MikroTik

BrianHiggins

https://help.mikrotik.com/docs/display/ROS/MikroTik+wired+interface+compatibility#MikroTikwiredinterfacecompatibility-SFP+/SFP28interfacecompatibilitywith2.5Gtransceivers This chart lists both the CRS328 and the RB4011 as compatible with 2.5Gbps SFP modules, yet I have a RB4011iGS+5HacQ2HnD that's r...

BrianHiggins

I for one welcome the pending death of 24v passive PoE. I hate that none of the hAP line of equipment supports standard PoE that can run off any regular PoE switch, because it means that every conversation I have about deploying them I have to add the disclaimer that they can do PoE, only if you hav...

BrianHiggins

rule of thumb if you dont need any newly introduced feature you don't necessarily need to go for latest versions in mi case, i am very happy with qos-hw-offloading (introduced on 7.15), only devices on which i wanted to test qos-hw were upgraded to 7.15, all other stay on another previous version i...

BrianHiggins

OP is a pot stirrer who also crossposted this same drivel to Reddit. ChatGPT generated nonsense like this should be stamped out wherever it’s used and the poster banned. OP's been a network engineer deploying MT hardware for over 20 years, and around long enough to remember when this forum was laun...

BrianHiggins

Hypothesis: As of 7/1/24 v7.15.x has not yet had a single stable release yet. v7.15.x is actually just the alpha release for 7.16... . Screenshot.png . I posted the changelogs for 7.15 and 7.16 into chatgpt for analysis and summarization with the prompt that it's a data and information analyst and n...

BrianHiggins

I've offered many times to pay an extra fee (in thousands of USD per year) for things like premium support with <1 day response times. I've begged many times to return the concept of a long term release that doesn't get new features until they have been baked into the regular releases for at least a...

BrianHiggins

v 7.12.2 Trying to do some testing, I've got some SFP 2.5GB modules that have been tested in other MT routers at 2.5Gbps, but plugged into a CCR2004-16G-2S+ I get the option to set the SFP port to 2.5G baseX or 2.5G baseT, but the link does not come up. It can see the device EEPROM info on the SFP t...

BrianHiggins

Duo has a great solution that works really well for 2FA with MT and other solutions. Using it in a lot of places and it's worked great for several years

BrianHiggins

www.aditumconnect.com Powered entirely by MikroTik hardware, but custom setup and built specifically for this purpose, full setup and configuration can be done in ~10 minutes (not counting wiring), supports fullly automated billing, reporting, heath checks, and many other features. Web managed and v...

BrianHiggins

Use "mikrotik home" android app for those clients

have you fixed the permissions yet so we can give a user tikapp or permissions to user the home app without needing to grant them full winbox access?

BrianHiggins

Just heard back from support, they say there's no official fix coming, except for in 7.15. So if you are going to load default configs <7.15 (I saw the problem on 7.11 too, not sure when it started), this is your only solution.

BrianHiggins

verified that the post to the API it does in fact confirm the config and eliminate the reset loop cycle. it's a bit of a weird solution, but it 100% resolves the issue. Great work. But this is a bug (or at least doc issue on how one should do this "correctly"). 100% yes, and according to ...

BrianHiggins

tool/fetch url=http://192.168.88.1/rest/system/note user=user password=password http-method=post http-data="{\"note\":\"system configured\"}" http-header-field="Content-Type:application/json" With POST, it URL is url=h ttp://192.168.88.1/rest/system/note /set...

BrianHiggins

I've got an idea I feel is close to working & solving the problem for now, but I'm struggling to get over the finish line... My idea is to use fetch to post to the local rest api on the device (credentials are already available in my script so no issues there) and change a setting somewhere. Tha...

BrianHiggins

Just heard from support, their suggestion was just to use 7.15+ as it now supports hiding the default configuration prompt (and no regards whatsoever to the giant and still not production ready change in wireless architecture starting in 7.13 that I'm a long way from being able to roll out to produc...

BrianHiggins

Hmm. I have defconf scripts, but I've never see anything like this. But $action is provided in a custom V7 defconf, and you AFAIK you do not have to confirm anything. Now I have NOT tested this recently... So perhaps this has changed when they separated out the caps-man defconf script. Also, I use ...

BrianHiggins

opened a ticket SUP-151561 as well.

BrianHiggins

Just after posting this I thought to run a different type of test. I added an additional test script to my default config, and then added to an existing scheduled script a command to remove the test script. After reboot (and each reset), 30 seconds later the scheduled script runs and deletes the tes...

BrianHiggins

UPDATE, note is below but I've confirmed this is a problem with ROS not confirming the saving of the custom default script. Previous versions it would prompt and ask to keep or revert, and that response was passed back to the script through $action. While it is setting $action="apply" befo...

BrianHiggins

Hyper-V Server 2019 is totally free and will continue to be supported under its lifecycle policy until January 2029, and fully supports SRV-IO.

Just one option. may not be the best one for you, but it does meet the stated requirements.

BrianHiggins

No problems running V7 on Azure. I recommend using Bicep to streamline your CHR installations for easier deployment on Azure. Thanks, though I only need to spin up 1 CHR instance for this situation so automating deployment isn't a benefit here. Any help with a tested & reliable way to deploy v7...

BrianHiggins

Has anyone ever successfully gotten a CHR instance running reliably in MS Azure?

I've got a use case where it would be helpful to have, but a quick cursory search didn't show anything helpful.

BrianHiggins

I've read through everything (but have not installed 7.13 anywhere to test yet, probably will wait for 7.14 instead of trying something so fundamentally changed), but I'm very unclear on 2 things. 1) if I have a hAP AC2 or hAP AC3 router, and load the 7.13npk package on the router, the new wifi menu...

BrianHiggins

troubleshooting a performance problem with a customer's 1072 that only occurs when traffic is above ~450 Mbps, I came across this thread, and thought to check the RAM, and yup 11.8 GiB of reported ram... already working with support on the issue with an active ticket, and going to add this info to t...

