MikroTik

killersoft

Thats awsome.
Love the formal stencils.

Draw.io is the new popular kid on the block and is my current choice of network drawings

killersoft

When an attempted upgrade goes wrong. There is nearly always info in the system log as to why it had an issue...

killersoft

viewtopic.php?t=75672

OR write a script thats triggered from netwatch.

killersoft

Have you checked the power supply is supplying both the correct voltage as well as having the correct available current.
Next double check the passive PoE media converter is working (unless your going via another device( PoE extension ) then defiantly check available current.

killersoft

Its been broken for a very long time now, I am surprised it has not been picked up ) RouterOS is not pushing the correct config in AUTO ( it should be pushing AT+CGDCONT=1,"IPV4V6","internet" ) in AUTO to the LTE Card, but is actually only pushing "IP" (which is ipv4) f...

killersoft

Looks like there is an issue more specifically with the FG621-EA and how RouterOS sets the card info with its operational modes, specifically IP TYPE : AUTO should set something like -> AT+CGDCONT=1,"IPV4V6","internet" on the card, but is not doing that. and is only setting it to...

killersoft

You need to upgrade the RouterOS firmware to at least 7.16, if not ( as of writing ) 7.17.1.

killersoft

Hi, I have been playing around with my hAP ax lite LTE6(arm) unit. It has v7.17.1 running on it. I am trying to understand why I cannot get both ipv4 & ipv6 running simultaneously on my LTE using INTERFACE->LTE->LTE APN's(default)-> IP TYPE set to :AUTO, if I force v6 on the APN it works(gives m...

killersoft

Go buy a 2nd hand switch starting with Cisco Catalyst 3560X onwards , 4xxx / cisco industrial( IE series) switch as they hardware offload'ed macsec. Even Juniper's got a good collection of macsec enabled switches. You can even buy off the shelf dedicated MACSEC media converters now-a-days : https://...

killersoft

+1 on nz_monkey regarding VXLAN comments and eVPN. Could I add in( no doubt a new switch chip for future products ), but hardware offloaded MACSEC as part of the underlay. "And include jumbo frames ( aka 9000 byte + frame)" My use case is commercial datacenter/carrier providers(via L2) to ...

killersoft

Hi, what hardware( chips ) / CRSxxx / CCR2 will VXLAN hardware offload will be available on.
I note I get the HW tickbox on my CCR1036( probably should not see that )...

killersoft

Hi. Just looking briefly at this; at the top of my head ~-61 dB RSSI, your probably only good for ~400/400Mbit using 40MHz in perfect conditions( yes it might say something > 400MHz ), but once you add data I guarantee that's the beginning of your Eb/N0(https://en.wikipedia.org/wiki/Eb/N0) journey ....

killersoft

Best put in a support ticket for that type of request.

That said, just did SNMP in librenms and sha2 is not yet supported on that platform ! So somewhat cutting edge !

killersoft

I'v had issues in the past with netinstall. Usually the device, or more specifically the ethernet port of the laptop/pc causing the netinstall trouble. Funnily enough, i'v used usb dongles on the same machine that had a fixed etherport tht didnt work, but the usb dongle allowed the netinstall proces...

killersoft

So I have just purchased a hAP ax lite LTE6..
I'll be testing it over the next week while I am away !

killersoft

I wonder if RoS v8, or a Kernel update( e.g v6.4+ ) will help assist with Wi-Fi 7.
E.g : https://www.phoronix.com/search/WiFi+7

killersoft

Maybe its time MT splits their product lines, and does a 'budget' version of their gear( which I understand reasons for ), and a PRO line of gear ( happy to pay more to have all the bells and whistles.)

killersoft

Let us know how you go after you update the firmware of the mikrotik and the lte card

killersoft

Last I checked, there's plenty of vpn or equivalent sneaky ways to get a MT to bypass a state based vpn block, that doesnt require some 'magic' plugin for MT that "would work", but other existing mechanisms already onboard dont...

killersoft

I agree that there should be a bit of a road-map from Mikrotik, at least in terms of "a product that will.... and has a form factor of ....", because honestly they need to start concentrating on larger customers who as stated by avacha do have large budgets and do lifecycle planning. I als...

killersoft

A couple of things. Is BOTH the routerOS version Current as well as the HapAX hardware board Firmware(System->RouterBoard { }, if not ->upgrade+reboot). Then after a reboot and the LTE comes back, have you checked the firmware upgrade for the LTE card itself ? ( Ps you could add in a watchdog servic...

killersoft

Not sure if this is common knowledge. But just tested MACSEC to see if I could get it to work using 3 mikrotik's and a generic switch to connect them. I was under the impression that it was just point to point, but no it point to muti-point plus !! I set up a CCR1036, a RB750 and a RB750r2 via a gen...

killersoft

100% Pain in the A$$, this issue. MT really needs to get onto fixing this. I have a mix of ~20ac + 20ax units running under capsman(wireless + wifi ) Being able to bring all my units under 1(wifi) controller-window is what I want. Its so close to working, even the ap's when I try this, i see in the ...

killersoft

I think you have the concept of WAN incorrect according to your drawings. Technically you have just interfaces, one of which is a private ip range 10.x.x.x( not routable on the internet ), and your 20 & 30 ranges technically routable on the internet Anyhow, you need a 3rd set of IP's on each int...

killersoft

CRS series are at the core a network switch. Yes they have some ability to do layer 3 in cpu, and some minor hardware offload, but you should 100% expect cpu to 100% cap out unexpectedly. . The CRS series is not what you should be using for routing. Try at minimum a RB5009 via the 10gbpt port as a r...

