v7.15.3 [stable] is released!

pe1chl · Thu Jun 13, 2024 2:01 pm

I think the problem is not only in free space.
I have 3500 KB of free space on my router.

Did you already increase the DNS cache size? It can be changed from 2048 to 20480 without issue on that router.

kos · Thu Jun 13, 2024 2:42 pm

I do not understand what this has to do with a port-knocking mechanism.

When a VPN serve has a "port-knocking" implemented, the client must "knock" in order to connect. Until 7.14.1 "on-down" script was performing the "knocking" perfectly.

pe1chl · Thu Jun 13, 2024 2:59 pm

It depends on what you mean with "until 7.14.1".
This bug was introduced I think in 7.12, before it worked like it does now.

kos · Thu Jun 13, 2024 5:23 pm

It has always been like this - After every unsuccessful attempt of VPN client to connect, "on-down" script is executed.

For example:
Until 7.14.1, if there is on-down=":log info TEST" in the "ppp profile" and the VPN client fails to connect, the result would be:

ovpn,info ovpn-out1: initializing...
ovpn,info ovpn-out1: connecting...
ovpn,info ovpn-out1: disconnected <could not connect>
ovpn,info ovpn-out1: terminating... - could not connect
ovpn,info ovpn-out1: disconnected
script,info TEST
ovpn,info ovpn-out1: initializing...
ovpn,info ovpn-out1: connecting...
ovpn,info ovpn-out1: disconnected <could not connect>
ovpn,info ovpn-out1: terminating... - could not connect
ovpn,info ovpn-out1: disconnected
script,info TEST

In 7.15 and 7.15.1 the script is not executed anymore.

pe1chl · Thu Jun 13, 2024 5:32 pm

I think it was not like that before 7.12, but I am not going to spend the effort to prove it.
However, I had a construct with up and down scripts that worked before 7.12 and started failing because of repeated down script execution.

dwnldr · Thu Jun 13, 2024 5:37 pm

Guys, have you also noted that (nearly) with every major version "comes" different Tx Power ?

If we check "United States" on ax3, with most recent 7.15.1:
ranges: 2402-2472/30
5170-5250/30
5250-5330/24/dfs
5490-5730/24/dfs
5735-5895/30

Those values are the same as on 7.13.x / 7.14.x, BUT :
For instance, till now on 7.13. , 2.4Ghz was Tx Power rated at "27" on channel "1 - 2412Mhz". Now it is "23" with same setup, same channel, same device, BUT rate "27" is available on channel "6 - 2437Mhz". This was just one of the examples, both 2.4 and 5 channels are behaving like this during updates, even if regulatory domain shows different allowed rates. On 5ghz is Freq 5180 rated also "23", but higher channel "149-5745" works with higher Tx Power "28".

Honestly, im confused from those changes between freqs and sw revisions...

szalkerous · Thu Jun 13, 2024 6:51 pm

Did the jump from 7.14.3 to 7.15.1 on a CCR1009 (Tile) Router, and had Winbox 3.40 unable to connect afterwards.

Clearing the WinBox cache did fix this problem.

For anyone else experiencing that issue.

guru431 · Thu Jun 13, 2024 8:32 pm

I think the problem is not only in free space.
I have 3500 KB of free space on my router.
Did you already increase the DNS cache size? It can be changed from 2048 to 20480 without issue on that router.

Yes, of course:

cache-size: 102400KiB
cache-used: 3259KiB

robtor · Thu Jun 13, 2024 11:47 pm

Currently I had problems upgrading this version using CAPsMAN or the Dude.

When trying to upgrade using capsman, it always said it could not find the wifi-qcom-ac-7.15 package. I think the issue has sth. to do with the version number stored in the package itself. It should have searched for the wifi-qcom-ac-7.15.1 package that actually existed on the capsman.

Same for the dude. There was always an error that required packages were missing, but with less details than the error with capsman.

Did anybody had a similar issue with this upgrade step?

sergiot77 · Fri Jun 14, 2024 12:30 am

I try today v7.15 on 3 different 4011.
VPLS vs 7.14 2216 doesn't go running.
After dowgrade it to 7.14 interface goes up with no configuration change.
Anyone noticed this issue?
i haven't upgraded yet but running vpls as well, did you experience this issue running bgp-signalled vpls? if so did you manage to find a solution on 7.15

we do not use bgp-signalled vpls. I opened a ticket to the support and they are still investigating, Same issue on 7.16 beta 1 and 2

nexusds · Sat Jun 15, 2024 7:32 am

tried all this.. and disabling 2g.. IPhones wont connect properly. going back to 14.3 9and without these additions) solves all problems. spent lots of time trying to make 15.x work without success.

Think your config is a bit messy, but not that strange @VadiKO.
What you can try:

- set encryption=ccmp on the for5G security settings
- set authentication-types to wpa2-psk only (had some strange stuff going on with combined wpa2-psk and wpa3-psk)
- set dtim-period (part of the configuration) to 3 (which is advised by Apple)

At last...I prefer to use a single bridge, but that is probably not a problem in your case.

erlinden · Sat Jun 15, 2024 9:29 am

Did anybody had a similar issue with this upgrade step?

Dude never worked for me (errors about incorrect files), upgrade through CAPsMAN works like a charm.

Sure that the path is correct and that the files are indeed in the correct folder?

Marc66FR · Mon Jun 17, 2024 9:56 am

Upgraded hEX from 7.15.0 to 7.15.1 without issues (5 days ago):
* Memory usage is stable and CPU usage is low
* No issues with speed or latency on my 1000/1000 link
* A bit more than 4 MB flash storage available

infabo · Mon Jun 17, 2024 1:10 pm

I don't know if this is a WinBox bug or is related to 7.15.1. winbox shows a default route for lte1 twice. Which is not duplicate on CLI. And what "8 items out of 24" means is completely unknown to me.

pe1chl · Mon Jun 17, 2024 1:59 pm

And what "8 items out of 24" means is completely unknown to me.

That is because the "ip routes" display is effectively a "filter" showing only the IPv4 routes out of all routes (including IPv6).

fischerdouglas · Mon Jun 17, 2024 2:31 pm

That is because the "ip routes" display is effectively a "filter" showing only the IPv4 routes out of all routes (including IPv6).

It's long past time for MikroTik to unify IPv4 and IPv6 commands and menus into IP, and create IPv4 and IPv6 submenus just for specific things.

ID · Mon Jun 17, 2024 3:06 pm

Not a big deal but sum of them not equal out of count.

Mon Jun 17, 2024 3:41 pm

That is because the "ip routes" display is effectively a "filter" showing only the IPv4 routes out of all routes (including IPv6).
It's long past time for MikroTik to unify IPv4 and IPv6 commands and menus into IP, and create IPv4 and IPv6 submenus just for specific things.

This would require a move to netfilter from iptables, a fairly major job. I imagine something like this would be a RouterOS v8 feature.

infabo · Mon Jun 17, 2024 3:54 pm

You mean nftables.

Mon Jun 17, 2024 4:38 pm

It is purely a winbox 3.x issue, unrelated to nftables, iptables, netfilters or anything else.
Like pe1chl already wrote, Winbox takes all routes from routing/route and is applying the filters.

leonardogyn · Mon Jun 17, 2024 6:15 pm

It is purely a winbox 3.x issue, unrelated to nftables, iptables, netfilters or anything else.
Like pe1chl already wrote, Winbox takes all routes from routing/route and is applying the filters.

.
About skins not working at all on 7.15.1, which I reported at viewtopic.php?t=208039#p1080153, were you able to confirm that? Fix for that is expected for something like 7.15.2 or 7.16 only? Thanks!

pe1chl · Mon Jun 17, 2024 7:23 pm

Not a big deal but sum of them not equal out of count.

There are 3 kinds of routes: IPv4, IPv6, and "link" (I think these are used for the link-level non-IP protocols like ARP).
So in your case there are 2 IPv4 routes, 5 IPv6 routes, and there are 4 interfaces, for a total of 11 routes.

infabo · Mon Jun 17, 2024 9:15 pm

Winbox is weird.

GSBNAHID · Tue Jun 18, 2024 7:28 pm

Hello everyone, Useing OS version V7.15.1, Getting some problem with PPPOE Server at Vlan interface being "invalid" after power off/on or normal reboot. Because of invalid pppoe server interface pppoe user cant connect to mikrotik. If manually disable/enable PPPOE server interface make interface valid again , then again pppoe user can connect to mikrotik. Can you please share solution of this kind of problem?

pe1chl · Wed Jun 19, 2024 10:54 am

Well, this of course is not as it should be. But when you are only looking for a workaround for now, you could make a script with this content:

:delay 15
/interface/pppoe-server/disable [find]
/interface/pppoe-server/enable [find]

and then in the scheduler run this script with start-time: startup

Simonej · Wed Jun 19, 2024 11:48 am

With SUP-155649 I was asking how “reselect-interval” ( https://help.mikrotik.com/docs/display/ROS/WiFi ) is working, but still no answer.
Anyone has a clue?

mndtrp · Wed Jun 19, 2024 12:37 pm

hAP ax3, 7.15 and Chromecast strange behaviour.
When I cast a movie from my smartphone to my TV via Chromecast, in a few seconds —no more than 10–20 seconds— all the WiFi devices in the house get disconnected. I mean all of them, 2 phones, 1 laptop and Chromecast itself.
Downgrading to 7.14.3 solved the problem.

I can confirm similar behavior with 7.15.1. Downgrade to 7.14.3 solved the problem for me too.

infabo · Wed Jun 19, 2024 12:52 pm

With SUP-155649 I was asking how “reselect-interval” ( https://help.mikrotik.com/docs/display/ROS/WiFi ) is working, but still no answer.
Anyone has a clue?

viewtopic.php?p=1080246#p1080246

ormandj · Thu Jun 20, 2024 2:43 am

hAP ax3, 7.15 and Chromecast strange behaviour.
When I cast a movie from my smartphone to my TV via Chromecast, in a few seconds —no more than 10–20 seconds— all the WiFi devices in the house get disconnected. I mean all of them, 2 phones, 1 laptop and Chromecast itself.
Downgrading to 7.14.3 solved the problem.
I can confirm similar behavior with 7.15.1. Downgrade to 7.14.3 solved the problem for me too.

What is the SUP number? The previous poster was asked for one by MT but I never saw a response.

ffries · Fri Jun 21, 2024 11:08 am

3) Device has enough free storage space for all RouterOS packages to be downloaded.

How do you monitor free space disk?

pe1chl · Fri Jun 21, 2024 1:47 pm

It depends on the device.
When the device has 16MB of flash and 128MB or more of RAM, the storage does not matter, new packages are downloaded into RAM disk.
When there is more storage, you can check it under System->Resources.

ips · Fri Jun 21, 2024 3:13 pm

I still have disconnection problems with Wifi on hAP AX3. I had to revert to 7.14.3 because I have no time now to debug the issue.

iustin · Fri Jun 21, 2024 7:03 pm

I still have disconnection problems with Wifi on hAP AX3. I had to revert to 7.14.3 because I have no time now to debug the issue.

