgrade RouterOS on all routers in Layer2 networks with VLAN and STP/RSTP configurations.
I sure wish I would of known about this issue prior to upgrading a dozen Mikrotiks last month. Because of spanning-tree issues, I had the biggest/longest network outage since starting my ISP business over 10 years ago.
North Idaho Tom Jones
Hmm on my RB2011 with my 50/24 VDSL it appears to be all normal, I achieve the expected upload rate.Something seems wrong with PPPoE upload:
You forgot to read the release notes!!Is this intended? Why? What's the point I am missing?
I've update the "RB2011UiAS" router from 6.37.2 to 6.38 and have same mistake when open the terminal of winbox. Any solution?Hello,
After upgrade in the log appear: system, info, critical - memory overclocked. All device which is contain 128 MB memory.
Devices affected in my network:
1x RB2011UiAS
2x CRS109-8G-1S-2HnD
2x CRS125-24G-1S
Devices not affected in my network:
2x RB3011UiAS
Thanks & Regards,
David
Sure I did not forgot this!You forgot to read the release notes!!Is this intended? Why? What's the point I am missing?
Important note!!!
To avoid STP/RSTP compatibility issues with older RouterOS versions upgrade RouterOS on all routers in Layer2 networks with VLAN and STP/RSTP configurations.
strods from MikroTik Support wrote:I've update the "RB2011UiAS" router from 6.37.2 to 6.38 and have same mistake when open the terminal of winbox. Any solution?Hello,
After upgrade in the log appear: system, info, critical - memory overclocked. All device which is contain 128 MB memory.
Devices affected in my network:
1x RB2011UiAS
2x CRS109-8G-1S-2HnD
2x CRS125-24G-1S
Devices not affected in my network:
2x RB3011UiAS
Thanks & Regards,
David
I return to a version safe 6.36.4 "Bugfix only"...
Thanks DuduZZZ, I read the comment of Mikrotik Support but I prefere usage a version safe where don't show any error.strods from MikroTik Support wrote:
Tue Jan 03, 2017 11:23 am
Do not worry about these overclocked messages - they are still work on progress. If you have not overclocked device manually, then there is no need to worry about that.
We are still improving this feature.
Previously RSTP in RouterOS bridges worked more like a per-VLAN RSTP and caused troubles with standard RSTP with VLANs.Can you elaborate on the RSTP incompatibility? We've been using 6.30/6.34/6.36 for some time now between different devices without a problem, including inter-operating with another vendor (A few HP/Aruba 48 port switches). Does this change affect the inter-operability with other vendors?
Thanks.
I had situation with 6.38 on my CRS
I have CRS-1009 router and CRS-125-24G switch. Both of them was ROS 6.37. I upgraded both to 6.38.
I am using Port based VLAN tagging described in http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN / example #1 on my CRS-125-24
After 6.38 and all IP traffic stopped on my switch. When I disabled Vlan taggings IP traffic started on my management LAN.
I downgraded to 6.37 and Vlan problem disappeared.
İs this the problem you mentioned "To avoid STP/RSTP compatibility issues with older RouterOS versions upgrade RouterOS on all routers in Layer2 networks with VLAN and STP/RSTP configurations."
Thank you.
Hi there,Just upgraded my shiny new HEX (RB750GR3) from v6.37.3 to latest stable v6.38. Unfortunately it did not come back. Instead it keeps beeping every 10sec.
I am not using any fancy stuff just natting between an telco edge router and my internal network. A reset did not work. Will try a Netinstall in a few minutes.
I experienced no problems when upgrading my RB750Gr3 from version 6.37.3 to version 6.38Really would appreciate you or others to confirm if there is a serious problem with this upgrade on RB750Gr3.
Thanks in advance.
Thanks very much for letting me know.I experienced no problems when upgrading my RB750Gr3 from version 6.37.3 to version 6.38Really would appreciate you or others to confirm if there is a serious problem with this upgrade on RB750Gr3.
Thanks in advance.