killersoft

Please put TAB's back not dropdowns

killersoft

I am going down this path at the moment. I have a front end wan mikrotik rb5009, connected to a netgate pfsense hardware appliance for internet services for desk pc's which are also in an active directory environment. That said at this point will be either going down a proxy gateway approach or trap...

killersoft

Yep, makes sense. The crs series is primarily a switch not a router(yes they route, but not fast and its not what they are aimed at as a product). Use a ccr series or maybe a rb5009.

killersoft

There is a linux kernel driver issue with intel ax201/ax210 cards..
https://bugzilla.kernel.org/show_bug.cgi?id=203709

killersoft

Looks like the 88E6393X switch chip used in the 5009 can do basic L3 hardware routing, but I cannot find doco on chip NAT functions.

https://www.marvell.com/content/dam/mar ... -brief.pdf
.
.

killersoft

Got to admit, not really a fan of this request.
I get the sentiment, but just chuck in a linux container if your really that desperate.

killersoft

https://help.mikrotik.com/docs/display/ROS/Basic+VLAN+switching With mikrotik you have generally 2 choices with vlan switching. Do it all on the devices switch chip (wirespeed ) OR Do in in CPU( the processor ) usually much slower. Doing it in switch chip is always choice 1 where you can. CRS 1 + 2...

killersoft

Well a bit of time has passed since I put up this thread.... Wi-Fi 8 ..802.11bn The goal of 802.11bn is to reach 100 Gbps speeds. This is faster than copper Ethernet which tops out at 40 Gbps. This will require retrofitting ceiling mounted access points with single mode fiber. https://en.wikipedia....

killersoft

Well I'll assume your using at least 24 or at worst 26AWG cat5/6 for such a long run. Cap ax's are power hungry beasts. Powering Details Number of DC inputs 2 (DC jack, PoE-IN) DC jack input Voltage 18-57 V Max power consumption 40 W (most likely CPU load related ) Max power consumption without atta...

killersoft

Yes, it looks nice, and will indeed fill in a gap in the market and be good for many "basic" switching applications.. That said, for me : Big talk of future upgrades; sorry, tell me what I am getting now, not what may or may not come.. Will stick with Cisco, as you know what your getting w...

killersoft

Let just hope they will be releasing next gen equipment that supports macsec hardware offload... https://www.marvell.com/content/dam/marvell/en/public-collateral/phys-transceivers/marvell-phys-transceivers-alaska-c-88x7121p-product-brief-2020-02.pdf or https://www.marvell.com/content/dam/marvell/en/...

killersoft

I know this might be weird attempt at a fix, but try:
WiFi Security -> FT(TAB) --> FT Enabled = YES

killersoft

Its funny, I work with a large Cisco environment( and have a lot of MT gear too :) ). But Cisco's software is also buggy as, let alone full of CVE's( funny when you compare against MT ! ). I'v experienced expensive and 'compatible' cisco sfps' that wont work in there hardware with various os release...

killersoft

Like most versions, there are beta's.
In the case of 7.15betas were out around 2 months.
Feedback was a plenty in the forums, let alone private submitted bugs to support.
Not bad for a free release !

killersoft

Was hoping 7.16 to fix roaming issues, but no luck, all worked perfect until 7.15 and new drivers. My devices keep roaming from 5ghz to 2ghz and thats very next to router under full signal, and often multiple devices roam same time(Samsung s23, LG OLED TV, ASUS tablet). I already reduced 2ghz to 10...

killersoft

Thats not good.

I'm writing a custom radius server program at the moment, and using MT as my test tool.
Lets hope that gets sorted

killersoft

WORKS ON RASPBERRY PI 5 WITH PROXMOX V8.1.7(arm).
Now to make it run native(ish via adding in inject uefi boot platform ) on a pi-5....
.

MIKROTIK_PI_PROXMOX.jpg

killersoft

Having been a MT user for the past 10 years. I note a usually pretty active pattern of software patches/releases on a ~2 to 4 week cycles. Why does it feel like they have got to about 7.14.x / 7.15rc.. But have stalled on significant releases over the past 2-3 months.. Is there a new hardware produc...

killersoft

Yes, that is correct.
I have just one VLAN ( a management vlan I like to call it !), that both capsmans(WiFi & Wireless) on the same physical controller unit work on.

All the clients both legacy + new ax devices use that vlan to connect back on for caps management.

killersoft

I am running DUAL capsman at the moment to support dozens of legacy devices || AC || and new AX devices. So far no issues on 7.13.4 as a controller. There are some things to navigate/additions on the new wifi side of capsman world, but have now got over that hurdle. I have 1 controller a CRS317, I u...

killersoft

tested WPA3 on a cAP AC on 7.13rc2 and it works

killersoft

Hi. I have a scenario where I have a few business units who look after their own gear, and do their own thing.. [ISP]-----v4(/28)--+-v6/(/54)---(VLAN200)--[CORE ROUTER-rb5009 v7.12.1]===(VLAN205)===>VLAN SWITCH===> Other routers(MT RB5009's v7.12.1) (/56) That said, I gatekeep the core router where ...

killersoft

While we're at it. It would be nice to be able to disable Winbox Graphics Licence and Help for the RouterOS login screen. And also the note You have connected to a router. Administrative access only. If this device is not in your possession, please contact your local network administrator. Plus may...

killersoft

The rb5009 has a 10gbit sfp+ slot.
Just buy a S+RJ10 sfp which is 100M/1G/2.5G/5G module.

