MikroTik

elbob2002

Yes something is wrong. You have no DNS resolver configured. i.e. you have no DNS server in your settings to forward requests to. /ip dns set servers=8.8.8.8,8.8.4.4 Edit - to clarify your router has no DNS servers configured but your clients do because your DHCP settings assign 8.8.8.8 as the DNS s...

elbob2002

Block Diagram is available:

https://cdn.mikrotik.com/web-assets/pro ... 241016.png

Tl;DR - ether1 direct to SoC. ether 2 to 5 to switch chip

elbob2002

Take a backup and run netinstall

elbob2002

Crash on Windows 7 SP1 with popup message "Entry point not found: The entry point to the CreateDXGIFactory2 procedure was not found in the DLL dxgi.dll ." I am having same problem. How do I get the correct files for windows 7 ? Really? An operating system that is out of support? At a gues...

elbob2002

How u checking kernel version?

/system/resource/usb

You should see something like:

0 1-0     Linux 5.6.3-64 uhci_hcd  UHCI Host Controller     12

elbob2002

Maybe it's because I'm getting old but it's very, very, difficult to navigate because of the "flat" design. Also something as simple as adding a firewall rule takes a lot longer because there's no tabs anymore. Suppose I have no choice but to get used to it. Edit - lack of gridlines is an ...

elbob2002

Hi - you should be fine to add as many CPUs as you want.

The System ID is generated on first boot and doesn't change for the lifetime of the VM unless you do it manually.

Even if it did change you can always assign the license from the Mikrotik customer portal to the new ID.

elbob2002

Try another power supply?

elbob2002

That is such a great explanation. Wish the official docs were as good with practical examples!

Filtering has been wrecking my head since it first came out.

elbob2002

What is connected to the ports you are seeing drops in? Out of curiosity I checked a CRS326-24G-2S+ that's in use as a server switch here and sure enough I am seeing TX drops however only on 4 interfaces. The devices connected to these 4 interfaces are all Proxmox servers. All 4 ports are vlan trunk...

elbob2002

No point even trying to guess what's wrong without seeing the configuration of each RIP router.

it has some dst nat based on my requirement

Can you elaborate a little bit?

elbob2002

Oh yes. Now I need to justify buying one!

https://www.youtube.com/watch?v=0mIfZYeGXmU

elbob2002

We just upgraded a few of our routers from 7.12.1 to 7.15.1. This broke our vpls sessions. So we downgraded down to 7.14.3 and now they are good again. Is there a known VPLS issue with 7.15.1? Read the other posts. There's a few VPLS issues reported. Or just search for "VPLS" in this very...

elbob2002

I know that ROS doesn't like some SFP modules. I've had issues with Arista modules for example. But start at the simplest - the fibre itself. If you can get a spare fibre somewhere to test with? You could also try cleaning the fibre tips, even though they should be clean as they're new - there could...

elbob2002

Of course there is. Have a look at the testing channel and you'll see 7.16Beta1. Look at the history of 7.15 and you'll see all the Betas and RC releases. There are Alpha versions too but usually they're not public. Not everyone will be willing to use Betas and Release Candidates in production. Some...

elbob2002

https://mikrotik.com/products/group/ethernet-routers Start with the most expensive and work your way through the list. You haven't provided any details whatsoever, are they PPPoE clients, LAN clients. Speed of your internet connection and so on. So it's up to you to figure it out based on your requi...

elbob2002

Thank you for your answers! Sounds like it does a lot of things. For me I was hoping I could use it for terminal access, i.e. using PuTTY or the like. I have been trying to figure out how to change the address range of the DHCP Server to 10.10.0.10-10.10.0.254. Every time I try I get kicked out of ...

elbob2002

You can also activate the license once if you have a Mikrotik account. Once activated you'll have upgrades for 60 days. After the trial period you'll no longer have updates but neither will you be limited to 1Mpbs You will have to have an account registered on MikroTik.com. Then you can request the ...

elbob2002

Read the documentation:

https://github.com/ktbyers/netmiko/blob ... ATFORMS.md

RouterOS and SwitchOS are on the list of supported platforms.

elbob2002

Putting this here for reference in case anyone else has a similar issue: https://forum.mikrotik.com/viewtopic.php?p=1065618#p1065618 I originally reported high CPU usage on an RB750Gr3 in the post above. I recently noticed the same on a brand new CRS310-8G+2S+ It turns out it was my own fault. Neith...

elbob2002

What temperature is it?

A quick google shows a range of SFP+ devices with a maximum of 85°

I have three 4 devices all with Cisco 10Gb SFP+ modules

CRS310-8G+2S+ : 38°
CRS328-24P-4S+ : 46°, 43° and 44°
RB5009UG+S+ : 43°
CRS326-24G-2S+ : 44°

Chances are yours is fine!

elbob2002

System ID is the same on your router as the portal so if there's a green flag in the CHR Keys section of the portal then it's active.

elbob2002

My initial thought as well.