Mikrotik has confirmed to ignore it if you haven't manually overlocked it. Its a feature they are improving on.i get in logs a critical system error "memory overclocked"
What device you are testing the fasttrack?Updating to 6.38 fastrack is broken, maximum download and upload speed is 150 Mbits, after downgraded to 6.37.3 all ok, speed about 800-850 Mbits
Had no problems upgrading my RB750Gr3 to 6.38, only difference from the described, is that I upgraded from 6.38rc52.Hi there,Just upgraded my shiny new HEX (RB750GR3) from v6.37.3 to latest stable v6.38. Unfortunately it did not come back. Instead it keeps beeping every 10sec.
I am not using any fancy stuff just natting between an telco edge router and my internal network. A reset did not work. Will try a Netinstall in a few minutes.
I also have several of these routers (RB750Gr3's) and as much as I really would love to upgrade to this version, I am a little worried of potentially bricking them thus leaving me without connectivity. Could you please let me know if the netinstall managed to rescue your device or not and also has anyone else with this same version suffered the same problem or is this just one rare occasion?
Really would appreciate you or others to confirm if there is a serious problem with this upgrade on RB750Gr3.
Thanks in advance.
Awesome, thank you for the confirmation and as soon as I get home, I will update mine.Had no problems upgrading my RB750Gr3 to 6.38, only difference from the described, is that I upgraded from 6.38rc52.Hi there,Just upgraded my shiny new HEX (RB750GR3) from v6.37.3 to latest stable v6.38. Unfortunately it did not come back. Instead it keeps beeping every 10sec.
I am not using any fancy stuff just natting between an telco edge router and my internal network. A reset did not work. Will try a Netinstall in a few minutes.
I also have several of these routers (RB750Gr3's) and as much as I really would love to upgrade to this version, I am a little worried of potentially bricking them thus leaving me without connectivity. Could you please let me know if the netinstall managed to rescue your device or not and also has anyone else with this same version suffered the same problem or is this just one rare occasion?
Really would appreciate you or others to confirm if there is a serious problem with this upgrade on RB750Gr3.
Thanks in advance.
Thanks for the explanation. Currently we use straight up RSTP, but I can see a day coming when we could benefit from using MSTP. Any plans to add that option?Previously RSTP in RouterOS bridges worked more like a per-VLAN RSTP and caused troubles with standard RSTP with VLANs.Can you elaborate on the RSTP incompatibility? We've been using 6.30/6.34/6.36 for some time now between different devices without a problem, including inter-operating with another vendor (A few HP/Aruba 48 port switches). Does this change affect the inter-operability with other vendors?
Q
Thanks.
Since most enterprise level switches understand RPVST, likely, there were not any compatibility problems with older RouterOS versions.
It is fixed, I have no problems using 33character passwords and longer. Contact support with supout file if you still cannot use longer passwords.First of all happy new year and nice work on overall ipsec improvements.
But the password length is still capped to 31 characters, which creates incompatibility to previous versions with long xauth passwords
i wrote this here:
http://forum.mikrotik.com/viewtopic.php ... 86#p573186
please try to fix it
model: RouterBOARD 962UiGS-5HacT2HnTWhat device you are testing the fasttrack?Updating to 6.38 fastrack is broken, maximum download and upload speed is 150 Mbits, after downgraded to 6.37.3 all ok, speed about 800-850 Mbits
Please report to support@mikotik.com with a support output file attached.
It is fixed, I have no problems using 33character passwords and longer. Contact support with supout file if you still cannot use longer passwords.First of all happy new year and nice work on overall ipsec improvements.
But the password length is still capped to 31 characters, which creates incompatibility to previous versions with long xauth passwords
i wrote this here:
http://forum.mikrotik.com/viewtopic.php ... 86#p573186
please try to fix it
Fasttrack is working fine for me on a RB951G-2HnD in a simple home NAT setup. Maybe something else in your config is causing it.Updating to 6.38 fastrack is broken, maximum download and upload speed is 150 Mbits, after downgraded to 6.37.3 all ok, speed about 800-850 Mbits
It's been in an RC version for months. It's now in the "current" release channel. If you need the old functionality, there's the "bugfix only" channel.Put it to some beta ROS version first, give it good tests with feedbacks and provide same functionality with minimum reconfiguration required.
I got a nightmare after upgrade ccr1009 & crs125 to 6.38.Changes with RSTP is a complete disaster!!! IMHO such changes are not the subject for release branch! RPVST was great approach with high level of flexibility. Now if we just update all our routers in L2 segment it won't work at all (fortunately tested on the table) and I'm talking about network that comes across few cities not a few offices!
