MikroTik

alexjhart

For everyone facing the same issue, i did further testing and Mikrotik support just confirmed:
The exact match is actually working, but has a bug to match on /32 subnets as well.

No other subnet sizes are affected.

Any chance you've received an update from support?

alexjhart

Looks like it's back!

alexjhart

I'm seeing this on multiple CHRs recently. Yes, I can ping those addresses. [***] > ping count=1 cloud.mikrotik.com SEQ HOST SIZE TTL TIME STATUS 0 159.148.147.229 56 53 193ms sent=1 received=1 packet-loss=0% min-rtt=193ms avg-rtt=193ms max-rtt=193ms [***] > ping count=1 license.mikrotik.com SEQ HOS...

alexjhart

So is Mikrotik working on MacOS native client or this https://help.mikrotik.com/docs/display/ROS7/Winbox#Winbox-RunWinboxonmacOSCatalina manual is best what we can expect? iOS/MacOS developer here at MikroTik. We just started working on a revised version of the iPad app and if all goes well, will p...

alexjhart

I know /31 RFC3021 isn't currently supported, but as we run out of IPv4 space, it sure would be nice to have working OSPF with /31. Maybe v7 will open the doors to making this happen. /31 is not supported.. You should use /32 or /30 Just a warning on using two /32 addresses as a workaround for the /...

alexjhart

@Normis, can you have https://help.mikrotik.com/docs/display/ROS7/Winbox#Winbox-RunWinboxonmacOSCatalina updated to include some of the things missing as pointed out in this threa? Such as: Xquarz version and download link wine staging version required and download link Drag and drop works for me, h...

alexjhart

On 6.43.11: I have a script containing the following command: :resolve $hostname server=$NS I set "read, write, test" permission on this script, run without error On 6.45.7: When the same script run into the command :resolve $hostname server=$NS" it caused the "not enough permis...

alexjhart

Is this sold just as single unit, or a pair?

alexjhart

you can power cycle only the USB port without power cycling the device where the woobm ist connected to. just go to: System -> Routerboard there you can use the "USB Power Reset" button Thanks for the suggestion, but considering the scenario where I'm locked out of the terminal, if I don'...

alexjhart

I'd like to request an option in the web interface to power cycle the woobm. This will help overcome terminal lockout issues and making changes to device that require power cycle, without pulling or power cycling the device powering it.

alexjhart

I'm seeing this too. In Chrome, characters are shown in real-time while tryping. In Putty, characters typed aren't displayed until the enter key is pressed. Windows 10 telnet client works properly.

alexjhart

Have you contacted support@mikrotik.com yet?

alexjhart

*) crs3xx - added initial hw-offload support for 802.3ad and balance-xor bonding

What does "initial" mean here?
Strods?

For those still wondering, I found this https://wiki.mikrotik.com/wiki/Manual:C ... es#Bonding

alexjhart

*) crs3xx - added initial hw-offload support for 802.3ad and balance-xor bonding

What does "initial" mean here?

Strods?

alexjhart

*) crs3xx - added initial hw-offload support for 802.3ad and balance-xor bonding

What does "initial" mean here?

alexjhart

My static ports in all bridges just disappear after reboot on CAPsMAN controller router. RB2011UAS-2HnD ROS 6.41rc61. Also on SXT ac, clients are diconnected from time to time (every few minutes). In rc56 was perfect. New bugs? Do you have support output files from older RC where the static bridge ...

alexjhart

700 meg wireless throughput Those are old slides. We can get more now. What is now possible? Is this only between Mikrotik devices? What can be expected with capsman manager forwarding? I'm currently seeing nowhere near 700 with 6.40.3 on hap ac (support said 700mbps driver update was included as o...

alexjhart

Feature request: change the "select columns" widget so that is is possible to tick/untick several column entries without having to open the widget every time. E.g. make it bring up a dialog with all column names and checkmarks (arranged so it fits on the screen) and an OK button to submit...

alexjhart

https://forum.mikrotik.com/viewtopic.php?f=21&t=118408&p=614776#p614776 Feature request: change the "select columns" widget so that is is possible to tick/untick several column entries without having to open the widget every time. E.g. make it bring up a dialog with all column name...

alexjhart

I would like to request that copying and pasting within winbox (using CTRL+C/CTRL+V) is added. Easier then right clicking and pressing copy and paste every time.

Not sure why it doesn't work (3.11, Windows 10)

Amen!

Sent from my SM-G930T using Tapatalk

alexjhart

Very cool!

Any chance the CRS317 will support MC-LAG / 802.1aq or similar, along with the rest of the CRS line?
+1 for MC-LAG / 802.1aq or similar

+1

Normis?

alexjhart

Bridge will handle all Layer2 forwarding and the use of switch-chip (hw-offload) will be automatically turned on based on appropriate conditions.

Will these "appropriate conditions" be documented on the wiki? When can we expect to see these?

alexjhart

Very exciting release! Way to go Mikrotik. Looking forward to testing this out. I think this is a step in the right direction.