BrianHiggins

Unfortunately, it is not possible. If you need both - use wireless.npk. If you are satisfied with using just 5 GHz, then wifi-qcom-ac will work for you. Functionality in wifi (old wifiwave2) that has been changed is described in the changelog. Still, wifi package does not include drivers for RB4011...

BrianHiggins

All devices are in stock at MikroTik. If "your country" has no stock, you should ask (not just refresh the webpage) your local distributor and they will order what you need been waiting a while for hAP AC3 routers which have been out of stock for a while here in the US, but it seems they ...

BrianHiggins

No experience with running in those temps, but my biggest concern would be condensation. Electronics rarely hate being cold, but condensation can destroy them.

BrianHiggins

I've seen issue with speedtest results and SFQ queues, basically the way the SFQ buffers it causes the speedtest to slowly ramp up over several seconds and falsely reports a really low number, yet if you were able to run a sustained transfer it would far exceed the reported speedtest number. FQCodel...

BrianHiggins

It requires a lot of prep and additional components.... without divulging our proprietary process details, you need to have something running to monitor when new devices are connected to the network, and then programmatically log into that device and load a configuration onto it using your preferred...

BrianHiggins

you can log the traffic from the NAT rule and see in the log what it is doing.

BrianHiggins

Odd. I have similar problem, also Dell. EOIP tunnel across the switch solved it for me. But that same switch ( out of my control) doesn't allow VLAN. And for that part I'm still stuck. Maybe I'll start a new topic for it so I don't hijack this one :lol: If managed, VLANs must be defined to allow th...

BrianHiggins

yeah, I saw a similar issue on UBNT gear, and I've tried messing with the ACL to ensure 0x88bf is allowed but I haven't had any success yet. Was hoping someone had already solved the issue before since I'm stumped.

BrianHiggins

I've got a scenario with multiple MT devices on a network, RoMON is setup and working, but fails to discover any devices that are connected through a stack of managed Dell N1548 switches. The devices are reachable via mac-telnet and other devices show up as discoverable via RoMON that are connected ...

BrianHiggins

hadn't noticed that myself, but have the exact same CSS code in my index2.html files. perhaps the % needs to be escaped? I don't have the right equipment hooked up at the moment to do any testing on it, but I'm curious to see what you find. Might need to update our login page in the future in the ne...

BrianHiggins

However, ubiquiti may have offered up an alternative solution already that I would love to see a mikrotik version of. The Instant AF outdoor adapter. takes standard PoE and coverts it down to 24V for their radios. I would love to see a mikrotik outdoor af/at/be adapter to 26-27v and then a full con...

BrianHiggins

biggest wish, get rid of 24v PoE on consumer devices, replace it with standard 48v PoE That's not a mikrotik feature and I do not want mikrotik trying to push that because radios are the determining factor, switches should follow the market not try to fix the market. That's absolute BS. The "m...

BrianHiggins

biggest wish, get rid of 24v PoE on consumer devices, replace it with standard 48v PoE

BrianHiggins

Maybe not a solution for all situations, but the solution that I'd most like to see implemented is a method of central configuration of CAPs Provisioning, specifically one that does NOT rely on a RouterOS device to control the provisioning rules, where we can essentially deploy a CAPsMAN server the ...

BrianHiggins

Was about to write and say it's not possible for windows to do that, but I was curious if there was any such way to do that and so I did some searching, and found this: http://pgina.org/ In no way is that an endorsement or even a suggestion to use it, I actually think it's a recipe for disaster and ...

BrianHiggins

as a service provider that restricts / hides most of the webfig functionality via skins to present the users only the functionality they are needed / authorized to access, the new UI is a nice upgrade. I'm looking forward to hearing the feedback when we move our CPEs from v6 to v7, the devices that ...

BrianHiggins

which is it, 7.1.1 is NOT 7.11 there's almost 2 years worth of difference between the two...

BrianHiggins

In the past I've seen cases where detect internet pulls it's own DHCP lease, which can cause all sorts of momentary problems, it's been disabled on all devices we support for several years so not sure if the behavior is any different today.

BrianHiggins

I think @normis thinks it works... because /ip/hotspot does in fact work correctly in V7. I would be more surprised if it didn't work than hearing it does work. It's a pretty simple function to implement there really isn't much to it code wise, I wrote the whole functionality to support it for our ...

BrianHiggins

Here's the list of what's been fixed since 7.1.1 was released on 2021-Dec-21. Perhaps try reading through the list to see if it's mentioned, or just skip the reading and go straight to updating to a newer version... What's new in 7.11 (2023-Aug-15 09:33): *) api - disallow executing commands without...

BrianHiggins

The webserver response content type must be set to Content-Type: application/captive+json in order for clients to accept & act on the values. But to be clear, content type is actually set when using /ip/hotspot AFAIK. To @normis point, I tested /ip/hotspot docs a few a months ago actually, and ...

BrianHiggins

It's been requested before and Normis even agreed that it was an oversight / mistake that needed to be fixed, but I'd like to bring it up again since it appears nothing has been fixed yet and it's been a year or more since I last saw any discussion on it. The MikroTik Home app requires winbox permis...

BrianHiggins

I'm not sure Windows respects the DHCP Option 114 / RFC-7110 / RFC-8910 scheme in the first place – Mikrotik can't change that ;) confirmed it does not. Also, for anyone trying to replicate this by uploading a text file to a webserver with the appropriate JSON string, that will not work. The webser...

BrianHiggins

Yeah /tool/romon/ssh has NO password= – apparently that has to be provided interactively – annoying... So it doesn't work via script either & if not attribute on CLI, would not be in API. yup, when I saw the news about :put [:typeof (>[])] I was hoping that might somehow be used to get around t...

BrianHiggins

AH... What I didn't know is there is actually a "/tool/romon/ssh" today. Learn something new. RoMON is kinda last resort, so I've always done it "manually" – didn't know it even be scriptable. Now I get it. You're saying that isn't in the API, but in CLI. Well, that sounds like ...

