MikroTik

hedele

Did the MLPPP implementation somehow lose its packet-reordering capabilities in ROS 7? On ROS 6 i could use MLPPP over three connections on a bond-interface and it would take care of packet reordering. Since using ROS 7 i am getting a large amount (25%+) of out of order packets.

hedele

This may sound stupid but did you maybe forget to activate a license (trial or paid)? By default CHR has a hard-limit of 1 Mbps if no license is installed.

hedele

To be honest, I'm not that surprised by your results. First of all, VMware is less performant for CHR installations than Hyper-V, so this machine is not using the optimal hypervisor. Also the CPU in this new router is essentially the same as the one in your old router (Intel Core i7 with 4 physical ...

hedele

Your problem is hopefully quite simple :) you reach the Mikrotik update servers through a VIX peering, so by default, your router will source all packets it sends towards that destination using the IP address it has assigned on the egress interface - which will be in the peering LAN range 193.203.0....

hedele

That is because as of ROS v6, Fastpath requires route-cache in order to work. If you disable route-cache, you disable fastpath (and by extension, fasttrack).

hedele

It should be possible to create a route filter that matches the BGP AS Path (regexp, in your case ".*45899$" should work), and then as action set-type=blackhole. That way all routes originating from that AS will be blackholed instantly. That said, it's a horrible idea to do this and you sh...

hedele

Please provide a method of restoring previous STP mode, whereby Router OS would exclusively transmit and process BPDUs on (R)STP bridge ports. I second this entire post - this change to how STP works is simply unacceptable as it breaks several different deployments we have in place where we NEED to...

hedele

I think it's important to remember that a substantial amount of traffic is needed to have any sort of effect on your devices. You won't be able to bring down a CCR using a residential xDSL line that only has a couple Mbit/s upload speed, or have one of your WiFi customers kill your network because t...

hedele

Hm... i just did some testing myself, and at 200000 packets per second a CCR1009 running 6.37.5 barely breaks a sweat (like 10% cpu load max). I'm not sure this is really a problem other than "if you throw lots of packets at something it will eventually die".

hedele

So using the access-from lists mitigates the problem? That would be awesome because we're already using that in lieu of firewall rules to keep the devices in fastpath.

hedele

The problem is that a firewall rule will knock our CCRs out of fastpath forwarding, thereby severely reducing throughput. Please fix this in software, and preferably offer an update for the current bugfix branch (6.37.x) as well.

hedele

Is this 6.38.5 and above only? Or does this also work on 6.37.5?

hedele

Sooo what about Fastpath on CHR then?

hedele

Fastpath/Fasttrack for CHR is pretty much the only thing I'm missing, apart from a more convenient install method (.iso?) for ESXi.

hedele

Hey, I'd be grateful if you could name the shop you got a replacement power supply from as I need to replace two of them myself and my distributor knows of no such thing.

hedele

I do not follow how this can be let to happen in a "current" version. My setup is fairly simple and I'm no veteran. I had always had the impression that Mikrotik devices are utilized in corporate environments, schools, banks, etc. and this issue caused major outages. Well here's the thing...

hedele

Also, the 2nd option will contribute to blowing up the IPv4 global routing table size even more - so please, don't start randomly deaggregating your IP allocations just because it's funny. Try having your customer prepend first or at least split the /22 into two /23s and not four /24s.

hedele

Same. ME909s-120 on 11.617.01.00.00. Routerboard RB912UAG-2HPnD, ROS 6.32.3, Firmware 3.24

hedele

Wow... greatly reduced CPU load over previous versions on devices with large routing tables! Also a CCR1016 does no longer produce packet loss in general packet forwarding when a single CPU core is stuck at 100%

hedele

I have a similar problem with the ME909s-120 on my RB912Gs - it hangs after a short period of high throughput. The lte1 interface stays up, but I don't get any more input packets. A usb power-reset fixes the problem. The issue is more pronounced when I'm using WLAN, leading me to believe that there'...

hedele

Check the CPU load of the device while testing - you'll probably see a single CPU core stuck at 100% load. If so, there's nothing you can do about this, any sort of tunneling just doesn't distribute across all CPUs... no idea if that will be addressed in RouterOS v7 (or if it's even possible/viable ...

hedele

The MC7455 just isn't detected on the RB912s I have, even if i force the USB to mini-PCIe. It however works fine in a USB to mini-PCIe adapter that is plugged into the front USB port of the RB912.

hedele

IIRC, any sort of packet forwarding that requires some form of processing that cannot happen in fastpath (encapsulating, like EoIP, VPLS, GRE...) may not distribute load across all CPUs. Which is why on a CCR1036, an EoIP tunnel will only transport around 550 Mbps with 512-byte packets - only a sing...

hedele

*) firewall - added pre-connection tracking filter - "raw" table, that allow to protect connection-tracking from unnecessary traffic;

So which is faster in terms of throughput - fasttrack or no tracking at all?

hedele

Intel X520 cards will work just fine, but will not show or allow to set L2MTU.

hedele

I'd say generally you should be using only-hardware-queue on pretty much every Mikrotik device (excluding x86 and some special cases like CRS125 which seem to work better with other queues). Having -ANY- firewall rule configured will disable fastpath, so you will need to use fasttrack instead.

hedele

Version 6.35rc37 has been released.
*) lte - supported modems now use unsolicit events for network monitoring;

Unfortunately, this still breaks compatibility with Huawei ME909s (Ticket#2016032166000454)

hedele

Version 6.35rc33 has been released. *) lte - changed AT parsing because supported Huawei modems use unsolicit events instead of polling I hoped that this might fix Ticket#2016031766000471 but unfortunately this just made it worse to the point that AT+CPIN? commands on the Huawei ME909s time out all...

hedele

If you assigned an IP address to the L2TP dialin that is within your LAN subnet, you will need to enable proxy-arp on your LAN interface.

hedele

I used a CCR1016 running traffic generator (2 UDP streams) as source for my tests, the sink was also a CCR1016. So the test looks like this: CCR1016-1 (sfp1) ---> (eth5) CCR1009 (eth1/6) ---> (sfp1) CCR1016-2 All devices were running ROS 6.32.3 I used a packet size of 64 bytes, because once we know ...

hedele

From what I gather, those devices cannot be supported in ROS 6 due to missing kernel support (the kernel in ROS 6 is pretty old). Backporting modules to an operating system that essentially has an expiry date already printed on is not really a useful way for Mikrotik to spend their resources. Why do...

hedele

I also received a CCR1009 in the lab today and can probably run some tests tomorrow.