I'm glad I haven't upgraded yet. And it's been quite a few days, and no answer from Mikrotik? At least on which use cases are affected?

satboxbg · Sat Jun 22, 2024 12:28 am

Exact same situation here with a CRS354, downloads goes to 10Mbps on some ports while upload is fine. Ok after a reboot for a little moment before it start again. I had to rollback to 7.14.3.

I confirm the same problem about 10Mbps download on some ports while upload is OK. I have two CRS354 with MLAG. Version 7.14.3 does not have this problem.

dvdhngs · Sun Jun 23, 2024 7:24 pm

hello everybody! sorry if this isnt the right place for this, but...
if(ros_command(":put [/system health get temperature]")>0,"have","havent")
I have this function on dude, that keep showing logs errors on rb that havent the temperature data.
The question is: There is any workaround to "test" without print error?
obs: the function is placed on setting/apperance of map, 20rb)

Amm0 · Sun Jun 23, 2024 8:10 pm

Yes. But open a topic in The Dude or Scripting section.

hello everybody! sorry if this isnt the right place for this, but...

Please keep this forum topic strictly related to this particular RouterOS release.

bbs2web · Mon Jun 24, 2024 2:57 pm

Bump on this please, has everyone else given up on MLAG on the CRS platform?

We provided supout files for both switches in SUP-155632, there are no interface drops nor drops on the LACP bond used for peer communications but peer link is continuously reported as being down and then immediately back up again. This is causing a constant stream of brief interruptions.

Having a problem with RouterOS 7.15 and 7.15.1 that MLAG peer link drops out causing interruptions in network:
Code: Select all
09:38:01 bridge,warning "bridge" peer disconnected
09:38:01 bridge,warning "bridge" peer link down
09:38:01 bridge,info "bridge" peer link up
09:38:01 bridge,info "bridge" peer connected
09:38:01 bridge,info "bridge" peer becomes primary DC:2C:6E:D2:AF:4B
2 x CRS354-48G-4S+2Q+ setup with 2 x 40G (QSFP+) LACP LAG as the peer link (called bond-peer).

Ports themselves and LACP link does not flap when these notifications happen. QSFP+ ports are interconnected using MikroTik Q+DA0001 DAC (40 Gbps QSFP+ direct attach copper cable).

sirbryan · Mon Jun 24, 2024 3:15 pm

Bump on this please, has everyone else given up on MLAG on the CRS platform?

I haven't. CRS312, CRS354 MLAG'd together with a CCR2116 on one side and a pair of MLAG'd CRS317's on the other. The 312 and 354 are running 7.15, tied together on SFP+ ports with a DAC. (The QSFP+ ports on the 354 have breakout cables for use with my lab routers, and aren't a part of the MLAG.)

The local 317's are running 7.13.2. I also have a pair of MLAG'd CRS317's in the data center that are on 7.14.1.

ormandj · Mon Jun 24, 2024 4:57 pm

I still have disconnection problems with Wifi on hAP AX3. I had to revert to 7.14.3 because I have no time now to debug the issue.
I'm glad I haven't upgraded yet. And it's been quite a few days, and no answer from Mikrotik? At least on which use cases are affected?

Where are the SUP tickets?

I'm running 7.15.1 with no issues on multiple cAP AXs and a huge variety of devices.

donkeyKong · Mon Jun 24, 2024 7:42 pm

Could we get more documentation/information on the QoS at the switch chip level?

For my use-case, I would like to modify the PCP and DSCP values of some packets by taking advantage of a new 7.15 feature. I would also like to keep the existing PCP/DSCP values and for that, will using using trust-l2=keep & trust-l3=keep be the solution?

I've asked a question in another thread (viewtopic.php?t=196068#p1081081) FYI

iustin · Mon Jun 24, 2024 7:50 pm

I'm glad I haven't upgraded yet. And it's been quite a few days, and no answer from Mikrotik? At least on which use cases are affected?
Where are the SUP tickets?

I'm running 7.15.1 with no issues on multiple cAP AXs and a huge variety of devices.

I haven't upgraded so I didn't have any devices running for opening tickets. (Well, I have one remote AP upgraded, but that gets practically 2-3 devices uses).

I wonder what makes the difference between the positive and negative reports? It's not like 7.14 doesn't have its own problems - e.g. I have a cap AC that continuously is rebooted by the watchdog due to a memory leak. Sigh…

pe1chl · Mon Jun 24, 2024 8:36 pm

Could we get more documentation/information on the QoS at the switch chip level?

https://help.mikrotik.com/docs/pages/vi ... =189497483

donkeyKong · Mon Jun 24, 2024 9:41 pm

Could we get more documentation/information on the QoS at the switch chip level?
https://help.mikrotik.com/docs/pages/vi ... =189497483

I’m looking for a diagram explaining the order of rules applied to packets

ericsooter · Mon Jun 24, 2024 11:34 pm

We just upgraded a few of our routers from 7.12.1 to 7.15.1. This broke our vpls sessions. So we downgraded down to 7.14.3 and now they are good again. Is there a known VPLS issue with 7.15.1?

elbob2002 · Tue Jun 25, 2024 12:04 am

We just upgraded a few of our routers from 7.12.1 to 7.15.1. This broke our vpls sessions. So we downgraded down to 7.14.3 and now they are good again. Is there a known VPLS issue with 7.15.1?

Read the other posts. There's a few VPLS issues reported. Or just search for "VPLS" in this very page.

ips · Tue Jun 25, 2024 2:06 pm

I'm glad I haven't upgraded yet. And it's been quite a few days, and no answer from Mikrotik? At least on which use cases are affected?
Where are the SUP tickets?

I'm running 7.15.1 with no issues on multiple cAP AXs and a huge variety of devices.

I re-upgraded to 7.15.1 from 7.14.3 my hAP AX3 and hAP AX lite (CAPsMAN on the AX3). I observe that an IoT device (MAC address starting with 44) continuously associates and connects.

reconnections.png

The IoT device placement is fixed.

I will open a ticket.

nexusds · Tue Jun 25, 2024 7:11 pm

Exact same situation here with a CRS354, downloads goes to 10Mbps on some ports while upload is fine. Ok after a reboot for a little moment before it start again. I had to rollback to 7.14.3.
I confirm the same problem about 10Mbps download on some ports while upload is OK. I have two CRS354 with MLAG. Version 7.14.3 does not have this problem.

Confirmed fixed in the next release (either 15.2 or 16.x).. downshift function problem. downshift doesn't affect LAG ports (at least on other platforms)

raffav · Wed Jun 26, 2024 4:11 am

Where are the SUP tickets?

I'm running 7.15.1 with no issues on multiple cAP AXs and a huge variety of devices.
I re-upgraded to 7.15.1 from 7.14.3 my hAP AX3 and hAP AX lite (CAPsMAN on the AX3). I observe that an IoT device (MAC address starting with 44) continuously associates and connects.
reconnections.png

The IoT device placement is fixed.

I will open a ticket.

Can you share you WiFi config for the 2g
Since from start when I got cap ax I can't use my Iot devices..
2g...
I try all settings combination possible the only one was forcing g only..
I have a open ticket with mk but still no solution..
Now it a bit more stable but I have all this association and disconnection.. Still

hasmidzul · Wed Jun 26, 2024 4:53 am

I still have disconnection problems with Wifi on hAP AX3. I had to revert to 7.14.3 because I have no time now to debug the issue.

Same here..Hap Ax3 7.15.1.wifi 5GHz disconnected issue.Hopefully somebody did report this to mikrotik.

Rox169 · Wed Jun 26, 2024 6:57 am

I still have disconnection problems with Wifi on hAP AX3. I had to revert to 7.14.3 because I have no time now to debug the issue.
Same here..Hap Ax3 7.15.1.wifi 5GHz disconnected issue.Hopefully somebody did report this to mikrotik.

Same here...When I came home my Phone oneplus 9 do not want joint the wifi. Turn off and on wifi on mobile helps..it was not happening in the older ROS.

Wed Jun 26, 2024 8:59 am

I still have disconnection problems with Wifi on hAP AX3. I had to revert to 7.14.3 because I have no time now to debug the issue.
Same here..Hap Ax3 7.15.1.wifi 5GHz disconnected issue.Hopefully somebody did report this to mikrotik.

And why don't you ? The more reports they get in with more info, the easier for them to find the problem.
If everyone is looking at someone else to report, nothing will happen.

And FWIW, no issues on my side with AX line APs (already on 7.16b2 with all devices at home, production devices are on 7.15.1)

ToTheFull · Wed Jun 26, 2024 9:29 am

I've had no wifi flapping since 7_16_beta2

ToTheFull · Wed Jun 26, 2024 9:40 am

Infact I upgraded to 7.16beta2 went back to 7.15_1 then moved forward again 7.16_beta2 for doh+adlist which works ok for me.

hasmidzul · Wed Jun 26, 2024 9:55 am

And why don't you ? The more reports they get in with more info, the easier for them to find the problem.
If everyone is looking at someone else to report, nothing will happen.

And FWIW, no issues on my side with AX line APs (already on 7.16b2 with all devices at home, production devices are on 7.15.1)

I just simply doesnt have the time to spend on logs and writing email and so on.Hopefully somebody has the drive to report SUP ticket.It intermitent though.

Wed Jun 26, 2024 10:13 am

And why don't you ? The more reports they get in with more info, the easier for them to find the problem.
If everyone is looking at someone else to report, nothing will happen.

And FWIW, no issues on my side with AX line APs (already on 7.16b2 with all devices at home, production devices are on 7.15.1)
I just simply doesnt have the time to spend on logs and writing email and so on.Hopefully somebody has the drive to report SUP ticket.It intermitent though.

But you do have time to complain about it ?
Making a ticket doesn't take much longer.

Serious ...

hasmidzul · Wed Jun 26, 2024 10:26 am

But you do have time to complain about it ?
Making a ticket doesn't take much longer.

Serious ...

Maybe I will.

coddy · Wed Jun 26, 2024 1:37 pm

Bump on this please, has everyone else given up on MLAG on the CRS platform?

I have a pair of CRS-317's in MLAG, with two DAC's in a bond forming the MLAG channel between the two CRS-317.
I have an upstream CRS-328P that is running LAG across both CRS-317's (In an MLAG LAG group).
I have AX3 access points coming off the CRS-328P with clients connected to those CAPsMAN access points.

The CRS-317's are connected to ESXi hosts. The ESXi hosts are not configured for LAG, but multipathed. This means that a particular VM will be mapped to a particular egress port of the ESXi at VM startup, and will 'fail over' to the other egress port if the chosen port goes down for some reason.