Does this bridge change affect the snmp mib? If so, how?

alexjhart

Hi!
Do we need add in last position of chain=bad_tcp RETURN rule?
Code: Select all
/ip firewall raw add action=return chain=bad_tcp

Return is the default when reaching the end of a custom chain, I assume that applies here too, making it unnecessary. So the answer would be no.

alexjhart

Hi, academically speaking, until this feature is implemented/perfected, is it possible to have capsman enabled with several caps and manually define the channel used on each one? This way we could manually avoid some problems, at least when the spectrum circumstances are stable. Yes, just have to m...

alexjhart

Hello, Winbox 3.11 does not start under Windows 10. After specifying the target IP and the login data the window disappears without error message. Winbox 3.8 is the last version which works with me. However modal windows for this version ( v3.8 ) do not function since the last Windows update. MfG 3...

alexjhart

These are the results that I got before I sorted out my MTU. The fragmentation will fry it. Have you confirmed that you aren't getting fragmentation over the tunnel? So far as I can tell, this is not the case. However, if you made changes and got the performance expected, perhaps I am missing somet...

alexjhart

Itcould be great if anyone with 72core router could verify if it work,too. Has anyone tried GRE over IPSec transport? Or SMB traffic on windows clients? That's been what we have had issues with. Looking forward to this fix filtering down - I'll be sorely tempted to use current rather than waiting f...

alexjhart

- Wireless + CAPSMAN: what about airtime fairness and bandsteering?

Probably best requested as new reply in viewtopic.php?f=1&t=45934 or topic in viewforum.php?f=1 (might already exist too)

alexjhart

*) ipsec - show hardware accelerated authenticated SAs; Is there any possibility that WinBox could highlight the algorithms that are hardware accelerated on each platform? You mean putting this information into winbox? https://wiki.mikrotik.com/wiki/Manual:IP/IPsec#Hardware_encryption. Couldn't hur...

alexjhart

I don't see anything in WinBox, but CLI has new flag "H - hw-authenc" in "/ip ipsec installed-sa print".

Thanks. Not sure how I missed that when printing before. Guess I was looking for a yes/no value, not flag. Makes sense.

alexjhart

6.39rc54 has been released.
*) ipsec - show hardware accelerated authenticated SAs;

Where can this be found?

alexjhart

Itcould be great if anyone with 72core router could verify if it work,too.

I should be able to do that soon and will get back to you.

alexjhart

So I did some additional testing, I can actually push around 800Mbit with a UDP flow and CPU usage is pretty good. However, when I run a TCP benchmark, CPU usage is very high (networking/cpu under profile) which I believe is constraining the TCP throughput now. I think I may have an issue with frag...

alexjhart

Version 6.39rc51 has been released. !) tile - fixed IPsec hardware acceleration out-of-order packet problem, significantly improved performance; Can you tell more about this? Does this also improve IPsec on other multicore platforms like RB750GR3? This is specifically for the CCR series (both probl...

alexjhart

What's new in 6.39rc51 (2017-Mar-10 12:50): !) tile - fixed IPsec hardware acceleration out-of-order packet problem, significantly improved performance; This is fantastic news. Does this work with all models, or as suggested by support earlier will it just be a subset at this time? Any details on w...

alexjhart

Have Mikrotik reached out to Wikileaks Yes, but as you can imagine, all the big tech companies are probably doing the same. Normis, when you say you are reaching out to them, does this mean it has only been a one-way effort so far, or have you made two-way contact with them as other tech companies ...

alexjhart

Bump about what specifically? I can share results with more than 550Mbit iperf test through hAP ac over wireless, but it seems to me, a few posters here are talking about CAPsMAN. So question unclear I see a couple things. One question was about fastpath support for capsman in the future. Another w...

alexjhart

Bump about what specifically? I can share results with more than 550Mbit iperf test through hAP ac over wireless, but it seems to me, a few posters here are talking about CAPsMAN. So question unclear I see a couple things. One question was about fastpath support for capsman in the future. Another w...

alexjhart

*) snmp - added back MAC address OID in "/caps-man registration-table" (introduced in 6.39rc33);

Many thanks

alexjhart

*) ipsec - updated tilera classifier for UDP encapsulated ESP;

Details?

alexjhart

alexjhart, MAC-address is not present in /interface wireless registration-table print oid either, and it is calculated in the same way as for capsman table OIDs. It's there in the bridge table and i wouldn't mind it for the wireless registration table too, but I was focused on capsman here. Especia...

alexjhart

Version 6.39rc38 has been released. Changes since previous version: !) routeros - added support for new products and RouterOS features which will be announced at MUM EU (https://mum.mikrotik.com/2017/EU/info/EN); Good call. We have a month to try it, but at least tell us where to search! Yeah, it w...

alexjhart

*) snmp - fixed CAPsMAN registration table OID print; *) snmp - fixed CAPsMAN registration table SSID type; Looks like you guys got it this time! Thanks for the quick fix. Still sad you are being stubborn about leaving/adding back the mac OID in there. I think redundancy is a poor argument and beli...

alexjhart

While I can see this works, it does seem to be easier to have a Hex-String or String conversion automatically done for us in an additional OID. Since the code was there already and it makes things easier on folks, why not just leave it (put it back)? That's additional data to be sent over the wire,...

alexjhart

This is an example about SNMP CAPsMAN registration table. We run SNMPwalk to device. As a result we get different OIDs. For example: iso.3.6.1.4.1.14988.1.1.1.5.1.12..587 In this case: iso.3.6.1.4.1.14988.1.1.1.5.1.12 - CAPsMAN registration table specific entry; xx.xx.xx.xx.xx.xx - MAC address in d...

alexjhart

OIDs for CAPsMAN will be fixed in next rc release. MAC-Address parameter is removed since it was already available and this was a duplicate entry, Where else is it included that we aren't finding (I say we because others are posting about this being gone too, so it's not just me missing it)? So bas...