Will be interesting to compare results.

Edit: moved to separate post

hedele

But on the other hand at least ports 1-4 should have worked fine together in this case, right? .

Well, actually no, because ether1 was enslaved to bridge1 (or whatever you called your bridge) and any configuration made on a slave port does not work in most cases.

hedele

That was my main problem, because I read that switch port used more cpu than "cpu port".

I have read that a few times as well, but could never reliably reproduce it in lab tests on both RB1100AHx2 and CCR1009-PC. If there is a difference, it is so minor it barely makes an impact.

hedele

You don't really need to be afraid of bandwidth issues on the switch-group. The only way you can oversaturate the 1gbps connection to the CPU is by downloading full speed to the switch-group from WAN, and also trying to download full speed to the switch-group from port 5 at the same time - which wil...

hedele

As far as I know, that is not possible, because Tile-GX 16 and 36 only have four XAUI interfaces available on their mPIPE engine, each of them can either be used for 1x 10G, or 4x 1G interfaces, so the most you can get out of those are 2x 10G and 8x1G if you want 10G uplink redundancy. Incidentally,...

hedele

Well, just use port 1 as your LAN port, and set port 2-4 to have port 1 as master-port. Don't use port 5 if you don't need it :) If you do need Port 5, you will have to create a bridge, and add port 1 and port 5 as members of the bridge (port 2-4 are already slaves of port 1, adding them is both not...

hedele

I tried to put ports 1,5 and 6 into a bridge and configure ether1 as a master for 2,3 and 4 at the same time. That was just an idea that came to my mind but it didn't work. That is odd, because that is the correct way to do it. Maybe something else in your configuration was off? You might want to t...

hedele

v7 Teaser alert, recursive ipv6 works
Code: Select all
[admin@tested] > /routing/route/print 

ooops.. looks like CLI will change a lot?

hedele

I have only given it brief testing as I lack the provisions to really get a CCR based system to break a sweat in terms of PPP, but judging from my experiences with plain Ethernet routing, Fastpath gives about a 2.5x speedup compared to non-fastpath. When replacing Cisco LNSes with Mikrotik, the devi...

hedele

I already mentioned that idea, but it was suggested by Mikrotik staff that essential kernel modules/drivers that are required to successfully run CHR on physical hardware are disabled/removed in the x86_64 kernel so this can't happen. I did not bother to verify that yet.

hedele

I don't hold high hopes that this is going to work without a hitch on ROS 6 with the normal x86 distribution :( Mikrotik seems hellbent on keeping the x86 distribution of ROS as barely usable as possible (no 64 bit support, missing support for lots of newer NICs) to push people towards using CHR, bu...

hedele

For some reason, sector writes don't show up on tile architecture boards, I checked an old CCR I have lying around running 6.18 and it doesn't show them either. Seems to be a design decision I guess?

hedele

Is RAM upgrade maybe also coming to CCR devices? The reason I'm asking is that for some reason, RouterOS for tile is HUGE when installed (46 MiB used out of 128 MiB on a CCR1016-12S-1S+), which makes using partitions almost impossible now (barely enough space to perform upgrade when using 2 partitio...

hedele

This is a stab in the dark, but I guess the USB modem might be pulling too much power. Consider using a powered USB hub between your Routerboard and the USB modem.

hedele

As long as BGP table scans are still performed on only one CPU core (RouterOS 7 anyone?), I would advise against using more than one BGP full feed on any tilera-based piece of hardware. A CCR1016 barely finishes the BGP table scan of two BGP full feeds before having to start the next one, so persona...

hedele

What does the "upload per interface" limit apply to? Ethernet interfaces or "all" interfaces?

hedele

If you are intending to use fastpath forwarding on the CCRs, you are required to use only-hardware-queue, as any other kind of interface queue will disable fastpath. multi-queue-ethernet-default should be worth trying on x86 systems with compatible NICs (in system - resource - irq you see several in...

hedele

As far as I know, CHR (the "official" VM version of RouterOS) is already x86_64 enabled - but Mikrotik refuses to offer this kernel in the x86 distribution. Maybe somebody with a lot of skill can rip the kernel out of the CHR and inject it in the x86 version. So as it stands right now, you...

hedele

it's actually pretty easy to set up. In winbox, you now have a new tab in the PPP menu called "L2TP Secrets". In there, you create an entry for the LAC IP address and the L2TP tunnel authentication password. Incoming L2TP control connections from a LAC will now be authenticated properly :)...

hedele

I didn't get around to testing the LNS functionality yet, but according to a separate thread where this feature was requested, it seems to work perfectly.

hedele

I see that there has been fastpath support added for eoip, ipip and gre tunnels, which I think is an amazing improvement! Are there any figures available as to how much this speeds up tunnel forwarding performance? Also, is there any hope of getting fastpath support for ppp-type interfaces (pptp, l2...