One you have processed your internet via the router
Drop if off to a crs switch eg
CRS310-8G+2S+IN

killersoft

If we were to wind back a bit regarding tagging/vlan and go back to documented basics Follow me here : https://wiki.mikrotik.com/wiki/Manual:Basic_VLAN_switching https://wiki.mikrotik.com/images/thumb/c/c7/Basic_vlan_switching.png/700px-Basic_vlan_switching.png What is the VLAN config DIFFERENCE, be...

killersoft

HERE IS A VIDEO SHOWING THE ISSUE https://www.youtube.com/watch?v=PLI-1Qm1Lp4 I'm not sure why the vlan appears twice in the list in your video, but the interface appearing under "tagged" should not be a problem and is correct. If it was untagged then your packets would likely have two ta...

killersoft

Depends on how you have the ports configured. If you have stuff "switching", like vlans etc then you should get full wirespeed. Else if you need to process traffic then the bottleneck is that 10Gb full duplex link to the cpu plus any load on the cpu itself.. https://i.mt.lv/cdn/product_fil...

killersoft

I think it's time you uploaded your configs mate. HERE IS A VIDEO SHOWING THE ISSUE https://www.youtube.com/watch?v=PLI-1Qm1Lp4 HERE IS THE CONTROLLER /interface wifiwave2 channel add band=5ghz-ac disabled=no frequency=5200 name=5GHZ_CHANNEL40_20_AC width=20mhz add band=2ghz-n disabled=no frequency...

killersoft

I run a CAMPUS mikrotik wifi network ~60 Radio's worth using legacy CAPsMAN. I can tell you it dynamically add's wireless access points & slave-ap's interfaces properly using VLAN's that are dynamically added to the bridge ( Yes I need to make sure that the required VLANs are on the bridge of t...

killersoft

Why do you have a VLAN interface under the Bridge? In my setup they all report as tagged into the Bridge which is what I want. Then the bridge has a trunk port to the switches to manage the VLAN so it finds it's way back to the firewall/router to be processed. I can be wrong here but if they where ...

killersoft

Just trialed 7.12rc to try and get WAVE2-Capsman-Controller ( on a RB5009 ) to properly set VLAN datapath on a cap unit ( in my case a cAP ax ) set as a cap with the manager set to capsman. I run a campus of older MT wireless and use a separate controller which is its ONLY task(not routing traffic v...

killersoft

Why in IPv6 DHCP server POOL option do I get a double static-only entry's listed:

ipv6 dhcp server pool issue.png

killersoft

I running capsman, with about 106 radio's at the moment( mix of 2.4 + 5.8 GHz, multi-channel ), in my campus environment and about to add AX gear too( yes it sux I have to add a new controller just for those too ). No problem with high density either( I'm comfortably doing ~7+ users per 10m2 of floo...

killersoft

I need to transport carrier grade ethernet(9000 byte frames) layer-2 traffic that is encrypted at layer2(macsec 802.11AE) as a backhaul using mikrotik's NV2 or NStream modes etc, not classic Wi-Fi mode(which everyone defaults to in these conversations) in a point to point bridge mode only... Current...

killersoft

*) wifiwave2 - enable changing interface MTU and L2MTU;
Now if you can only adjust the wireless MTU to 9000+ Bytes for bridging l2 networks for jumbo frame support(e.g MEF 3 carrier grade connections ) in ptp wireless setups :)

killersoft

Yes, take into account that most client devices ( phones etc ) have "crap" internal antennas( pretty deaf on the RX ) and low TX power. Understanding that, will help you choose a better setup, eg. more smaller units mixed around the area( same ssid/passwords , but different channels ) to h...

killersoft

Think I found something I will explore further :

Cambium Jumbo frame.png

killersoft

I have a requirement to extend a layter-2 metro fiber Ethernet service from a carrier provider over a few km's over some water. The traffic is macsec encrypted to a site. Its pretty simple stuff. So the wireless gear just needs to support 9000 Bytes-Jumbo frame(Ideally 9200 Bytes ). Mikrotik stops a...

killersoft

Grateful if mikrotik could look into supporting Layer-2 Jumbo frame support( 9000+ Bytes L2 MTU ) into its Wireless backhaul products. I have a requirement to pass metro ethernet over a few KM's point to point with a L2 MTU of 9000, but wireless side gear currently (NetMetal ac² with 30dBi dishes) i...

killersoft

So today I had to pull apart a LHGGM to get a sim card out. Was not happy.!1 So I made a new 3D printable model for a sim card cradle that allows you to pull it out without tape( etc ).. I have attached the .STL file if you want to 3d print one yourself ( I used a creality S1 PRO on super-quality .1...

killersoft

So today I had to pull apart a LHGGM to get a sim card out. Was not happy.!1 So I made a new 3D printable model for a sim card cradle that allows you to pull it out without tape( etc ).. I have attached the .STL file if you want to 3d print one yourself ( I used a creality S1 PRO on super-quality .1...

killersoft

LoRa device EUI cannot be set !

killersoft

Why? Genuinely curious as to why anyone would use WebFig over Winbox if they have the option to use Winbox. Winbox needs to be installed, WebFig is available using pre-installed browser. So why even bother with Winbox ? Winbox is fantastic in "Windows world", apple / linux... wine I guess...