All works well, UNTIL you reboot one of the CRS-317's forming the MLAG. Whilst the CRS-317 is rebooting everything continues on as normal, maybe a ping or two lost as ESXi switches over to the other CRS-317 for what ever VMs it had running on the CRS-317 I just rebooted, but all VM's remain accessible from the access points.

When the CRS-317 comes back up, everything is ok for a few seconds, then I lose access to a 'random' number of VMs for 5 minutes (arp aging timeout on the CRS-317's I am suspecting). Basically the ESXi host starts using the rebooted CRS-317 for those VM's that were originally using it, but the non-rebooted CRS-317 does not know/see that, flushing the ARP cache on both CRS-317 fixes the problem.

So, at least in my case, the MLAG switches do not converge their ARP caches, but appear to rely on ARP caching aging to fix things for them.

mtrakal · Wed Jun 26, 2024 4:38 pm

routerboard: yes
board-name: hAP ax^2
model: C52iG-5HaxD2HaxD
firmware-type: ipq6000
factory-firmware: 7.5
current-firmware: 7.15.1
upgrade-firmware: 7.15.1

My 2.4Ghz wifi radio stopped working. Same configuration as before, but it's not searchable SSID, not possible to connect. 5g still working like before.
I'm not able to search for any 2g wifi around from Mikrotik:

] > interface/wifi/scan wifi2
No output

] > interface/wifi/frequency-scan wifi2
Columns: CHANNEL, LOAD, NF
CHANNEL LOAD NF
2412 100% -49
2417 100% -49
2422 100% -50
2427 100% -67
2432 99% -64
2437 100% -64
2442 100% -66
2447 99% -68
2452 100% -72
2457 99% -74
2462 100% -77
2467 100% -76
2472 100% -79

But Freq scan still work. But I don't think, that's working... Around me is jut a 6 APs and all are far far away.

5g looks as usual:

] > interface/wifi/frequency-scan wifi5
Flags: P - PRIMARY; S - SECONDARY
Columns: CHANNEL, NETWORKS, LOAD, NF, MAX-SIGNAL, MIN-SIGNAL
CHANNEL NETWORKS LOAD NF MAX-SIGNAL MIN-SIGNAL
S 5180 -96
P 5200 7 2% -97 -82 -92
5220 -96
5240 -96
5260 -95
5280 -96
P 5300 1 19% -95 -80 -80
S 5320 12% -94
5500 -94
5520 -93
5540 -93
5560 -91
5580 -92
5600 -91
5620 15% -89
5640 -91
5660 -91
5680 -90
P 5700 1 1% -91 -75 -75
5720 -91
5745 -91
5765 -91
5785 -92
5805 -93
5825 -93
5845 -104
5865 -104

Could it be FW issue, or Radio is burned out?

Kanzler · Wed Jun 26, 2024 4:45 pm

@mtrakal,
Did it stop working immediately after the update?

mtrakal · Wed Jun 26, 2024 4:51 pm

I'm not sure :(. I've updated FW remotely and checked that's not working when come to the place after days. There was some power outage as well between FW upgrade and checking why radio not working. So I'm not sure if it happen after ROS FW upgrade or after outage, or in any other time :/

Kanzler · Wed Jun 26, 2024 5:06 pm

It could be anything. Have you tried downgrading?

raffav · Wed Jun 26, 2024 9:58 pm

For me my Iot device..
Don't metter which version some of them old smart plug keep flapping.. Connect to disconnect...
If I use other brand no issue at all...
I have to keep 2 access point, cap ac only for Iot 2 Ghz
And cap ax only 5ghz for my devices....

ormandj · Thu Jun 27, 2024 11:47 am

For me my Iot device..
Don't metter which version some of them old smart plug keep flapping.. Connect to disconnect...
If I use other brand no issue at all...
I have to keep 2 access point, cap ac only for Iot 2 Ghz
And cap ax only 5ghz for my devices....

What is your SUP? These wireless issues are not easy to diagnose with comments about disconnects without a supout file and support ticket. So far there have been a few people here indicating they have disconnect issues but none have generated this file and created a support case with it and details of the problem, as far as I’ve seen.

raffav · Thu Jun 27, 2024 9:35 pm

For me my Iot device..
Don't metter which version some of them old smart plug keep flapping.. Connect to disconnect...
If I use other brand no issue at all...
I have to keep 2 access point, cap ac only for Iot 2 Ghz
And cap ax only 5ghz for my devices....
What is your SUP? These wireless issues are not easy to diagnose with comments about disconnects without a supout file and support ticket. So far there have been a few people here indicating they have disconnect issues but none have generated this file and created a support case with it and details of the problem, as far as I’ve seen.

I have a sup case, open 20/Dec/23
I sent also a pcap to them
no fix yet,
the origin of my problem is that from 11 iot devices 6 was not even seeing ssid, while i set up 2.4-ax if i set 2.4 n it was instable, only if I set 2.4-g only
but now 7.15.1/7.16 all devices connect but 2,3 of them keep flapping

15:23:19 dhcp,info dhcp10 deassigned 192.168.0.125 for 1C:3B:xxxxxxxxx05 HS110
15:23:19 dhcp,info dhcp10 assigned 192.168.0.125 for 1C:3B:F3xxxxxxxxx HS110
15:23:19 dhcp,info dhcp10 deassigned 192.168.0.124 for B0:95:xxxxxxxxxCC HS110
15:23:20 dhcp,info dhcp10 assigned 192.168.0.124 for B0:95:75xxxxxxxxx HS110
15:23:38 dhcp,info dhcp10 deassigned 192.168.0.125 for 1C:3B:xxxxxxxxx05 HS110
15:23:40 dhcp,info dhcp10 assigned 192.168.0.125 for 1C:3B:F3xxxxxxxxx HS110
15:23:48 dhcp,info dhcp10 deassigned 192.168.0.125 for 1C:3B:xxxxxxxxx05 HS110
15:23:48 dhcp,info dhcp10 assigned 192.168.0.125 for 1C:3B:F3xxxxxxxxx HS110
15:23:48 dhcp,info dhcp10 deassigned 192.168.0.126 for 1C:3B:xxxxxxxxx68 HS110
15:23:48 dhcp,info dhcp10 assigned 192.168.0.126 for 1C:3B:F3xxxxxxxxx HS110
15:24:06 dhcp,info dhcp10 deassigned 192.168.0.126 for 1C:3B:xxxxxxxxx68 HS110
15:24:06 dhcp,info dhcp10 assigned 192.168.0.126 for 1C:3B:F3xxxxxxxxx HS110
15:24:11 dhcp,info dhcp10 deassigned 192.168.0.125 for 1C:3B:xxxxxxxxx05 HS110
15:24:11 dhcp,info dhcp10 assigned 192.168.0.125 for 1C:3B:F3xxxxxxxxx HS110
15:24:12 dhcp,info dhcp10 deassigned 192.168.0.124 for B0:95:xxxxxxxxxCC HS110
15:24:12 dhcp,info dhcp10 assigned 192.168.0.124 for B0:95:75xxxxxxxxx HS110

Fri Jun 28, 2024 10:42 am

What's new in 7.15.2 (2024-Jun-26 14:42):

*) bth - improved system stability;
*) defconf - configure the default-route property for PPP clients only on devices with a built-in modem;
*) modem - fixed modem firmware upgrade for Chateau 5G and Chateau 5G R16 (introduced in v7.15);
*) route - fixed incorrectly handled route distinguisher and route targets (introduced in v7.15);
*) ssh - fixed SSH cryptographic accelerator selection (introduced in v7.14);
*) switch - fixed limited Tx traffic on Ethernet ports for CRS354 devices (introduced in v7.15);
*) system - fixed an issue where routing configuration was missing after performing a reset, adding a new configuration and then upgrading (introduced in v7.15);
*) winbox/webfig - fixed skins (introduced in v7.15);

fragtion · Fri Jun 28, 2024 12:18 pm

Has the issue of wireless clients being disconnected on hap ax2 been resolved yet? I haven't seen anything in the changelogs yet on this (staying on v7.14.3 in the meanwhile), hopefully someone can confirm

Kanzler · Fri Jun 28, 2024 12:20 pm

No. Otherwise it would be in the changelog

ToTheFull · Fri Jun 28, 2024 12:26 pm

Has the issue of wireless clients being disconnected on hap ax2 been resolved yet? I haven't seen anything in the changelogs yet on this (staying on v7.14.3 in the meanwhile), hopefully someone can confirm

My hAPax2/cAPax has stopped flapping devices on on the latest beta, also DoH seems to work on 1.1.1.1 with add-blocking just dandy.
Did you backup your config and try it yet?

rushlife · Fri Jun 28, 2024 1:22 pm

crs354 fixed ? Ok, I'm deploying....

rpingar · Fri Jun 28, 2024 7:41 pm

Hello everyone, Useing OS version V7.15.1, Getting some problem with PPPOE Server at Vlan interface being "invalid" after power off/on or normal reboot. Because of invalid pppoe server interface pppoe user cant connect to mikrotik. If manually disable/enable PPPOE server interface make interface valid again , then again pppoe user can connect to mikrotik. Can you please share solution of this kind of problem?

take supout when invlaid and open a ticket.
I have similar behavior and have a ticket opened since last year: sup-119592

Mikrotik says that they are not able to reproduce........... I have this behavior on all routers.....

regards

leonardogyn · Fri Jun 28, 2024 11:25 pm

What's new in 7.15.2 (2024-Jun-26 14:42):
*) winbox/webfig - fixed skins (introduced in v7.15);

.
Thanks ... skins are working again on the webfig, thanks a lot :)

akakua · Sat Jun 29, 2024 8:28 am

] > interface/wifi/frequency-scan wifi2
Columns: CHANNEL, LOAD, NF
CHANNEL LOAD NF
2412 100% -49
2417 100% -49
2422 100% -50
2427 100% -67
2432 99% -64
2437 100% -64
2442 100% -66
2447 99% -68
2452 100% -72
2457 99% -74
2462 100% -77
2467 100% -76
2472 100% -79

looks like usb3 interference

infabo · Sat Jun 29, 2024 9:28 am

Upgrade to 7.15.2 without issues. Chateau LTE12, cAP AC and map lite.

MrRobotdev · Sat Jun 29, 2024 11:28 am

Upgrade to 7.15.2 from 7.14.3 on my 2 hAP ax2. The icons left of WIFI and Wireguard disappeared.
I have also 2 hAP ac2 - icons are fine there.
Webfig / browser Chrome

infabo · Sat Jun 29, 2024 11:31 am

Clear Winbox cache.

MrRobotdev · Sat Jun 29, 2024 11:31 am

Clear Winbox cache.

from webfig

infabo · Sat Jun 29, 2024 11:33 am

Oh. Maybe browser cache then. I have this same issue on Mikrotik Android app and clearing caches does not resolve it. Already reported to support.