hedele

What you have seen is actually the BGP table scan hitting one of the CPUs for 100%. Unfortunately, once you get a full BGP table (550k routes) on a CCR, the single CPU core can barely finish one run of the table scan before the next one is due, which is the reason why one core stays more or less 100...

hedele

My guess is you still need it, because not all connections can be fast-tracked. So you probably have to put the fast-track rule first, and a "normal" established/related accept rule afterwards to catch non-fasttrackable connections (like gre, ipsec-esp, icmp, etc...)

hedele

This is a 24 volt supply that is supposed to deliver 18 watts of power (that's why it is named 18POW).

hedele

Cisco has GRE multipoint tunnels to handle that specific situation (static server, dynamic client IP), Mikrotik does not offer that possibility. You will have to use L2TP instead, and then either pull the GRE/EoIP tunnel over the L2TP session, or use L2TP without another tunnel on top.

hedele

I can only see a slight problem with the Google Authenticator bit... since the one-time codes are derived from clock time, there's going to be trouble when your Routerboard reboots and fails to sync clock time with NTP afterwards as no RB has a battery-buffered RTC included, leading to you being una...

hedele

Hi, This will not work as Mikrotik does not implement NHRP protocol, as that is required for mGRE tunnels to work. You will have to use point-to-point GRE tunnels between Cisco and Mikrotik gear. Also, Mikrotik does not implement EIGRP protocol, so even if you would get mGRE running, you would still...

hedele

@jeroen If you're spinning it that way, you might as well consider TCP "overhead" and reduce the actual payload to 1460 Bytes. Or consider the overhead of any higher layer protocol and reduce the payload even further. That way of thinking is misleading when you're talking about throughput ...

hedele

... ok, let's play Networking 101 ;) An ethernet frame is 1518 bytes in size, 1500 bytes payload, 14 bytes for the header, 4 bytes for FCS/CRC. L2MTU is NOT Ethernet frame size, but Ethernet PAYLOAD size. Thus, testing with L2MTU 1500 equals 1518 byte frame size - all tests that Mikrotik publishes r...

hedele

As far as I know, both of them do not work due to missing drivers.
You really should have chosen their intel counterparts when configuring the server... the Intel 2-Port 10G cards (Intel X520 DP) that Dell offers work fine in ROS 6.18 and even offer 2 rx/tx queues.

hedele

That's the point: While there are a bunch of surprisingly fast and surprisingly cheap L3 switches available, they usually offer only a very limited amount of maximum route entries - most of them can only handle around 16-64k routes, which is not enough to use them in any true multihomed BGP scenario...

hedele

As SSTP is a purely TCP based tunnel, it can suffer from TCP meltdown problem and may generally not deliver optimal performance on links that are not 100 percent clean and stable. You have the same issues when using OpenVPN TCP tunnels. PPTP is using GRE to transmit encapsulated data, and does there...

hedele

I don't see a problem with your device. The numbers match up. Don't just look at the Mbps, look at the packets per second also. You are getting in Excess of 170k packets per second in your first graphic. RB2011 is rated for 227k packets with fastpath routing (NO firewall/connection-tracking whatsove...

hedele

KVM is inherently an x86-only technology - so I'd say definitely no.
You can already use KVM on RouterOS x86.

hedele

Well as you can read from some of the feedback in this thread, winbox 3 does not seem mature enough for production use yet.
Also, I don't think that there is any technical reason that winbox 3 is required for new rc builds, it's probably just politics to force people into beta-testing winbox 3.

hedele

Winbox v3 is required for router’s configuration. Welp... no more rc testing (or upgrading, for that matter) for me then... I'll stay on 6.18 on all of my devices, since EoIP (which I use it a lot) is broken on 6.19. 6.18 was a great release (the first really stable and usable one with no major bug...

hedele

That shouldn't be a big problem, not a lot of services use these ports server-side anyway, most of them multimedia- or gaming-related. If customers are complaining, you can justify this measure with an incoming ddos, they should understand that issue.

hedele

How about accepting connections to the udp ports you know are being used for openvpn, accepting "established" packets, accepting connections to udp/1701 (l2tp) and dropping the rest of udp? there's not much you can do with icmp, except drop it or use a limiter in firewall so only a certain...

hedele

Well technically this will only hit traffic where the local devices are stupid enough to send their traffic towards the default gateway, even though the destination is within the same subnet - which should never happen if the device has a correctly working IP stack. So there's really no reason not t...

hedele

Can you make a supout.rif while you encounter the BGP problem?
It's a long shot, but if you succeed in getting a supout, maybe Mikrotik support can find something out.

hedele

You need to create more policy rules, which must be located at the beginning of your policy route ruleset. For each of your LAN subnets, you need to create a rule which says dst=$Lan_Subnet action=lookup table=main (do not enter anything in src) - otherwise the subnets won't be able to communicate w...

hedele

Interesting, which ROS version are you using? According to mrz, this shouldn't work:

http://forum.mikrotik.com/viewtopic.php ... 79#p432579

hedele

Well to put it plain - it simply cannot work this way. Subnetting doesn't work this way. The only possibility to do this is to bridge your WAN and LAN interfaces, which would put all your clients directly on your uplink. You can still do limited traffic flow manipulation and NAT with "Use IP fi...

hedele

Linked ALMOST correctly :) it's actually 13.25.6 13.25.6 AutoIsolate A Boolean. Set by management if isolate (13.25.20) is to be set, causing a Designated Port to transition to Discarding if both AdminEdge (13.25.1) and AutoEdge (13.25.5) are FALSE and the other bridge presumed to be attached to the...

hedele

I'll try to give it a whirl tomorrow, i somehow can't believe that 100 mbit/s is all that it's gonna do.

