MikroTik

mongobongo

mongobongo, support receives a ton of support tickets a day. The need to "triage" and it is quite fair that you received a honest answer. You can't expect them to make educated guesses on your environment that you apparently did not understand yourself fully (you wrote about ISP with NAT,...

mongobongo

I already had the NAT rule from years gone by but had it disabled.

Told you so!

Yeah @rplant provided the exact mangle rule, but I completely switched off after pinging with 1400 bytes and seeing it succeed

@anav, cheers

mongobongo

https://mikrotik.com/consultants Thanks though I will fix it with the help attained from this community I have enough info and have resolved it. I already had the NAT rule from years gone by but had it disabled. For the record in my case add action=change-mss chain=forward new-mss=1452 out-interfac...

mongobongo

@mongobongo; Well, good for you! Though a reboot is hardly a long-term solution since you obviously didn't manage to isolate the root cause of the issue. And please don't blame support for doing their job, or anyone else for that matter, for not telling you to reboot your own equipment. And I reall...

mongobongo

rplant already gave you the MTU hint 2 days ago. It feels like an MTU/ mss issue. Don't blame Oskars. It just confirms Oskar's words: support is not responsible for wrong configuration. Yes and if one followed I responded back to him that I tried what he suggested and it did not show that it was an...

mongobongo

rebooting the IKEv2 client2 router brought the IKEv2 connection back up, just switched to 1400 MTU and am now waiting for the IKEv2 client2 router to come back online to test ... **** SOLVED ***** Now to work out the max MTU I can use without causing this issue. If only Oscar had the kindness to rea...

mongobongo

Which has been deleted from the support panel I suspect it has not been deleted, but marked closed. There is a filter "closed" issues in JIRA-based help.mikrotik.com portal. Thank you for that information, suprise suprise, when i logged back in the post has now be marked "opened"...

mongobongo

Too funny!!

yeah im crying both ways (happy/sad)

mongobongo

I've read all your posts several times and I am still confused. Let's focus on the part from your napkin diagram that isn't working. What do you mean by 'Only one way communication'? Have you checked you have two active peers/SA on both sides, or do you mean that you only receive traffic from one d...

mongobongo

So ive put the PPPoE back to 1480 and the non working IKEv2 clients are not "calling back" at all.

Im going to have to wait till early hours of the morning to reboot the IKEv2 server as i run a small WISP from it so obviously I dont want to do that at this moment in time!

mongobongo

Yes I am allergic to many things but mostly IPV6, capsman and IKEv2, although I did get it working from my iphone to MT router once.

lol and I am doing this for remote management of a capsman server

mongobongo

I can help you get a working Wireguard tunnel between your two MT devices, but this requires at least one of the devices has a public IP, or is connected to an upstream router (yours or ISP) that can forward a wireguard port to your device. Please advise. @Anav: it's the same requirement for IPsec/...

mongobongo

I can help you get a working Wireguard tunnel between your two MT devices, but this requires at least one of the devices has a public IP, or is connected to an upstream router (yours or ISP) that can forward a wireguard port to your device. Please advise. Man, I have a working tunnel. Im close to g...

mongobongo

should have added a computer on the lan of the ike2v server which is running Winbox ...

mongobongo

You don't need advanced tools to illustrate your network topology. Use plain text, like "x.x.x.x A -> internet -> y.y.y.y B," as I suggested (where x.x.x.x and y.y.y.y are IP addresses). To help us understand your issue, please describe it briefly in one or two sentences, such as "I ...

mongobongo

Hi, please provide a simple network topology diagram, for example: "Host A (client) xxxx -> Internet -> Host B (server) xxxx" along with version info and the most current configuration files (if all devices are Mikrotik that is). Then, we might be able to help you out one step at a time. ...

mongobongo

Will you provide the ticket number or not?

MikroTik support #[SUP-152995]: ikev2 tunnel established but winbox has issues ...