And tell me what should I do with this situation now?
Upgrade to future versions is not possible without almost complete redo of L2 logic of whole network. With RPVST it was also possible to assign different bridges as root for vlans that have same parent interface and yes you may need it in some situations. Now this doesn't work.
Please, revert this changes back!!! Put it to some beta ROS version first, give it good tests with feedbacks and provide same functionality with minimum reconfiguration required. Otherwise it turns for us into hell, really. Especially if similar "surprises" will come in future releases in the branch that considered as production branch.
strods from MikroTik Support wrote:Installed 6.38 to a 50+ device mix of MT routers/crs devices(~50%) and AP's(~50%) from v6.37.1.
Had 3x devices die from a 6.37.1 ->6.38 upgrade ( 1xRBwAP2nD & 2xRB912UAG-2HPnD), had to net-install to fix.
*** Had ALL 5x RB2011UiAS 2x CRS125-24G-1S give a WARNING in the log about OVERCLOCKED RAM at boot.
I am in process of rolling back all 50+ MT devices to 6.37.3..
On my 2011 it works OK. Primary NTP server on the LAN, secondary on the internet.RB2011 with NTP-Package is losing the correct time while displaying "synchronized" after a while, it does not matter if I enter another routerboard or official NTP-Servers. (Standard System-SNTP not tested, as I need the NTP-Server portion)
On my 2011 it works OK. Primary NTP server on the LAN, secondary on the internet.RB2011 with NTP-Package is losing the correct time while displaying "synchronized" after a while, it does not matter if I enter another routerboard or official NTP-Servers. (Standard System-SNTP not tested, as I need the NTP-Server portion)
remote refid st t when poll reach delay offset jitter
==============================================================================
x127.127.8.0 .DCFa. 0 l 73 64 356 0.000 -1.904 2049498
+127.127.28.0 .GPS. 0 l 8 16 377 0.000 13.589 0.187
*127.127.28.1 .PPS. 0 l 7 16 377 0.000 -0.002 0.002
192.168.1.1 192.168.1.3 2 u 34 64 377 0.213 -1.042 0.033
I did notice this bug too: because of not learning MAC-Addresses on the bridge all packets are being broadcasted! My VPN is getting all the ether-master packets.Today I found a severe bug with 6.38:
It will not (or at least incompletely) learn MAC-Addresses on a bridge connected to the master-port of a switch.
What's new in 6.39rc7 (2017-Jan-05 12:24):
*) bridge - fixed MAC address learning from switch master-port;
From the changelog:Hi all,
After upgrade to 6.38, I feel my routerbox temperature too high than before. As I often check before upgraded the temperature about 50-51 but now it is 60-62, anybody have same with me?
My box is: RB850Gx2, already downgrade cpu speed to 400MHz but not effective.
Maybe your clock crystal is too far off to keep synchronized.a periodic "restart" of ntp (disable+delay+enable) solves the problem at the moment for about 5 minutes as the clock deviates again
devices that are using this ntp-server are still getting bad packets with "server-not-synchronized"
Maybe your clock crystal is too far off to keep synchronized.a periodic "restart" of ntp (disable+delay+enable) solves the problem at the moment for about 5 minutes as the clock deviates again
devices that are using this ntp-server are still getting bad packets with "server-not-synchronized"
Thanks problem confirmed, will try to fix in next v6.39rc version
IPsec xAuth with Mode Config (ROS as Client): sometimes after a SA-Rekey the devices are losing their IP-Adresses and are not getting them back until ich do a manual peer "kill connections" which is obviously not the way to go. Until is do this, they have no IP-Address on the Interface making the tunnel anymore and display an invalid policy while at the same time having another identical dynamic policy which is not working because of the missing IP-Address.
/ip firewall filter add connection-state=new chain=forward connection-nat-state=dst-nat dst-port=443 connection-limit=100,32
Is there a detailed description how (PV)(R)STP was handled prior ROS 6.38 versus it is being handled with ROS 6.38?Important note!!!
To avoid STP/RSTP compatibility issues with older RouterOS versions upgrade RouterOS on all routers in Layer2 networks with VLAN and STP/RSTP configurations.
