MikroTik

benlg

This completes what I previously said :)
CRS112 is clearly not an option anymore, no bridge VLAN filtering support (so another way to configure it from CRS3XX devices), and no 10G uplinks.

benlg

I would love to see a PoE+ version of the CRS310-8G+2S+IN =) Can you guys clarify the use case of 2.5G ports but with PoE output? I thought this kind of switch was great for high end PC's, not for plugging in more routers? I see CRS310-8G+2S+IN as a perfect replacement for CSS610-8G-2S+IN. One of t...

benlg

Hi, @MikroTik deavteam, do you plan to support RouterOS on CSS610 (CSS610-8G-2S+IN / CSS610-8P-2S+IN) ? Would be a really nice idea. SwOS is easy, but of course lacks many useful things RouterOS has (configuration backup, scripting, monitoring...). These are the only 2 recent switches not supporting...

benlg

Doc still mentions about port 80 though :
https://help.mikrotik.com/docs/display/ ... rtificates

benlg

Sure, there's certainly a MikroTik hack somewhere...
Which is exactly what I do for now in my own renew schedules (I do not rely on MikroTik ones, to avoid leaving port 80 opened) :)

benlg

Yes, but then it still needs port 80 to be opened in FW :)
tova, a few posts above, seems to say that port 80 does not need to be opened anymore in FW, which then sounds strange :|

benlg

In 7.7 it is not neccessary open port 80 on firewall and enable http. Interesting, no more needed to open port 80 to generate a Let'sEncrypt certificate ? How does RouterOS do then ? And http service no more needed either ? Certainly they now use the "standalone" certbot method. But "...

benlg

You have 2.17rc1 attached a few post above.

benlg

Many thanks @oskarsk, works as expected !

benlg

Hi,
Please provide fixed firmware link ?
Same issue here on a production site...
Thank you !

benlg

@normis, what about ATL LTE18 kit antenna gain please ?
To compare with mANT LTE 5o on a LtAP LTE 6 kit.
Many thanks !

Found in the PDF product page, sorry for the noise...

benlg

@normis, what about ATL LTE18 kit antenna gain please ?
To compare with mANT LTE 5o on a LtAP LTE 6 kit.
Many thanks !

benlg

Upgraded a CRS354-48P-4S+2Q+RM MLAG paired stack. After this weekend customer reported extreme slow network speed.
Made a return to 7.2.3 and now everything works again.

What about 7.4.1 ?

benlg

Simply dedicate one of the 8 RB5009 ports (which you can then (un)tag in your management VLAN) for local administration purpose ?

benlg

Would also prefer RouterOS on both CSS610 non-PoE and PoE versions.
Perhaps one day @MikroTik dev team ?

CSS610-8P-2S+IN properly replaces old CRS112-8P-4S-IN though :)

benlg

@rextended, thank you, I saw, just asked for confirmation, as video for this new product shows a 24V DC-jack voltage...

benlg

@normis, do you confirm that the power-supply which comes in the RB5009UPr+S+IN box is the 48V2A96W (and not the 24V one which comes with RB4011 and previous RB5009) ?
Btw, really nice newsletter, awesome products :)
Many thanks !

benlg

/interface/ethernet/switch/rule add switch=switch1 ports=ether8 new-vlan-priority=6
failure: new-vlan-priority not supported for this switch

Please support this on RB5009 (SUP-70924 opened accordingly, jan 2022).
Many thanks MikroTik dev team !

benlg

Do you also suffer, on CCR2116, from some IPs not responding when a large number of interfaces are configured (as described above) ?

benlg

Sounds like this ?

benlg

Still facing issue on CCR2116, when running too many IPs, some of them do not respond at all.
Bringing most of the IPs down make the other coming back online, which is really strange...
SUP-80578 still waiting for support on this.
Thank you again MikroTik team !

benlg

Then, simply run this after restore :