Which has been deleted from the support panel

mongobongo

So your not complaining about a bug, or issue with the router? You need assistance to configure the router.?.............--> Perhaps take some courses maybe. https://www.youtube.com/@MAICT Really mate, your responses to people posts such as mine are so predicatable. Yes you made a good assumptions ...

mongobongo

You post the ticket answer - but not your question. Do have something to hide?

Nothing to hide here

All info is public apart from my ticket which was outright deleted by the "support" representative

mongobongo

If receiving such reply, like posted, it means the customer asked somebody to configure his router. That response says, that we don't do that, you can hire a consultant. No, I did not ask and I have never asked that! Why dont you ask "Oskar" to post what I wrote, I cannot provide you what...

mongobongo

Just tell me in simple terms why Mikrotik have a support website if those who answers tickets clearly dont care about doing their job with care and attention to someone who is asking for some assistance ? And the below copy/paste response, there is no excuse for that ! Hello MikroTik support offers ...

mongobongo

Implementing the below exactly as it shows (obviously im changing the IPs as to fit my network topology), does not even establish a tunnel. The only difference in my configuration is that the WG server is not behind a public NAT, so I modified the example and still no connection can be established. ...

mongobongo

I have a working wireguard server on the same device I have the ikev2 server setup so I decided to set up a wireguard client on the non working ikev2 client and guess what, tunnel is established, but neither side can ping each other ! Then i saw the comments that something looks to be broken in the ...

mongobongo

Got an a copy/paste answer from "support" a disgrace I must say, "Oskars K" you should be ashamed of that reply. Little to say other there is no "support" directly from Mikrotik, well only if you pay their "consultants" for premium support And to push that to ...

mongobongo

From a Windows PC (192.168.1.5) from the lan of where the ikev2 server (192.168.1.1) is located, Winbox towards the ikev2 client

Below is the sniffer from working ikev2 client

mongobongo

Im guessing this is an issue that even the "veteran" forum members cannot even tell me if I have something wrong, or even if this expected behavoir.

mongobongo

OK, im hoping the below is the issue, but I cannot work out why.

On the working ikev2 client the active peer is the "responder"

On the non working ikev2 client the active peer is the "initiator"

Any ideas, anyone ???

mongobongo

Working ikev2 client # 2024-05-14 17:31:02 by RouterOS 7.14.2 # software id = N2LR-NCS7 # # model = RB5009UG+S+ # serial number = HFE096XXXX /interface bridge add name=bridge_office /interface ethernet set [ find default-name=ether2 ] comment=ether2 name=Lan-office set [ find default-name=ether8 ] c...

mongobongo

It feels like an MTU/ mss issue. Can you ping the remote end with 1400 byte packets over the link. /ping something-at-other-end-of-tunnel do-not-fragment size=1400 You could add some mangle rules to change the mss of tcp syn packets that leave or enter router using the IKEv2 policies. (1360 seems c...

mongobongo

It feels like an MTU/ mss issue. Can you ping the remote end with 1400 byte packets over the link. /ping something-at-other-end-of-tunnel do-not-fragment size=1400 You could add some mangle rules to change the mss of tcp syn packets that leave or enter router using the IKEv2 policies. (1360 seems c...

mongobongo

nobody.....?

mongobongo

WIll make this as simple as I can. Let assume two indentical configs for Mikrotik IKEV2 client both connecting to the same Mikrotik IKEv2 server. Setup 1 Everything works as I expect it to with regards to Winbox I.e. From the client I can connect to the sever and from the server I can connect to the...

mongobongo

I don't think Mikrotik can really make any specific comments on this. They don't know much more than we do, and even if they did, they can't pass on information that may be seen as favouring one distributor over another. I have emailed, and am simply advised to contact ' my ' distributor. I'm surre...

mongobongo

Sorry you dont get instant gratification here, now go suck on a lollypop and learn patience like the rest of the children.