alexjhart

OIDs for CAPsMAN will be fixed in next rc release. MAC-Address parameter is removed since it was already available and this was a duplicate entry, Where is it available? I do not see the MAC address anywhere in TR-069 data returned from device, except for the MAC addresses for the WiFi interfaces. ...

alexjhart

OIDs for CAPsMAN will be fixed in next rc release. MAC-Address parameter is removed since it was already available and this was a duplicate entry,

Where else is it included that we aren't finding (I say we because others are posting about this being gone too, so it's not just me missing it)?

alexjhart

Hi everyone I have 10g ports on my router and graphs look like this: http://i.imgur.com/RYVcXoF.jpg I am using version: 6.38.1 3G everything looks good, after exceeding this value, it begins to fall apart. What could be the reason? I will add that any problems with the link no :) The cacti looks no...

alexjhart

6.38.1 is a good version to downgrade and get back mac address oid. I just did it and all are back to normal

Thanks for taking the time and effort to confirm that. Odds are in our favor they will add that back in then

alexjhart

Well, look at that. Not only did they not fix the misprint of oid, they did in fact remove mac from the tree. I'm guessing someone just removed they wrong thing by accident. They'll need to fix that clearly. I could have sworn it was in there, but I downgraded to the last release (rc27) and still d...

alexjhart

Well, look at that. Not only did they not fix the misprint of oid, they did in fact remove mac from the tree. I'm guessing someone just removed they wrong thing by accident. They'll need to fix that clearly. I could have sworn it was in there, but I downgraded to the last release (rc27) and still d...

alexjhart

Help people! I have a script that was reading snmp individual mac address from capsman registration table. After upgrade I can not read any of them. What is the SNMP oid to get all the wireless clients MAC on capsman (not the count)???! I posted above (ignore the minor bug they're working on) `/cap...

alexjhart

Help people! I have a script that was reading snmp individual mac address from capsman registration table. After upgrade I can not read any of them. What is the SNMP oid to get all the wireless clients MAC on capsman (not the count)???! I posted above (ignore the minor bug they're working on) `/cap...

alexjhart

What's new in v3.11: *) fixed wireless interface tabs, HT MCS tab was not shown in 5g/n/ac mode; *) ask for confirmation when exiting or disconnecting in Safe Mode; *) fixed problem where context menu Add command could not be selected if it had submenu; *) fixed problem where ip accounting settings...

alexjhart

Version 6.39rc33 has been released.

Changes since previous version:
...
*) snmp - fixed CAPsMAN registration table OID print;
...

I'm still getting the same incorrect output.

alexjhart

We've been struggling to get GCM (i.e. software only encryption) working between our CCR1009s and Cisco ASAs. As such I'm in a real pickle having recommended Mikrotik. We'll take any kind of workaround right now (e.g. run CCR1009 as single core router) until there is a proper fix. For now, RB1100AH...

alexjhart

My last update says they're still working on ike2, but they will try to fix this in "one of the next versions". Unfortunately, the fix will be for lower core routers (CCR1009 and CCR1016) first. "Because solution for these routers are almost ready. For others, not yet." Hopefully...

alexjhart

Thank you very much for the report about capsman oid values.

Happy to help

alexjhart

*) dhcp-client - added "script" option which executes script on state changes (CLI only); cool. now I can react to lease instead of scheduling script to do ddns, address-lists, etc. ? :) *) snmp - added SSID to CAPsMAN registration table; Didn't know this was in the works. Looked through ...

alexjhart

I agree
Related thread for others on this issue: http://forum.mikrotik.com/viewtopic.php?f=1&t=112545

alexjhart

I'll do this same test with a CCR router in about 15/20 days. I'll also try to stress with multiple tunnels to the same Cloud Core Router. Beware there is an issue with CCR hardware encryption, so you may be wasting your time on that until they fix it. See: http://forum.mikrotik.com/viewtopic.php?f...

alexjhart

My ticket on this as of 1/18/2017:
We will continue to work on this problem when ike2 main features will be finished.
The wait goes on.

Thanks for joining in the struggle to get this fixed. Don't forget to update your starting post in the thread.

alexjhart

Just poking via ticket email. Any news on this poking?? I just replied to my ticket again for another update. I haven't heard from them in over a month. Maybe 6.39 will be the lucky release? Support said: We are still working on ike2, right after this we will continue to work on reordering problem....

alexjhart

Just poking via ticket email.
Any news on this poking??

I just replied to my ticket again for another update. I haven't heard from them in over a month. Maybe 6.39 will be the lucky release?

alexjhart

Just poking via ticket email.

alexjhart

My latest update from support on this (from yesterday) is:
"We are working on the ipsec problem right now."

I'm not sure what that means for timeline, but it does show they are giving attention to this issue that I brought up with them about 1 year ago now.

alexjhart

Related post: http://forum.mikrotik.com/viewtopic.php?f=1&t=112545 (Is re-ordering fixed yet with IPSec and hardware acceleration? (Updating thread))

alexjhart

How do we use this? http://forum.mikrotik.com/viewtopic.php?p=566652#p566652 Hello. I have not worked on version 6.38.24 and 6.38.38 what am I doing wrong? /interface bridge add arp=proxy-arp name=bridge1 /ip ipsec policy group add name=group1 /ip pool add name=l2tpUSERS ranges=192.168.100.129-192....

alexjhart

Use Dude function "ros_command" inside a function. Use POSIX ERE for matching inside "ros_command" script. In this example I look for registrations at CAP wich name starts with "2_": ros_command("/caps-man registration-table print count-only where interface~\"...