MrRobotdev · Sat Jun 29, 2024 11:39 am

Oh. Maybe browser cache then. I have this same issue on Mikrotik Android app and clearing caches does not resolve it. Already reported to support.

thanks, clearing images cache, resolve the problem

zBear · Sat Jun 29, 2024 6:36 pm

I have a "problem" with wireguard spamming in log
Before 7.15.2 I was using 7.12.x and had no such issue

Normis was saying that this issue should be fixed in 7.15, but for me it's still here, so I'm suspecting that something is off with my settings
Looking for help to spot the problem

This is how my log looks like

This is one of the peer's settings

infabo · Sat Jun 29, 2024 8:05 pm

tick Responder

zBear · Sat Jun 29, 2024 9:19 pm

tick Responder

sorry, forgot to mention, found it in wiki and already tried it, nothing changed

infabo · Sat Jun 29, 2024 9:25 pm

well, you set persistent keep alive. what do you expect?

zBear · Sat Jun 29, 2024 9:43 pm

well, you set persistent keep alive. what do you expect?

because nothing was changed regarding wireguard on my side, I was expecting the log having the same entries that I had on 7.12

can you please suggest better setting for this situation? should I disable persistent-keepalive completely? or disable persistent-keepalive and use a peer side client-keepalive?

gabacho4 · Sat Jun 29, 2024 9:56 pm

You shouldn't need keep alive for a dynamic peer. How is the router supposed to keep a connection alive with a peer that is disconnected? Just remove the keep alive for the peer and you should be fine.

ips · Sat Jun 29, 2024 10:37 pm

Has the issue of wireless clients being disconnected on hap ax2 been resolved yet? I haven't seen anything in the changelogs yet on this (staying on v7.14.3 in the meanwhile), hopefully someone can confirm

When I upgraded to 7.15.1 from 7.14.3, I had the issue. Then, I reset the device re-applying the configuration from 7.14.3 and the issue disappeared. Maybe some left-over from previous attempts?

I did not upgraded to 7.15.2 since the changelog does not mention items that I need/want.
But I can suggest to try to upgrade.

hasmidzul · Sun Jun 30, 2024 4:12 am

Has the issue of wireless clients being disconnected on hap ax2 been resolved yet? I haven't seen anything in the changelogs yet on this (staying on v7.14.3 in the meanwhile), hopefully someone can confirm

Nope...Hap AX3 here.Im on 7.15.2 from 7.15.1.Wifi clients still disconnecting randomly.

zBear · Sun Jun 30, 2024 8:52 am

Just remove the keep alive for the peer and you should be fine

thanks
found an explanation on reddit about these settings
did exactly that and without responder, my log looks fine now :-)

gabacho4 · Sun Jun 30, 2024 9:21 am

thanks
found an explanation on reddit about these settings
did exactly that and without responder, my log looks fine now :-)

Rock on.

slav0nic · Sun Jun 30, 2024 10:59 am

Has the issue of wireless clients being disconnected on hap ax2 been resolved yet? I haven't seen anything in the changelogs yet on this (staying on v7.14.3 in the meanwhile), hopefully someone can confirm

no, the problem still exists

infabo · Sun Jun 30, 2024 1:52 pm

Anyone else using wifi-qcom-ac on AP with clients in "pseudobridge" mode? Starting with 7.14 I experience network issues (dhcp timeout, no traffic) once there are two pseudobridge clients on the network (or same SSID??) . With one pseudobridge client it works all, but once I connect the other client the issue starts. Sometimes immediately and sometimes it takes some hours.
I suspect some RSTP thingy but I am unable to debug it. Bridge topic dont get logged, stp topic nothing in log as well. 7.13.5 was rock stable in this regards and had not an issue at all. I dont know what changed with 7.14 onwards.

See viewtopic.php?p=1059665#p1059665

mx5gr · Mon Jul 01, 2024 1:08 pm

We updated from 7.15.1 to 7.15.2 to several RB760iGS units.

We have activated the "allow incoming requests" to the DNS server of each device, as it is used by local clients for name resolution.

Since the upgrade, we have been noticing the DNS service to stop responding to requests from clients, every 3-4 hours or so, and receive complaints from users. The only solution is to enable (& save) and disable the "allow incoming requests" setting of the router AND clear the DNS cache.

Even after reverting to back to 7.15.1, the issue remains.

pe1chl · Mon Jul 01, 2024 3:16 pm

I noticed that on the RB5009 when doing a partition copy to (router has been configured with 2 partitions) some timing-critical tasks fail.
(e.g. BGP with BFD, Tool->Netwatch)
I don't think I have seen that with earlier versions...

EternalNet · Mon Jul 01, 2024 4:43 pm

Does anyone have issues with QSFP+ (40gbps) with 7.15.2 ? loops etc ?

- issue with qsfp cable, after connection it was acting as 4x1gb those loops where crated.

DanMos79 · Mon Jul 01, 2024 4:56 pm

I noticed that on the RB5009 when doing a partition copy to (router has been configured with 2 partitions) some timing-critical tasks fail.
(e.g. BGP with BFD, Tool->Netwatch)
I don't think I have seen that with earlier versions...

I have noticed the same when the RB5009 works as CAPsMAN. All CAP interfaces disappear and reappear after a few seconds.
However, this does not happen with every copy operation.

pe1chl · Mon Jul 01, 2024 5:54 pm

Correct, it does not happen every time, but I thought that would be related to the exact moment at which the copy is started....
It appears that the router is "dead" during the copy (probably during the "erase" part), maybe interrupts are disabled during that operation?

mtrakal · Tue Jul 02, 2024 9:18 am

] > interface/wifi/frequency-scan wifi2
Columns: CHANNEL, LOAD, NF
CHANNEL LOAD NF
2412 100% -49
2417 100% -49
2422 100% -50
2427 100% -67
2432 99% -64
2437 100% -64
2442 100% -66
2447 99% -68
2452 100% -72
2457 99% -74
2462 100% -77
2467 100% -76
2472 100% -79
looks like usb3 interference

Hello,
I'm not sure what noise it was, but it realy causes some interferrence/noise, after few days it's back working. Second mikrotik was not broadcast SSID in same room as well, but when I try with same settings in different building, it broadcast without any issue. That's crazy..., but my 2g is working again 🤷‍♂️. Thanks for tips here.

Ullinator · Tue Jul 02, 2024 2:52 pm

Does anyone have issues with QSFP+ (40gbps) with 7.15.2 ? loops etc ?

No, not for me. 2x 40GBit connection to a CRS326-24S+2Q+ (ROS 7.15.2 and Firmware) with cables by FS without any problems.

mx5gr · Tue Jul 02, 2024 4:00 pm

We updated from 7.15.1 to 7.15.2 to several RB760iGS units.

We have activated the "allow incoming requests" to the DNS server of each device, as it is used by local clients for name resolution.

Since the upgrade, we have been noticing the DNS service to stop responding to requests from clients, every 3-4 hours or so, and receive complaints from users. The only solution is to enable (& save) and disable the "allow incoming requests" setting of the router AND clear the DNS cache.

Even after reverting to back to 7.15.1, the issue remains.

Just to add that 7.15.1 and 7.15 both present the same issue. The issue is more intense now, with 10-15 minutes of normal DNS resolution and 5 minutes (or so about) with no resolution been made. Had to revert to 7.14.3.

Support issue opened SUP-157852

infabo · Tue Jul 02, 2024 10:13 pm

how to reproduce?

EternalNet · Wed Jul 03, 2024 2:22 pm

Does anyone have issues with QSFP+ (40gbps) with 7.15.2 ? loops etc ?
No, not for me. 2x 40GBit connection to a CRS326-24S+2Q+ (ROS 7.15.2 and Firmware) with cables by FS without any problems.

Thanks. I found issue with qsfp+ cable, acting as 4x1gb for no reason (faulty)

EternalNet · Wed Jul 03, 2024 2:33 pm

] > interface/wifi/frequency-scan wifi2
Columns: CHANNEL, LOAD, NF
CHANNEL LOAD NF
2412 100% -49
2417 100% -49
2422 100% -50
2427 100% -67
2432 99% -64
2437 100% -64
2442 100% -66
2447 99% -68
2452 100% -72
2457 99% -74
2462 100% -77
2467 100% -76
2472 100% -79
looks like usb3 interference

The more I read the less i know.
There is even intel write up about usb3.0 interference: https://www.usb.org/sites/default/files/327216.pdf

mx5gr · Wed Jul 03, 2024 7:15 pm

how to reproduce?

If you refer to my comment, there is no step to be taken for reproduction.. it just happens continuously after power on!

Apachez · Wed Jul 03, 2024 7:34 pm

how to reproduce?
If you refer to my comment, there is no step to be taken for reproduction.. it just happens continuously after power on!

If possible try to in a lab setup your own authoritive DNS server for the zone lets say "example.com" and then have a client using your Mikrotik as a resolver for test.example.com and have that being looped by a bashscript or such and see if you get a constant time before your Mikrotik starts to no longer give replies?

Im thinking it could be the current resolver you are using (lets say 1.1.1.1) who is after a while throttling your requests, or some other firewall in between or some kind of connection tracking in your Mikrotik (if you are using the firewall) who runs out of available connections which then gives this behavior because there will be one incoming connection towards your Mikrotik DNS resolver and one outgoing (unless already cached).

infabo · Wed Jul 03, 2024 7:46 pm

how to reproduce?
If you refer to my comment, there is no step to be taken for reproduction.. it just happens continuously after power on!

It does not happen for me despite using the mikrotik DNS as well. That is why I asked how to reproduce it.

Paternot · Wed Jul 03, 2024 8:50 pm

If you refer to my comment, there is no step to be taken for reproduction.. it just happens continuously after power on!

The question "how to reproduce" can be translated as: "please, tell me the EXACT steps in order to make it happen on my system". There is a logic behind it: what is "clear" and "obvious" to you may not be to me - or him.

And if the developer can't reproduce the problem, we get that dreaded answer: "works for me".

So, what were the EXACT steps? What did happen? What did You expect? These three points will make far easier to debug the problem.

Wyz4k · Fri Jul 05, 2024 11:01 am

Just came here to report as well that I've had to update a perfectly good script because it contained ":return" and has been working since 2021.

jaclaz · Fri Jul 05, 2024 12:52 pm

So, what were the EXACT steps? What did happen? What did You expect? These three points will make far easier to debug the problem.

Just in case, problem report standard litany reference:
http://jdebp.info/FGA/problem-report-st ... itany.html

Guscht · Fri Jul 05, 2024 3:42 pm

That is because the "ip routes" display is effectively a "filter" showing only the IPv4 routes out of all routes (including IPv6).