killersoft

PPPoE is a CPU based process last I checked.Not sure how the cpu load would look, but isnt a CRS3x a better switch than 'route/network' device.. Would a RB5009 or CCRxxxx series be better to do what you want in PPPoE and QoS.. Anyhow try CPU and use packet/connection marking in mangle and then use Q...

killersoft

Hi golf0r. Use 'export' rather than 'print to show configs. e.g /export file=MyFile.rsc and from the winbox / files you will see the MyFile.rsc which you can drag onto the windows desktop and open with a text editor or use /export file=[filename] hide-sensitive command to not add in things pike pass...

killersoft

I'd be waiting for cAP XL ac, but an AX version( who knows when ). That said the cAP XL ac has about 3dB better RX ( on my personal tests just looking at noise floor in a RF quiet environment ), and its got 3db+ more tx power by default over a classic cAP ac too( adjustable of course for country rul...

killersoft

I've been there in my very early days millions of years ago!! with that vlan / interface port per bridge thing, and its WRONG, very wrong..( Yes it works, but at a big cost(readability + CPU load ) Via the bridge menu you should ONLY be, and do ALL of that inside there...!!! Then do your FIREWALLING...

killersoft

Sorry I missed something, why does a bridge need a 100 IP DHCP range? Because that's exactly where your suppose to apply the DHCP server if you add a bridge to a physical interface port( because the physical becomes a slave interface), furthermore if you add a vlan to a bridge or physical interface...

killersoft

+1 on Rextended's comments.

Your better off spinning up a CHR RoS on a virtual machine and getting a CHR license to manage the hotspot users, than using an under-spec'ed(CPU/mem) device for even 50+ simultaneous users !

killersoft

Hi.
Well, that's not good, as it would be classed as a Denial of Service issue in cyber world.

It may be best that you send this to : security@mikrotik.com

Let us know if they get back to you on it. !

https://mikrotik.com/supportsec

killersoft

Noting the expected 2024 timeframe for most manufacturers to have product(s) ready. It would be now where the R&D teams should be getting there sample/test boards ready for a ~1year turn-around to market. Of all the new bells and whistles coming with WiF7, I'm most optimistic about MU-MIMO becau...

killersoft

Just a nice to have... With WiFi 6 / ax having barely been introduced into Mikrotik harware lineup as of this general message. I read Wi-Fi 7 is not far off. Further reading I see Mikrotik's favorite supplier Qualcomm is now producing chips with Wi-Fi 7 onboard. ( IPQ9574 / PQ9554 / etc etc) Would i...

killersoft

Have you tried the official mikrotik support channel.
https://mikrotik.com/support
or via email : support@mikrotik.com

killersoft

I think ( and probably wrong !! will need to test ). Based on some playing of other things a few nights ago If you adjust the MTU of the ETH ( or adjust down the bridge ) by ~ +/- 64bytes, and take and try again, the error may go, as I dont think MTU gets corrected when you add it to bridges/vlans a...

killersoft

Thanks Network5 Thats quite handy information. Especially on CPU load. I wonder if one/two of the cores was dedicated to that task thus the ~50%'ish cpu-load !! ? Not bad I guess for a unit that's only got a CPU and no dedicated switch chip. At least there is head room for other activities on the ro...

killersoft

The CRS310 is a L2 switch with Layer3 routing capability. You have the right product, but I'm not sure if you understand how to program the interface ports to do it via Router OS. There are plenty of guides e.g :https://wiki.mikrotik.com/wiki/Manual:CRS_Router#CRS3xx_series_switches In the simplest ...

killersoft

Happy to report MACSEC on v7.6 beta 10 on CHR is now working and passing IP....
Excellent work...

Just make sure you use the same CAK / CKN on both ends and happy times ahead..
Now for VLAN's over MACSEC.... hmmm

killersoft

Happy to report MACSEC on v7.6 beta 10 on CHR is now working and passing IP....
Excellent work...

Now for VLAN's over MACSEC ...

killersoft

Hi. Just FYI, when you do a export use : export hide-sensitive so that passwords etc are not shown.. Looking over your config further shows me that you are doing a LOT of CPU intensive work. As for switch chip native & vlan traffic, it looks like all your processing needs are CPU based not switc...

killersoft

yes, the picture shows everything

Well based on the winbox shot.. Yep CPU limiting issue !

killersoft

Without console config files( export ), its hard to see how you have configured devices correctly. Especially the hex S which is not designed for massive loads. That said, if your are offloading to the SWITCH CHIP of each device and NOT the CPU as you have by the looks of your winbox screen shot, yo...

killersoft

A brand new cisco router out of the box has no password either.

killersoft

In regards to the 'Cloud' solution.
Not everything I have in now >100 devices touches the public internet.
I would prefer a solution I can spin up on a Virtual Machine in a closed environment.

I understand that other people could benefit from a cloud controller, but not in my current use case.

killersoft

Noted, will take a look soon.