BrianHiggins

sorry, you misunderstand or maybe I didn't explain clearly. I'm connected via the API to one device that's on the same layer2 network as the 2nd device. I need to execute a command from there on the 2nd device that's reachable via layer2 only. In this example it's just setting the system identity (a...

BrianHiggins

officially there is only netinstall, but in the event downgrading to 6.45.8 is possible, I've found that almost always does the trick. When testing various upgrade paths and upgrade scripts it's often required for us to remove a "test" branding config and revert back to an older version, I...

BrianHiggins

Couldn't use the API to temporarily adjust the firewall to allow winbox temporarily via WAN (e.g. /firewall/filter/add port=8291 insert-before=0...), so you can use RoMON via the first router's IP? RoMON's first hop can be IP, and that router will proxy via RoMON via layer-2. But the 2nd hop/L2-onl...

BrianHiggins

So for an ISP, they likely have a billing system, which likely has a secure web server to use to serve the JSON needed to "warn" as user – assuming preexisting config that use Option 114 in CPEs to check a URL in a billing system's web server. While not 100%, likely be useful to direct a ...

BrianHiggins

This would be nice as an ISP to be able to push this DHCP option to managed routers, having them redirect to a server on the network that reminds them they are overdue on payment Just did exactly that, tested and deployed the entire solution in 1 day and released live to update the config on every ...

BrianHiggins

Most of my devices use RADIUS to authenticate users, so they never exist in /users, so..... Not sure. BUT...I'd bet the RADIUS users still show up in /user/active & if you disable them in RADIUS while winbox is still open, they'd have access until winbox was closed. they certainly do show up in...

BrianHiggins

I wrote a small script that detect logged in users that do not exist in /users:

Most of my devices use RADIUS to authenticate users, so they never exist in /users, so.....

BrianHiggins

and then possibly winbox can be dropped.

you couldn't pry winbox from my cold dead hands, don't even try, I've killed people for less.

/s (sorta)

BrianHiggins

We also had a farm in South Woodbury Vermont. Maybe we are related LOL.

I grew up in in midwest, moved here in 2008 so I'd say chances of that are pretty small, but I do love Vermont what a beautiful place to visit!

BrianHiggins

Good points, if one is simply flowing data from an existing vlan into the device and out one of the ports, the bridge is not tagged just the interfaces involved tagged coming in and either tagged or untagged on the way out depending. The only vlan that needs to be identifed in /interface vlan and t...

BrianHiggins

Yes, In this case the router is not supposed to interact with VLAN100, just simply pass the tagged VLAN packets between the ports. If that the case, you're right, your bridge called "LAN" shouldn't be tagged=... I'd presume there is NOT a /interface/vlan with vlan-id=100 — as that wouldn'...

BrianHiggins

!/2 the equation, you need to show the /ip interface bridge add bridge=LAN ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ethernet3 add bridge=LAN ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ethernet5 Not trying add multiple bridges.... By the way using wo...

BrianHiggins

This was the config I found /interface bridge vlan add bridge=LAN tagged=LAN,ether3,ether5 vlan-ids=100 Inclusion of bridge port to the list of ports members of certain VLAN allows device (router) to interact with said VLAN. As bridge port is configured as tagged member of VLAN 100, a vlan interfac...

BrianHiggins

Hoping that someone here has an idea how to accomplish something, because so far I have not. I need to connect to a MT device that sits behind another MT router, and my options are limited only to layer 2 protocols, aka RoMon or Mac-Telnet, connections via IP are not possible. The challenge is that ...

BrianHiggins

Update - I was able to run some test configs yesterday and verified the addition of the bridge name in the tagged list didn't seemingly do anything, and best I could tell had no effect on any traffic whatsoever, so it's being removed from the production config during the next maintenance window. I ...

BrianHiggins

/interface/ethernet/print does not give speed for me. It looks like it did back in ROS6 but not in ROS7. On a slightly related note, I'm assuming you're using proplist because it helps performance in some way? I've just been getting all the results back and then getting the information I need. The ...

BrianHiggins

If you mean get the current utilization speed you need to use the following: /interface/monitor-traffic =once= =interface=ether1 =.proplist=rx-bits-per-second,tx-bits-per-second,name I'm unaware of any other method that works via the API to get current utilization rate, and it only retrieves one int...

BrianHiggins

And you can't use ramdisk (or perhaps /task) either in V7 to apply @rextended's file approach without adding writes.... (Now I've never run into flash issues but...I don't provoke them either & imagine specific hardware may be better/worse with flash durability ) I'm still suspicious of DNS - e...

BrianHiggins

Yeah, you lose the HTTP return code in on-error={} – makes it tough... My initial thought was if URL was interpolated from other variables, perhaps something needs some additional escaping (like a device name etc), or some part of URL resulted in a nothing/nil. Lot can go wrong when building a stri...

BrianHiggins

I've got a strange script issue I can't figure out. I have got a few thousand devices running an identical script, 99% of them are running normal, but about 20 of them are erroring out and not completing the script. These 20 devices are showing "Unable to connect to service" in the log, an...

BrianHiggins

I found another lost data type: :put [:typeof (>[])] Return: op this data type behaves like code Anyway to use this data type to write a script that uses mac-telnet to log into another device by MAC address and execute a command? :?: Something I've been struggling with since there seems to be no wa...

BrianHiggins

[…] but more the vast number of copy/paste programmers that have tinkered a script that works and suddenly it breaks when upgrading. […] You always manage to give me that point of view that I miss, Thank you. it's also easy to update one or two devices, when you've got scripts baked into default se...

BrianHiggins

Got to test this over the weekend and it was a success. However it only worked after setting disable-running-check=yes on the master and I had to run the AP on the master and the station on the virtual. Just to see how things worked I also tried configuring it with master=station and virtual=ap, but...

BrianHiggins

Hope someone is sending out the "40mbit intolerant bit", with all those 40MHz wide channels (Ce) . 28dBm is indeed possible for FCC (US), not for ETSI (EU). All together in channel 1 and 6 (40 mbit wide) , no one in channel 11 ? How does one count/deal the weak (<-86dBm) signal? The noise...