Holy fck... Winbox/Mikrotik/ROS is still surprising me after almost 20 years...
IP/Routes is only a "Filter"... Next mental breakdown is coming soon, feel it...

mx5gr · Fri Jul 05, 2024 5:21 pm

If you refer to my comment, there is no step to be taken for reproduction.. it just happens continuously after power on!
The question "how to reproduce" can be translated as: "please, tell me the EXACT steps in order to make it happen on my system". There is a logic behind it: what is "clear" and "obvious" to you may not be to me - or him.

And if the developer can't reproduce the problem, we get that dreaded answer: "works for me".

So, what were the EXACT steps? What did happen? What did You expect? These three points will make far easier to debug the problem.

Thank you for the EXACT clarification....

As noted, there are NO PARTICULAR steps to be taken.. it just happens after boot, with any 7.15.X firmware.

If you require more EXACT, however:
(1) Place router A/C plug to wall
(2) Connect power supply to router

Reverting to the latest 7.14.X firmware, solves the issue.

mx5gr · Fri Jul 05, 2024 5:23 pm

So, what were the EXACT steps? What did happen? What did You expect? These three points will make far easier to debug the problem.
Just in case, problem report standard litany reference:
http://jdebp.info/FGA/problem-report-st ... itany.html

I think my description so far on how to reproduce and to the nature of the issue, covers the input you mention..

Thank you for the suggestion, however.

infabo · Fri Jul 05, 2024 5:43 pm

Well, Your description is more like "I'm ill, doctor. Help!" just slightly improved. Please generate a supout.rif file and hand it to support@mikrotik.com. Or before doing that, export your config and post it in a separate topic for further investigation by community. Thanks.

jaclaz · Fri Jul 05, 2024 6:01 pm

Please generate a supout.rif file and hand it to support@mikrotik.com.

To be fair:

Support issue opened SUP-157852

infabo · Fri Jul 05, 2024 6:10 pm

Please accept my apology. Still unclear if supout.rif was attached to that SUP, but I am sure Mikrotik will request it if missing.

Apachez · Fri Jul 05, 2024 10:36 pm

Please accept my apology. Still unclear if supout.rif was attached to that SUP, but I am sure Mikrotik will request it if missing.

Sorry for going slightly offtopic but what is the expected turnaround time to get a response from support?

I filed this /ip/dns VRF-failure bugreport almost 2 weeks ago and still havent heard from Mikrotik support (like did I do something wrong, how was the quality assurance test and config look like that approved that VRF-support is now functional for /ip/dns in 7.15 stable, is it a known issue, any ETA for when one can expect to see a fix for it etc - just crickets so far)..

While a feature request regarding logging I filed yesterday I got a reply for today in less than 24 hours...

infabo · Sat Jul 06, 2024 12:17 am

Exactly. Some tickets are answered on the same day, while others take days or even weeks. I believe that tickets are prioritized based on their complexity and/or topic. My experience with the support has been positive (overall).

nichky · Sat Jul 06, 2024 7:10 am

ZeroTier after dis/ena the interface, is keep creating a route.
Has this been reported?

v.7.15.2

Benzebub · Sun Jul 07, 2024 10:38 am

Bump on this please, has everyone else given up on MLAG on the CRS platform?
I have a pair of CRS-317's in MLAG, with two DAC's in a bond forming the MLAG channel between the two CRS-317.
I have an upstream CRS-328P that is running LAG across both CRS-317's (In an MLAG LAG group).
I have AX3 access points coming off the CRS-328P with clients connected to those CAPsMAN access points.

The CRS-317's are connected to ESXi hosts. The ESXi hosts are not configured for LAG, but multipathed. This means that a particular VM will be mapped to a particular egress port of the ESXi at VM startup, and will 'fail over' to the other egress port if the chosen port goes down for some reason.

All works well, UNTIL you reboot one of the CRS-317's forming the MLAG. Whilst the CRS-317 is rebooting everything continues on as normal, maybe a ping or two lost as ESXi switches over to the other CRS-317 for what ever VMs it had running on the CRS-317 I just rebooted, but all VM's remain accessible from the access points.

When the CRS-317 comes back up, everything is ok for a few seconds, then I lose access to a 'random' number of VMs for 5 minutes (arp aging timeout on the CRS-317's I am suspecting). Basically the ESXi host starts using the rebooted CRS-317 for those VM's that were originally using it, but the non-rebooted CRS-317 does not know/see that, flushing the ARP cache on both CRS-317 fixes the problem.

So, at least in my case, the MLAG switches do not converge their ARP caches, but appear to rely on ARP caching aging to fix things for them.

I had issues with this as well. I got it to work a bit better by setting an admin-MAC on the bridge and also lowering the ageing-time to 1min.

vecernik87 · Sun Jul 07, 2024 11:37 am

tl'dr: UPnP enable/disable switch is not working, always stuck in enabled mode.

I think there is bit (or rather big) of an issue with UPnP! I just upgraded first production hAP ac2 from 7.13.2 into 7.15.2 and after short while, I found UPnP records in my log. Not only in log, it truly creates FW rules. That should not happen because my UPNP is DISABLED! after enabling and re-disabling UPnP, rules disappear but only temporarily...

u9oJ4ol32o.png

To be completely clear, I do have interfaces in UPnP configured from my past tests, but that should not have any effect when UPnP is disabled.

[xxxx@router] > ip upnp export verbose
# 2024-07-07 18:19:04 by RouterOS 7.15.2
# software id = xxxxxx
#
# model = RBD52G-5HacD2HnD-TC
# serial number = xxxxxx
/ip upnp
set allow-disable-external-interface=no enabled=no show-dummy-rule=yes
/ip upnp interfaces
add disabled=no !forced-ip interface=eth1-nbn type=external
add disabled=no !forced-ip interface=home type=internal
[xxxxx@router] >

After disabling interfaces, UPnP is no longer creating FW rules, but after re-enabling interfaces it does, even though UPnP is disabled

winbox_ojP7N0HYom.png

This was not happening in 7.13 and I don't know when it was introduced, but I am sure it should not behave like this.

edit: Ladies and gentlemen, we got a prime suspect:

What's new in 7.15 (2024-May-29 15:44):
*) media - added support for DLNA;

https://help.mikrotik.com/docs/pages/vi ... =237699479

DLNA and UPnP work in tandem to provide a seamless media sharing experience.

Again, a feature which has nothing to do with routing was introduced, only to bloat main package and cause security vulnerabilities. Since DLNA can't be disabled or uninstalled, I guess we have to live with it now...

No, seriously - who asked for DLNA? Who needs DLNA in the main package of the router? Without ability to turn it off? Is it really that hard to keep routers for routing and separate packages for other unnecessary functions? Every single unnecessary feature increases attack surface and helps bad guys to get in. Every feature like this increases likelihood of another 0-day. Can we PLEASE put security and stability first?

edit2: basic POC to confirm something isn't right:

Get ROS 7.15+
confirm that UPnP is not enabled:
Code: Select all
```
/ip/upnp/print
```
Add at least one internal interface for UPnP
Code: Select all
```
 /ip/upnp/interfaces/add type=internal interface=bridge1
```
(you may need different interface name)
Now via that interface, make HTTP GET request to ANY of router's IP. e.g.
Code: Select all
```
http://192.168.88.1:2828/gateway_description.xml
```
- it returns SSDP xml, example in attachments below. This does not pose any risk, just announces that UPnP on the router is available. As long as you don't have
Code: Select all
```
type=external
```
interface set up, no FW rules will be created, even if your local devices request it.

disable the upnp interface

/ip/upnp/interfaces/set [find type=internal] disabled=yes

make the same HTTP request as in previous step - it times out, the port is closed as it should always be while UPnP is disabled.

Paternot · Sun Jul 07, 2024 6:47 pm

No, seriously - who asked for DLNA? Who needs DLNA in the main package of the router? Without ability to turn it off? Is it really that hard to keep routers for routing and separate packages for other unnecessary functions? Every single unnecessary feature increases attack surface and helps bad guys to get in. Every feature like this increases likelihood of another 0-day. Can we PLEASE put security and stability first?

I agree with all your points: this is the kind of thing that should be in a different package. But just another day I found out WHO would want DLNA on routers (I was wandering about it too...)

Looks like there is a market for this, weird but true. It was on the last newsletter (#119). Page 4, if I'm not mistaken. It just should be on another package, not the main one.

Apachez · Sun Jul 07, 2024 10:44 pm

No, seriously - who asked for DLNA? Who needs DLNA in the main package of the router? Without ability to turn it off? Is it really that hard to keep routers for routing and separate packages for other unnecessary functions? Every single unnecessary feature increases attack surface and helps bad guys to get in. Every feature like this increases likelihood of another 0-day. Can we PLEASE put security and stability first?
I agree with all your points: this is the kind of thing that should be in a different package. But just another day I found out WHO would want DLNA on routers (I was wandering about it too...)

Looks like there is a market for this, weird but true. It was on the last newsletter (#119). Page 4, if I'm not mistaken. It just should be on another package, not the main one.

I also agree with previous writer - put security and stability first THEN add new "cool" features as packages.

DLNA is NOT a needed router feature and for those who wants it then grab it as a package instead. Same with UPNP and a few others.

pe1chl · Mon Jul 08, 2024 11:14 am

Exactly. Some tickets are answered on the same day, while others take days or even weeks. I believe that tickets are prioritized based on their complexity and/or topic. My experience with the support has been positive (overall).

It likely works as in most companies: there is a "first line" that opens all the tickets and provides quick answers to those that are mostly questions or are based on obvious user errors.
When it is not so obvious what is wrong, the ticket is escalated to "second line" personnel and it will take longer to be answered.
When the issue is really complicated it may be escalated to developers, and it will take a very long time to ever receive feedback.
That will then usually be "the bug will be solved in an upcoming RouterOS release, but we cannot tell you which one". Because a developer can recognize a bug and put a fix into the versioning system, but has no control over the release process.

infabo · Mon Jul 08, 2024 11:29 am

Regarding extra packages, the explanation often given is: feature X is too small - the overhead for an extra package is too big. On the other hand, there are already packages like "lora 8kb" and "gps 24kb", "calea 20kb" or "ups 45kb". So, splitting them off was apparently possible.

mkx · Mon Jul 08, 2024 11:29 am

That will then usually be "the bug will be solved in an upcoming RouterOS release, but we cannot tell you which one".