No Winbox open. snippet above are from an SSH connection to the router.

elbob2002

Noticed very high CPU Usage on an RB750Gr3 Profile showed that the "management" process was using almost between 24% and 27% of CPU and another "unclassified" process was using another 16% CPU NAME USAGE ethernet 0% console 1% ssh 0% firewall 0.1% networking 5.6% neighbor-discove...

elbob2002

This is going against the essence of what a router/switch should be, heck even enterprise routers/switches do not even have any sort baked into it. I have several Catalyst C9500-48Y4C switches at work. 8 Core Xeons with 32GB RAM and a 960GB SSD. Granted they're in a slightly different league than M...

elbob2002

It's expected. Using the mikrotik bandwith test will never show the switching performance. Switching will be wirespeed and as you have no VLANs you can be reasonably certain that you will get full switching performance. As @lolski already mentioned running iperf between two devices connected to the ...

elbob2002

You're going to have to take the performance hit if you insist on using EOIP. As it's CPU bound there's no way around it.

Other than replacing the routers with models with the highest performing CPU!

elbob2002

I have used Cisco 1GB GLC-T in my RB3011 and it worked fine. I did have an Arista one that didn't work so it could be hit or miss with some modules. EDIT - Forgot to mention that the reason I stopped using the SFP on my RB3011 is because there are two switch chips in it with an aggregate 2Gb/s link ...

elbob2002

You are running RouterOS 6.49.3 and there has been many releases over the years since. There has also been many fixes particularly related to SFP modules in that time. Upgrade to latest 6 release and see if that fixes the issue or else plan an upgrade to the latest v7 release. If you go the v7 upgra...

elbob2002

Can you post your configuration?

/export/hide-sensitive file=myconfig

You can then download the config and open it in a text editor and post it here.

elbob2002

What hardware? What version of Router OS? and can you post your configuration?

It's impossible to even guess what the issue might be without any helpful information.

elbob2002

The overhead is EOIP.

It's not hardware offloaded so uses the CPU and I don't think it's multithreaded either.

Try the tests again and monitor CPU usage with Tools --> Profile running to monitor CPU usage.

elbob2002

You'll have to netinstall -

https://help.mikrotik.com/docs/display/ROS/Netinstall

Be warned though - it can take many frustrating attempts to get netinstall to work properly!

elbob2002

While I agree with a lot of what's already been said above I think it's something of a testament to Mikrotik and how good their hardware/software can be (within it's limitations) that people are comparing them to the "big name vendors". But still I can't see large enterprises changing from...

elbob2002

Click on your profile top right. The "My Board Style"

ForumPrefs.png

elbob2002

Installed it via pip and Web was accessible on http port 8080

elbob2002

No
Assumed it would open a new winbox session.
No Opinion
Having just read the documentation I don't think it does!
N/A

elbob2002

You can try to generate a new license ID and then renew license.

Then on the Mikrotik Portal where your CHR Keys are you can transfer from the old ID to the new ID

elbob2002

You should netinsall to factory reset the router. It's the only way to be certain that the compromise has been completely removed: https://help.mikrotik.com/docs/display/ROS/Netinstall That won't prevent you from future hacks though so likely you have an issue with your firewall rules or services op...

elbob2002

System --> Logging, click on Actions tab and create a new remote action.

Then create a copy of the rules with the actions set to to your new one.

elbob2002

The license should appear as available in your Mikrotik.com home page. Under All CHR Keys.

Locate the Key you want to assign to the CHR you want to upgrade and click on Transfer.

On that CHR then renew the license and it should pull the P10 licence.

elbob2002

I'd go for an RB5009 I have two of them and they're great. However for price I'd go for an L009 . I have an RB3011 too but there's two switch chips which become a PITA when it comes to VLANs. There's also no L3 Hardware offload. It's also an old design now at this stage. The L009 supports hardware o...

elbob2002

LibreNMS might fit your bill.

I use it extensively. There is a docker container for it.

elbob2002

I´ve updated my wAP AC with the wifi-qcom-ac package and the main ROS 7.13Beta1 package. All went smooth and the change to my CAPsMAN-AX also went well. But I get some strange error messages in the CAPsMAN AX for the AC-device: Is it required to update the CAPsMAN AX to 7.13 Beta1 also to make it w...

elbob2002

You need to allow GRE on the firewall. Probably IPSec ports too if you're using that to encrypt your tunnel.

elbob2002

You don't mention your connection type. Is it a DSL SFP? Is it fibre?

If it's fibre then you should be able to just plug straight in. If it's one of the DSL SFPs then they can be a bit tricky to get working.

elbob2002

You're probably best off in opening a support ticket for this issue.