BrianHiggins

I see maybe 3 other APs in my apartment. It does depend on the country, on where you are (private homes will see even less interference, compared to small apartments in densely packed buildings). (We had DSL in previous generation of population :D I remember DSL 20 years ago, but younger people hav...

BrianHiggins

@normis didn't claim it was trying to compete with the "consumer" line. I am sure the case on the L009 is much more expensive to make than the hap cases. My take is these are aimed at lab situations, and for that use case, they may make sense. In an open desktop rack, the wifi could even ...

BrianHiggins

As you yourself wrote, v7 isn't stable yet (because it lacks functionality) so it can't be made LTS. And you yourself wrote there's hardware that requires v7. Combine that with some of ROS paramounts (same feature set on all devices, same ROS version for all devices) and it's clear that what you're...

BrianHiggins

excellent, It'll be a week or so before I'm back there to try this, but this looks promising, all these years I've thought the virtual interfaces had to be mode=ap, and also the master interface as well....

Thanks!

BrianHiggins

at first expected to see it as a worthy representative of 2011-3011-4011-5009 Latvian Muscle legendary Router Family when it is far from it We already have the rb4011 and rb5009 Yes, like you say, we already have RB4011 and RB5009. This is at the other end of the line up (the LOW COST model in simi...

BrianHiggins

Virtual wlan on itf 1 ? Done it enough with map lite. Uplink in station mode and personal wifi via virtual as slave ap on same wifi itf. Caveat: virtual wil only work when uplink has connection. Also, don't expect to set any speed records :lol: But it works. Wait, you can run a virtual AP in mode=A...

BrianHiggins

Many of the bugs fixed in version 7.9 have been introduced in the 7.8 beta. And many errors seem to occur randomly. This is a sign of bad programming: before 'fixing' old bugs, you should review your development team. which is why us old timers used to love the long term release tree, but now that ...

BrianHiggins

NO, it's better to "fix" the scripts (very easy) than revert to the previous shitty format Breaking script compatibility in the middle of a major revision is not a trivial task and should be taken very seriously. It may not be a significant concern for a garage-based company full of hacke...

BrianHiggins

Is anyone still using these? I've got one that I pull out now and then when I'm having trouble getting connected to a router, except for the last several years it has not once successfully launched the terminal window on any computer I've tried to connect to it such that I can actually send commands...

BrianHiggins

I have very unique installation situation where I have a single hAP AC Lite (RB952Ui-5ac2nD-TC-US) that's configured with wlan1 as an uplink (mode=station) and wlan2 as the AP. Everything works great, except I also need to be able to connect a single 2.4GHz only client device to the network but my u...

BrianHiggins

This is not a "new top of the line wireless AP". For that we have hAP and Chateau and other series of devices. Chateau AFAIK is only available with LTE (unnecessary cost for our use case), and has 5 ethernet ports. All models in the hAP line only have 4 or 5 ethernet ports. Once you plug ...

BrianHiggins

/system clock set format=<VALUE> format can be yyyy-MM-dd or mmm/dd/yyyy, the default is yyyy-MM-dd absolutely fully and wholeheartedly agree 100% with this idea. this is the only way it should be done, and then ALL date/time fields in ROS, terminal winbox and webfig, should be displayed using this...

BrianHiggins

One thing I did not write correctly, Guest mode right now denies communication between connected Wireless users. So there is at least that level of security. I believe what he was saying is that Guest mode should include a rule that denies all traffic !out-interface=wan, and also in-interface=lan &...

BrianHiggins

Any plans for a future dual band version of the L009? 2.4 only makes this of limited value, with 5 GHz it would be a quite attractive offering.

BrianHiggins

I'm not sure if it is still a thing, but years ago when you first setup a RADIUS client for VPN or PPP you then had to reboot the MT router before it would begin to send the requests. Have not tested that particular requirement in several years, but I believe at least as recently as 6.45 it was stil...

BrianHiggins

FYI, I very recently participated in a PCI compliance audit for someone, and in order for their business to continue to process customer credit cards, all web managed network devices on their LAN, like switches, are required to restrict web management to HTTPS only (and any use of telnet to manage a...

BrianHiggins

Last week I had a site with a CCR1036-12G-4S, running nearly identical config to well over a dozen other sites with that same model router, all running v7.7. It recently started to experience kernel failures and spontaneous reboots with uptime rarely lasting 24 hours. We first tried swapping out for...

BrianHiggins

Hello, is there a possibility to configure where the WinBox would download the files from the router for example when downloading via Windows / File list / File? Currently it just brings a window with Desktop, <Windows username>, This PC, Libraries and Network... and I always have to click through ...

BrianHiggins

Using the MAC address as password is a bad idea. 1) One can find out the maker of the router, just looking at the MAC Address (they are tight controlled, and every business receives a block of them to use). 2) Knowing this, it would be easy to create a worm/virus/exploit to infect the user's comput...

BrianHiggins

In my setup I have /system logging action add name=System target=memory /system logging add action=System topics=interface /system logging add action=System topics=system,!account /system logging add action=System topics=health After upgrading a device from 7.7 to 7.9 last night these settings were ...

BrianHiggins

confirming that this bug requiring sensitive is still present in winbox 3.38 and v7.9 stable, and skins files created in webfig that works perfectly in webfig can still cause winbox to crash. ticket SUP-115140 Ya they wanted to close my ticket pretty quickly after saying they release this winbox js...

BrianHiggins

Why? Genuinely curious as to why anyone would use WebFig over Winbox if they have the option to use Winbox. Winbox needs to be installed, WebFig is available using pre-installed browser. So why even bother with Winbox ? There's no installer, it's just a stand alone executable you can run from anywh...

BrianHiggins

Love the form factor and price, but need dual band 2 & 5Ghz and, probably more CPU if it's only 4x faster than the 2011. 2011 and the similarly CPU powered hAP AC Lite would reliably max out around 75Mbps using PPPoE for the WAN. One of these priced around $130 US that had dual band WiFi, and ha...