hedele

That is a very old problem that can be traced back until when MLPPP was first implemented (back in ROS 3.x). Curiously, I have no idea what causes it, and it never got fixed over time. The main problem with that is, that this causes very bad performance (I once had 27 parallel connections open on tw...

hedele

Yeah I'd suggest that, too. A RB1100AHx2 has 13 gigabit ports, but only 5 of them can be used without oversubscription. Also, routing traffic between those non-oversubscribed ports is faster than routing "on a stick" where source and destination are on the same port or switch-group. So you...

hedele

Well, according to some other thread I recently read here, Mikrotik's official response is that you can't.
If you need this, you will have to open a ticket asking for this particular feature.

hedele

It will work, but EoIP is terribly, terribly slow on CCRs, at least for me. I can't get more than 450 Mbit/s of traffic through any one EoIP tunnel. x86 rocks the world for that, you can push 3-4 Gigabit/s through a mid-range Xeon easily.

hedele

Hi ganewbie, I think you misunderstood - there is a difference between authenticating users, and authenticating the l2tp tunnel itself. Authenticating users works fine, authenticating the l2tp control channel does not. Cisco enforces L2TP control channel authentication by default, which needs to be ...

hedele

Hi ganewbie, Yes LNS functionality works, with one caveat - L2TP tunnel authentication is not supported, so whoever is on the LAC side must NOT use a l2tp tunnel password or l2tp tunnel authentication. On a Cisco LAC, you will need to put "no l2tp tunnel authentication" in the correspondin...

hedele

It's easily possible to use Mikrotik as an LNS (even in 5.26, as the L2TP Keepalive function is already available there), but in terms of LAC you're really out of luck. Still, i resort to using Cisco gear for most LAC/LNS duties.

hedele

That's actually pretty simple once you know what to look for

CoS bit/p-bit is called priority in RouterOS.
You need to create a Firewall Mangle rule, for out-interface=yourWANinterface with action=set-priority priority=2
and you should be ready to go.

hedele

Can you try if deleting the interface in winbox, and then using the undo button (which will re-create the interface) fixes it?

hedele

Agreed regarding the VTI . I have some extremely reliable mtk boxes that I might possibly have to junk now as we've moved away from a nix based quagga server to a fortinet and I absolutely need VTI. How so? Fortinet VTIs interoperate perfectly with standard IPSec Site to Site implementations like M...

hedele

The thing is - according to official performance figures, RB750 should be fast enough to handle 50 Mbit/s in 64 byte packets, as MPLS performance is supposed to be somewhere between bridging and routing, but I think Fastpath does not work with VPLS. The safest choice of Routerboard for this applicat...

hedele

As customer, if I specifically tested small packet sizes, I would not accept that performance, as I ordered 50 Megabit/s, and I should be able to reach that performance regardless which packet size my preferred application uses. That said, as ISP you could probably argue with IMIX (http://en.wikiped...

hedele

No, only enable it on your LAN Port (Master-Port of switch-group, or on bridge, depending on what you use).
Still, I'd go for Hamachi in any case

hedele

This is kind of problematic with PPTP and L2TP, because game/hostdiscovery in warcraft 3 works by using broadcast packets, which usually does not work over any PPP based connection. You are better off using an alternative solution like Hamachi (which I can confirm as working) or Tunngle. Your best s...

hedele

I can't remember the exact version, but support for this chipset was removed by Mikrotik because it caused too many issues.
You will have to stay at ROS v5 if you really want to use that device.

hedele

+1 for not implementing EIGRP. It simply does not scale too well compared to ISIS or OSPF, and becomes a resource hog in larger networks, while converging more slowly than OSPF. Also, I have yet to see a network that didn't work more reliably and converge faster when EIGRP was replaced by OSPF (and ...

hedele

I can confirm that issue - connecting to a Router with winbox through any kind of directly connected ppp interface (pppoe, pptp, l2tp) causes the winbox session to randomly disconnect. Tested on 6.13, 6.14 and 6.15. I'm not sure if using MPPE makes any difference, but I think not.

hedele

Is there already any timeframe on implementing RSTP on CRS125 switch chip?

hedele

No, unfortunately not. The TP-Link converter is using a 100 Megabit connection (100Base-FX), and Mikrotik SFPs use a 1.25 gigabit connection (1000Base-LX). Unlike with Ethernet on copper, there is no such thing as auto speed negotiation, and the transmission standards in use are incompatible with ea...

hedele

We are using this productively on a number of 1100Hx2 and 1100AHx2 and had no problems so far.
24V power is fed through PoE, and 12V through the internal AC adapter - you can happily plug each one out or in without any service disruption

hedele

I think he refers to this RFC where Carrier-Grade NAT using reserved IANA IPv4 space (100.64.0.0/10) is defined: http://tools.ietf.org/search/rfc6598 In this document, it is said that: ... Shared Address Space can be used as additional non-globally routable space on routing equipment that is able to...

hedele

Well I found that for the wireless in 751U and 751G to work reliably, I have to disable RX/TX Chain 1, leaving only chain 0 active. While that limits me to 65 Mbps @ 20 MHz (Real-Life throughput of around 35-40 Mbps), at least the connection is stable. Enabling TX chain 1 is usually(!) not a problem...

hedele

Is there at least hope to finally get support for huawei cdc_ether?
There are lots of Huawei 3G/LTE Sticks around now, that cannot perform well because ROS only supports PPP mode instead of cdc_ether/NDIS mode.

hedele

Ah okay so that was probably just an oversight... yeah I agree that CRS should have white background, maybe you can sneak the configuration for that into one of the next releases.

hedele

Same happens on my CRS test device... mildly irritating. Did not try ROS 6.6. yet though.
Also, the LCD screen is inverted, compared to the CCRs i have on my desk.
On the CCRs, background color is white, text color is black, while the CRS has black background and white text... wtf?