Totally uncalled for

mongobongo

Anyone here believes an employee of Mikrotik will come here and explain the reasons ? For example I see on varia.com that they have a lead time, but it just keeps getting pushed back. I would imagine they are being given information from "someone" to keep updating the lead times on their w...

mongobongo

Hi, anyone know the reasons for the shortages in particular Mikrotik products ?? CRS328-24P-4S+RM - Been out of stock all across Europe for months now (almost 6) each update from certain website about availability keep getting pushed back RB4011IGS+5HACQ2HND-IN - Just looked for one of these for a c...

mongobongo

On the bridge vlan-filtering is enabled. This was with reference to your statement about the CRS, but you posted the CCR configuration. That looks fine except /interface bridge settings set use-ip-firewall-for-pppoe=yes use-ip-firewall-for-vlan=yes is likely unnecessary, it is only required in some...

mongobongo

Here I am running CAPSMan using VLANs on the CCR with the "bridge" method. Do you mean local forwarding mode? On the CRS328 switches I am not doing anything in the VLAN sections. Configured with a single bridge having vlan-filtering=no so VLAN tags are not treated differently to any other...

mongobongo

Hi peeps, hopefully someone can shed some light on what I am doing wrong as I cant work this out at all. I have the following equipment in a working config that has been in place for 3 years with no issues what so ever CCR1009-7G-1C-1S+ CRS328-24P-4S+RM RBcAPL-2nD Here I am running CAPSMan using VLA...

mongobongo

Hi, this situation is getting worse! We were told that in the 6.47 version the file size would be reduced, but the opposite is occuring. It is a stuggle to update these devices, we are now having to downgrade to version routeros-smips-6.32.3 to be able to upgrade, and this old version wipes the pas...

mongobongo

mongobongo: Did you ever try to reboot the device just before trying the update? That may solve it for now. The reason I mention this is that MikroTik claim in many threads that they "always test an upgrade with a device running with default settings" and they claim it works. But we as th...

mongobongo

My question was, does anyone have issues using "check for updates" with a device with factory installed version? Because in the examples I either see custom package sets, or 6.48 beta versions. Yes, from offset factory defaults. Devices have been upgraded for consecutive number of years. ...

mongobongo

Do your hundreds of devices have custom packages installed? Normally there shouldn't be any custom packages and no problem upgrading. Hi, fortunately I dont have 100s of device I have 10s of devices. All device have default packages. This issue didnt just start happening out of the blue. Currently ...

mongobongo

And when we have a network of hundreds of HAP lite ??

Mikrotik should provide a trouble free solution to this situation ...

mongobongo

Hi, this situation is getting worse! We were told that in the 6.47 version the file size would be reduced, but the opposite is occuring. It is a stuggle to update these devices, we are now having to downgrade to version routeros-smips-6.32.3 to be able to upgrade, and this old version wipes the pass...

mongobongo

The first two examples... https://wiki.mikrotik.com/wiki/Manual:CAPsMAN#Basic_configuration_with_master_and_slave_interface These example are for different SSID on the same AP I have a one SSID for each AP. This an example where to configure the access points and the security rules. Read the manual...

mongobongo

Make a security config in capsman (Security Cfg. tab) Have that as your master password Under COnfigurations, create a config for each SSID Make each config reference the one Security config for their security (Top option under Security tab in new config window) Assign the different configs to the ...

mongobongo

You can make x (i.e. 3 or 38) security configurations per SSID (containing the corresponding password of the SSID). Changing a password would be done in a single place. Can you please explain: starting with 3 accesspoints and changing your question to a situation of 38 accesspoints!? A single place...

mongobongo

The first two examples... https://wiki.mikrotik.com/wiki/Manual:C ... _interface

These example are for different SSID on the same AP

I have a one SSID for each AP.

mongobongo

Make three configurations, 1 per accesspoint. That way you can specify a single SSID per accesspoint. But...why? You are still on the same network (unless client isolation is activated). What is the purpose? Perhaps the answer is not suitable for your problem... Yes, but with the three configuratio...

mongobongo

Yes it's possible.