BrianHiggins

confirming that this bug requiring sensitive is still present in winbox 3.38 and v7.9 stable, and skins files created in webfig that works perfectly in webfig can still cause winbox to crash. ticket SUP-115140

BrianHiggins

- new regulations on default passwords An idea :-) Why not using the MAC for the default password together with a simple brute force protection? The MAC is printed on all devices, easy to implement and much more secure than the default password (not secure at all, but much better). I believe I sugg...

BrianHiggins

SKINS ARE NOT FOR SECURITY It is to hide confusing items from beginner users. maybe your novice technician needs to disable users and doesn't want to see confusing menus. Set him up with correct winbox and tell him what button to push. You can also use it for translation, or simplification of menu ...

BrianHiggins

several bugs found with regards to WebFig & Skins and Branding maker. Created ticket SUP-115140 In summary: -Branding maker upload of skins file does not appear on device, uploading of the same file via the custom files does work correctly. -Winbox still fails to load skins without sensitive per...

BrianHiggins

It seems to me that you're advocating for a "politically determined" declaration of some version to be long-term. Just because you have to (management of your company is asking you?) install a new LTS version of OS to whatever infrastructure you've got and MT didn't deliver one for quite ...

BrianHiggins

*) fixed skin file reading; Can you add a minimum winbox version option for the next release of ROS? We're interested in releasing winbox access for customers (currently we only allow a heavily skinned webfig) but need to ensure that skins are honored by all connections, and so need to ensure that ...

BrianHiggins

What's new in 7.9rc5 (2023-Apr-28 11:52): *) console - fixed password prompt (introduced in v7.9beta4); *) lte - improved system stability when changing LTE interface configuration during network scan with MBIM modems (introduced in v7.8 ); *) wifiwave2 - fixed a compatibility issue when using OWE ...

BrianHiggins

To reply to a long post with short: there is no long-term version which contains wifiwave2. And according to previous post, there shouldn't be one before wifiwave2 gets very stable. there's currently no long term version at all for v7, and the last v6 long term build was released in December of 202...

BrianHiggins

We do need wave2 in v7 long-term ... because a few device models require it to run their wireless interfaces. It doesn't matter that it's in separate package. And similarly your post contains other BS. my point is that no features should be in long term until they have survived multiple stable rele...

BrianHiggins

A barcode - unlike OCR or QR - is simple, clean, accurate, effective and cheap. They also generally continue to work much better when the label is partially worn or damaged. There's a reason that the barcode is still universal standard at retail and grocery stores for all UPC codes, the scanners to...

BrianHiggins

[...]The whole process for 120 routers took me just over 2.5 hours in total (100 hAP AC2, 40 hAP AC Lite). Overall the reboxing and labeling took as long as the configuration did. [...] You slap your Aditum label over MikroTik that fast? amazing. Anyway, other countries are fighting to get rid of s...

BrianHiggins

[ And I wouldn't be surprised if you find something I wrote in the autoconfiguration code you use... :lol: ] considering that the initial version of the CPE autoconfig scripts was written in 2015, and based largely on an earlier autoconfig script I'd written in 2014, most certainly not. However one...

BrianHiggins

Yes, at some point MikroTik should stop adding features to a selected version, and then there should be some stabilized point releases after. At least this is how it was before. We might change something in future. Edit: yes, you seem to have noticed that v7 is a bit different, versions come out mu...

BrianHiggins

you don't seem to understand that THIS REQUIRES LOGGING INTO THE ROUTER FIRST. you can't take a brand new hAP AC2 router out of the box and simply netinstall it, you have to log into the router first to change the boot settings. *** ALL ABSOLUTELY WRONG *** It seems to me that it's you who don't kn...

BrianHiggins

Like it or not, I think all roads go through netinstall for the mass deployment scenarios. No amount of discussion is likely going to change that home device will have a default password. No doubt this is PITA, but needed and totally manageable IMO. I think there are some under-appreciated advantag...

BrianHiggins

In my tests, I just set the default "read" group to use the skins above. And the single-quoted one worked fine, at least in v7.9rc1. BUT the default includes "sensitive"... If I remove the "sensitive" policy... @rextended is right, skins does NOT work in winbox ... wit...

BrianHiggins

Do you have any idea of the extra workload, on this way, then there is for anyone? Do you work with RouterBOARD? Just netinstall-it-all. you don't seem to understand that THIS REQUIRES LOGGING INTO THE ROUTER FIRST. you can't take a brand new hAP AC2 router out of the box and simply netinstall it, ...

BrianHiggins

1. Distribitors got all needed information some time ago, please ask Your distributor to check their email and their account, where relevant info is shown in a giant popup. 2. Here is a real sample of the file the Distributor is able to give you: "item_code","item","master_...

BrianHiggins

I'm not currently using branding on this. Its just broken, going to delete the skin and try again.

I've seen on v7 loading a skin doesn't always make it available to select until after you reboot the router, worth a shot if you haven't tried a simple reboot yet, can't hurt.

BrianHiggins

Passwords are available in CSV format from the distributor accounts. You guys are good with scripts, come up with a script that takes these passwords from CSV as variables and uses them in your SSH mass config scripts :) Or ... just Flashfig routers en-masse with some big switch. Few problems with ...

BrianHiggins

The idea of using the new RB5009 as a PPPoE termination is interresting. So t clarify, you use it as a termination and for example plug it to a 10G switch like the CRS13 ? I would presume they are referring to the same type of deployments we started doing ~15 years ago with APs up on the tower runn...

BrianHiggins

Chiming in here, I added this to the newsletter post but I felt it needed included here. Like several others here, we do automated deployment of devices, the process is we plug in 20 routers at a time into our bench PoE switch on ether1, then we load up our in-house deployment tool, and plug in a 2n...

BrianHiggins

The netinstall procedure would be fine if it was possible to initiate it without having to press any buttons on the device itself. Only then it could be automated. Think of something like having user "netinstall" with fixed password "Run_it_now!" that can only login once after r...