Or even "We acknowledge the bug, but we don't know if we'll ever fix it." (I've received such a response but worded differently ... I'm not going to skim through e-mail archive to quote it though)

bratislav · Mon Jul 08, 2024 4:55 pm

There is a bug in a new and useful MSTP feature (introduced in 7.14 i believe) and that is that now MSTI shows ID 0 MSTI as dynamic entry...
The issue is that if you change something for MSTI 0, priority for example, it doesn't change until you reboot the switch:

interface/bridge/print proplist=priority 
Flags: X - disabled, R - running 
 0 R ;;; defconf
     priority=0x8000 
[admin@CRS309] > interface/bridge/msti/print proplist=priority 
Flags: D - DYNAMIC
Columns: PRIORITY
#   PRIORITY
0   0x7000  
1   0x7000  
2   0x7000  
3 D 0x7000

after reboot it shows correct value:

interface/bridge/msti/print proplist=priority 
Flags: D - DYNAMIC
Columns: PRIORITY
#   PRIORITY
0   0x7000  
1   0x7000  
2   0x7000  
3 D 0x8000

I presume that the configured values are used but dynamic entries in MSTI should be dynamically updated...

S8T8 · Mon Jul 08, 2024 6:17 pm

Has anyone discovered how this works?

*) console - added option to get "about" value (dynamically created text field by RouterOS services like CAPsMAN);

EDIT:
Thanks @infabo, "about" is not available in v7.14, your guess is right

/interface wifi get about

infabo · Mon Jul 08, 2024 6:22 pm

print proplist=about

Maybe???

Simonej · Mon Jul 08, 2024 10:06 pm

With SUP-155649 I was asking how “reselect-interval” ( https://help.mikrotik.com/docs/display/ROS/WiFi ) is working, but still no answer.
Anyone has a clue?

Still waiting for answer from support, infabo suggested

reselect interval you define lower and upper bounds of interval. e.g. 30m / 1h. So earliest every 30m and latest every hour they perform reselect scan.

Then each AP randomly picks a value between 30m-1h, e.g. AP1: 41m30s, AP2: 32m34s, AP3: 50m10s. So they don't scan simultaneously and choose the same channel because no one is broadcasting and everyone just listening.

still not clear how to use it, with the default !reselect-interval channels are not scanned? Was not easier to select a time, (01:00-02:00AM)? Using 6h-12h it could disconnect a client during work hours.
How are you using it?

mkx · Tue Jul 09, 2024 8:06 am

Initial scan (e.g. after a CAPsMAN gets restarted, hence all CAPs get reprovisioned at the same moment) will be done ... well, initially and immediatelly. So at initial scan it may happen that some CAPs will select same channel (if allowed). However, the reselect-interval introduces new feature which forces (C)AP to do reselection at some (pseudo) random intervals. Due to (pseudo)randomness it's likely that subsequent reselections won't happen at the same time for adjacent (C)APs and hence they will probably end up using distinct channels.
As I hinted: it's a new feature, previously (C)APs tended not to reselect at all and kept occupying the same (possibly highly utilized) channels for long time. And I guess that with out reselect-interval being set the behaviour then reverts to the previous behaviour (i.e. not doing pseudo-periodic reselections).
As to disconnecting clients: (C)APs are supposed to do the scan in background, which means that clients should not be affected. I'm not sure how this works if (C)AP selects a CAC-infested channel as candidate to use in next time period (I don't think it can do CAC in background unless it has a spare receiver to do it full-time).

grusu · Tue Jul 09, 2024 9:34 am

Something is wrong with the initial scan for 5 GHz. Every time at boot, the frequency is set to 5500 on all APs. This does not happen for 2.4 GHz where APs receive different frequencies.

erlinden · Tue Jul 09, 2024 9:41 am

Something is wrong with the initial scan for 5 GHz. Every time at boot, the frequency is set to 5500 on all APs. This does not happen for 2.4 GHz where APs receive different frequencies.

That is something that is bothering me as well. This frequency is checked for 1 min before used, hence this situation. Would really help if CAPsMAN took into account such a situation. I think this is solved after a rescan.

infabo · Tue Jul 09, 2024 10:08 am

Well, only 2 APs managed with capsman here. After a reboot both AP choose the same 2.4 and 5ghz channel. Funny enough, Mikrotik loves 5500. But this is something about Capsman that I find kind of weirdo, why this system is so dumb on a initial scan. Rescan-interval improved this situation. But rescaninterval comes with a burden: have it low (e.g. 15m-30m) -> APs down very often. Have it high (e.g. 12h-24-) -> APs may stay up to one day on same channel.

@Simonej
it is an interval. 6-12h does not mean between 6 and 12 on your clock. It means somewhere between 6-12hours after last channel scan.

pe1chl · Tue Jul 09, 2024 10:49 am

Automatic channel selection methods are useless anyway when you value performance.
It is better to first study the layout of the channels, then do some manual scanning and investigation of channel usage, and finally decide on fixed channels to use for each of your APs.
E.g. some channels may have weather radar, but you can still use them for an AP in the cellar or other similar well-shielded room.
Which channels you can use also depends on the bandwidth you select. You do not want overlapping channels so you need to accommodate for that.
It is already a bit helpful here that MikroTik uses channel frequencies rather than channel numbers, because you can easily see that when you have channel bandwitdh 40 MHz and you have one AP on 5500 you should not put another on 5510 or 5520 but rather 5540 is the first one that can be used.
Also note that channels are allocated in chunks of 20 MHz and when you have wider bandwidth you effectively are setting 2, 4 or 8 of these 20 MHz chunks where you specify the frequency of one of them. That would often be the lowest one, but that isn't necessarily true, it is possible to select this. This is indicated by the Ce or Ceee or Ceeeeeee after the bandwidth (at least with the old driver).
The wider bandwidth you choose, the fewer options you will have for channel selection.

infabo · Tue Jul 09, 2024 10:57 am

Simply no. When you are surrounded with other vendor APs of nearby offices which change their channels randomly as well - you are out of luck with your "I plan my channels on a sheet of paper" approach.

Tue Jul 09, 2024 11:15 am

Automatic channel selection methods are useless anyway when you value performance.
It is better to first study the layout of the channels, then do some manual scanning and investigation of channel usage, and finally decide on fixed channels to use for each of your APs.

Exactly

But I do admit the locations of my installations are relatively free of random intruders.
If some are visible, they mostly observe 1/6/11 scheme quite nicely or stay fixed on certain 5GHz channels (which I then avoid for that area of that AP).

mkx · Tue Jul 09, 2024 11:21 am

Simply no.

Well ... if you fix your frequencies and your neighbours don't, then those APs may eventually start to avoid "your" channels, making everybody happy. If neighbours also fix their frequencies, then again everybody is happy as long as one manages to avoid no only "C", but also "e" frequencies (as @pe1chl already mentioned).

The only problem in the whole ordeal is if somebody fixes frequencies without first considering (at that time current) state of environment ... e.g. blindly fixing frequencies to those already occupied (if they are occupied statically, then there will be a conflict until someone notices it).

pe1chl · Tue Jul 09, 2024 1:55 pm

Simply no. When you are surrounded with other vendor APs of nearby offices which change their channels randomly as well - you are out of luck with your "I plan my channels on a sheet of paper" approach.

The approach may depend as well on the scale of your installation.
I manage a system with 39 access points in 3 buildings, most of them in a single "metal box" style industrial building.
I use a carefully planned frequency table on 5 GHz, where the known weather radar channels are only used in completely inside rooms like the warehouses, and the office rooms are planned so that adjacent uses of the same channel are as far away is possible.
We do not pay attention to outsiders, because they often set 160 MHz channels anyway so there is little you can do.

On 2 GHz we have automatic selection 1/6/11 only, but 2 GHz is not really used except as a fallback in low coverage areas.

At home when I scan on 2 GHz I see 100 other APs. No need to "optimize the channel".
A problem also is the broken APs that use other channels than 1/6/11 and cause even more interference.
Fortunately on 5 GHz that isn't as common.

nmt1900 · Tue Jul 09, 2024 4:01 pm

Not to mention these who have their 2,4 set to 40 MHz random channel like 3 or 7 - this way almost all 2,4 band can be flooded with single access point...

S8T8 · Tue Jul 09, 2024 8:12 pm

I agree, commands like :error, :quit, :return are valid and it should not produce such error in log.

@optio @eworm, what is now the correct way to terminate a script without an error in the log?

hasmidzul · Wed Jul 10, 2024 9:30 am

Has the issue of wireless clients being disconnected on hap ax2 been resolved yet? I haven't seen anything in the changelogs yet on this (staying on v7.14.3 in the meanwhile), hopefully someone can confirm

I did reset hap ax3 to default setting and reconfigure all the PPPoe client..and my wifi is working good.No more disconnection.Ros 7.15.2. (5GHz ax 80MHz 5500).The 2GHz was switched off.

rushlife · Wed Jul 10, 2024 10:48 am

still present in 7.15.2

pseudobridge (wifi client against capsman APs) on Metal 2SHPn and RBmAP2nD still high packet loss, since ros 7.14.x

infabo · Wed Jul 10, 2024 11:35 am

What worked for me: set "protocol=none" on the "station pseudobridge" device.

optio · Wed Jul 10, 2024 12:46 pm

@optio @eworm, what is now the correct way to terminate a script without an error in the log?

Not sure if any command currently exits script without producing error.
You can rework scripts and break certain logic into functions and call it under some conditions to avoid deep nesting. Loops can be braked using while command by checking condition of some variable which is set inside loop block.
I didn't bother to modify some of my scripts like that, just muted script error log hoping that some day it will be possible to exit script without error like before.

eworm · Wed Jul 10, 2024 1:17 pm

@optio @eworm, what is now the correct way to terminate a script without an error in the log?

Well, you can just wrap your code into a block, den catch the error and do nothing...

:do {
  # your code
  # exit early with :error
  :error false;
  # other code
} on-error={ }

BUT! Be aware that this mutes ALL errors, even the legitimate ones that should be regarded!

massinia · Wed Jul 10, 2024 1:29 pm

pseudobridge (wifi client against capsman APs) on Metal 2SHPn and RBmAP2nD still high packet loss, since ros 7.14.x

.

What worked for me: set "protocol=none" on the "station pseudobridge" device.

Worked also for me:
viewtopic.php?p=1025978#p1025970
It's stable and has been working perfectly for months.

Jotne · Wed Jul 10, 2024 2:03 pm

@optio @eworm, what is now the correct way to terminate a script without an error in the log?
Well, you can just wrap your code into a block, den catch the error and do nothing...

BUT! Be aware that this mutes ALL errors, even the legitimate ones that should be regarded!

You should try to make script so that it does not give error. And if there are no way around to avoid error du to different hw or software config, use on-error on a small block as possible.

infabo · Wed Jul 10, 2024 3:12 pm

pseudobridge (wifi client against capsman APs) on Metal 2SHPn and RBmAP2nD still high packet loss, since ros 7.14.x
.
What worked for me: set "protocol=none" on the "station pseudobridge" device.

Worked also for me:
viewtopic.php?p=1025978#p1025970
It's stable and has been working perfectly for months.

It worked for me with "protocol=rstp" (default value) until 7.13.5. Problems started with 7.14.

Changelog of 7.14

*) bridge - improved protocol-mode STP and RSTP functionality;

"improved" is a Mikrotik codeword for introducing a fundamental change thus breaking some existing behaviour.