If you need wirespeed macsec, I suggest getting yourselves a couple of second hand Cisco 3850's with an appropriate NIM module each.( config e.g https://community.cisco.com/t5/network- ... -p/3368918 )

killersoft

Where are we at with MACSEC ????

killersoft

Its a great idea. I manage approximately 97 mikrotik devices from my desk. Of which I have about 12 different models of MT hardware incl a couple of VM's Dude only gets me so far with f/w updates with the hardware side. Ideally I want a platform that : 1. Keeps an eye on configs across all devices a...

killersoft

Yep, seems pretty normal for generic sfp's to randomly work between MT chassis. I have about 50 MT devices in my care all using fiber trunks. Generally speaking I use either genuine mikrotik SFP's, or Cisco Genuine( which seem to work fine ) in my MT gear. I also keep an eye on : https://wiki.mikrot...

killersoft

Hi Mikrotik Next time your dev'ing up some hardware, can you look at the possibility of adding in a 'feature' as seen in some Cisco gear known as Dying Gasp. It would be nice for the last function of a router/switch who has remote syslog to receive a message with. I'm done, all power has been lost I...

killersoft

I have not seen Mikrotik do anything in this area.!!! The MACSEC option has been there in the console since the very first v7 RC public release back in 2019. Its 2022 and NOTHING, yet > interface/macsec is there hidden in place sight of the console terminal... bump... I've Tried to configure it on l...

killersoft

Wireless Tables -> Access list is your friend... Kick low signal clients( from the perspective of the AP ) using it. E.g /interface wireless access-list add allow-signal-out-of-range=30s interface=wlan1 signal-range= -86..120 add allow-signal-out-of-range=1s authentication=no forwarding=no interface...

killersoft

Log into it 1st up via WIFI ( The default state from opening the box is the unit has WiFi AP enabled )
Then remove the default config, via MAC/WINBOX.

killersoft

I have nearly every CRS3xx box in my network, but CRS312 is not one of them(yet!), but have not come across such issue. Could you list your config. And double check your error counters on your connected ports/sfp's to see if drops match against heat load( may be a sfp issue if you use them ? ) Other...

killersoft

These units are not really different conceptually to a Layer-3 switch from Cisco e.g Catalyst 3560G( one sitting on my desk atm ! ). I have 1xCRS326-24S+2Q+RM in my network, but its primary role is wire-speed switching, and the only offloaded cpu task I hand to it is the management vlan network. Pro...

killersoft

Hi. I'd recommend you doing some basic online network courses 1st up to get basic network understanding. You don't do port-forwarding unless your running a local server people connect to. Don't confuse connecting to an external server's Port requirements to having your own server, they network flow ...

killersoft

Can you fix your front web page newsletter date. Its set to 2021 !
Cheers

killersoft

MT Boards with chips like IPQ40xx chipsets are USB3 compatible, just need to check they have a minipcie interface and away you go.. e.g : https://www.qualcomm.com/products/ipq4019 MT boards like : AP ac(RBwAPGR-5HacD2HnD) are what your looking for :) Remember to look at the chipset datasheets to see...

killersoft

No console port by the looks ( Should have gone the CRS ! ), and thats a classic lock out
I suspect a factory reset is your only way forward

killersoft

For sure.
I'v run out of ports (>24 ports in use ) on a couple of areas with sfp / sfp+.
Would love a 36/48 port sfp+.

Maybe even if it was modular and dual hot swapable power supplies.

If it native 802.11AE/ Macsec working for trunks I'd love that too !

killersoft

Old time hardware favorite bandwidth shaper.

shaper.png

killersoft

Then why not a wAP ac
https://mikrotik.com/product/wap_ac
That's got 2x 1gbit interfaces and later gen ipq-4018 cpu and wifi-5 ac1200.

And its ceiling or wall mountable

killersoft

Netinstall can suck, and can be the actual PC's/Laptop network interface causing trouble in getting netinstall to work.
I'v found (sadly) sometimes I have been forced to use a usb to ethernet adaptorto get netinstall to work, after trying a dozen times on a specific pc or laptop.

killersoft

Why not use a cAP XL ac

From my bench testing of these, its about 3 dB higher RX( based on noise level testing against a cAP ac) , and they have also bumped the TX power by +3dB too.
Should be no problem for +100Mbps throughput @ 5GHz at reasonable line of sight distances.

killersoft

Indeed band 66 is not part of the physical hardware you have installed in your LHG LTE6 and cannot be 'software fixed' Your best bet if you want to use that band is to remove the LTE card inside your LHG and replace it out with a suitable card that supports band 66. Something like a Quectel EP06-A w...

killersoft

You need to add the LoRa package from the Mikrotik ->Downloads->"Extra Packages", extract out the LoRa package and drag it into winbox, the same as you would to upgrade the router with the main software update. So I would update to the latest long-term or stable(depending on your risk asse...

killersoft

I do!

http://cssmaps.killersoft.net/ep06e/
There for a short time only..

killersoft

If anyone needs the EP06-E firmware upgrade(EP06ELAR03A08M4G.zip) and is not getting a response from Quectel support. I have a copy of it after much pain in getting it from Quectel. The upgrade process was a relative painless operation of the firmware upgrade using the Quectel v4.19 flash tool and h...

killersoft

7.1 Installed(updated) ok on x86(test) and on RBcAPGi-5acD2nD.

MACSec/802.11AE still not working....

killersoft

Please Mikrotik, can you add some comments on where MACSEC is currently at.. Now trying with 7.1rc7 using x86... All I see is ether-type traffic 888e on the interface I configured it on between 2x VM's. I can add an IP against the 'macsec1' interface using the command line( not winbox ) too,. mikrot...

killersoft

Hi, I was wondering if Mikrotik would introduce physical USB license dongles. Use case I have is in an x86 virtualization scenario, where NO internet connections is unavailable(eg CHR). Notably the deletion/modification or moving an x86 VM would require a newly generated x86 license code. Passing th...

killersoft

Can you show us the CPU usage of both A. Your LAPTOP/PC and B. Your Router.