Would you care to explain the general procedure ?????

mongobongo

Hi, as per topic title Is the following achievable, if so what is the procedure? Example We have three cAP lite devices, named: apt1, apt2 & apt3 apt1 has SSID: APT1 apt2 has SSID: APT2 apt3 has SSID: APT3 I would like to be able to change the wireless password on all three devices, but from onl...

mongobongo

Same here!
RouterOS: 6.44.1
WinBox: 3.17

mongobongo

mongobongo

Just came to post the Mikrotik dont care about this issue and have no respect for the end user, reseller and most importantly for themselves.

This conclusion has come from the email correspondence I have had with support regarding these.

Way to go Mikrotik ...........

mongobongo

OK so I 'repaired' these devices by removing the four SMDs and soldering a wire from ground to one of the left side pads of one of the the SMDs (lower left). I cannot find out exactly what these SMDs are to purchase replacements to test. Can anybody with electronic expertise comment on what job thes...

mongobongo

What a mess! Fortunately we did not deploy so many of these. Our situation is as follows, We are a reseller, we buy from a distributor in our country (Cyprus, EU). We have received several of these 'broken' in transit. The cracks are around the edges of the front cover. Our distributor, wont refund ...

mongobongo

So, hopefully the fix I have applied remains, If this is the case then there would be a high probability that this is either a design issue or a bad SMD component issue. Basically on the two Lite5 AC I worked on the four small SMD regulators below the main IC (see picture below). https://i.imgur.com...

mongobongo

These unit looks like it has seen much humidity, how it is mounted? Hi! Thanks for your response, Yes, our location has high humidity as we are near the Mediterranean sea. The Lite5 have/do not show this type of problem. They are mounted on a steel pole that is attached to the steel cage that holds...

mongobongo

Hi, couple of days ago had a second Lite5 AC (RouterBOARD SXT 5HacD 2n r2) die with some type of hardware failure. Both of them died in similar circumstances. They first start to sporadically connect/disconnect until one day they have difficulty in powering up at all. Both devices were grounded with...

mongobongo

Just did an update for a lite5 and now it needs debricking

Updated from 6.41.2 to 6.42.6.

Now the device beeps every 5 seconds and the user led blinks at the same interval.

Good job I didnt apply this update to my devices on the network!

Will attempt to do a net-install.......

mongobongo

There is a problem in your AP's configuration, please check this guide: https://wiki.mikrotik.com/wiki/Manual:Layer2_misconfiguration#VLAN_interface_on_a_slave_interface Hi, thanks for your reply, I used the wiki link below https://wiki.mikrotik.com/wiki/Manual:VLANs_on_Wireless (Example with vlan-...

mongobongo

Hi, I am unsure if what I am seeing is what should be occuring so I will post below the scenario in the hope that someone can comment. Simple setup, a gateway, an AP and a CPE Gateway /interface vlan add interface=ether3_Lan name=vlan10 vlan-id=10 /ip pool add name=pool_vlan10 ranges=10.0.10.2-10.0....

mongobongo

Only by bigger force... Or negotiate with the neighbor to stop that. None has exclusive right for ssid or Mac address number. At least until you registrate some word as trademark. Then you can maybe suit your neighbor for misusing your intellectual property... Very hard, complicated and not enough ...

mongobongo

Hi, Will be as clear and accurate as I can. Is it possible to create a 'pseudo AP' using the following information Wireless Radio Name Wireless Channel Wireless MAC Address I am asking as today somone created a 'pseudo AP' to mimic one of our AP's with the information listed above. Basically this is...

mongobongo

NVM several minutes, how about this cloud change time Jul/28/2017-16:42:47 => Aug/06/2016-02:49:17 !! Just seen this, I pressed forced update and it returned to cloud change time Aug/06/2016-03:19:28 => Jul/28/2017-17:13:41 Several minutes off Quite surreal to be honest And why is this turned ON by ...

Search found 66 matches