My 951G dropped from 305 Mb/s with ~50% CPU (6.37.3) to 210 Mb/s with 100% CPU (6.38). I had to downgrade to keep the speed up.Software 6.38 cpu usage for fasttrack connections very high. For example ( 951g-2hnd at 750mhz) bandwidth 300 Mbps 6.37.3 cpu usage 30-40, 6.38 cpu usage 80-85.
Totally agree. MikroTik team, please, implement this feature. This would be really helpful.There should be a global setting to restore the old behaviour.
There are large networks which don't use the switch-chip-feature at all and cannot be upgraded at once.
I had situation with 6.38 on my CRS
I have CRS-1009 router and CRS-125-24G switch. Both of them was ROS 6.37. I upgraded both to 6.38.
I am using Port based VLAN tagging described in http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN / example #1 on my CRS-125-24
After 6.38 and all IP traffic stopped on my switch. When I disabled Vlan taggings IP traffic started on my management LAN.
I downgraded to 6.37 and Vlan problem disappeared.
İs this the problem you mentioned "To avoid STP/RSTP compatibility issues with older RouterOS versions upgrade RouterOS on all routers in Layer2 networks with VLAN and STP/RSTP configurations."
Thank you.
I have a RB750Gr3, almost new, received it around xmas. Updated from 6.37.3, got the 100/20 from my VDSL2 connection over PPPoE, with FP for around ~2-10% CPU usage.I have the same issue with the Fasttrack on 6.38. With 6.37.3 I had my full 250mbit internet speed without any issues. With 6.38 it dropped to 30Mbit the packets are going through the FP but not at the rates expected.
Any suggestions? I'm going to upgrade to GR3's in the future to have everything on the FP but since my Comcast upload limits the speed for now it was not needed.
I had situation with 6.38 on my CRS
I have CRS-1009 router and CRS-125-24G switch. Both of them was ROS 6.37. I upgraded both to 6.38.
I am using Port based VLAN tagging described in http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN / example #1 on my CRS-125-24
After 6.38 and all IP traffic stopped on my switch. When I disabled Vlan taggings IP traffic started on my management LAN.
I downgraded to 6.37 and Vlan problem disappeared.
İs this the problem you mentioned "To avoid STP/RSTP compatibility issues with older RouterOS versions upgrade RouterOS on all routers in Layer2 networks with VLAN and STP/RSTP configurations."
Thank you.
no dude package
Strange Bug:
After upgrading my CCR1009-8G-1S-1S+ from 6.37.3 to 6.38 the exported config mixed up the interface IDs:
/interface ethernet
set [ find default-name=ether5 ] l2mtu=1520 name=ether1-kbd
set [ find default-name=ether6 ] l2mtu=1520 name=ether2
set [ find default-name=ether7 ] l2mtu=1520 name=ether3
set [ find default-name=ether8 ] l2mtu=1520 name=ether4-inl
set [ find default-name=ether1 ] name=ether5-wan-lacp1-1
set [ find default-name=ether2 ] name=ether6-wan-lacp1-2
set [ find default-name=ether3 ] name=ether7-wan
set [ find default-name=ether4 ] name=ether8-wan
This was definitely NOT the actively running config since i did not rename the interfaces that crappy
Just to make sure that the export was wrong tried to load this config into the zeroed device but it failed.
after a manual correction to:
/interface ethernet
set [ find default-name=ether1 ] l2mtu=1520 name=ether1-kbd
set [ find default-name=ether2 ] l2mtu=1520
set [ find default-name=ether3 ] l2mtu=1520
set [ find default-name=ether4 ] l2mtu=1520 name=ether4-inl
set [ find default-name=ether5 ] name=ether5-wan-lacp1-1
set [ find default-name=ether6 ] name=ether6-wan-lacp1-2
set [ find default-name=ether7 ] name=ether7-wan
set [ find default-name=ether8 ] name=ether8-wan
everything worked fine.
Is there any explanation for this effect?
Cheers,
Christoph
Thank you for the report, we will try to fix this problem in the v6.39.Hi.