Speed Test dies when cpu on a PC/Laptop hits 100% !

killersoft

Why would mikrotik, make a niche product for that band plan by FCC. Niche? 6 GHz is used for 802.11ax world wide (https://en.wikipedia.org/wiki/IEEE_802.11ax-2021). Within Q3/Q4 2021, vendors start selling their enterprise access points. Consumer routers with triple radios (2.4GHz, 5 GHz, 6GHZ) and...

killersoft

Wifi 6 when? I am starting to wonder if Wi-Fi 6 or Wi-Fi 6e is even on the road map. Over a year ago , the FCC opened up the 6 GHz band (5.925–7.125 GHz) and made it available for unlicensed use. More than a year later and total lack of any official Mikrotik information, I can only assume there are...

killersoft

Has 802.11AE / MACSEC been fixed yet ?

killersoft

Bump..
Any news on this front Mikrotik I have tried with 7.1beta4 and still cannot get MACSEC up???

killersoft

I heard 2 things to try. 1. is to bulk up your sim card with some tape at the back of it to ensure its pushing up against the pins, as apparently some sim's are thinner than the specification 2. There is a beta v027(as of Jan2021) that mikrotik can send you. They will also ask you to put the current...

killersoft

I did not think about the SIM card, as an issue, but yes that could cause random issues. That said, if it was working well before you upgraded, it might not be sim card issue.

killersoft

Well your radius service needs to be made routable to your mikrotik-router, or put pfsense on your local LAN segment.

killersoft

Well, yes, you can overdrive a RF front end pretty easily. I'm a ham radio operator too, and have experienced that for myself on RF equipment. You can also simulate that with an Access point and a client sitting on top of one-another, notable throughput can drop a bit, as opposed to being ~1meter aw...

killersoft

To use your pfsense/ freeradius as a login for mikrotik. Use winbox : RADIUS -> check the login button & add in the IP address of your pfsense box & add in your pfsense/freeradius login password. On System->UserList, click the AAA, and check the "use Radius" Thats it. RADIUS HOW TO...

killersoft

Just add the phone number to mikrotiks userman as both username/password. And set the account for a 30min timeout. Or use radius, same deal username/password as the phone number. You could add a virtual AP and just have your mate login to the VAP with a WPA2 with just a phone number as the WPA2 pass...

killersoft

Hi, Yes, you should not have issues with that antenna, or those signal levels.( maybe you have too much signal LOL(wrap some aluminum around the external antennas to drop it back ! ) I note your probably doing Carrier Aggregation on B1 + B20. I wonder if you force the modem to only do band 1 OR 20, ...

killersoft

EoIP is basically a Layer2 link.
You can add your VLANs or other tunnels inside your EoIP interface..( not sure why you would tunnel in a tunnel as your MTU on you inner tunnel is going to small, plus your CPU load will be high running it like that )

killersoft

FEC is common on networks such as satellite comm's. That said, it will be CPU intensive, especially over EoIP. Noting that TCP knows when frames have not been received and windowing of the frame. I would image that using a smaller TCP window size is the better option. As for UDP( Voip / Gaming packe...

killersoft

Hi, have you installed the external antenna's for the unit, also what is your signal strength indicators RSRP/RSRQ/SINR etc ? Also what if your providers frequency's/band's V.S what LTE/4G towers(and there associated frequencies/band) are nearby. https://www.youtube.com/watch?v=ysiSoglchg0 I install...

killersoft

The answer is YES for your trunk.( and yes its compatible too with Cisco trunks too(and other vendors), not just MT->MT ) There are at least 2 ways of achiving it and depending on your mikrotik's hardware(e.g Rb vs CRS) there are a couple of different ways to configure it to do the same thing( One b...

killersoft

Your rb951g-2hnd does not have a 5GHz WiFi chip/radio in it.

killersoft

When are we likely to hear about 802.11ax products. ?? E.G "cAP ax" :)
Running a significant Mikrotik Wi-Fi network here(50+ AP's(yes with AC)), and now seeing plenty of people with .11AX phones, laptops now onsite..
Just bolt a IPQ8074 into one of your boards MT :)

killersoft

Actually mikrotik does DPI (https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/L7). And no, it cannot break SSL etc, nor do I care whats inside normal day to day end user traffic as long as the end machine its not breaking my or SNIFFING around my NETWORK, and if it IS, then I want to detect those LA...

killersoft

Hi. Would it be plausible to 'integrate' an IDS / IPS " package " into RouterOS 7 ? I know it would be both CPU & storage-wise expensive. That said, I propose it as a package, and aimed at x86 / CHR (virtualized) & up-scaled Mikrotik Hardware. I know you can of course stream IP tra...

killersoft

Just tried to use 3.27 on a RB2011(current long term). I cannot add data to the firewall -> NAT, each line goes blank when I highlight it..
I need to revert to an older version now.

killersoft

I still cannot get MACSEC running between devices("Gets to negotiating only"). Any suggestions ? /interface macsec add cak=4cb39ed149d0e0dbea5fad4b91e5456f ckn=f98446584e49ad9e2cd99b2aff00adb73e0b4109eb916b8d5bbe208dda274abb \ disabled=no interface=ether5 name=macsec1 profile=default [admi...

killersoft

Nice to have next-gen products!!
.AX & WPA3 support.
Maybe 3x3 mimo plus..
Potentially other limited band support of wifi( 60ghz , 24Ghz ?)

killersoft

Take a look at LtAP-mini or LtAP ,with your choice of MT-LTE card, you just need 2x~5 to10cm u.fl -> SMA patch leads & a drill. Job done, then you can put your external antenna. Else there are plenty of other offerings like a routerboard and again install your LTE card onto and do your own custo...