alexjhart

For folks having trouble with IPsec in latest RCs, change your peer generate policy from port-strict to port-override. Support says they are working on a fix for this, but that was enough to get it working for me.

alexjhart

What's new in 6.37.2 (2016-Nov-08 13:15): *) firewall - fixed "connection-state" value disappearance in rules that were created before v6.22; Are 6.38rc builds affected by this as well? If so, will there be an update that includes this fix? Does this fix rules that were already broken by ...

alexjhart

What's new in 6.37.2 (2016-Nov-08 13:15): *) firewall - fixed "connection-state" value disappearance in rules that were created before v6.22; Are 6.38rc builds affected by this as well? If so, will there be an update that includes this fix? Does this fix rules that were already broken by ...

alexjhart

I sent a support ticket on 11/16, but haven't heard back from anyone. I get this error when trying to launch the Dude client on Windows 10 after fresh install. dude crash 6.37.1.PNG 6.37.1 ACCESS VIOLATION at: 401f4b eip=401f4b eflags=210202 edi=3032060 esi=9cf044 ebp=9cf074 esp=9cf02c eax=1 ebx=9cf...

alexjhart

While relevant, lets not get distracted too much from the larger theme with this routing filter issue

alexjhart

6.37.2 just releasing for make dude bugy?

I think it was released early to fix important issues. Hopefully 6.38rc either isn't affected or will also have another release soon

alexjhart

What's new in 6.37.2 ? Changelog is empty. From download page: What's new in 6.37.2 (2016-Nov-08 13:15): Important note!!! Dude doesn't work in this version, it will be fixed in soon to be released v6.37.3 Changes since 6.37.1: !) ethernet - optimized packet processing on low load when irq re-balan...

alexjhart

Maybe the path Mikrotik should follow now is making FPGA based Hardware for NAT, Queuing and Firewall Filters. In my opinion, MikroTik shines in making routers based on very inexpensive "general" communications processors running the generic Linux OS (which has lots of networking capabili...

alexjhart

right now it's not possible, but the next major release of Dude is planned to have this and more possibilities

Bringing this up again since "the dude is not dead" and it's been a while since this thread was bumped.

alexjhart

Please fix the L2TP/IPSEC functionality before the final release

I agree it needs to be fixed before final release. Make sure to send support supout. I am still working through some issues with them that were introduced in this rc. Works in rc7, but hasn't in rc25-31 (haven't tested rc8-24).

alexjhart

- Routing filters often need to be disabled/re-enabled to make them work.
Can we have more details sent to support?
Do you modify routing filters frequently?

I've experienced this too and have helped many others with the same issue. Is Mikrotik unaware of this mrz?

alexjhart

I upgraded from rc7 to rc24 on x86. My road warrior L2TP IPsec VPN stopped working (both OS X and Android clients). I upgraded to rc25, still didn't work. Downgraded back to rc7 works again. rc24/25: 08:46:31 ipsec,debug respond new phase 2 negotiation: 2.2.2.2[4500]<=>1.1.1.1[10584] 08:46:31 ipsec...

alexjhart

Send supout to support from rc25

Sent

alexjhart

I upgraded from rc7 to rc24 on x86. My road warrior L2TP IPsec VPN stopped working (both OS X and Android clients). I upgraded to rc25, still didn't work. Downgraded back to rc7 works again. rc24/25: 08:46:31 ipsec,debug respond new phase 2 negotiation: 2.2.2.2[4500]<=>1.1.1.1[10584] 08:46:31 ipsec,...

alexjhart

*) discovery - added LLDP support; I thought LLDP was already added? AFAIK this is RC changelog, there is no point to add new line for every fix/update for features that was introduced in this RC, when released in current it will still be just one changelog entry about feature introduction. So thos...

alexjhart

http://forum.mikrotik.com/viewtopic.php?f=21&t=114253&p=567026#p566410 Have you picked up on something that may offer us relief or just another reference point? Just another reference point. I felt the same way when I saw the notes in the newsletter. I am somewhat comforted that they unders...

alexjhart

My ticket reporting IPsec driver issue on CCR has been open for nearly 1 year now with no resolution. Others are noticing too: http://forum.mikrotik.com/viewtopic.php?f=1&t=112545 The most frustrating part is that even with weeks between checking in, I repeatedly get told things like "I do ...

alexjhart

http://forum.mikrotik.com/viewtopic.php ... 26#p566410

alexjhart

What measures should be taken to avoid packet reordering?
[irony]do not do hardware IPsec on CCR, huh?.. [/irony]

http://forum.mikrotik.com/viewtopic.php?f=1&t=112545

alexjhart

*) discovery - added LLDP support;

I thought LLDP was already added?

alexjhart

Great idea

alexjhart

Can it be used as an an access point (in conventional meaning)? I mean, can it be wired to another router, which shares internet through LAN port?

absolutely

alexjhart

Does anyone know whether this occurs with regular TCP/UDP streams too (so without HW encryption)? Secondly, is SSTP working ok or is that HW accelerated too? Bit of a shocker this thread:-) Yes, it impacts all traffic. Note that you can use IPSec ciphers/hashes that will not use hardware encryption...

alexjhart

RB850x2 with HW encryption can encrypt/decrypt up to 500Mbps with 1400byte packets new hex RB750Gr3 can encrypt/decrypt up to 470Mbps with 1400byte packets Where on the mikrotik webpage i can get the informations which device has hardware encryption and which encryptionmethods are supported ? I hav...

alexjhart

Is re-ordering fixed yet with IPSec and hardware acceleration? (Updating thread) Not 100% sure what nathan1 meant by adding ping output to first post, but this ping is going aes-128-cbc eoip tunnel (hex3 - hap lite): 64 bytes from 192.168.50.1: seq=0 ttl=63 time=16.875 ms 64 bytes from 192.168.50.1...

alexjhart

It turns out at all a problem with speed, and Mikrotik simply deceives the clients in speed The problem is at the Windows side. The MikroTik routers with hardware acceleration on multicore processors are really fast, but they re-order the packets when the link is loaded (multi cores operate in para...

alexjhart

Yes, it does. It was already announced that hex 3 has HW support.
mrz, can you speak to the problem we are all fighting here? Does the hex3 maintain packet order per-flow?