/interface ethernet reset-mac-address [find]

benlg

Found a bug (on CCR2116, did not test on other devices) where, with "too many" VLAN interfaces / IP addresses configured, some IP do not respond anymore.
Disabling some of the IPs make the other ones available again.
With a rather random behavior...
SUP-80578 created accordingly.

benlg

I agree about split-tunnelling issue with multiple networks, only the first subnet is considered by some clients, and especially macOS. SUP-59668 created months ago regarding this, MikroTik knows the issue and will fix it (as the problem is on RouterOS side), but no ETA unfortunately :-/ For Android...

benlg

Yes, IPsec / IKEv2 should rather be used instead IMO...
Properly supported by MikroTik, and by all OSes / mobiles devices etc...
Much nicer solution...

benlg

RouterOS can't generate multiple Let's Encrypt certificates for different domains (using the /certificate enable-ssl-certificate dns-name="different.domain.com" command), it simply keeps re-generating the first one already created.
SUP-79724 created accordingly.

benlg

Found a bug on routers with several public IPs where ipsec tunnel negociation is handled with the proper defined local-address address, but then data traffic is sent using the lowest public IP, making, as a result, receiver to reject it. SUP-79720 created accordingly. Edit : was facing this : https:...

benlg

*) switch - added option to match source and destination IP addresses in ARP packets for RB5009 (requires mac-protocol=arp setting); Good news ! So the rule : ... /interface ethernet switch rule add dst-address=192.168.192.200/32 new-vlan-id=100 ports=ether2 switch=switch1 also needs the following ...

benlg

Default speed is AUTO ??!!

Yes, set it to auto, and don't bother anymore with CPU speed...
OS will manage it, to properly handle high load, and to save some power during idle periods.
Green router :)

benlg

Thank you @holvoetn for explanation 👍 One additional question, let's assume I have a device, installed with RouterOS 6. Will the following procedure... - update packages to RouterOS 7 ; - /system reset-configuration no-defaults=yes ... produce the same final result as a netinstall ? Or does perhaps ...

benlg

Thank you for clarification @strods 👍

benlg

Note that on Windows, my colleague suffered from this with old WinBox versions, and did not have "the chance" to trigger it with last versions.
Can't remember to have reproduced it with WinBox 3.35 on macOS yet, but as per my understanding, @Amm0 did, as well as @Chupaka.

benlg

So, we must pay attention if we upgrade from RouterOS < 7.1 (including RouterOS 6 ?) to any other version >= 7.1 ?

benlg

Mmmmh, a colleague told me he also suffered from this on Windows, when I showed him the bug on macOS.
Not sure then it is strictly Wine related.

benlg

Hello,

I can read here and then some people advising to netinstall the device with RouterOS 7, if it comes from RouterOS 6.
Instead of simply updating the packages from RouterOS 6 to RouterOS 7.
Why ?
Is this recommendation documented somewhere ?
Does it come from MikroTik support ?

Thank you !

benlg

Good catch !
Sounds like 7.2.1 coming in the next hours :)

benlg

Thank you very much already ahead of time!

And thank you for being so transparent, deserves consideration !
Had to be said :)

benlg

Someone knows in which format are the .umb database backups / exports ?
Are they encrypted ? With which key ?

As they contain sensitive information, would be good to know, before exporting them out of the MikroTik device...
@emils ?