I discovered the following problem with the current 6.38 Release on a RB951G-2HnD with the auto certificate feature of CAPsMan:
If you request certificate with a CAP on the same device as the CAPsMAN, the device is unable to issue the private key for the certificate. The certificate for CAP is created ('I' can be seen in certificate list) but without private key ('K' is missing in certificate list), thus it cannot be used by CAP. Also if you manually create the certificate on the router itself with private key, it's not accepted, log says certificate is not valid anymore, but it actually is ... really weird!
Version 6.37.3 in contrast is working fine.
Best regards
@colinardo
Please report to support@mikrotik.com with a support output file so we could check the configuration and try to reproduce your problem.There is some performance issues on 6.38
On my RB3011
ROS 6.37.3
Download 900Mb/s
Upload 200Mb/s
CPU 14% during speedtest
ROS 6.37.3
Download 260Mb/s
Upload 200Mb/s
CPU 67% during speedtest
I'm back to 6.37.3
Please report to support@mikrotik.com with a support output file so we could check the configuration and try to reproduce your problem.My 951G dropped from 305 Mb/s with ~50% CPU (6.37.3) to 210 Mb/s with 100% CPU (6.38). I had to downgrade to keep the speed up.Software 6.38 cpu usage for fasttrack connections very high. For example ( 951g-2hnd at 750mhz) bandwidth 300 Mbps 6.37.3 cpu usage 30-40, 6.38 cpu usage 80-85.
If I check the profiler I can see the "networking" is taking ~30%. On 6.37.3 it was about 1% on full speed.
Yes, but I wonder why the temperature rise up too high, 10 degree from previous version. Although the box working same function.From the changelog:Hi all,
After upgrade to 6.38, I feel my routerbox temperature too high than before. As I often check before upgraded the temperature about 50-51 but now it is 60-62, anybody have same with me?
My box is: RB850Gx2, already downgrade cpu speed to 400MHz but not effective.
*) rb850Gx2 - fixed pcb temperature monitor if temperature was above 60C;
[admin@MikroTik] > system health print
voltage: 12V
temperature: 49C
cpu-temperature: 60C
[admin@MikroTik] >
From the change log I would assume your board temperature was like 60*C, but ROS was showing lower one (which was fixed in 6.38).Yes, but I wonder why the temperature rise up too high, 10 degree from previous version. Although the box working same function.
Ohh!! I got it, that it mean the box has kidding me so long time... hahaFrom the change log I would assume your board temperature was like 60*C, but ROS was showing lower one (which was fixed in 6.38).Yes, but I wonder why the temperature rise up too high, 10 degree from previous version. Although the box working same function.
Agree. It would be nice if after every new release that a new repo say called old current/stable or something was created and used to store the previous version as it's very frustrating to have to use net install to switch back to the exact version we were running before.Please can 6.37.x be made the bugfix release?
There has to be a convenient way to update routers to this version that proves to be quite stable,
and avoid the current problems with 6.38 without having to go back to 6.36.4
No, please NOT!!! 6.36.4 is the only version which works with some older WIFI-Devices, like INTEL 2200.Please can 6.37.x be made the bugfix release?
There has to be a convenient way to update routers to this version that proves to be quite stable,
and avoid the current problems with 6.38 without having to go back to 6.36.4
I have suggested that in the 6.39rc thread already but I suspect it cannot be done in an existing release (e.g. by serving a different file from the update server)Agree. It would be nice if after every new release that a new repo say called old current/stable or something was created and used to store the previous versionPlease can 6.37.x be made the bugfix release?
There has to be a convenient way to update routers to this version that proves to be quite stable,
and avoid the current problems with 6.38 without having to go back to 6.36.4
We need more detailed report - provide us export file or support output file so we could try to reproduce this problem.Hello! DHCP server in 6.38 and higher version include bug with synthetic NIC (Hyper-V) on my RB-951G. When virtual NIC trying to get offer from dhcp following message in log is appear:
- dhcp,warning,info,debug dhcp1 offering lease Virtual_NIC_IP for Virtual_NIC_MAC without success
As result i lost connect to Hyper-V HOST also. 6.39RC9 - same problem. Return to 6.37 and all become OK again.