Or you can take a backup and recreate the VM and restore the backup.

elbob2002

If you have a contact in your ISP ask them if they support Baby Jumbos If they do you can set your ether1 MTU to 1508 and then your ppp-out1 interface to have an MTU of 1500 Will reduce packet fragmentation if they do support it. FWIW I never had to change the interface MTU before. Just the MTU of t...

elbob2002

What NIC drivers are you using? VMXNET or e1000? The manual has this to say about e1000 if you are using it: Warning: We do not recommend using the E1000 network interface if better synthetic interface options are available on a specific Hypervisor! You also should probably update to the latest 6.xx...

elbob2002

If it's anything like my ISP there seems to be some sort of a restriction on the MAC or Device Identifier that can connect. You may need to wait for it to expire before trying again.

I usually have to wait 30 minutes and then try again if I change my router.

elbob2002

BCP has me curious - have you a quick example?

elbob2002

I think he wants to extend a single LAN across two physical locations.

For this EOIP is the only real method:

https://help.mikrotik.com/docs/display/ROS/EoIP

Performance depends on CPU though. You can have very mixed and sometimes disappointing results with EOIP.

Eoip-example.jpg

elbob2002

That device supports bridge based VLAN filtering.

The documentation is here and is quite easy to understand:

https://help.mikrotik.com/docs/display/ ... NFiltering

elbob2002

Probably using an unsupported disk type.

i've no idea what OpenNebula use but from the documentation here:

https://help.mikrotik.com/docs/display/ ... ter%2C+CHR

It seems that you should use IDE for the disk type.

elbob2002

/routing/route print detail
And clearly you haven't read the forum posts...

Neither have you.

Your snippet shows the results of

 /ip route/print detail

Not

/routing/route/print detail

elbob2002

As for the VLAN issue:

Try:

/interface ethernet switch vlan
add independent-learning=yes ports=ether1,ether4 switch=switch1 vlan-id=101

elbob2002

Most likely because that device doesn't support Bridge VLAN offload so the recommended way to VLAN these devices is via switch chip rather than bridge. Otherwise performance would be abysmal. Although as the HAP Lite only has 100Mbps the performance hit might not be so bad using the bridge. It is a ...

elbob2002

All there on this page:

https://mikrotik.com/support

You can contact support via the link to Jira on that page or e-mail them. Bug reports as well.

elbob2002

Can you post your complete config?

elbob2002

Tag the bridge with VLAN30 too:

/interface bridge vlan
add bridge=bridge comment=LAN tagged=bridge,sfp5,sfp-sfpplus4,sfp-sfpplus3 untagged=sfp4 vlan-ids=30

elbob2002

Can you show your config?

Did you enable VLAN filtering on the bridge?

/interface/bridge/ set vlan-filtering=yes 0

elbob2002

I'm afraid I'm not going to be any help with the script but why not block IPsec at firewall and only allow the IP address of your tunnel endpoint?

Of course this is no good if you have roadwarriors.

elbob2002

You'll be waiting. They aren't available anywhere yet.

My usual distributor said they will have them in August.

elbob2002

They look removable so most likely RP-SMA as @kfrag mentioned above.

elbob2002

You can also use USB as a serial port. All Mikrotik devices with a USB Port can display a console via USB. Unfortuantely the OS has to start first for it to be available so you cannot use it to interrupt the boot process like a regular console port but it's usefull nonetheless if you can't access Wi...

elbob2002

/tools/graphing

https://help.mikrotik.com/docs/display/ROS/Graphing

elbob2002

Add your dockerhub username and password:

/container/config/set username=myusername password=mypassword

Or use winbox to set it.

elbob2002

I've limited Proxmox experiernce but with ESXi you need to enable promiscious mode on your vswitch.

Not sure what the setting for proxmox might be for this.

elbob2002

Do you mean switch and router all in one? Answer is yes and no. The CRS3xx and 5xx range have L3 hardware routing but that's mainly for VLANs. As for a router and firewall then there's no suitable device really as the CPUs in the switches are too weak. Go through the product pages on Mikrotik.com an...

elbob2002

Pretty much any relatively recent router. Just did a test from a windows L2TP client to an RB3011 on a 1GB/1GB connection using iPerf to a client behind the RB3011 and was pushing 85Mbit I've no way of testing IPSec with IKEv2 but performance shouldn't be much different. I'd imagine an RB4011 or an ...

elbob2002

RB 4011 after upgrading to v7.9 does not connect using SFP S+DA0001. It has been tested on other RB4011's, and they all have the same problem.

Says right on the product page:

Passive DAC (MikroTik S+DA0001/S+DA0003) are not supported.

https://mikrotik.com/product/rb4011igs_rm

elbob2002

There are all kinds of containers, it's not all memory intensive software. There are tiny tools you can use as well. L009 is our low cost device. Adding RAM will make it not so cheap anymore. We have other products with more RAM RB3011 has 1GB of RAM. Other than the colour it seems the L009UiGS-RM ...

elbob2002

That is extremely helpful @anav.