hedele

It's a little bit late for a reply, but I only just got that card and using the following as init-string in the ppp-client interface should solve the problem:

AT^CURC=0;AT^STSF=0,0

This will turn off all diagnostic and unsolicited output on the info-channel and stop the rb from fucking up

hedele

Well I might at least have an idea how you could terminate all customers on only one pppoe server... Create a bridge where your pppoe server will listen on, and add a bridge filter rule for that bridge, chain=forward, action=drop. Now add every customer vlan interface to this bridge. What this does,...

hedele

Then why the heck has this Routerboard not been in stock anywhere in Western Europe since the end of May? What's wrong with your production planning? I mean, people already know that you did a new hardware revision for the 2011 series, why can't you just admit something went wrong with the time plan...

hedele

From my experience, you should change the emulated NIC to e1000e in the corresponding .vmx files for your routers as soon as you are going beyond simple routing (even with VLANs i would strongly recommend switching to e1000e). This also has the bonus of being able to set L2MTU in RouterOS. VMware ES...

hedele

Which NIC are you emulating in vmware?
There are often strange issues when you try to use e1000 with MTU -> 1500 bytes, especially with mpls/vpls.
Did you try playing around with MPLS MTU? If not, try to set it to 1500 or 1522.

hedele

You need to set your onboard SATA controller mode to IDE/PATA/Compatibility Mode in BIOS and connect your hard disk to the onboard SATA controller.
RouterOS will not detect most AHCI-SATA controllers, if not all, and will definitely not detect any disks connected to a hardware RAID controller.

hedele

I think I may have found a bug on x86 version of 6.0. I believe that loopback interfaces (or in this case, a bridge without anything on it) might end up being broken when it comes to adding it within OSPFv3. On my MIPS-BE router (RB751) it works perfectly, but on my x86 router it shows as inactive ...

hedele

Hi, This is very unfortunate :( I also had that problem with two of my RB1100AHx2. The problem seems to be related to the NAND driver. There are some very old threads about this in the forum. ROS 5.14 contains a fix: What's new in 5.14 (2012-Feb-22 12:04): *) fixed rare configuration retention probl...

hedele

I don't unterstand why more people don't just file away a little bit of the plastic PCIe socket on the mainboard, instead of irreparably damaging the card... If you mod the PCIe socket, the x4 card will fit (but work in x1 mode), but you can still re-use the x4 card somewhere else with full speed an...

hedele

Why all the panic? :) RC11 can still be downloaded: http://www.mikrotik.com/download/routeros-ALL-6.0rc11.torrent http://download2.mikrotik.com/routeros/6.0rc11/routeros-tile-6.0rc11.npk http://download2.mikrotik.com/routeros/6.0rc11/routeros-mipsbe-6.0rc11.npk http://download2.mikrotik.com/routeros...

hedele

I have a similar problem with a Macbook Pro (OSX 10.8.3) and RB 411U with R52 wireless card: 23:51:42 wireless,info 40:B3:95:F2:1C:47@wlan1: connected 23:51:43 wireless,info 40:B3:95:F2:1C:47@wlan1: reassociating 23:51:43 wireless,info 40:B3:95:F2:1C:47@wlan1: disconnected, ok 23:51:43 wireless,info...

hedele

There is a slight problem with RB1100Hx2 and 5.24 System - Routerboard - Settings shows the following error [admin@MikroTik] > sys rou set pri baud-rate: 115200 boot-delay: 2s enter-setup-on: any-key boot-device: nand-if-fail-then-ethernet cpu-frequency: 1066MHz memory-data-rate: (unknown) boot-prot...

hedele

Hi there,

just a short question to Mikrotik Staff (or anyone else?) - can you please confirm if this change from 5.22
is also included in 6.0 rc4?

*) l2tp server - added keepalive-timeout setting;

thanks!

hedele

Frankly, I don't have that problem. I also tried the LAC (Cisco) -> LNS (Mikrotik) variant of tunneling dsl connections, and if I pull the dsl cable from the modem, it only takes about 30 seconds for the l2tp server interface to disappear. So, I guess there's a 30 second hard-coded keepalive (at lea...

hedele

Did you consider spanning-tree delays on the switches? If spanning-tree is active (and, if using cisco switches, portfast is not set), the switch will have a 30 second delay (15 sec. listening, 15 sec learning) before letting traffic pass through the port, in order to avoid forwarding loops. Of cour...

hedele

Hi, I guess you maybe know that - Routerboards can accept L2TP tunneled DSL connections as LNS if no tunnel authentication is required. If the LAC is a Cisco router - you have to use "no lt2p tunnel authentication" in the vpdn group. Relayed ppp sessions will then show up as L2TP server in...

hedele

BGP Peer Groups would be good too. When you have say 10 peers with common settings, the only thing thats different is the peer IP and remote AS, have them belong to a parent group that defines all the other settings, then when you need to change a setting you only need to change it in one place ins...

hedele

I would just create a /32 route for the destination you intend to ping, pointing to your main gateway.
8.8.4.4 would be better for that, since a lot of people may actually use 8.8.8.8 as primary dns.

hedele

I don't understand what's so difficult in filtering somebody based on mac

Make your PPPoE server run on a bridge interface, and use bridge filters on input chain to temporarily block MAC adresses.

hedele

You are probably using balance-rr as bonding mode - there is no packet reordering in router os, and therefore TCP will get frequent pipeline-stalls because of packets arriving out-of-order. Try a different bonding mode (balance-xor) - but that will require you to make more than one concurrent TCP co...

hedele

To be honest, this sounds like an early April Fools Joke

However, I would definitely like to see something like this!