I would love to know this too.

alexjhart

Yes, it does. It was already announced that hex 3 has HW support.

Hey, Mikrotik finally joined the thread.

Does routeros have support for the hardware support the hex 3 offers, or is it like the 3011 that doesn't yet?

alexjhart

So the hex r3 was just released and supposedly supports hardware encryption on a MIPS chip. Has anyone found out if this platform maintains order? It would be amusing if they do which would mean these $60 units outperform our $500+ units. http://www.mikrotik.com/download/share/hexr3.pdf http://foru...

alexjhart

The problem with misordered packets is that the receiving side has to wait for everything to come in so it can reorder them and feed them to the application. This results in the connection slowing down and scaling the window size smaller in order to guarantee delivery. You could tweak the settings ...

alexjhart

I have given Mikrotik evidence that router-to-router-ipsec-with-hardware-encryption traffic is received out-of-order, therefore affecting the encapsulated traffic, and they have confirmed this is a problem. It does affect throughput. How much depends on latency, protocol, etc. SMB with Windows is on...

alexjhart

Well, that's promising, but I'm not going to run RC firmware on my production network. Since it appears to require adding your master ports to a bridge to enable the switch-chip functionality, I wonder what the performance impact will be on the CRS CPU as a result of implementing STP. I wondered ab...

alexjhart

http://forum.mikrotik.com/viewtopic.php?f=21&t=112844

What's new in 6.38rc7 (2016-Sep-30 07:33):
!) switch - added hardware stp functionality for CRS devices (http://wiki.mikrotik.com/wiki/Manual:CR ... e_Protocol);

alexjhart

http://forum.mikrotik.com/viewtopic.php?f=21&t=112844

What's new in 6.38rc7 (2016-Sep-30 07:33):
*) discovery - added LLDP support;

alexjhart

Also, great work on getting STP for CRS and LLDP out the door!

alexjhart

*) snmp - do not allow to execute script if user does not have write permission;

I'm glad my ticket was addressed quickly to resolve executing scripts with read-only access.

What about adding the ability to chose which scripts are given SNMP access?

alexjhart

In my opinion it will never be fixed.
This is a problem in hardware (tilera).

Mikrotik has already agreed to fix it and have discussed possible solutions with me. I don't think this is an if, but when. Unfortunately, they won't commit to a timeline, so I'm not sure when it will be.

alexjhart

I asked for another update on 8/30/16 via email to my ticket on this issue and was basically told to stop asking for updates and just watch the changelog.

alexjhart

*) snmp - added script table which executes script and returns it's output on get request;

Please explain how to use this feature, because I cannot find it in the user interface...
I too am looking for more information. Don't see anything in the wiki yet?

@emils maybe?

alexjhart

About loop protect: How is that handled if interface is in a bridge / switch group?
How is routing performance improved?

Yeah, I'm wondering if this can help with the CRS shortcoming (no STP for switch group ports). I haven't purchased CRS yet because of this.

alexjhart

*) snmp - added script table which executes script and returns it's output on get request;

Please explain how to use this feature, because I cannot find it in the user interface...

I too am looking for more information. Don't see anything in the wiki yet?

alexjhart

I'll just add to this. Mikrotik, hurry up and release a CRS with the Qualcomm IPQ processor (Like RB3011), Full size USB3 port and a 802.3af/at POE option. We would buy a LOT of them, for use with wAP's and to power IP phones and cameras. I would kill for a 48 port CRS with an IPQ-8064 and 802.3af/...

alexjhart

Any one seeing issues with Winbox disconnecting after a few minutes? I've been running Winbox 3.4 under Wine on linux without issue. I upgraded one router to 6.36 and now it just randomly disconnects after a few minutes. I've tried from a workstation and laptop both of which have no issues with win...

alexjhart

Currently we are still adding Switching features for the CRS. Right now you get only basic Switch functionality, but the hardware allows for much more, and new features will be added with every software update. Please give us examples of the most important switch functions that you want us to make....

alexjhart

I'm wondering about v7 and v6.36

alexjhart

Yeah that's what I'm using for now. Software is much higher quality, but unfortunately comes with a performance bottleneck. I'm with you; hopefully they get this worked out soon so we get high quality and throughput (meaning higher goodput).

alexjhart

Probably related: http://forum.mikrotik.com/viewtopic.php ... 48#p538801

alexjhart

Yes, this is likely the same issue. I have been going back and forth with them since December of last year. Wasn't until March they admitted to/understood the issue. It sounded like they had some ideas on how to fix it when I talked to them in April. My last update was May 20 when they said, " ...

alexjhart

Why structure of "/interface list" menu is different from "/address list" in WinBox? Why they haven't same logic?. I wondered exactly the same thing! Workflow inconsistency = Bad We talked about this earlier in the thread. They are planning more for this than the current firewal...

alexjhart

My question exactly :) That's what I would like to know as well. I will try to answer the question myself: I think the address is resolved at boot and when DNS TTL reaches 0 and is renew in cache. Test it yourself? That's crazy talk! ;) Actually, good idea. We just tested as well and found the same...

alexjhart

Version 6.36rc16 has been released.
*) firewall - allow to add domain name to address-lists (dynamic entries for resolved addresses will be added to specified list);
Nice!!!