I did not find a way to debug RSTP until today. Neither log topics "bridge" nor "stp" log anything related to RSTP. Already asked support but all they told me was: try bridge or stp topic. I would like to log the RSTP election process of root brige, when ports stop forwarding and so on. But it seems to be impossible.

nmt1900 · Wed Jul 10, 2024 3:55 pm

If root bridge election "wants" to go wrong then changing the RSTP priority can help. Set it to lower than default (8000) on bridge that should be a root bridge.

pe1chl · Wed Jul 10, 2024 4:51 pm

I'm debugging a mysterious problem... I have a RB4011 with a VLAN-filtering bridge on all ports (except ether1) and the wireless interfaces. It has 3 VLANs plus the default untagged. Some ports are untagged on one VLAN, others are "hybrid" (untagged one VLAN and tagged some others).
On one of the hybrid ports a hAP ac2 is connected which operates as a switch and WiFi access. IPv6 is not configured on the hAP ac2.
Until 7.15 was installed, the devices connected to the switchports or the WiFi on the hAP ac2 received IPv6 addresses being sent (RA) from the RB4011, but this now no longer works.
I have already disabled STP but there is no change. When I Torch on the switchport to the hAP ac2 I don't see IPv6 traffic.
But when I monitor using wireshark on a PC connected to another port on the same router, I do see the IPv6 RA's on the different VLANs. The PC and also devices connected to the RB4011 WiFi get IPv6 just fine.
This has me completely baffled... how can this happen? The bridge should just relay the RA multicasts to all ports, right?
And in the past (previous installed version was 7.12.1) it worked just fine!

infabo · Wed Jul 10, 2024 5:52 pm

If root bridge election "wants" to go wrong then changing the RSTP priority can help. Set it to lower than default (8000) on bridge that should be a root bridge.

Yes, I already noticed that. bridge of "station pseudobridge" device was elected as root-bridge. I already believed that this was my problem and lowered the bridge-priority on my main-AP to 0x7000. Then root-bridge was elected as I wanted - but it did not change anything on the issue. wifi port where the "station pseudobridge" connected was still "forwarding: no". Set protocol=none on this "station pseudobridge" device and all working. For me it seems like "improved" RSTP of 7.14+ does not play well with that pseudobridge thingy. Or it is some kind of incompatibility as this "station pseudobridge" device is the only ROS v6 device on my network.

optio · Wed Jul 10, 2024 9:33 pm

:do {
  # your code
  # exit early with :error
  :error false;
  # other code
} on-error={ }

This is similar approach as when you mute script error logs in Logging settings since you need to put most of script code into do={} on-error={} to work (part where :error command is executed and everything after that). Nothing should not be added after on-error={} because it will be executed. It's just hacky approach, personally I did't want to change scripts like that.

bbs2web · Thu Jul 11, 2024 11:35 am

Running 7.15.2 on CRS354-48G-4S+2Q+ devices. Using 2 x Q+DA0001 cables to create a 2 x 40G DAC bond as the MLAG peer bond.

Continue to see the switches reporting peer bond drops but the bond itself and ports that make up the bond are not flapping:

JulienPicalausa · Thu Jul 11, 2024 12:06 pm

It seems like the 7.15 release broke radsec support for me and a few others. I'm linking it here in hope it gets some attention (viewtopic.php?p=1085055)

Thu Jul 11, 2024 3:24 pm

Only way to get proper attention is to create a support ticket.

AlexanderK · Thu Jul 11, 2024 4:55 pm

What worked for me: set "protocol=none" on the "station pseudobridge" device.

you saved my life :)

rextended · Thu Jul 11, 2024 6:37 pm

BUG:
Default smb "guest" user is deletable, on RouterOS v6 not.
But on v7 "guest" appear to be the default both on "export" and on winbox colours...

wfburton · Thu Jul 11, 2024 7:53 pm

.

Worked also for me:
viewtopic.php?p=1025978#p1025970
It's stable and has been working perfectly for months.
It worked for me with "protocol=rstp" (default value) until 7.13.5. Problems started with 7.14.

Changelog of 7.14
Code: Select all
*) bridge - improved protocol-mode STP and RSTP functionality;
"improved" is a Mikrotik codeword for introducing a fundamental change thus breaking some existing behaviour.

I did not find a way to debug RSTP until today. Neither log topics "bridge" nor "stp" log anything related to RSTP. Already asked support but all they told me was: try bridge or stp topic. I would like to log the RSTP election process of root brige, when ports stop forwarding and so on. But it seems to be impossible.

What other managed switch do you have on your network that runs Rapid Spanning Tree Protocol?

logically it should be no STP. Only Mikrotik can explain why RSTP is the default.

On my network I have a mitrotik switch and a zyxel switch configured for RSTP.

Network Switch - Configure RSTP (Rapid-Spanning-Tree-Protocol) in a ring topology (example)
https://support.zyxel.eu/hc/en-us/artic ... pology#one open this link

Right click on image and open in new tab to view the image to get a better view

Screenshot_20240711_124811.png

Screenshot_20240711_124944.png

Screenshot_20240711_125000.png

Screenshot_20240711_125454.png

Mikrotik-mibs ( no RSTP data?)

Screenshot_20240711_125651.png

infabo · Thu Jul 11, 2024 8:25 pm

all Mikrotik devices. all RSTP by default. no other switches on the network.

wfburton · Thu Jul 11, 2024 8:30 pm

all Mikrotik devices. all RSTP by default. no other switches on the network.

View the link I posted

I don't think you understand RSTP

Logically it should be no STP.

infabo · Thu Jul 11, 2024 8:54 pm

I know what RSTP is. Ask Mikrotik why they ship all their devices with enabled RSTP by default.
But I have to admit that I only have a vague idea what "station pseudobridge" actually does on L2.

Apachez · Fri Jul 12, 2024 12:31 am

Only way to get proper attention is to create a support ticket.

I have tried... only 1 out of 3 tickets got a reply for the past 3 weeks...

deejaysanoj · Fri Jul 12, 2024 4:22 am

upon my observation this update works fine and stable on my hAP ax, thank you for keeping let us upgrade routerOS constantly.

mkx · Fri Jul 12, 2024 8:19 am

all Mikrotik devices. all RSTP by default. no other switches on the network.
Logically it should be no STP.

Why do you think that? If there are no bugs, then having xSTP enabled should not be a problem (but can potentially protect your network from errors in topology). So clearly if problem gets solved by disabling RSTP, then there's a bug (in this case in station-pseudobridge implementation).

nmt1900 · Fri Jul 12, 2024 12:07 pm

Not just errors - some features and solution explicitly rely on xSTP to be able to work properly - like topology solutions with path redundancies and MLAG.

mkx · Fri Jul 12, 2024 12:29 pm

... topology solutions with path redundancies and MLAG.

These clearly don't appear in mindset of @wfburton ...

pe1chl · Fri Jul 12, 2024 2:03 pm

STP is not as innocent as you may think. I also disable it where it isn't required.
Remember it takes some time for a port to "come up" with STP (it can be more or less depending on configuration) and this often conflicts with devices that have automatic detection of a valid network. WiFi clients may disconnect when they cannot quickly establish DHCP and internet connectivity.
Recently I had enabled RSTP on my home router and 2nd AP, and also on a small Netgear switch, but it never recognized the Netgear switch as part of the network, and when I recently encountered problems I disabled it again.
But indeed, at work where MLAG is in use, I have RSTP enabled.

mkx · Fri Jul 12, 2024 3:22 pm

I think that STP dilemma (to have it or not to have it) is somehow similar to the dilemma about default firewall action (allow everything not forbidden or block everything not allowed). In certain cases the answer is clear, mostly it's murky, but in principle it's good to have STP (or rather RSTP) unless one determines it makes problems. You named one (slow port unblocking), there may be other, like the bug with station-pseudobridge, but normally it's better to have it enabled as it normally doesn't interfere with traffic. And due to this I support MT's decision to have it enabled by default ... because problems are always easier to spot than the missing functionality.

Paternot · Fri Jul 12, 2024 4:10 pm

I think that STP dilemma (to have it or not to have it) is somehow similar to the dilemma about default firewall action (allow everything not forbidden or block everything not allowed). In certain cases the

Yeah, I agree with it. It's easier to spot something that causes a problem than something that is off and should be on. Not to mention that it usually works.
Now, about firewall... I'm a firm believer of "block everything not allowed". I think it makes a neater and safer config.

On a side note:
Upgraded one RB5009 to 7.15.2
Almost everything works: one IPsec peer didn't come back. I need further investigation, as this peer has a past history of weird traffic problems. Since it's not controlled by me, it may take a while.

But Wireguard, BGP, BGP filters and EoIP are all working ok.

pe1chl · Fri Jul 12, 2024 4:29 pm

I too upgraded our RB5009's but unfortunately there is a bug in PoE for which I had to install 7.16beta4 to fix it :-(

wfburton · Fri Jul 12, 2024 5:36 pm

Logically it should be no STP.

Why do you think that? If there are no bugs, then having xSTP enabled should not be a problem (but can potentially protect your network from errors in topology). So clearly if problem gets solved by disabling RSTP, then there's a bug (in this case in station-pseudobridge implementation).

I'm not having any network issues. I just posted what I have configured on my network as a comparison for others to view. You mentioned station-pseudobridge. Can you elaborate on that?

I don't see having RSTP enabled if you don't have another switch with RSTP enabled. All you would have is a designated root. No?
I tried disabling RSTP on my zyxel switch to see what snmp data I get but it still shows incomplete data.

Looking at the SNMP data on mikrotik seems incomplete as shown in my post. I have no data for designated root, ip address/mac address and designated bridge ip address/mac address. Plus, I don't understand where it's getting this path cost of 20000 2000 from if I'm running RSTP?
Shouldn't it be path cost 4 and 0 as shown in zyxell rstp snmp data?

Mikrotik and zyxel is all behind a watchguard firewall with no STP. My lan interface for the LAN is not configuration as a lan bridge on the watchguard firewall.

I updated mikroik mib file but no change. I still don't see RSTP data.

TIA

wfburton · Fri Jul 12, 2024 5:54 pm

... topology solutions with path redundancies and MLAG.
These clearly don't appear in mindset of @wfburton ...

With such a post like that. I guess it was easier for you to insult me then explain why I need MLAG.

I have no need Multi-chassis Link Aggregation Group. I have no vlan's and no client device issues.

infabo · Fri Jul 12, 2024 6:47 pm

I don't see having RSTP enabled if you don't have another switch with RSTP enabled.

Any ROS bridge acts as a "switch" AFAIK.

mkx · Fri Jul 12, 2024 8:07 pm

I don't see having RSTP enabled if you don't have another switch with RSTP enabled. All you would have is a designated root.