hedele

This is the normal behaviour of netwatch since ... well, ever since I started using RouterOS (somewhere around 3.10). I would suggest that you use System -> Watchdog - you can set it to ping something (and reboot if it is unreachable), and also set a timeout after reboot, which will keep it from reb...

hedele

I found that this might be related to auto IRQ assignment on RB1100AHx2. Sometimes, when auto IRQ assignment changes CPU assignment for a switchgroup or eth port, the port flaps. This can also be forced by manually changing CPU assignment. However, it doesn't always happen, maybe 25% of the time. Of...

hedele

A netinstall will probably take around 45 minutes, which is what I had happen to me when I tried it. Afterwards though, the routerboard seemed to work normally. I never run into the issue, that flash cannot be written, but hat a different problem where the RB forgets about half of it's configuration...

hedele

Our RBs experience the same effect - a lot of RX errors on the pppoe-out interface (depending on load),
without any detectable impact on service quality (except maybe small latency jumps).
Therefore i tend to agree with your opinion, it's probably related to packet reordering.

hedele

It's a little late to reply to the OP, but the MTU is always 1524, as that value is forced upon the Routerboard from the LNS. I guess you are using Cisco equipment to terminate the MLPPP connection, as 1524 is the Cisco default value for MLPPP. You should be able to change it on your LNS; but not th...

hedele

I had the same problem with two other RB1100AHx2. Sometimes, on boot the RB would "forget" parts of the configuration, such as passwords or IP Adresses. Config changes made during this problem are not committed to flash. A reboot results in a kernel panic related to the flash device, the b...

hedele

Is your ppp-out client set to dial-on-demand=yes (which is default behavior)? If so, the ppp-out interface will always spoof "running" status.
Disable dial on demand, and it should show the correct interface status.

hedele

Usually this happens when the modem has some kind of hickup and needs a power-cycle (unplug/replug) to work normally again. Unfortunately, RB411U does not support USB power-reset. To test this, try opening a serial-terminal on the data channel (disable ppp-client first), and try ATDT*99***1# - you s...

hedele

So it is a x86 machine? Which network card are you using?

hedele

I guess that's just some weird naming convention difference, you would have to ask mikrotik support why.

hedele

That is completely up to your personal preference, there is no performance difference.

hedele

Yes I am pretty sure that routing between ether1 and 2+3 is generally faster, as far as I know, that was also already stated by some mikrotik guys here in the forum. ... and to be honest, it's quite logical that routing is faster that way, if you take the IRQ and bandwidth sharing into accoung :) Al...

hedele

Guys, no need to panic :) ether2 and ether3 are both using the IRQ shown as "switch0" Even if you are not using switching function of ether2 and ether3, they are both connected to the CPU through the onboard switch chip IC-Plus-175D, as the Atheros CPU only has support for two ethernet por...

hedele

You do not need to change L3 MTU in order to get Q-in-Q working - unless you are using a x86 machine. If so, use a Routerboard instead where you can set L2 MTU. Maybe someone else can propose a workaround (e.g. you may try having vlan interface on ether1 with mtu 1500, and use it as parent interface...

hedele

I think you forget one very fundamental problem: Your EoIP packet is also just another IP packet for ether1, if EoIP packets are transmitted over ether1. The EoIP packet is up to 1542 byte in size (1500 bytes eoip MTU + 42 bytes EoIP header). If Layer 3 MTU on ether1 is 1500, then EoIP Packets will ...

hedele

As far as I know (and experienced), .backup files (binary backups) are only 100% compatible if you use the exact same device (by that I mean restoring the backup to exactly the same router you took it from) and about 95% compatible within the same series of routers (using a backup from a RB750 on an...

hedele

To be honest, I wouldn't ever use a RB where I have to buy a USB Power Injector. I've been using RB411U and RB433UAH for quite some time, and didn't experience any out of the world problems (other than Huawei Modems sometimes hang and need to be unplugged/replugged). In my experience, ZTE Modems wor...

hedele

Very strange, all ATZ does is tell the modem to reset itself *g* I can remember reading somewhere, that you shouldn't normally use ATZ for some UMTS Modems, because it causes them to not work anymore until you unplug and replug it. Oh well, but if it works, why bother :) On a related note: The USB c...

hedele

I have received a RB751U-2HnD today and tested the e372 successfully with that device as well.
If the USB power injector does not work as well, you may have to try upgrading the firmware on the e372 I guess...

hedele

a LCP ProtRej is not a big deal in this case, as it just tells you that the remote router does not support using IPv6CP/MPLSCP. In theory, yes, there could be something wrong with power supply, but from what I have experienced, that should lead to the modem resetting itself during the connection att...

hedele

Very strange... but at least there is no LCP timeout anymore.
For some reason, your provider is not assigning you an IP address.
Possibly your SIM card is not active (or locked), or the APN is wrong.
Can you check that as well?

hedele

Hi,

give it another try, but disable chap! so that the ppp-client only says allow=pap

hedele

I am using the firmware from here (11.203.05.00.00):
http://www.dc-files.com/files/huawei/modems/E372/
however, give your router a try with the ppp client configuration I posted before flashing around on your stick.

hedele

Your ppp-client settings look way too complicated and confusing. Try it this way (works on my e372 with 3 Austria on ROS 5.11): /interface ppp-client add add-default-route=yes allow=pap,chap apn=bredband.tre.dk data-channel=0 dial-command=ATDT \ dial-on-demand=no disabled=yes info-channel=4 keepaliv...

hedele

Argh still no IPv6 routing marks

Pleeeeease, add IPv6 routing marks in 5.9!

hedele

But would 3G cards with onboard SIM connector (Like some Novatel cards have) work on a RB800,
or is there no USB functionality implemented on the miniPCI-e slot?