How often is updated?

My question exactly

alexjhart

I wish I had a more detailed post to direct you to, but check out this for now: http://forum.mikrotik.com/viewtopic.php?p=535450#p534818 Likely what you are seeing is an issue with the hardware encryption driver that causes problems with packet delivery. With TCP, this often results in poor single ...

alexjhart

Mikrotik. I have to say, this is one of the nicest pieces of hardware you have designed. My only real feedback is that a LED visible from the outside would be welcome. This way we can see at a glance if the unit is operational. We use the LED all the time on our Motorola, AeroHive and Ubiquity AP's...

alexjhart

I'll just add to this. Mikrotik, hurry up and release a CRS with the Qualcomm IPQ processor (Like RB3011), Full size USB3 port and a 802.3af/at POE option. We would buy a LOT of them, for use with wAP's and to power IP phones and cameras. I agree, I'm happy to see the hEX PoE coming, but look forwa...

alexjhart

I wish I had a more detailed post to direct you to, but check out this for now: http://forum.mikrotik.com/viewtopic.php?p=535450#p534818 Likely what you are seeing is an issue with the hardware encryption driver that causes problems with packet delivery. With TCP, this often results in poor single t...

alexjhart

I'm guessing they put in under /interfaces because they plan on being able to use that list/group/zone in other areas outside of firewall, like queues. I agree naming should be consistent. Also, regardless of context/naming issues and not being available in winbox yet, I am happy to see this new fea...

alexjhart

Hi. Is any chance to improve TCP performance on single session over IPSEC on IPIP/GRE tunnel in this version? Now is max 40-80 Mbps per session regardless of device model (tested on CCR 1009 and CCR 1036). What encryption are you running? We see close to 600mbit/s over EoIP/IPSEC with AES256-AES256...

alexjhart

normis, will the hex poe have 802.3af out?

alexjhart

When I asked about this, support said some things to make this work are broken and might be fixed in v7.

alexjhart

I have a VM doing just that, but considering other vendors have this functionality built in (Ubiquiti, Cisco, etc), I would hope they could also provide this.

alexjhart

Mangle doesn't appear to have any affect on the mDNS (224.0.0.251) TTL like it does others. Either way, I agree we need an in router solution. Avahi does this really well (Ubiquiti adopted this use on edgerouter). http://leerspace.com/2015/12/20/bonjour ... ti-edgeos/

alexjhart

The better way to handle this (or in addition to wiki) is to throw an error in the console saying the file is too large.

I wish there was a way to handle reading larger files from the router...

alexjhart

It would be nice if you could drag and drop the order of columns in all windows in winbox. Also, if you could right click on any column name to get the dropdown to select additional columns, that would reduce friction involved instead of using dropdown and selecting show columns to see list each tim...

alexjhart

Few things : I haven't read all suggestions, but a simple way of filtering the log view on routeros would be nice. A way to only see a curtain PREFIX f.ex from the logfile while its running. in linux something like this. tail -30f /var/log/syslog | grep -i FW-DROP-LOG-PREFIX1 or even better to see ...

alexjhart

alexjhart

It sounds like you're pegging the CPU. When you have the hybrid Mikrotik/Cisco link and it works well, try transferring a file in the opposite direction to see if the speed falls off or stays good. Whatever the case, watch the CPU of your Mikrotik while the transfer is taking place. My case is CCR1...

alexjhart

I have similar setup and see similar results. I was given the same advice too, yet already implemented it with no improvement as well.

alexjhart

I just did a UDP test with 10 streams.. I got 800mbit.. with 20% packet loss..

Transmit only.

Yeah, same here

Sometimes the packet loss is even worse (like 80-95%) depending on test parameters. All of which are virtually zero without encryption enabled.

alexjhart

We were able to get 1.7 Gbps of IPSEC on a 1500 byte MTU between two CCR1036 routers in our lab. Sounds like you may have other factors in the transport or the AWS endpoint that may be limiting you. http://www.stubarea51.net/2015/10/16/10-gbps-of-layer-2-throughput-is-possible-using-mikrotiks-eoip-...

alexjhart

My testing started at 6.33.3. While others may be reporting performance improvements from earlier versions, I find the hardware encryption quality with IPSEC on CCR1036 dissatisfying. Testing with everything identical except setting and unsetting ipsec-secret in GRE config (enabling and disabling en...

alexjhart

alexjhart

I am seeing this behavior as well.

alexjhart

While I agree v7 will be a great improvement, 1072 can exist without it. Although, they might both end up landing around the same time anyway.

alexjhart

sodMetaldream, it does have dual power supplies. They are removable too.

alexjhart

I would also like to add having faster response on /ip route print where xxxxx commands would be appreciated. Many are very slow with full routing tables.