BrianHiggins

Also UK has something similar, and basically everywhere the governments are working on ways to improve security: https://techcrunch.com/2018/10/05/california-passes-law-that-bans-default-passwords-in-connected-devices/?guccounter=1 https://www.bbc.com/news/technology-59400762 https://www.lexology.c...

BrianHiggins

FYI, I forgot that if you're loading the skin via branding maker, there's a bug where it writes the skin as a hidden file and can't be seen/accessed, so from my testing you need to also load it as a custom file in branding maker, which allows it to work for webfib, but not winbox. Winbox requires th...

BrianHiggins

Full formatting in this case can last 5-10 minutes. It seems that the device was rebooted without waiting for the formatting to complete. Try resetting, booting from the main bootloader, booting from the backup bootloader again. https://wiki.mikrotik.com/wiki/Manual:RouterBOARD_settings#Protected_b...

BrianHiggins

it does work in v7, though I haven't tested enough to actually allow anyone to actually access winbox with a skin as the function/security limiting function (though I do with webfig). It's on my product roadmap to test for later this year. You haven't tested it, but I have on 7.8, it doesn't work. ...

BrianHiggins

While a reconnect timer for safemode would absolutely be useful at times when you are working remotely and are about to make one or more changes that will knowingly reset the connection, Another (and possible very easy to implement) also needed option is to have a setting in winbox (and enabled by d...

BrianHiggins

We have such app, it's called MikroTik Home. The problem is, that there is no policy that rectricts users to ONLY this app. Sounds like I don't even need to submit a feature request, you already know what needs to be done! The pro app signs in using winbox permissions, the home app signs in using t...

BrianHiggins

it does work in v7, though I haven't tested enough to actually allow anyone to actually access winbox with a skin as the function/security limiting function (though I do with webfig). It's on my product roadmap to test for later this year.

BrianHiggins

While testing some configs in our lab someone managed to lock themselves out of a CRS125-25G-1S with a config that was somehow causing the device to lock up and freeze at boot, and would not accept any external connections and couldn't login thorough the console either. The usual procedure would be ...

BrianHiggins

I too am dying waiting for a LT release of v7. I had been waiting for bug fixes for webfig and branding maker for well over 2 years that had stopped me from updating because they never made it into a long term release, that's still stick at v6.48.6. I was recently forced to adopt a mix of v6.49.7 an...

BrianHiggins

I'm trying to use the API to launch a command, specifically one launched using execute so that it runs async and the API returns success/finished/!done etc while the long running command stays running. I've tried every variation of API syntax I can think of, and while the sample below runs, it doesn...

BrianHiggins

I haven't played with the json web api yet, But presumably that can somehow trigger a script to run on the lte device, fetch from the fiber device can easily post a json string to the lte device to push a status, presuming there's a useful endpoint for launching scripts available...

BrianHiggins

Before you bought it, it was clear that it didn't support v6, before you bought it it was clear that v7 could have different APIs, before you bought it, you have omitted tests on a CHR and have not tried to install v7 on another test device All before you bought it. And now they certainly can't put...

BrianHiggins

issue fixed ... again :) fortunately, I got all my testing done and finalized the new config package I had to build late last night while this was still working, but the branding maker outages this week put me 3 days behind schedule on projects, Normis can you comment on what the root issue is and ...

BrianHiggins

yup found at least 1 so far under system health. It completely breaks anything that calls that menu because it completely changes the data format on the reply from how v6 responded in an entirely incompatible format. I have an open ticket (SUP-96931) about API changes that brake 3rd party software, ...

BrianHiggins

Didn't you read what I wrote?

yup, and already posted about it just above your post... don't think you read the reply

BrianHiggins

For cpes I have a check in script that runs hourly, and a web server that, among many other tasks that client / server relationship does, decides when to release a update to them, when it does it sends the download url to the cpe and the script downloads and reboots. For core routers I wrote somethi...

BrianHiggins

Normis, any eta on hAP AX routers that support PoE input? (and I mean real 802.3af or later 48v PoE, that works with switches that are aren't either MT or UBNT).

I will buy a lot of them!

BrianHiggins

Problem has returned, it was working yesterday but now broken again.

BrianHiggins

It is time for MikroTik to make a very trivial app where the customer changes the SSID and the password on his own, so that he can see the number of devices connected to the wifi and how much traffic passes, without assulting anything else. So the end users are interested only in this without any o...

BrianHiggins

I'm considering allowing end users to access their CPEs through the MikroTik Home app to configure their wifi and see connection stats, since it appeared to have its own permissions and limited access (and therefore an inability for them to break things)... However, in testing it seems that even tho...

BrianHiggins

ok, I don't know why it worked this time, but I swear I pasted the original code and it didn't work (and why I assumed that $strData needed escaped, because it stopped throwing an error on that line when I did) but now it works! This line is the key to making it work. :local arrData [[:parse ":...

BrianHiggins

Readed from file, or declared as string, for this example is equal: { # :local strData ([/tool fetch url="https://myserver.com/getvalues" output=user as-value ]->"data") :local strData "{ssid=\"network\";username=\"test@domain\";pass=\"mypass123\&qu...

BrianHiggins

Hello, I have a specific issue. i am downloading some data with /tool fetch command Thecontent of that file is in correct Mikrotik array format, but when i load it into a variable, it is not recognised as an array, but as an ordinary string instead. :toarray transforms this string into an array wit...

BrianHiggins

I've been banging my head against the wall for the past ~5 hours and have gotten absolutely no-where on this. Can anyone show a method that works? testing on 6.49.7... I am trying to use fetch to pull down the contents of an array, and then retrieve elements of it for later use. It looks like it sho...

BrianHiggins

When will we get AX devices that support 802.3af PoE? I have a huge demand for these with standard PoE input (aka not 24v passive)...

BrianHiggins

bump, any ideas on this? still stuck...

BrianHiggins

Should hopefully be a simple answer... I have a particular environment I'm working with that has a IPSec tunnel from a main router to a 3rd party operated network (tunnel is working fine), and I also have 5 other OSPF connected routers that also connect to that same main router. All connectivity is ...