killersoft

Having managed a few massive satellite ground stations in my time, 2 things usually happen. 1 is the lightning rods on the top of the satellite dish which is directly cabled to ground safely takes the hit. Lightning arresters installed after waveguide->LNA/LNBs->Coax go open circuit(blow the fuse), ...

killersoft

Why not SSH to the unit (better than web based config)?
You could go back to RouterOS(The switch menu is there, if you need pure wire-speed config ) and use Winbox or SSH for secure logging in.
RouterOS supports HTTPS too.
https://wiki.mikrotik.com/wiki/Manual:W ... ling_HTTPS

killersoft

Why CCR (Whats your bandwidth your forwarding/inputting )? Most RB's will do fine.
Try a RB4011, good bang for buck, or just run a x86 VM of RouterOS.

killersoft

I think in your case, you will need a second LTE/4G card to achieve what you want to do with sim1 being for LAN and sim2 being for wifi services. Pretty stright forward MT route config. That said, I think you will then need to do some homework on antennas for a dual card setup. Not sure if it helps ...

killersoft

Arr my mistake
2 ltap questions with similar usernames !!

killersoft

Please see my response to your earlier post.
viewtopic.php?f=13&t=164306

killersoft

EC25-xx(whatever) has a USB2 minipcie interface and will work in the LtAP with out hardware issue as LtAP's chipet is USB2/MiniPCIe cpu based board. EP06-xx IS USB 3.0 interfaced card on the hardware interface and will require you to tape/glue or cut pins on the card to get it to work in USB 2 mode(...

killersoft

How did it show you that it was using CA? I'm not seeing that. But maybe it's different with a Mikrotik modem. RBwAPGR-5HacD2HnD WITH A R11e-LTE6 card (Card firmware version R11e-LTE6_V025).. See how winbox shows Primary Band & CA Band.. Sometimes its different bands like B3/B7 or vise versa !!...

killersoft

Hi, just wondering if there is any formal documentation for Mikrotik's 802.1AE (AKA MACsec) in RoS v7. Given its been in RoS v7 at least since its early beta release I was hoping to see some doco on it by now. As of yet I have not got it working between devices( Get as far as it 'negotiating', and c...

killersoft

Interesting installation on a SXT.
Band 28 is hard to get right given the physically large antenna required to have a good efficiency(Q rating) for a given antenna.
I'm sending some gear up to rural NSW tomorrow for a B28 job, the other guy is a ham radio operator and is making his own B28 antenna.

killersoft

I answered my own question. This is definitely a whole lot easier with RouterOS 7 beta. It's just plug and play. So that's what I'm using. WinBox doesn't seem to have any indication that the modem is using carrier aggregation, but based on the output of AT+QCAINFO ("Query Carrier Aggregation P...

killersoft

Hi, just throwing this one out there since we know MT's are flexible in their architecture & designs. I was staring at my cAP AC mounted in the ceiling of my house, and was thinking wouldn't it be great if the unit had plug-inable sensors like : "Smoke detector", "Particulate dete...

killersoft

Thanks for the advice on that. Just about to buy Vmware essentials plus kit v7.0.. The problem is neither the physical switch nor the routerOS license level. It's in ESX. Link aggregation is only supported on distributed switches. These are only available from vSphere enterprise license level upward...

killersoft

I'm looking to do the same thing very soon, so a tested config( & esxi notes appreciated )

killersoft

Depends on your config about whats wrong with why you cannot see other devices If you don't want to use capsman then just create a bridge, add all your LAN side ports & WLAN ports onto the bridge interface. Give your bridge an private IP address of your liking ( 192.168.1.1/24 ) Add your normal ...

killersoft

Impossible to update in Hap Lite.
smips.JPG

hAP update seems ok to me.

killersoft

Client can connect to far end(srv side) internet if IPSEC is disabled If IPSEC = enabled ( client box cant get past client-side MT ) & notably the srcnat rule doesn't get a hit from the client. No problems under 6.45.9 !! Can you post both Mikrotik configurations (see anonymisation hints in my ...

killersoft

Can confirm in 6.47 there is an issue with l2tp/ipsec vpn, where the server + client device is also a mikrotik, and the client runs a NAT. The client side NAT rule doesnt even get a hit when IPSEC is enabled(both ends). If I turn it off(both ends) and just run l2tp, all is good and the src-nat rule ...

killersoft

1. At least cat 6 2. Australia is currently using these LTE bands: 2100MHz (B1) 1800MHz (B3) 850MHz (B5) 2600MHz (B7) 900MHz (B8) 700MHz (B28) ** works well in long distance in Aus environment *** 2300MHz (B40) 3. 2G was discontinuted a couple of years ago in country. 3G will start being removed in ...

killersoft

Please keep this topic related to the problems found in this RouterOS release. This topic is not made for feature requests. For that please create a new topic or contact support@mikrotik.com. Where is CAKE?!?!?!? Literally everyone expects it, yet there's nothing about it from mikrotik.. Kind of pa...

killersoft

LtAP mini VS v7.0beta 8 Well the wifi via a station & station bridge mode does not work. It connects briefly(10 seconds), then drops( no its not a signal, issue, 6.47 works a treat on the same unit)). I have a Quectel EC25 LTE board in it. That works no problem ! Doing a WiFi SCAN produces rando...