Thanks for such a thorough reply!

elbob2002

YES!!! Thank you! I knew it had to be something relatively simple. I indeed missed that bit in all my reading earlier. Adding the following on the server site worked absolutely perfectly! Also I think this is the quickest I've seen a question resolved ever on the forum. /interface wireguard peers ad...

elbob2002

Hi all, I've been driven crazy by this issue all day. I've read the documentation and I've read @anav's excellent Wireguard Success For The Beginner guide and I stil think my configuration should work but it doesn't. I have a CHR as a Wireguard server. I have three other CHRs that I want to connect ...

elbob2002

What are your firewall rules? can you run:

/ip/firewall/filter export

elbob2002

You need to tag your bridge under vlan 1 instead of untagged.

elbob2002

You're running BGP I presume going by the VM name.

BGP performance is much improved in v7. There are threads aplenty elsewhere about BGP performance so that's likely to be your culprit.

elbob2002

I use Caddy for my reverse proxies - one running on a container on an RB5009:

One small config file and automatic SSL with Letsencrypt:

https://caddyserver.com/

elbob2002

A router would have a more powerful CPU for a start. And more RAM. The CRS 354 only has a single core CPU running at 650Mhz with only 64MB of RAM. You can see the performance yourself on the product page: https://mikrotik.com/product/crs354_48g_4splus2qplusrm#fndtn-testresults 410Mbps with 25 rules....

elbob2002

Proxmox uses KVM. For VLANs you need to make the bridge interface VLAN aware and then add the interface to the VM something like this: virtio=00:00:00:00:00:00,bridge=vmbr0,firewall=1,tag=88 Where tag=88 is obviously VLAN88. For a physical network you will need to create a new bridge for each physic...

elbob2002

It depends on your hypervisor.

In VMware you add another NIC to the virtual machine. Proxmox is almost identical.

Those devices get added to what ever Virtual Switch you are using.

elbob2002

Are they all the same version? 6.49.7 is the latest v6 stable release. There's been a lot of fixes between your version and the latest.

elbob2002

Looks like your RB750Gr3 might not have hardware suppored IPSEC.

From this table:

https://help.mikrotik.com/docs/display/ ... celeration

The MT7621A CPU only supports 3DES and AES-CBC accelerated encryption.

elbob2002

You don't seem to have a filter rule to accept established or related INPUT traffic on your WAN interface:

add action=accept chain=input connection-state=established,related

elbob2002

RouterOS doesn't use Docker.

I think it uses LXC or a derivitive. Open to correction here.

elbob2002

Lakh means 100,000 in India.

So 200,000 concurrent users with a total of 1,000,000 users among 5 POPs is my understanding of the question.

elbob2002

Can this be installed on CRS3XX series switches now?

I know it doesn't say it on the release notes but given all the Beta versions had the warning I'm still a bit hesitant!

elbob2002

Just out of curiosity can you rename the USB disk to Disk2 or USB or something like that and use that label for your pull directory and container location?

elbob2002

There's no filesystem on it. You need to create an ext4 partition on it.

elbob2002

Disk1 is the flash storage of your RB3011. Go to System --> Disks to get the path of your USB You will likely need to change your tmpdir location too. For example here are my partitions running on 7.8Beta3 - you can see usb-part1 is the partition of the USB Key if I were to use mine for storage. Als...

elbob2002

Try disabling Auto Negotiation on your LAN port and setting it to 1Gbps

elbob2002

feature request: Administrator portal or customers menu as the old one.

Second last paragraph on the very first post:

there won't be a separate administrators portal as in the old User Manager.

elbob2002

No experience with Proxmox but on VMware ESXi I had to set promiscious mode on the vswitch for CHR to work correctly.

I assume there's an equivilent on Proxmox?

elbob2002

It's there in the change log:

*) disk - improved external storage file system mounting, formatting and naming;

Also Post 25 on this thread:

viewtopic.php?p=976231#p971852

elbob2002

Cisco VIC Ethernet is what exactly? What card is it and what chipset? Broadcom? Intel etc? What speed is it? 1Gb, 10Gb, 100Gb? CHRs have limited driver support. It's quite possible that the driver you are looking for is not in the CHR kernel. Also the CHR kernel is not modular so it's not possible t...

elbob2002

Thanks! I was just looking to do something similar this morning and came across this.

elbob2002

You need to add the variables for your container before you pull it down:

/container/envs/add key=cap-add name=MYCONTAINER value=NET_ADMIN
/container/envs/add key=device name=MYCONTAINER value=/dev/net/tun

Where MYCONTAINER is the name of your container.

elbob2002

Uptimez.png

elbob2002

It's been mentioned somewhere else here before but apparently the 16Mb of flash storage on most MIPSBE devices means there will never be wifiwave2 for those devices. Since there are no MIPSBE devices that have wave2 chipsets (not the stock devices anyway), its pretty possible that wifivawe2 package...

elbob2002

It's been mentioned somewhere else here before but apparently the 16Mb of flash storage on most MIPSBE devices means there will never be wifiwave2 for those devices. The driver package for ARM is 10MB in size alone!

elbob2002

changed the cables? duplex settings okay? what does the log say? yes i replaced the cable nothing change, to avoid this i just reboot every 23H what is wrong with the release ? as a managment switch untill now its perfect log says interface down and up 3 or 4 times untill work as 100 Mbps. maybe 7....