BrianHiggins

I'm new to and trying to get up to speeds with LORA & IoT protocols. I'm trying to understand how LORA would be deployed & configured as a service provider, where I might want to deploy some KNOT LR9's (US based), but I want to ensure only devices I've authorized are able to connect. It seem...

BrianHiggins

Home app - goes thorugh nothing to do with WAN setup. What if its PPPoE? Does this just purely rely on a DHCP WAN? For any kind of funky setups, surely you need the normal MikroTik app, where a lot more options are available. This is for home users with no configuration needs. PPPoE is a "funk...

BrianHiggins

I think you should have a look at this presentation, they talk exactly about your issue and explain how to resolve it. MikroTik bandwidth manager https://www.youtube.com/watch?v=loaVBWq6cWA been using the same config outlined in that video for a long time. The problem isn't pushing 300+mbps total t...

BrianHiggins

Does anyone know how to specify the Bucket Size through the Mikrotik-Rate-Limit attribute, or via some other RADIUS attribute? I tried appending it to the usual string format of "rx-rate/tx-rate rx-burst-rate/tx-burst-rate rx-burst-threshold/tx-burst-threshold rx-burst-time/tx-burst-time priori...

BrianHiggins

bump - did you find a solution on this? I'm experiencing an issue that may be similar.

BrianHiggins

other than to load them with a script every reboot, is there any way to get an environment variable to persist between multiple reboots?

BrianHiggins

there is no DUDE installation here, and unless there's a way to pull the OID via the MT script that won't work. the actual goal here is to set a traffic monitor script to perform a web call when traffic throughput exceeds a certain threshold, and if possible include the current mbps ul/dl in the dat...

BrianHiggins

this is a really simplified script of what I'm trying to do, but the first two lines don't work, and I can't figure out how to do a get on this figure... I don't care if I need to use a few extra lines to pull the tx/rx speeds, I simply can't figure out how to get just the rx/tx values into variable...

BrianHiggins

Scenario, RouterBOARD 962 setup as wifi router. ether1 is WAN, ether2-ether5 is bridged for LAN. Device connected downstream to one of the LAN ports on the RB962 needs to be able to communicate over VLAN 500 to the providers upstream router that ether1 is connected to. the RB962 only needs to functi...

BrianHiggins

I too have a possible large project which can benefit from docker support. either or both running RouterOS inside docker, and docker inside RouterOS.

BrianHiggins

You can't change username anymore, if you need different username create new, and delete old one. This is feature, not a bug. I disagree, it's a bug. Proof: where is this in any changelog? (because I looked before posting, twice) v6.43 changelog *) user - all passwords are now hashed and encrypted,...

BrianHiggins

You can't change username anymore, if you need different username create new, and delete old one.
This is feature, not a bug.

I disagree, it's a bug. Proof: where is this in any changelog? (because I looked before posting, twice)

BrianHiggins

Unable to change default username for admin account (or any account), command line gives error "failure: user name can't be changed" and winbox options are disabled. /user set admin name=somethingelse password=mypass comment="changed default account" failure: user name can't be c...

BrianHiggins

Yes, last bugfix 6.40.8 is fine (+ change your passwords after upgrading, restore your configuration and inspect it for unknown settings, implement a good firewall) What's new in 6.40.8 (2018-Apr-23 11:34): !) winbox - fixed vulnerability that allowed to gain access to an unsecured router tell that...

BrianHiggins

Is there anymore detailed information than the old blog post? I've seen numerous routers running 6.40.8 bugfix get compromised in the last few days. Winbox was externally accessible. On Friday I updated a couple older routers that had not yet been compromised that weren't on 6.40.8 to 6.40.8, only t...

BrianHiggins

I have a 600+ unit (res) complex coming up for wifi and want to stick to all MT throughout as ive done on others, but am very worried as users want wifi speed on their consuemr devices. I *KNOW* i can deliver that wifi speed with UBNT APs and MT routing, but want so badly to go all MT (only issue i...

BrianHiggins

Just to be clear, my implementation is done only upon one of our admins clicking the test bandwidth button inside the web admin console they use to manage their hardware, and it's hard coded to run only a single 10 second test up, followed by a single 10 second test down, it then disables the test b...

BrianHiggins

Months ago I embedded a 10 second duration upload and download test into our web provisioning platform to assist with determining bandwidth performance when doing new installations (this generates at most less than 5 or 10 minutes of collective tests spread over the course of a month, so definitely ...

BrianHiggins

more pointedly, why do you need 3 VAPs at all? why not use the master interface as one of the APs, and then use only two VAPs. You can still perform all the same config and routing / bridging / vlaning options, and that actually will provide better wireless performance since you are wasting less air...

BrianHiggins

I haven't yet tested this myself, though I will probably be doing so in the near future for a similar project. I think it's helpful if you realize that hotspot and capsman are not connected or related functions, and actually have nothing to do with each other. I believe the correct solution would be...

BrianHiggins

That is why there is a disable CSMA/CA option for NStream....

BrianHiggins

Is it possible for CAPsMan APs to still provide support for using the WPS button? If not, enabling WPS on a caps configuration would be really useful for a project I'm working on. Master configuration only would be fine, though the ability to specify it to work on a slave configuration could be usef...

BrianHiggins

Just noticed a script I've been using for ages that went through and dynamically updated address list entries via DNS to current IPs stopped working. It fails on the line /ip firewall address-list set $i address=$newip It appears that $i is being parsed as *N where N is the item number of the addres...

BrianHiggins

[*] also add support for MT-Rate-Limit attribute when using DHCP+RADIUS as already promised (Ticket#2016110222000039) This already exists! Use the Mikrotik-Rate-Limit VSA sorry, it's in the ticket I referenced, and wasn't entirely clear in this post. what I meant was full support, which means also ...

BrianHiggins

Is there any community support for pushing to see an official metarouter image that would enable some IDS / IPS features? I would be interested in seeing something that can be integrated via the web proxy, and run 100% inside the router. I would like to see a supported metarouter image that contains...