Many thanks !

benlg

At least it works here with RSTP, and just tested with STP, it also works.
Be sure you only have one bridge, as only the first bridge will be hardware-offloaded.

benlg

Maybe this is a Mac/wine thing... I often get "multiple selection" behavior when there is only one choice. Specifically, in Winbox's login screen's neighbors. Multiple routers can be selected, even with using just "a single click". It does seem to use the last one selected, but ...

benlg

I tested 6.48.5, 7.1.1, 7.1.3, 7.2rc4, all have the issue.
Very old bug perhaps ?

benlg

Strangely enough, the following command does not drop gre connections :

/ip firewall connection remove [find]

SUP-77175 created accordingly.

benlg

Makes sense, you were comparing CRS317 with l3hw against CCR2116 without. OK :) CCR2116 seems now a better choice for routing than CRS317, which, even if it has a bigger hardware table (stores more routes, fasttracked connections etc...), will certainly run slower once hardware table is full (or in ...

benlg

Many thanks @Znevna for the CCR2216 details. Would also be nice to have some numbers without l3hw, so that we would know what to expect from this device once hardware table is full (or if l3hw is intentionally disabled). Same for CCR2116 of course. @MikroTik support ? :-) And for CCR2116 ipsec numbe...

benlg

CCR2116 likely won't be able of wirespeed routing between many interfaces, specially not if one is after wirespeed for single or small number of TCP connections.

@mkx Why did you say this ?
Could you elaborate please ?
Many thanks !

benlg

In 7.2rc1 : *) ipsec - added hardware acceleration support for CCR2116; @MikroTik support , could you then please add ipsec numbers to CCR2116 product page ? https://mikrotik.com/product/ccr2116_12g_4splus#fndtn-testresults Also note that there's no block diagram and no performance numbers at all fo...

benlg

benlg - What is the actual issue here?

I just edited my 2 posts above, got answer from your support team, many thanks Strods !

benlg

[admin@MikroTik] > /ip/firewall/service-port/disable dccp failure: module dccp is built-in and cannot be individually disabled [admin@MikroTik] > /ip/firewall/service-port/disable sctp failure: module sctp is built-in and cannot be individually disabled [admin@MikroTik] > /ip/firewall/service-port/...

benlg

Strange issue on RB5009 where the following rule does not handle the related ARP traffic : /interface ethernet switch rule add dst-address=192.168.192.200/32 new-vlan-id=100 ports=ether2 switch=switch1 No issue on (for example) CRS317. SUP-74646 created accordingly. Finally, RB5009 switch chip is s...

benlg

Face this 7.2rc4 issue in 7.1.3 : https://forum.mikrotik.com/viewtopic.php?p=915589#p915589 Edit : Strange issue on RB5009 where the following rule does not handle the related ARP traffic : /interface ethernet switch rule add dst-address=192.168.192.200/32 new-vlan-id=100 ports=ether2 switch=switch1...

benlg

Strange issue on RB5009 where the following rule does not handle the related ARP traffic :

/interface ethernet switch rule add dst-address=192.168.192.200/32 new-vlan-id=100 ports=ether2 switch=switch1

No issue on (for example) CRS317.
SUP-74646 created accordingly.

benlg

[admin@MikroTik] > /ip/firewall/service-port/disable dccp failure: module dccp is built-in and cannot be individually disabled [admin@MikroTik] > /ip/firewall/service-port/disable sctp failure: module sctp is built-in and cannot be individually disabled [admin@MikroTik] > /ip/firewall/service-port/...

benlg

Face this 7.2rc4 issue in 7.1.3 : https://forum.mikrotik.com/viewtopic.php?t=183548#p915588 Edit : [admin@MikroTik] > /ip/firewall/service-port/disable dccp failure: module dccp is built-in and cannot be individually disabled [admin@MikroTik] > /ip/firewall/service-port/disable sctp failure: module ...

benlg

Good news, many @raimondsp !

benlg

This works flawlessly whatever the number of connections to clear is :

:local e 1
:while ($e) do={
  :set e 0
  :do {/ip firewall connection remove [find]} on-error={:set e 1}
}

benlg

However, with v7.2rc3 I have fasttrack forward rules with hw offload working on RB5009. Did not find time for propper testing yet, but a quick ipperf run between routed VLANS on SFP+ shows >6GB/s with less than 50% total CPU load. So I understand you tested with tagged ports. I'm scared untagged po...

Search found 56 matches