I guess this was already offered up:

alexjhart

tile - rare situation when CCR devices failed to auto-negotiate ethernet link (introduced in v6.25);

Can you tell me more about that please?

alexjhart

I already checked with support on the ability to use v7 as a pure route reflector and was happy to hear that functionality will be included. This is already possible: - Create ip/vrf - Create bgp/instance - Assign bgp/instance to ip/vrf - Create bgp/vrf - Connect to peers and see their routes only ...

alexjhart

Good idea

alexjhart

BGP performance hasn't been too much of an issue. The things talked about at MUM for v7 sound great. As far as BGP related requests, these are some: Hi Mrz, Any chance to have support for SNMP BGP4-MIB in 6.x? Thanks. +1 BGP4-MIB Also, adding the BGP AS source to netflow Cisco offers either peer or ...

alexjhart

This would be great to have for sure, especially being able to specify number of parallel client threads to run.

alexjhart

Winbox RC1 is available. There are lots of changes since beta 3* http://download2.mikrotik.com/routeros/winbox/3.0rc1/winbox.exe Overall highlights of Winbox 3: Remembers all layout details between sessions Inline comments global setting Winbox loader can self upgrade Choose any of the saved sessio...

alexjhart

Sounds great!

alexjhart

@Shiro I added store logging, nothing yet. @normis I can't make a supout, because it appears read-only. sup-output hits 100%, but doesn't show a file created. Also, if I try to create a backup it says "Couldn't make backup - action failed (6)". Bad blocks information isn't present for Clou...

alexjhart

Watching this thread closely as I have the same issue. Holding off upgrading anything that doesn't have the problem and don't know what to do with affected units. Also have read-only problem, so no supout. Also concerned remote reboot will render other settings missing and have a bigger problem.

alexjhart

I would love to see this as an option, but as I understand it, they still haven't implemented this feature.

Also, check out:
http://forum.mikrotik.com/viewtopic.php?f=14&t=43853

alexjhart

Hey Mikrotik, any progress on this? Seems to still be an issue in v6.12

alexjhart

By chance, are you guys (v6.7) using spaces or dashes in your WPA/2 key? I am and found that removing those (at least on a VirtualAP) allowed me to connect with the devices having trouble.

alexjhart

I am seeing this to. I started noticing it on the 6.0 pre-release builds. I still see it on v6.2 sometimes. I have yet to know if 6.3 fixes it.

alexjhart

+1
I am surprised this hasn't been implemented yet.

alexjhart

I haven't had any issues with reboots while on rc9 (13 days uptime on tile and 14 on 951-2n so far). Many thanks!

alexjhart

I am dealing with random reboots on rc7 with CCR1036.
Please try the version with fixes for this problem: http://www.mikrotik.com/download/share/ ... 6.0rc9.npk

I haven't had any issues with reboots while on rc9 (13 days uptime so far). Many thanks!

alexjhart

When routing traffic across two interfaces, I am seeing better performance with fast path off vs on, which seems backwards to me. iperf results: With "/ip settings set allow-fast-path=no" 787+790=1570Mbps With "/ip settings set allow-fast-path=yes" 862+199=1061Mbps pathtest resu...

alexjhart

I forgot to mention, my RB951-2n was rebooting every day or so as well and putting rc9 on it has helped. That router has lasted 2d 06:33:15 so far.

alexjhart

So far I have gone 1d 09:51:40 with rc9. This is the longest it has lasted without an unexpected reboot. Granted, it tends to reboot every few hours when I have traffic passing through, even when it didn't it didn't make it 24 hours without the watchdog (I assume) rebooting. I might try giving it so...

alexjhart

When the bar stopped updating today, I opened the resources window and it didn't refresh the main bar, nor is the data in the resources window updating automatically. However, every time I close and re-open the resources window, the data displayed is up-to-date, just not continuing to update. It als...

alexjhart

When I leave winbox open, the the main bar stats (uptime, memory, cpu, etc) stop updating after being connected for a while. Other things like stats in the interface list continue to update. If I click system > resources, the main bar stats start updating again. Also reconnecting with winbox fixes i...

alexjhart

Thanks normis. I will give that a try.

alexjhart

I am dealing with random reboots on rc7 with CCR1036.

alexjhart

I am also seeing a lot of random reboots in 24 hour periods. The main concern is on v6.0rc7 with CCR1036. I have sent two supouts to support and haven't had a single reply yet. Fast path isn't being used. I don't know if that has anything to do with it. I will have to try the serial console to colle...

alexjhart

When routing traffic across two interfaces, I am seeing better performance with fast path off vs on, which seems backwards to me. iperf results: With "/ip settings set allow-fast-path=no" 787+790=1570Mbps With "/ip settings set allow-fast-path=yes" 862+199=1061Mbps pathtest resul...

alexjhart

You can configure the router to use any port as the WAN interface. That is far more likely than expecting power out on port 1.

alexjhart

I was doing some testing with some RB750s with queues and I kept seeing disconnects, which matched up with reboots. I switched to an x86 sandbox and noticed the same thing was happening, so this probably isn't hardware specific. I didn't change much on v6r3 from factory settings. I am thinking this ...

alexjhart

My latest update from support:

new changed poe-controller firmware will be included into RouterOS 5.22. It will
address "crazy lights" when in auto-on mode, weirdness with ether5 port. However
it will not address issues with forced-on mode.

alexjhart

Does mikrotik have any answer to this? Since Mikrotik isn't updating us on any of this, I reached out to their support email. A couple weeks later, I was told "we are working on completely revised version of firmware." Hard to say what it will fix or when, but it is in the works and they ...

alexjhart

But now we see that CCR is another sorry but how do you see that "now"? we have not published any performance tests or other new specifications. how do you know that it is not more powerful in all areas than your category Cisco? on what data you base your assumption? This thread is gettin...