To reproduce this problem you just need to try obtain IP by guest OS's NIC (Hyper-V) from DHCP server in 6.38 and higher version ROS. As for me - i must again do upgrade-downgrade cycle on Router in production. This may take a while - 1 day at least. What will take a less time?We need more detailed report - provide us export file or support output file so we could try to reproduce this problem.Hello! DHCP server in 6.38 and higher version include bug with synthetic NIC (Hyper-V) on my RB-951G. When virtual NIC trying to get offer from dhcp following message in log is appear:
- dhcp,warning,info,debug dhcp1 offering lease Virtual_NIC_IP for Virtual_NIC_MAC without success
As result i lost connect to Hyper-V HOST also. 6.39RC9 - same problem. Return to 6.37 and all become OK again.
I think you don't understand. Uldis request a supout.rif file. More information: http://www.mikrotik.com/supportTo reproduce this problem you just need to try obtain IP by guest OS's NIC (Hyper-V) from DHCP server in 6.38 and higher version ROS. As for me - i must again do upgrade-downgrade cycle on Router in production. This may take a while - 1 day at least. What will take a less time?We need more detailed report - provide us export file or support output file so we could try to reproduce this problem.Hello! DHCP server in 6.38 and higher version include bug with synthetic NIC (Hyper-V) on my RB-951G. When virtual NIC trying to get offer from dhcp following message in log is appear:
- dhcp,warning,info,debug dhcp1 offering lease Virtual_NIC_IP for Virtual_NIC_MAC without success
As result i lost connect to Hyper-V HOST also. 6.39RC9 - same problem. Return to 6.37 and all become OK again.
Yes. Mikrotik - DHCP server. Guest OS on HOST and HOST himself - clientsyour hyper-v client is a dhcp-client receiving the address from the DHCP server?
We have observed exactly this with a UniFi UAP-LR and a Soekris Engineering Net4801 board. We have reverted to 6.37.3 to restore correct DHCP behaviour.Yes. Mikrotik - DHCP server. Guest OS on HOST and HOST himself - clientsyour hyper-v client is a dhcp-client receiving the address from the DHCP server?
In addition - when described error is occurred, the affected clients remaining in "offering" state in DHCP server - Leases table with cycled 30s timeout. Seems like synthethic NIC dont answer on offer from DHCP, while real ones work as usual. In ROS 6.37 all work fine with both NIC.
i have the same problem with hap lite, old toshiba notebook with intel 2200bg doesn`t work if upgrade to 6.37.xx or 6.38, works perfectly on 6.36.4No, please NOT!!! 6.36.4 is the only version which works with some older WIFI-Devices, like INTEL 2200.
This version should be supported until the new wireless-package is fixed.
I have >60 IP-Cams, which only work on 6.36.4. I hope no one asks me to replace them all just because of thisi have the same problem with hap lite, old toshiba notebook with intel 2200bg doesn`t work if upgrade to 6.37.xx or 6.38, works perfectly on 6.36.4No, please NOT!!! 6.36.4 is the only version which works with some older WIFI-Devices, like INTEL 2200.
This version should be supported until the new wireless-package is fixed.
Adding an extra repo wouldn't effect anything, wouldn't touch the existing versions available, it only would give users an alternative to install, I.e old stable.No, please NOT!!! 6.36.4 is the only version which works with some older WIFI-Devices, like INTEL 2200.Please can 6.37.x be made the bugfix release?
There has to be a convenient way to update routers to this version that proves to be quite stable,
and avoid the current problems with 6.38 without having to go back to 6.36.4
This version should be supported until the new wireless-package is fixed.
I agree! But the quoted question was not to add an extra version, it was about to replace the current bugfix-version. I support adding a new one!!Adding an extra repo wouldn't effect anything, wouldn't touch the existing versions available, it only would give users an alternative to install, I.e old stable.
My bad, wasn't intended. Should proof read what I type moreI agree! But the quoted question was not to add an extra version, it was about to replace the current bugfix-version. I support adding a new one!!Adding an extra repo wouldn't effect anything, wouldn't touch the existing versions available, it only would give users an alternative to install, I.e old stable.
In some cases it could be nice to have a "countdown timer" with a rule like with address list members,You could use the note feature for that. Enter reason why each rule is made.
my whish is to get an "time"-object which I can add to any firewall-rules. The tiime-object should have an beginning and an end-datetime.In some cases it could be nice to have a "countdown timer" with a rule like with address list members,You could use the note feature for that. Enter reason why each rule is made.
to temporarily open some thing without risk to forget to remove it later, but I do not consider it important
enough to make it into a feature request. The comment feature already is a very nice advantage of
RouterOS over competing products and even operating systems.