As explained earlier: in most cases having RSTP enabled doesn't do any harm. But it can prevent probkems caused by some stupid mistakes (such as connecting two switch ports ... can be over a wall cable run, so not really obvious). Which IMO means that having it enabled by default is a sane thing. If somebody discovers that it causes a problem, then that particular admin can disable it.

As to insults: what you deem as an insult was a colorful response to your "Logically it should be no STP." which is IMO a pretty bold statement. Perhaps it's logical in your (plain) use case, but defaults are there for everybody.
I'm not trying to tell you that you need anything (do I couldn't care less if you need MLAG or not), I'm just saying that you can't expect MT to adapt defaults to some plain use case.

Paternot · Fri Jul 12, 2024 9:46 pm

I too upgraded our RB5009's but unfortunately there is a bug in PoE for which I had to install 7.16beta4 to fix it :-(

PoE in or out? I'm powering mine from a CSS106-1G-4P-1S. It's working perfectly.

pe1chl · Fri Jul 12, 2024 11:53 pm

PoE out. I am powering a hAP ac and a wAP ac from it (the hAP was originally powering the wAP but now the routing is done on the 5009 and the hAP is just for WiFi).
It worked fine on 7.12.1 and after upgrade to 7.15.1 it still worked, but then a powerfailure occurred and after that the port connected to the hAP ac showed repeated "overload" messages.
I asked support and they replied it was an error in the PoE chip firmware and 7.16beta4 would fix it.

infabo · Sat Jul 13, 2024 10:30 am

Indeed, beta2 already:

*) poe-out - upgraded firmware for SAMD20 PSE (AF/AT) controlled boards (the update will cause brief power interruption to PoE-out interfaces);

seriquiti · Sat Jul 13, 2024 10:50 am

I have a HAP AX2 with CAPSMAN setup and have been noticing that every 5-15 min the WIFI interface lock up for 10-20 seconds - no data passing to WIFI clients. When this happens, some clients will disconnect (infamous "disconnected, connection lost, signal strength -40") some cycles more clients than other. Not the same clients every cycle but even the clients that don't disconnect can't pass packets in this time. It's a new setup so haven't tried previous versions so that is my next troubleshooting step. Have tried just about every channel on 2.4 and 5ghz and have seen no difference between any of them so don't think it has to do with noisy environment. Have no issues with HAP AC lite in my home.

Only WIFI clients are affected - wired have no issues at this time. Anyone experiencing similar issues on 7.15.2?

seriquiti · Sat Jul 13, 2024 6:14 pm

So after trying several different config changes and even PSU swap I couldn't solve the WIFI stability issue. As a last resort I downgraded to 7.14.3 and after 3 hours not a single stability issue - except for 3 SA query timeouts on IOT devices.

Definitely seems like there is a WIFI stability issue in 7.15.2.

midenok · Sat Jul 13, 2024 6:55 pm

There was ROS version string in v6 visible from every menu. What happened to that in v7?

pe1chl · Sat Jul 13, 2024 8:11 pm

There was ROS version string in v6 visible from every menu. What happened to that in v7?

Please explain in detail what you mean...

Paternot · Sat Jul 13, 2024 11:48 pm

Almost everywhere we had a string saying "RoS 6.x.x". It doesn't happen anymore with V7.
Take the web interface: It shows "RouterOS v6.49" just above the login. With V7 we have "RouterOS" only.

This behavior happens everywhere. We used to just look at the interface and know the OS version. Now we have to look into "packages" or "Resources".

It's not a big deal, but I think that's what he's talking about.

pe1chl · Sat Jul 13, 2024 11:59 pm

Oh in webfig? He did not say it was about webfig... in winbox the version is in the title bar for both v6 and v7.
In general it is not a good idea to reveal the version on a login page. Scanners and intruders use that to know if you are running a version for which they know how to break in to it.

Paternot · Sun Jul 14, 2024 10:25 am

Well, in webfig I'm certain of it. Rarely use Winbox, and the command line... well, no one expects to see the version at every command output.

Yes, I do agree with the security problem. But, You see, with webfig we had the version (after login) at the top bar. At every page. It's gone now. In its place we have the identity we chose.

Again, a minor inconvenience - but I think that's what he is talking about. It was not only the front page.

Apachez · Sun Jul 14, 2024 11:19 am

Oh in webfig? He did not say it was about webfig... in winbox the version is in the title bar for both v6 and v7.
In general it is not a good idea to reveal the version on a login page. Scanners and intruders use that to know if you are running a version for which they know how to break in to it.

That can be argued regarding what to display before you are logged in.

But once you are logged in there is no reason to hide the version even if its 2 clicks away (you can in ROS 7.x click in the upper right corner on that settings icon and then select about to get to the page with /system/resources who will display current version and current boot version).

When you use CLI/SSH the version is displayed in the MOTD (that ascii-art Mikrotik logotype).

pe1chl · Sun Jul 14, 2024 8:16 pm

I do not think it is that useful or important to always know what the version is.
What I would consider useful and important is to display the "Note" from the winbox neighbor list next to the "Session".
When you have several devices to manage it is helpful to know immediately which device you are accessing.

Apachez · Mon Jul 15, 2024 12:55 am

It is very useful.

This is what you see when you login through CLI/SSH:

  MMM      MMM       KKK                          TTTTTTTTTTT      KKK
  MMMM    MMMM       KKK                          TTTTTTTTTTT      KKK
  MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO      TTT     III  KKK  KKK
  MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO     TTT     III  KKKKK
  MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO     TTT     III  KKK KKK
  MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO      TTT     III  KKK  KKK

  MikroTik RouterOS 7.15.2 (c) 1999-2024       https://www.mikrotik.com/

Press F1 for help

So why cant webfig tell you the same if you choose to login using HTTP/HTTPS?

The versionstring could be written either next to the hostname at the top like "HOSTNAME (v7.15.2 stable)" or as the bottom entry in the menu to the left just below "Make Supout.rif" as "v7.15.2 stable" (as a text and not button).

Mon Jul 15, 2024 10:14 am

Hover your mouse cursor on the window title / tab, version is right there

Apachez · Mon Jul 15, 2024 10:58 am

Worst place ever to place that info :D

Mon Jul 15, 2024 11:00 am

How many places you want?

Title bar
Resources
Package menu
Check for updates button in Quickset

If this is so important, set up a script, that upgrades your device automatically

Apachez · Mon Jul 15, 2024 11:12 am

Its not about that this information is hidden behind 25 clicks in the webfig - its about getting this info in less than 1 click as in no click at all as with when you login through CLI/SSH you get it as the MOTD message.

Mon Jul 15, 2024 11:16 am

Why is it important?
Maybe somebody else has another "very important" variable they need everywhere. We can't cram everything in one screen.

Larsa · Mon Jul 15, 2024 11:17 am

How many places you want?

Somewhere where it's easier (ie obvious) to spot in the ordinary work space, please!

Mon Jul 15, 2024 11:20 am

Pro tip ...

1. Click "Design Skin"
2. Go to Resources
3. Click triangle button next to Version
4. Select "Add to Status page"

now any variable can be your home screen.

Apachez · Mon Jul 15, 2024 11:26 am

Why is it important?
Maybe somebody else has another "very important" variable they need everywhere. We can't cram everything in one screen.

You have PLENTY of dead unused space below the button "Make Supout.rif" in the left menu - same with the area where the hostname is being displayed at the top of the page.

Just sayin...

Apachez · Mon Jul 15, 2024 11:33 am

Pro tip ...

1. Click "Design Skin"
2. Go to Resources
3. Click triangle button next to Version
4. Select "Add to Status page"

now any variable can be your home screen.

Fugly workaround... at least its one click away that way since the naming of the page wont display due to too long string (so the mousehover trick doesnt work).

Is this setting accessible through CLI so I can make this for all my Mikrotik without having to click gazillion of times on each and every one to create that "Status" button in the upper left of the menu?

Larsa · Mon Jul 15, 2024 11:34 am

Pro tip ...

1. Click "Design Skin"
2. Go to Resources
3. Click triangle button next to Version
4. Select "Add to Status page"

Looks promising though I'm unable to locate any tab/menu called "Resources" in Design Skin mode.. (v7.15.1). Anyone?

Apachez · Mon Jul 15, 2024 11:38 am

Pro tip ...

1. Click "Design Skin"
2. Go to Resources
3. Click triangle button next to Version
4. Select "Add to Status page"

Looks promising though I'm unable to locate any tab/menu called "Resources" in Design Skin mode..

Click on System -> Resources first. Then in the upper right click on the setting icon and then "Design Skin".

Note that the look is buggy so the text of the entry goes away but currently its the third from the bottom which you then click on the upside down triangle to get a menu and select "Add to Status Page".

When you now leave the "Design Skin" mode (by again in the upper right click on the settings icon and then "Design Skin") you will now see a "Status" button at top of your menu to the left.

When clicking that you will have your selected version entry displayed.

To remove this go to the status-page (first menu entry to the left) and then in the upper right click on settings -> design skin and unmark the entry at the status page and then click on settings -> design skin again and the status menu option is gone (if the version was the only object in there).

Larsa · Mon Jul 15, 2024 11:48 am

Thanks! It was "System > Resources" I was looking for. Yeah, it's buggy, all right.

EDIT: I wish version info could be presented in a more obvious place as standard so you wouldn't have to hack the webfig "skin" on each new instance to find it.

Screendump.png

Mon Jul 15, 2024 12:35 pm

There is a scroll bar, scroll to the right

Paternot · Mon Jul 15, 2024 12:40 pm

I have to do a mea culpa here: for me the version shows on my browser's title window (webfig). Don't know why, but never saw it until now.
That said, why not show it after the device name - that is shown at the top of every page?

No, it isn't a serious problem. No, it isn't critical or anything else - after all we can easily get the version on system/resources or system/packages.
It's just that it's so easy to look there... also, it was the RoS 6.x behavior.

jaclaz · Mon Jul 15, 2024 1:01 pm

Only 36 years passed since this was published, and some (right) concepts have not been fully translated into interfaces:
https://en.wikipedia.org/wiki/The_Desig ... day_Things

OT, but not much, my car has a screen where - when the radio is selected - on the first top two lines there is on the right side the date and time and the outside temperature, on the third and fourth line there is (double height) the name of the radio station (but NOT the FM frequency it is on), then all the rest of the screen shows a (senseless) drawing/picture of an antenna, exception made for the bottom line where a number of tabs are present with some FM frequencies to switch to.
When the radio senses that the signal for the selected station is low, it shows a message to the effect of "Scanning ..." that is on a two lines gray band as large as the whole screen, which covers date/time/temperature.
In zones with hills/mountains this happens often enough and lasts for several seconds.

Everytime I need to quickly glance at the screen to check the time and find it covered by this gray band I feel sad (besides not knowing if I am going to be late or if I have time to get a coffee).