hedele

Maybe there is also a problem involving 3G Modems in ROS 5.8 - a line of ZTE 3G cards do not work anymore in 5.8 (they used to work in 5.6 and 5.7). So, if you're upgrading 3G-enabled units in the field, be careful - and please post your experiences here. I have already opened a Ticket (201111026600...

hedele

For best performance, do not send rate limits per-user, as this will create a lot of simple queues on your RB, slowing it down significantly. Instead, create PCQ Queues on your RB matching your services (e.g. Queues for 1024/256 kbit service, another one for 2048/512 kbit service), and have them mat...

hedele

Using /system routerboard settings menu. set the memory clock to 533 MHz, then set the cpu-clock to 1066 MHz. However, you should intensively test your RB 800 for stability after overclocking.

hedele

How about the RB493G or RB435G? They don't have PPC processor, but at least they have gigabit ports.
Also, they are priced nicely between the 433AH and 800.

hedele

I think it would be a wonderful addition to Scripting/Dude. Just imagine - shipping a stock RB750 to a customer without opening the box at all. Only note the MAC Address, and create a configuration file, while the RB is shipping. After the customer receives the RB, he can follow the on-box instructi...

hedele

You can use RB800 and overclock it to 1066 MHz. It has a Compact Flash Slot onboard, and has 3 Gigabit interfaces as well as 4 Mini-PCI Slots. This is what we use right now when we need a higher performance Router, as the 1100/AH/x2 are pretty much NEVER EVER in stock, and the RB1200 is pretty unrel...

hedele

The CPU in the RB1200 does not support Virtualization - therefore no Metarouter, and no Virtual Ethernet. However, you can probably do what you need with a simple Bridge interface. Create a new bridge, assign a admin-mac-address. Do not put any physical port on the bridge. This makes the bridge inte...

hedele

@Mikrotik Team - Can you please maybe evaluate using openl2tp server for RouterOS? LAC/LNS function would really be very appreciated.

hedele

Careful - if you only once get the wrong values for data channel, you will need to unpower and repower the routerboard,
in order to make the 3G Modem work again. That makes for some annoying testing, but it should work out...
However, is you found a new modem which just works, that is fine as well

hedele

As a workaround, you might also consider using a scheduler to toggle the winbox service every hour or so.

hedele

Maybe you will have to play around with the data channel number.
For example, I noticed that ZTE 3G Modems used to spawn 3 channels in ROS 4.x (0,1,2),
but in ROS 5.x there are now 4 channels with those modems (0,1,2,3).

hedele

You need ROS 5.7 for this to work, as only ROS 5.7 has the main-l2tp ipsec exchange mode which is needed for this.
Other than this different settin, you can roughly follow the corresponding Wiki article at http://wiki.mikrotik.com/wiki/MikroTik_ ... IPSec/L2TP

hedele

You should try to reduce the MTU size in the IPIP Tunnels. MTU 1480 in the IPIP tunnel results in a 1500 Byte IP Packet (because of the duplicate IP Header). This probably works fine with your internet connection. However, if you consider IPSEC ESP Overhead, the resulting IP packet is larger than 15...

hedele

Well... it is a rather dirty fix, but you could add the 198.51.100.253 address to your LNS'es ether1, give your L2TP client a private (192...) address, and then NAT the whole official IP through using two netmap rules in /ip firewall nat I also noticed, that activating proxy-arp while an interface i...

hedele

Still, a /32 is more specific than e.g. a /29.
So a /32 route with metric 100 will always win against a /29 route with metric 0.

hedele

a bridge with 5 EoIPs on it will behave the same as a bridge with 5 ethernet links - you will get a loop. alternatively, if you are using STP, only one link will be active. So creating a PPPoE Client on one bridge interface will not help, you will need ML-PPPoE. However, ML-PPPoE can only multiply t...

hedele

I guess it's probably easier (and cheaper) to house a Cisco 18xx series Router and a Routerboard somewhere (if all lines are the same speed)... and it should only cost a fraction of that. The Routerboard terminates the EoIP necessary, and bridges them to the Cisco. The Cisco 1800 series can work as ...

hedele

I think you could just enable "Use IP Firewall for VLAN" in bridge options, that should work nicely...

hedele

Hi, this is something that has been found several times before. But, as far as i know, nobody ever found a fitting conclusion why this is happening. I have three ideas... 1) mipsbe architecture is very bad at performing the mathematical operations required for sha-1 2) sha-1 hashing algorithm implem...

hedele

Well, only creating a Metarouter (but not running it) already doubles CPU usage for any amount of traffic running through. I suppose, that is because there is an invisible bridge being created, where the physical and virtual ethernet ports are then attached, so there is an additional forwarding deci...

hedele

Well... that's exactly why I always mentioned cisco router

and also why there is no ML-PPPoE Server in Mikrotik RouterOS.
I think there is a very rudimentary MLPPP server for BSD based systems, but I am not sure.

hedele

Yeah give it a try, as ML-PPPoE does segment and packet reordering. It should give the expected results.

hedele

Hi, No, extra QoS or queue-tree should not be needed. Just do whatever you normally do in terms of QoS. As far as I know, there is only one way of reliably bonding two links together - using ML PPPoE. If your ISP cannot enable ML-PPPoE for your two circuits, you will have to create an EoIP over each...

hedele

Hi, You will have problems with TCP Downloads, because bonding interfaces with balance-rr mode will make packets arrive out of order. So, if the server sends packets numbered 1,2,3,4 they could arrive in order 1,2,4,3 Therefore, the TCP algorithm will assume that packet 3 is lost, because it receive...

hedele

I have also seen that kind of problem. Built like this on a RB450G 4.5 (yeah, old): Bridge (Ports: ether2 + ether3) No VLAN Interfaces configured, so full VLAN trunk is passing between ether2 and ether3 Torching on the bridge shows no VLAN ID on tagged packets arriving from a Cisco Router on VLAN 20...

hedele

NO you cannot!
RB 1200 is not supported by ROS 4.17.
Trying to downgrade will effectively brick the Router, and
you will have to netinstall it again with ROS 5.5

There is a thread somewhere in the General section where someone tried to do that and failed.

hedele

write to support@mikrotik.com; they will provide you with another license key - if you state your problem, you should get it without charge.

hedele

You should try downgrading to ROS 4.16 or 4.17. I can easily reach 500 Mbit/s using VPLS transport (which is arguably more stressful) between two RB 600s...

hedele

and DHCP-server is VRF aware..