elbob2002

It might be able to ID the device correctly from PCI ID. But probably there is no driver in the kernel for that chipset.

elbob2002

1GB of traffic is about right according to the test results on the product page. I presume you're using queues or filters and given it's PPPoE probably an MTU of 1492? Routing none (fast path) 254.4 3089.4 309.8 1268.9 315.4 161.5 Routing 25 simple queues 104.6 1270.3 104.4 427.6 104.6 53.6 Routing ...

elbob2002

I think Pihole will still need a complete restart of its container. Unless it's possible just to restart PiHole-FTL

/container/shell 0

Is there any init scripts?

elbob2002

Why not use VRRP?

https://help.mikrotik.com/docs/display/ROS/VRRP

elbob2002

Here's a screenshot of one of my CHRs. Two containers. Both running Alpine. First is running Caddy as a Reverse Proxy, Second is running Openspeed Test.

You can clearly see where I fired up the second container on Monday. Memory usage is very stable.

Screenshot 2022-10-26 122914.png

elbob2002

Worked for me on the Openspeedtest container thanks!:

add dst=/var/log/nginx name=openspeed src=/disk1/openspeed/var

elbob2002

Disk1 one is attached storage I presume - is it formatted as Ext4?

Edit - just tried on a CHR and I get the same permissions errors. Are there any variables that should be set? Any mountpoints according to the image documentation?

elbob2002

You can run Zerotier in a container on CHR. I've had success with this one: https://github.com/zyclonite/zerotier-docker Instead of using a seperate subnet for the veth interface needed for Docker I just added the veth interface to the existing bridge. Probably not good practice but it works! Change...

elbob2002

You can run Zerotier in a container on CHR. I've had success with this one: https://github.com/zyclonite/zerotier-docker Instead of using a seperate subnet for the veth interface needed for Docker I just added the veth interface to the existing bridge. Probably not good practice but it works! Change...

elbob2002

Last thing I can think of is this thread:

viewtopic.php?t=189042

Supposedly the fix will be in 7.6 - you could test the latest 7.6RC and see if that fixes the issue.

elbob2002

Change the cables for new ones?

elbob2002

What are the two identical switches? Make/Model.

Do both have the port you are powering the RB5009 from configured for 802.3af/at ?

elbob2002

I have my Starlink into an RB5009. All works well. Except IPv6 which was once available but now seems to have disappeared. I have the round dish - Here in Ireland the weather never really gets too cold anyway but the de-icing can be turned off or just set to automatic. Power usage is typically aroun...

elbob2002

The Hap AC doesn't have a console port at all. At least according to the hardware page.

https://mikrotik.com/product/RB962UiGS-5HacT2HnT

I don't think any of the small Mikrotik devices have console ports either. I know my RB750-Gr3 doesn't either as I've locked myself out of that before as well!

elbob2002

Was that CPU usage overall? What's the usage per core?

elbob2002

You have two bridges. Only one can be hardware accelerated. The other is going through CPU and maxing whatever core it's using out. Check your CPU usage while iPerf is running through each bridge. Edit - As was pointed out to me not so long ago the only exception are CRS1xx/2xx series switches which...

elbob2002

Hardware offloading only works on a single bridge interface.

elbob2002

I found on 7.5 that for L3 hardware off loading on my CRS328, not all VLANs would be offloaded.Each new VLAN I added required a reboot for it to work. But I can see on yours that you've rebooted.

elbob2002

You have no source address set.

trafficflow.png

elbob2002

As explained already the CRS-1XX Series don't support bridge hardware offloading. From the documentation: For example, you use this configuration on a CRS1xx/CRS2xx series device and you started to notice that the CPU usage is very high and when running a performance test to check the network's thro...

elbob2002

Downloading and unzipping the firmware results in a myriad of files and folders. No way to know which one to try so not even worth attempting it:

This is just tthe update folder:

Screenshot 2022-08-26 233442.png

elbob2002

Chateau has only 16MB of flash. the firmware is over 100MB. I think we have to wait for the Mikrotik release of the firmware and whatever method they use to do the upgrade.

elbob2002

There are two Cisco facilities here so you could be right!

elbob2002

The reasons are probably the same that you have with all vendors. We are not really happy if Cisco tells use we have 380 days of lead time for eg. Wireless AP's 9100-series etc. Certain Catalyst LAN-switches is also quite problematic etc. We ordered 8 Catalyst 9407R back in March. Our delivery date...

elbob2002

Hi, ipsec problem are fixed ? somebody knows ?

What IPSec problem?

If it's not in the changelog then chances are it's not been fixed.

elbob2002

Can you post your config?

export hide-sensitive

elbob2002

Chateau LTE12 and RB750GR3 upgraded successfully from RC11 with no issues.

