I have 2 CCR1036-8G-2S+ running 6.34.2 Both are configured with VRRP on both the WAN and LAN side The LAN side also has the 2 sfp ports bonded, with Multiple VLANs each vlan with a VRRP interface. bonded -vlan400 --vrrp400 -vlan410 --vrrp410 For addresses each VLAN has a /24 address while the VRRP h...

If anyone has set the server-dns-names in the console I would recommend you get a backup now! I have managed to brick my RB493G (mipsbe) 3 times already, the last 2 times were to be sure that was the cause and it wasent a fluke, after setting that and rebooting it would get to starting services then...

The product page for the Mikrotik S-85DLC05D says it is tested and compatible with both the Mikrotik RB260GS and Mikrotik RB2011UiAS-RM

I have a RB2011UiAS-RM with S-85DLC05D at one side and a RB260GS with a S-85DLC05D at the other. After the RB260GS was turned off the fiber the Link between the two dropped and did not come back up, the RB2011 still showed the interface as running, but no data being received. If I disabled/enabled t...

I added a template: add group=default template=yes src-address=0.0.0.0/0 dst-address=0.0.0.0/0 protocol=all proposal=default But I still have the same issue... The router is requesting 172.16.1.0/27 to 0.0.0.0/0, tried the above and even tried the template having exactly this and it still dident fin...

You mean the equivalent of Address Lists but for Ports instead of Addresses?

We have been using Draytek Vigor 120 ADSL Modems successfully with our Mikrotik routers until Mikrotik make one or build it in

I have an RB2011 the new hardware revision so im stuck using 6.x. We set it up identically to an existing RB2011 but its the older hardware revision running 5.24. The routers main purpose is to terminate IPSec LAN to LAN VPN's The only config issue I had moving to 6.2 was the generate-policy under t...

Thanks! I will give it a try

This is what I have so far... not really sure what I need to add to B?? #Router A /ip ipsec peer add address=B.B.B.B/32 dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha1 lifetime=8h secret=????? /ip ipsec policy #A->B add dst-address=172.16.0.0/16 level=unique proposal=default sa-dst-addre...

I have 3 sites A, B and C each with a Mikrotik Router

I have working IPSec VPNs between A => B and B => C

Is it possible to send traffic from A to C without creating a new tunnel directly between them eg route thought B?

We have been using Draytek Vigor 120 ADSL modems with various RouterBoards on many of our sites, each time we just add a PPoE client on to the interface the modem is plugged in to, supply it the ADSL user name and Password and it works fine. It always create 2 dynamic Mangle Rules to lower the MSS. ...

We have been using Draytek Vigor 120 ADSL Ethernet Modems with Routerboards that require ADSL, config is a breeze and done completely in the Routerboard.

Still would be better if it was just one device.

Thanks for that, I think that may be a neater solution then what I currently have. I had played about with the limit option but found it wasent suitable as it was just letting in random packets I need all IKE packets from a host at a time, I ended up using the limit option to add the addresses to a ...

Its running the latest 5.19 I turned on the logging only after the issue happens to work out why none of the vpn's were connecting and the messages were about the phase 1 failing. DH group is 14 (modp2048) The problem does appear to be the router getting bogged down trying to do all the key exchange...

No the RB1100AHx2 is not set to send the initial contact, it is left to the remote routers to initiate the connection when required

I have a RB1100AHx2 which is currently terminating 250 IPSec vpn's The problem is if the router is rebooted it gets hit with all the vpn connection attempts at the one time, the cpu maxes out and all connections seem to fail on phase 1. Occasional I got one connection up but it dident last long. Wha...

That worked great, Thanks!

I am using RouterOS 5.1, I have an IPSec VPN setup to a cisco router, its LAN is subnet1, it has a route to subnet2. With the IPSec tunnel setup i can get to subnet1 but not subnet2. From what i have read this is due to the IPSec policy, to fix this it seems to suggest adding another policy with sub...