Well that is already available, but it appears that it allows only cyclic definitions and no date fields. That can probably be fixed rather easily.my whish is to get an "time"-object which I can add to any firewall-rules. The tiime-object should have an beginning and an end-datetime.
Somehow... it should be available as an own "object", just like the adress-list. If so, I can add several named "time-objects" and add them to te corresponding rules.Well that is already available, but it appears that it allows only cyclic definitions and no date fields. That can probably be fixed rather easily.
time
This matches if the packet arrival time/date is within a given range.
All options are optional, but are ANDed when specified. All times are
interpreted as UTC by default.
--datestart YYYY[-MM[-DD[Thh[:mm[:ss]]]]]
--datestop YYYY[-MM[-DD[Thh[:mm[:ss]]]]]
Only match during the given time, which must be in ISO 8601 "T"
notation. The possible time range is 1970-01-01T00:00:00 to
2038-01-19T04:17:07.
If --datestart or --datestop are not specified, it will default
to 1970-01-01 and 2038-01-19, respectively.
--timestart hh:mm[:ss]
--timestop hh:mm[:ss]
Only match during the given daytime. The possible time range is
00:00:00 to 23:59:59. Leading zeroes are allowed (e.g. "06:03")
and correctly interpreted as base-10.
[!] --monthdays day[,day...]
Only match on the given days of the month. Possible values are 1
to 31. Note that specifying 31 will of course not match on
months which do not have a 31st day; the same goes for 28- or
29-day February.
[!] --weekdays day[,day...]
Only match on the given weekdays. Possible values are Mon, Tue,
Wed, Thu, Fri, Sat, Sun, or values from 1 to 7, respectively.
You may also use two-character variants (Mo, Tu, etc.).
--contiguous
When --timestop is smaller than --timestart value, match this as
a single time period instead distinct intervals. See EXAMPLES.
--kerneltz
Use the kernel timezone instead of UTC to determine whether a
packet meets the time regulations.
I know this from shorewall, It is really a nice feature and a nice addition to Mikrotik and I'd appreciate also this smaller solution.That functionality is not available in netfilter I think, so it would have to be implemented entirely in the management layer.
Just a guess - did you enable fasttrack?hi guys,
does anyone of you encountered problems in PCC after upgrading their Mikrotik OS?
PCC currently is not working anymore after upgrading . please help.
Confirm - at 6.38 (and possibly earlier, updated from 6.37) fasttrack is broken, dynamic rules are in "passtrough", as well as on devices that do not support this feature. Downgrade to 6.37 recovers it.After upgrading to 6.38, my pppoe connection to WAN speed test makes cpu go to 100%. FastTrack counters seem OK --> FastTrack seems to be configured properly.
Because of the cpu, the router no longer gets 300 mbps at 45% of CPU. Now I get up to 200 mbps at 100%.
UPDATE4I might have found some other IPsec related bugs:
1. sometimes the new "PH states" are not correct, traffic is flowing but there is "no PH2" or "ready to send" which often only reverts after phase1 rekey or new phase2
2. if the initiator is reconnecting too fast e.g. after PPPoE 24 hour reconnect and the old SAs are not flushed on responder, the initiator thinks he is connected and has SAs but the responder has an invalid policy and no traffic can flow.
EDIT
If a peer reconnects after PPoE 24h disconnect within DPD timeout and with a another IP address than before, there will be the situation described in 2.,
I tested this by setting delay before attempting to reconnect to a value greater than the DPD timeout which "solved" the problem. Bit this is clearly not the expected behaviour.
UPDATE
even my workaround did not solve the problem
UPDATE2:
now again a second reboot after the upgrade seems to solve this problem for now (testet with a script doing disable+enable)
UPDATE3
second reboot does not solve this for long. after two days the problem is back. responder shows invalid dynamic policy while initiator thinks that he is connected.
as usual, please fix![]()
thank you in advance
No.does this fix the out of order packets on the CCR models when using the encryption hardware acceleration?