Two CHRs running containers upgraded with no issues from RC11. Scheduler script started containers successfully at power on.

elbob2002

It's a different Kernel with a big rewrite of some of the RouterOS internals so it's quite possible some extra resources are needed. It also depends on how you router is configured. Fasttrack, queues etc. Also between 4 and 7% hardly qualifies as high CPU usage! Your CPU usage seems quite comparable...

elbob2002

Just tested on a new 7.4 VM on ESXi 6.7 Hot added a disk to the CHR and formated it as EXT4 with Partition Table enabled. Rebooted and had no issues. If I have a chance later I'll try a v6 CHR and upgrade and then add a disk and see if the same thing occurs. The CHR was imported from the OVA - the O...

elbob2002

Very useful informations for help you,
a post full of details....

Not helped by having a useless comment like yours.

elbob2002

This issue occurs if the second disk is formatted with "Partition Table" checked.

Apparently it's been fixed in 7.4

*) chr - fixed booting with added additional SCSI disk;

elbob2002

Add your tun/taps as variables for your container. I tested with Zerotier in an Alpine Linux image and it works perfectly:

ZTTUNTAP.png

elbob2002

Figured out Tun/tap devices. Just add them as environment variables

ZTTUNTAP.png

elbob2002

*) container - added tun/tap support for containers;

This brings us one step closer to Zerotier on CHR. Is there any documentation on how to enable tun/tap devices for a container?

elbob2002

Still no timeline for supporting other architectures? I bought a Hap ac3 just to try it out and it works great! But I'm literally waiting for you guys to support x86/CHR before purchasing any more licenses!

You can run Zerotier in a Docker container on CHR.

elbob2002

You mean like this? 7.4RC2

ContainterParams.png

elbob2002

Thank you! I don't know how I missed that in the docs!

elbob2002

reload last vm backup you made before do that test

Yep. Had a snapshot so reverted back. Any idea what command I should actually use not to brick the vm again?

elbob2002

Got the following error on CHR:

mikrotik container failure: not allowed by device-mode

Tried to resolve it by changing the device mode:

system/device-mode/update mode=home

And now my CHR is dead with this error:

CHR ERROR.png

elbob2002

Maybe try a CHR on a supported hypervisor? You can add more resources if you find you run out.

elbob2002

What bandwidth test did you use? Bandwidth Test built into mikrotik devices relies heavily on the CPU and never seems to give true results.

Iperf or Iperf3 between devices on each side of your CHR will give a better indication of performance "through" your router.

elbob2002

Centralised updates and configuration management!

elbob2002

Of course there might be advantages to other alternatives, but at the moment ZT is the only available solution for Mikrotik (so far). So ZeroTier cannot meet ANY of those 3 CRITICAL advantages ..... otherwise you @Larsa would be singing from the Tree Tops :) To bad that TailScale is not integrated ...

elbob2002

CHATEAU LTE12 IS V7 ONLY! Download the latest 7.2.3 stable for ARM here: https://mikrotik.com/download Use Winbox to and drag and drop the package you downloaded to Files and reboot. For future upgrades you will be able to use the normal SYSTEM/PACKAGES method to update. Edit - The Chateau LTE12 is...

elbob2002

I have the exact same issue and I reported it before. And it's occurred ever since Zerotier was added as a package. If you leave it without restarting the zerotier instance it will eventually come back which makes me believe it's related to connection tracking in the firewall. Although I haven't bot...

elbob2002

Cosmetic/Minor Bug:

Almost every non-CHR Device I upgraded is now showing a warning under System --> Routerboard:

Warning: cpu not running at default frequency

750GR3, RB5009, Chateau 12, CRS-125.

The only device that doesn't show this error is an RB3011.

elbob2002

OSPF stopped working - invalid area and invalid instance.

Fix was to change the Router ID in instance from "main" to the IP address of the router.

elbob2002

Seems fine on 7.1.3 and on 7.2RC4

webfig2.png

Webfig1.png

elbob2002

Mine is currently running 7.1.3 with no issues. 4 interfaces in use - also a Zerotier interface. I have a Cisco Fibre 10G SFP+ connected to a CRS328 that I did have to disable auto-negotiation and manually set the speed to 10G. I did that when I got it and it was running 7.0.5 and haven't changed th...

elbob2002

"ZeroTier IP addresses and routes can overlap public IP space." from https://help.mikrotik.com/docs/display/ROS/ZeroTier That meant nothing to me. Maybe a practical example or explanation??? With Allow Global disabled Zerotier will only handle private IP addresses. If you wanted to expand...

elbob2002

Your first solution should be to educate users not to open suspicious attachments. Second solution should be to implement a proper e-mail filtering solution. Rate limiting SMTP should not be considered a solution and will likely cause problems in the future. Also rate limiting won't clear any mail i...

elbob2002

What does "Allow Global" do?

"ZeroTier IP addresses and routes can overlap public IP space."

from https://help.mikrotik.com/docs/display/ROS/ZeroTier

elbob2002

You're using a bridge based VLAN which is only really supported on a limited number of newer devices. While it works it does result in the performance you are seeing.

elbob2002

Good morning everyone, I would like to know if zerotier works in version V7.1.3 because I cannot receive the IP address on the zerotier interface, however my status is OK. I appreciate your help Works perfectly fine. Although I have manually assigned an IP address to my instance running on an RB301...

elbob2002

Two CRS-125 - Port flapping on both.