alexjhart

Currently we use Agilent and Xena Networks equipment for our Ethernet tests. Tests are done between CPU attached ports - ether1,ether6,ether11 on RB1100AHx2 and all 16 ports on CCR1036 Devices are configured to send traffic equally from all to all ports. (so 6combinations*20connections=120streams ...

alexjhart

I had found a similar issue as well @mikrotik You should be able to do this in your lab (this is all your gear): 1. plug in 750UP via 2.5A 24V include supply and computer in ether1 2. load 5.20 and update poe firmware. 3. with default config, only change poe off on ether3: /interface ethernet set 0 ...

alexjhart

ok, Normis, now show the router throughput in L3 with 20-40 rules of firewall !!!! Proove that CCR is more powerfull that ubnt EdgeMax !! ) I too would like to see performance with queues and firewall rules in place. Not just more powerful. You got to sell this thing. Needs competitive price and pe...

alexjhart

I thing recording will become available after the MUM.

I hope so. Let us know when it does. The live feed is pretty useless right now (isn't playing)

alexjhart

hi, whith 5.20 on my 750up (poe firmware 2) i'vo got random reboot on ubnt rocket M5. Set "forced on" do nothing. :( What to try out??.. log They added a lot of information here: http://wiki.mikrotik.com/wiki/Manual:PoE-Out I haven't had a chance to try anything out yet, so I don't have a...

alexjhart

solution with capacitor is dangerous if short is happening, it can damage the router and connected hardware when on short that large capacitor is discharging, on the other hand, if you know that no shorts are going to happen - it is not that bad to stabilize the fluctuations. People are just lookin...

alexjhart

My desired setup (and how I'm testing) is with the Mikrotik-provided power supply (24V @2.5amp) feeding through a passive poe injector (y-cord) through 120' of cat5e cable. The 750UP is fed on the DC plug from that 120' cable. Then I have a 1 or 2 Nanostations on a 30' cat5e cable connected to one ...

alexjhart

we are working on new controller firmware that should remedy these problems.

Got this today:

What's new in 5.18 (2012-Jun-21 17:20):

.....
*) fix health and poe access reliability on OmniTIK UPA and RB750UP boards;

......

Is that what we are all waiting for or a tease?

alexjhart

Our 2nd solution that we are awaiting parts to try is a 48V to 24V PoE Converter, silimar to Mikrotik's but the one we ordered has 30W output instead of 24W, I would've preferred a >40W unit, but we couldn't find one that was readily available and at a resonable price. This would allow us to use a ...

alexjhart

This has everything to do with tagging and trunking. In my tests, I was plugging the 750UP ports into a switch (I used port 1 and 2-5, one at a time). I had a different IP on each VLAN on the 750UP. Those VLANs were sent over a trunk with tagging (1 ethernet cable between 750UP and the switch). On ...

alexjhart

With ports 1-5 removed from the master port and put into a bridge, I added the vlan under the switch to ports 2-5. I also added the vlan interface to the bridge. This allowed me to attach an IP address to the vlan. Let me know if you need more information. Yes, but from what you are describing, thi...

alexjhart

This is a little off topic, but does the 750UP support VLAN tagging and trunking? I'm trying to set this up, but keep getting: "failure: not supported for this switch" No, rule table is not supported on 750up. See the wiki below. "Rule table is very powerful tool allowing wire speed ...

alexjhart

We will make software upgrade that does some output adjustments to compensate for this noise.

When??? Days, weeks, months?

alexjhart

specs of working modified 750UP seen above OS v5.5 24v PoE injector 200ft of CAT5 cable RB750UPether1<-->200ftCAT5<-->24vPoE<-->120VAC RB750UPether2<-->empty RB750UPether3<-->UBNT900Mloco RB750UPether4<-->UBNTM2Rocket RB750UPether5<-->UBNTM5Rocket no devices plugged in: [admin@MikroTik] > system he...

alexjhart

I've been able to resolve my powering issue. I soldered a 35V 2200uf capacitor onboard (the board still fits in the case) and all is well. I put this back on the tower 200ft up in the air and now can power 3 UBNT devices! Finally it works as expected!!! $2 and its fixed? Where do we solder? Have so...

alexjhart

we are working on new controller firmware that should remedy these problems.

Do you have an ETA on that firmware? Which problems exactly will it remedy?

alexjhart

I have spent hours upon hours trying to figure out the problems with these. Turns out, they do just fine if you power them directly or have them powered by a very short cable run. With a 100ft cable run (for example), a Nanobridge M5 runs just fine, but if you put a 750UP at the end of that run and ...

alexjhart

When this happens, is it logged?

alexjhart

The update did not work for me on my problem unit.

alexjhart

I wrote a little script that restarts power based on the port status, but it doesn't work because find for poe value doesn't work. I believe this is a bug. :local iface; :foreach i in=[/interface ethernet find poe-out=forced-on] do={ :set iface [/interface ethernet get $i value-name=name]; /interfac...

alexjhart

We are having issues with devices connecting to a 750UP as well. We have a site that has two Nanobridges attached to it. The logs show that the interfaces go down. We end up cycling the POE power on-off-on (or forced on in the newer firmware). We have tried to 750UP devices thinking we may have just...

alexjhart

I am running 5.8 on RB750. With another RB750 running 4.11, I can get the leases from SNMP in 1.3.6.1.2.1.9999 as expected. With this unit, I get output, but it doesn't include my current leases as expected. Is this a known issue? I couldn't find it in the forums or the changelog. Anyone else having...

Search found 198 matches