BrianHiggins

also add support for MT-Rate-Limit attribute when using DHCP+RADIUS as already promised (Ticket#2016110222000039)

BrianHiggins

This is actually exactly what our company does...

We have a complete process for this, including automated provisioning and tenant account management, bandwidth controls, IP provisioning, etc.

brian at aditumims dot com for details.

BrianHiggins

I tried to apply the lock pack to a hAP lite AC tower, because I actually wanted to further lock it down by disabling protocols other than 802.11, it does not appear to be accepting the lockpack config as NStream is still an option. Is there any special procedure like a netinstall needed before appl...

BrianHiggins

In a script, Without knowing how many Ethernet ports are on a router, how do I identify the last port?

aka RB\2011 has 10 ports, I need to ID ether10, CCR1009 has 8 ports, I need to ID ether8

any ideas?

Edit, this also needs to exclude any sfp ports

BrianHiggins

on Cisco "no ip source-route" instructs the router to ignore any ip options headers that contain routing information and to perform only policy routing. While policy routing is the standard way we all route on MikroTik, I've never seen anything about if source routing via ip options header...

BrianHiggins

I would like to be able to suppress user login / logout events from the memory log, but only when logged in / out via the API I have played around a little trying to figure out the best way to do this and I don't easily see how. I would like to suppress / ignore the first two lines here, but make su...

BrianHiggins

goal, single API command that matches and set parameters on multiple items A couple of example commands that I want to work, but don't... /radius/set =src-address=1.2.3.4 ?service=PPP /queue/tree/set =limit-at=1000 =max-limit=10000 ?parent=ParentQueue Any idea how to do this without first doing some...

BrianHiggins

I've successfully implemented the API outlined here connecting over the regular API port of 8728

http://wiki.mikrotik.com/wiki/API_in_VB_dot_NET

Can anyone shed any light on what is required to modify the code to enable me to connect over the api-ssl service on port 8729?

BrianHiggins

an option to auto add a comment to the interface with the remote Identity name would be a nice way of handling it.

BrianHiggins

Thanks, Was looking in the wrong place for this, worked like a charm, though I think I found a few bugs in the AP provisioning process (will email support later this week)...

BrianHiggins

Anyway to get a virtual AP up and running under CAPsMAN (under a different profile/config), or even just add a Virtual AP to a router that the primary AP is controlled by CAPsMAN?

BrianHiggins

6.12, how do I get the local wireless interfaces to get managed from within capsman? I have successfully gotten a remote AP provisioned and working, but the local wlan1 interface on the router running the manager won't show up under radios, I've tried everything I can think of.

BrianHiggins

so virtualized hardware will not be supported.

and so licenses for virtual instances or ROS will not be purchased... fix the drivers to support hyper-v (hint: they already exist, you just need to include them), and you'll sell more licenses.

BrianHiggins

will you add that to VLAN driver? ppp interfaces?..

Any update on resetting PPP interfaces? Clearly that isn't drive dependant...

BrianHiggins

I'm deploying a new Hyper-V server, and due to requirements I am forced to implement a virtual MikroTik router, and because of these limitations, going to be running v4.17... I would happily purchase a new license, even a L6, and upgrade to something new, but it simply isn't an option here until sup...

BrianHiggins

Whomever posted a comment to me on my personal website back in December asking for help regarding this (I don't know your screen name), I apoligize, the comment was flagged as spam and I just noticed it a few minutes ago. I email'd you, but wanted to post this as well to ensure you get me email.

BrianHiggins

setup a DHCP server, assign IPs from a private IP block, and the setup a webproxy that redirects all traffic from that IP block to whatever website you want, and drop all other traffic. you're not actually redirecting the PPPoE session, but instead redirecting anyone who doesn't have a valid / activ...

BrianHiggins

did you install/enable the UPS package?

BrianHiggins

http://en.wikipedia.org/wiki/Burstable_ ... Percentile

BrianHiggins

1st question, why not use the MikroTik as yout VPN server?

2nd question, what IP on the interface plugged into the switch do you have assigned to the mikrotik, and to the VPN server? (hint, they must be unique)

BrianHiggins

regular outdoor PtMP I 100% agree that you should avoid circ pol antennas, but for an indoor implementation the signals will be bouncing around everywhere and you have no idea what polarization they will actuallly strike the antenna in.

BrianHiggins

But why the WDS/station-psudobridge? Because you want to have the client deal with the PPPoE authentication themselves? I see no advantage in that? Some clients hardly know how to switch their PC on (really! :shock: ), let alone how to setup a PPPoE interface and a login. So we still end up with th...

BrianHiggins

You are better off doing your bandwith shaping via PPP (ex pppoe) than by interface or mac. It requires MUCH less managment / config on your part, and gives just as much control.

BrianHiggins

under what circumstance would you recommend wds? sorry for the delayed response... I'd reccomend WDS only in the following circumstance: You have an AP, and a small group (usually under 10) of potential customers in a small area, but only one customer can actually get a signal. put up a CPE, config...

BrianHiggins

sorry, been a while since I checked back here. correct on all accounts, the default of 3200 may or not be right for you, test if out and give it a try. just don't use any policy other than best fit. I found the others don't seem to work as well (specifically the exact size option) One thing you may ...

BrianHiggins

since this thread was resurrected... after v3 came out and was stable, we eliminated nearly all WDS links from the network, and changed all CPEs to station-psudobridge mode. This improved performance, reduced latency, and allowed more customers per AP with better performance than with WDS. We still ...

BrianHiggins

citrix uses lots of small packets, do you have any limit rules enabled??

BrianHiggins

This version had been working fine for the last 5 years 3.7 is at most 3 years old :) I agree, you should upgrade it. but check for any filter rules with anything set in the "extra" tab, specifically things like the PSD or the Nth section before you do, those rules could cause issues like...

BrianHiggins

I've used mikrotik R52 radios coupled to this antenna http://www.streakwave.com/Itemdesc.asp?ic=IN800%2F5900%2D5&eq=&Tp= many times with good results. It also has a very clean professional look that blends in well with most office buildings, and is easy to install. However if you will be ins...

Search found 750 matches