Well thanks for pointing that out

Are there any plans of bringing VRF awareness at least the other key services like PPP?

hedele

It does not consume an additional license, and i think virtualization is implemented in x86 using KVM. I never tried it though

hedele

You don't need to provision them manually. Try using BGP autodiscovery for VPLS (there's a wiki entry for that). It works like a charm. It's a lot less work than fondling around with VPLS tunnels by hand. Also, I wouldn't break too much of a sweat about having to fragment. As RouterOS is using VPLS ...

hedele

If you are using VLAN, VPLS needs to encapsulate the appropriate ethernet header as well.
So in that case, you have an outer ethernet header (for Transport on wire) and an inner ethernet header (where your VLAN is contained).
Therefore, your L2MTU is 1530.

hedele

Hi all, I recently tried to make ROS work with two VRFs, which by itself worked fine. However, I have a problem with the router accessing services within the VRFs. I have two VRFs, RED and BLUE. Both RED and BLUE are using the 10.0.0.0/24 subnet. RED is on interface ether4, BLUE on interface ether5....

hedele

You first have to adjust RAM clock speed, in order to be able to set CPU clock to 1500 MHz.
RAM Clock speed adjustment is also done in /system routerboard settings menu.

hedele

Thanks normis - by the way, would you mind telling me if 75°C CPU Temp on a RB 1100AH is normal, problematic or just a wrong display?

hedele

Well if that customer is not educated enough to know that his computer does stuff without him telling it to do so, he should not be using one :) Windows DOES tell the user it has downloaded updates and would like to install them. Also, I think he would be a lot more pissed if his computer would keep...

hedele

The RB1100AH I just got has a CPU temp of about 75°C, while doing absolutely nothing...
Also, the Fan sounds like a turbine

Is that normal? I would suppose the CPU Temp should be a lot lower...
The other Temperature measured (Board/Environment) is about 29°C.

hedele

I don't see how that would be your problem...

hedele

Now that was unexpected :) I didn't know that FTTx is common anywhere in the world right now ... Well, now that you put it that way, it of course does make sense... Still, any plans on incorporating SFP into the high-end routerboards? If I might make a wish, please include 2 SFP ports to be able to ...

hedele

Are you maybe using an invalid primary DNS server?
It would be one explanation for why everything takes some time to work (until first dns resolve try fails),
but then spontaneously works (secondary dns resolves normally).

hedele

Hi Normis, Is there also going to be a RB1100 AH X2-style Board with SFP onboard sometime soon? To be honest, I actually assumed that these higher class boards would be the first to be outfitted with SFP :) I know of absolutely nobody who would need a low-cost SFP CPE... FTTx is just way too uncommo...

hedele

Damn, I missed the new product announcements
so did I

I didn't but the live-stream wasn't working during that time...

hedele

Disable conntrack if you don't need it
Rework your queueing system, if you are using it
rework your firewall rules...

... the usual stuff

hedele

I unfortunately know of these problems... usually a reboot or USB power cycle should fix the problem...

hedele

I would not risk that if I were you, and would rather try out a RB1100AH when it is shipping...
Even then, you might have to overclock it to 1500 MHz, depending on your Firewall and Queue Setup.

hedele

transform ipv6 into ipv4.

Well, of course it does, it essentially sticks an IPv4 Header in front of the IPv6 packet, and off it goes (also over IPSECv4)...

hedele

You could try using a host route (/32) to the host you are pinging to check the availability of ISP 1. No packet filtering or marking is required. so for example: 123.123.123.1/32 gateway1-ip 0.0.0.0/0 gateway1-ip X 0.0.0.0/0 gateway2-ip Then use Tools -> Netwatch to ping the pinghost. use "on ...

hedele

Hi, Simple Queues and L7 inspection slaughter the CPU. Please do not use them, or at least don't use hundreds or thousands of them. No Routerboard will be able to cope with that kind of (useless, because redundant) work. Try to convert your simple queues to a queue tree, or to PCQ simple queues. Dro...

hedele

@normis: ever thought about how it would be nice to know when a "unwanted reboot, probably power outage?" happened? ;) That's what you need a clock battery for... if I connect to a router which has had several power outages, all of them are shown as 1.1.1970 at 02:00:02 .... very helpful.....

hedele

Correct, you can use full performance between the 5 servers on the same switchgroup - just remember to configure switching for the interfaces! Out of the box, the Ports work as standard routed interfaces. The other 8 ports can be used individually (keeping in mind that the second switchgroup also sh...

hedele

I never said it would be used as a core device... Our core devices push in excess of 10 Gbits, so there is no way in hell any amount of RB 1000s (or any MTik device at all) could cope with that. However, the RB 1100 is "just too slow" to use for a single Gbit Link (be it in the distributio...

hedele

Also, Metarouter doubles CPU usage. Well no sh*t, all frames have to be handled by both the physical router, and the Metarouter...
Since it also brings down my RB1000s every few days (completely irrelevant which ROS version I use), I completely stopped using it alltogether...

Search found 339 matches