Downgraded both to 7.1.2 left one on Firmware 7.1.3 and the other downgraded to Firmware 7.1.2

Switch with Firmware 7.1.3 still had port flapping.

Now have both on ROS 7.1.2 and Firmware 7.1.2 and no more port flapping.

elbob2002

Try Cisco. You'll only have about 18 to 24 months to wait for them to fulfill your order.

elbob2002

How is PPTP any less secure than running IPIP, EoIP or any other VPN protocol with no cipher enabled that will show no such warning? And what's next? All open WIFI interfaces will show red warnings too? ROS is supposed to be for professionals that know how to use it and what limitations each of the...

elbob2002

The issue is with your ROS template in GNS3.

Change the network interface section like this:

GNS3MTIK2.png

When selecting an interface to connect ether1 will still appear as ether0 in the GNS3 selector but labels will be fine.

elbob2002

Can't find this update on my RB5009. Have checked for updates in /system packages Quick Set > Check for updates shows installed version 7.0.5 and latest version 6.49.2 Upgrade to 6.49.2 and you should see 7.1.2 6.49.2 won't run on an RB5009 You'll need to remove any extra packages that may be insta...

elbob2002

MPLS / VPLS sorted??

I cant find anything in the changelog

Then it's not sorted then is it? If it was it would be in the changelog!

elbob2002

Looks like a simple matter of the 5009 having a more powerful CPU than the 4011.

elbob2002

I just upgraded a RB1100AHx4 to 7.1.1 -- on reconnection after reboot I see a warning that I don't have a key: I thought it might be a weird 7.1.1 glitch -- the other two RB1100AHx4's I've upgraded were running 7.1 not 7.1.1 - so I tried a downgrade to 7.1 -- no luck, same message: MikroTik RouterO...

elbob2002

I have the exact same issue. Was going to report it to the GNS3 team as I believe the issue is on their end but never got around to it.

elbob2002

It definitely would help if you provide more details to describe problems. Do you ask your doctor for help saying "I'm feeling ill"? :) Still writing "Calculating download size ..." You need to remove any extra packages installed before upgrading. This has been mentioned in near...

elbob2002

Add a new mark using Routing Tables and a new FIB if required.

https://help.mikrotik.com/docs/pages/vi ... d=59965508

Then this table will be available in Firewall.

examples here:

https://help.mikrotik.com/docs/display/ ... ll+Marking

elbob2002

I believe I have resolved this issue. Devices with the "leaked" IPV6 addresses were connected to an upstream access switch. A CRS-125 with SFP port as a trunk to the CRS-328. Reviewing the VLAN configuration on the CRS-125 cropped up a few configuration issues where egress translation wasn...

elbob2002

Here's the complete config: The router serves three other VLANs in my lab as you can plainly see in the config. VLAN56 VLAN88 and VLAN999. IPV6 addresses leak to those interfaces too. # dec/29/2021 09:01:22 by RouterOS 7.1.1 # software id = # # model = RB5009UG+S+ # serial number = XXXXXXXXX /interf...

elbob2002

Hi, More IPV6 woes I'm afraid. I have an RB5009 connected to a CRS328. No VLANs are configured on the RB5009 however the interfaces are connected to tagged ports on the CRS328. Essentially the RB5009 acts as my VLAN router. I've configured IPV6 on two interfaces. One for the default network i.e. no ...

elbob2002

You are spot on! Wrong Prefix.

Thanks for spotting that for me. Works now!

Very much appreciated. Cheers!

elbob2002

Did that before posting here. Had the same result unfortunately.

It's a PITA to have to use another server just for IPv6.

elbob2002

Hi, I'm trying to test IPv6 here in my lab. Router is a 750GR3 running RouterOS 7.1.1 For testing I've decided to use the same Ipv6 range in the Mikrotik documentation. The specific issue I'm having is that DHCPv6 clients are not being assigned an IP address from the pool. IP Pool: 2001:db8::/64 I'v...

elbob2002

4095 is the default VLAN and is enabled dynamically. There is no way to disable it.

elbob2002

I had issues on the last beta and now again with 7.1 in that Zerotier on my RB3011 becomes unresponsive. Other devices on the same Zerotier network are still contactable. About every 5 days I need to disable the Zerotier interface on my RB3011 and re-enable it again. However my RB3011 is bridged to ...

elbob2002

Hi I have some question. Could someone answer and help. I have a Chateau LTE12. 1) Is it possible to downgrade to version 6.49.2 from version 7.1 ? It was upgraded to version 7.0.3 earlier . 2) I have configured dot1x. The ISE server is behind the ipsec tunnel. I do not see any traffic on the firew...

elbob2002

I've an SXT G-2HnD that I upgraded out of curiosity: uptime: 3d6h43m21s version: 7.1 (testing) build-time: Dec/01/2021 14:07:27 free-memory: 5.5MiB total-memory: 32.0MiB cpu: MIPS 24Kc V7.4 cpu-count: 1 cpu-frequency: 400MHz cpu-load: 17% free-hdd-space: 109.9MiB total-hdd-space: 128.0MiB write-sect...

elbob2002

RouterOS 7.1 does not work properly with boards equipped with 32MB of RAM (e.g. RB411) 00:01:06 system,error,critical router was rebooted without proper shutdown 00:01:07 system,error,critical kernel failure in previous boot 00:01:07 system,error,critical out of memory condition was detected 00:01:...

elbob2002

Very unstable operation of ospf with md5 auth:

OSPF Auth is broken in 7.1

viewtopic.php?t=180847

elbob2002

hAP Lite stuck in "calculating download size..." since hours. A reboot didnt help. Current packages [admin@MikroTik] /system package> print Flags: X - disabled # NAME VERSION SCHEDULED 0 ipv6 6.49.1 1 dhcp 6.49.1 2 advanced-tools 6.49.1 3 system 6.49.1 4 routing 6.49.1 5 multicast 6.49.1 ...

elbob2002

It stuck on "calculating download size..." when trying to update from any ROS 6.

You need to remove any extra packages you have installed first.

elbob2002

Like mentioned in original post, did this, still the same issue.

There was/is an issue with some DACs not working on some devices. This might be your issue.

My RB5009 and CRS328 are connecting using Cisco SFPs with fibre and both manually set to 10Gbps full duplex and autonegotiation disabled.

elbob2002

Turn off Auto Negotiation and set the speed to 1G

I've had to do this on a CRS328 running 6.4x and on an RB5009 running 7.1RC6

elbob2002

Turn off Auto Negotiation and set the speed to 1G

I've had to do this on a CRS328 running 6.4x and on an RB5009 running 7.1RC6

elbob2002

The RB5009 will definitely give you the best performance for the price I reckon. I'm very happy with mine. It doesn't have WiFi though.

elbob2002

High memory usage on Caplite and RB750gr3 after 7.1b6
(About 16 MB more than version 6.49 )
6.49 => 44.1MB free memory
7.1b6 => 27MB free memory

Big jump in Linux kernel version. What else would you expect?

elbob2002

This issue was resolved in 7.1RC5

elbob2002

Upgraded an RB5009 and a chateau LTE 12 and getting ERROR: file not found on the package screen after rebooting.

Screenshot from 2021-11-08 10-46-50.png

elbob2002

Just got mine today and have the same issue with bad blocks. Upgraded to 7.1RC5. Haven't done a netinstall and don't think I'll have the opportunity for a while either. uptime: 45m39s version: 7.1rc5 (testing) build-time: Oct/25/2021 17:15:25 factory-software: 7.0.5 free-memory: 833.9MiB total-memor...

elbob2002

Upgraded the following with no issues:

Chateau LTE12
RB3011
Hex 750Gr3
CRS-125-24G-1S
CRS-125-24G-1S-2HnD
CHR

No major issues on any of the devices. Modem Firmware on the Chateau through winbox worked perfectly.

Small issues - 750Gr3 still shows voltage incorrect.

elbob2002

System --> History in Winbox.

Not sure how long the history there lasts though.

elbob2002

If it's stuck on calculating download size then you need to remove any extra packages that are installed.

elbob2002

Not sure if this happened to anyone else but the 3 devices I had running 7.1RC4 stopped routing after 7 days uptime. RB3011, 750GR3 and a CHR. I could connect to each device on their management IP but even the devices themselves couldn't ping other subnets they were each connected to. They are runni...

elbob2002

By the way, RB5009 will also have "per device" ROSv7 stable version? I got one now. How is with updates ? RB5009 running ROS 7.0.5 stable.... Should I "upgrade" to 7.1 beta 4 ? There is no official downloads for RB5009. 7.1RC3 and 7.1RC4 have IPsec offload so if you need that mi...

elbob2002

PIM SM
what's that ?

https://help.mikrotik.com/docs/pages/vi ... d=61767728

elbob2002

Date and timestamp issue with netflow has been fixed!

elbob2002

Read the product pages:

CCR2004-1G-12S+2XS - Size of RAM in RouterOS v6 1792MB ECC / RouterOS v7 4GB ECC
CCR2004-16G-2S+ - RouterOS (v7 only)

You have a CCR2004-16G-2S+ so it's RouterOS v7 only.

elbob2002

The hypervisor will also reserve some memory for video RAM.

elbob2002

All three options are as stable as each other. By stable I mean not the version of RouterOS but the installation.

elbob2002

Out of curiosity what type of NIC have you? I've seen issues with some Intel NICs on Linux where the NIC would what would seem like half it's advertised speed. Affected me on XCP-NG. The solution was to turn off TCP Segmentation Offloading for the interface like this: ethtool -K <interface> tso off ...

Search found 308 matches