killersoft

As a rule dont try and do VLAN 1 as a management vlan or as a separate vlan, you will come unstuck with vendors and some Linux kernel versions. In Cisco world vlan 1 is the Native vlan e.g the default layer 2 traffic on an unconfigured switch . Googling 'vlan 1' or 'native vlan' has so many varied r...

killersoft

Hi. Attached is a screen shot of what RouterOS shows for 2xQSFP's in a CRS326-24S+2Q+

CRS326-24S+2Q+.png

killersoft

Need more than 4x 40Gb ports then check Cisco 9500 series out..
https://www.cisco.com/c/en/us/products ... index.html

killersoft

There are a few ways to do a Management-VLAN for MT devices, and you could just add a VLAN against your trunk interface(not a great recommendation, but will get you out of a tough spot ). OR do it the better way for MT/RouterOS https://wiki.mikrotik.com/wiki/Manual:Basic_VLAN_switching The info belo...

killersoft

Hi. I am testing out MACSec(beta 3) on a RB951G-2HnD & RB750G, but cannot seem to get the two mikrotik units past "negotiating". I'm using the same cak and ckn values between the units, and the ethernets are of course connected together. I'm using the same code(different interface name...

killersoft

Please add IEEE 802.1AE AKA MACSEC to Router & SwitchOS.

killersoft

Thanks mkx for the eNB ID info. @RogerWilco Consider a EC25-AU as it is electrically more compatible(+RCM compliant) with most MT boards (usb 2) plus it also fully support all the AUS bands(like B28). See(about taping pins): https://wiki.mikrotik.com/wiki/Cellular_Quectel_modems_01 That said, I susp...

killersoft

This is quite subjective, also to note is that the EP06-E is running on the default antenna's on my w AP R ac unit. Also I am currently back in Victoria. I suspect that the B28 tower is at a different location to the other tower doing band 3&7!? So B3 / B7 /B28 .. BAND 3.png BAND 7.png BAND 28.p...

killersoft

Just curious, what Linux version will/is ROS v7 be running under the hood ?
(Noting v6 is running v3.3.5)

killersoft

Nice mate! Finding a modem that works with LTE and not PPP with B28 + Telstra is perfect. I don't suppose you could tell me where in Australia you got the card and what firmware is on it? What speeds you getting with the modem? Hi. I picked up the EP06-E from ebay : https://www.ebay.com.au/itm/1838...

killersoft

Take a look at : viewtopic.php?f=3&t=150368

killersoft

Well happy to report that a Quectel LTE EP06-E(RCM compliant) installed in a wAP ac(RBwAPGR-5HacD2HnD) tested using ROS 6.45.1 works without the need to cut or tape pins on the card. (I am testing with ALDI mobile(mdata.net.au APN, which uses Telstra Towers here in Australia ). I used this to get to...

killersoft

I have an ec25-AU. It took me about 15 minutes of buggering around to get it to LTE mode from the default PPP mode ( In the end I actually put it in my latop, installed (windows drivers for it), Connected to the COM port, Putty'ed into the com port and put in the command(as seen on the MT wiki ). Pl...

killersoft

I am running a EC25-AU in a LtAP, its currently running outback Australia. Its with 2x 3dBi Antennas and is working a treat on 3G( getting ~-81dBm). 4G lte b28 700MHz also works well, but getting a better signal off 3G 850Mhz at the moment and due to my extreme tower edge location. My phones I have ...

killersoft

Hi. I have the same issue. I'm trying to look into it to see if it can be changed to some sort of bridge mode, rather than the NAT style address its giving out. !

killersoft

Having recently obtained a couple of MT RB4011iGS+RM's for install in a rack. I have to say what a poor rack ear attachment design for this router. The router is a nice robust bit of kit, but the rack ear attachment is terrible. Just 1 small screw on either ear to hold this unit is place is just cra...

killersoft

Hi. I have a bit of a general MT wireless question. I have run MT gear for a long time(10 Years now!) and have seen this wireless link phenomenon notably in my long distance links(7KM's+), but never understood why this occurs. This is notable when I am passing little to no traffic. If I have hard se...

killersoft

Maybe its time for MT to consider a parallel "community" like edition version of RouterOS. That open to view /compile "source code" and allows the community to quickly fix issues(CVE's !!!) and add networking functionality as community made plugin's for MT Hardware..

killersoft

At some point enough, is enough. And yes, other vendors have other issues. Other vendors may also be more costly. But at least other vendors take responsibility for their products, have a clear guideline what a timely response to a ticket is and implement critical features, that customers and the i...

killersoft

While many of you are notably upset about the extraordinary amount of time that has gone by on this issue. I note some of you are wanting to move to new product vendors. This is your prerogative to do so. That said, I will point out the BIG VENDORS such as CISCO are smashed by CVE's problems ALL the...

killersoft

True for that particular situation. But not all installs are secure buildings. 30dBi Antenna's such as the https://mikrotik.com/product/MTAD-5G-30D3-PA can become big wind sails and stress mounting gear that was not obvious when install occurs on a nice day. Also managing sites remotely e.g those th...

killersoft

Hi. I was thinking about how useful a vibration sensor would be for a fair chunk of mikrotik outdoor products. Over my many years of wireless installs, wind is usually an enemy for wireless antenna/integrated WiFi products where the guy wires or structures that mount those systems is not quite up to...

killersoft

Sorry, I don't agree with you R1CH for my typical mikrotik configurations across my campus network. If this was a typical cisco switch(ASIC switching) I would agree, or if I was using mikrotik switch chip directly. I can use Torch on the bridge and or each interface and see traffic 'Forwarding' or '...

killersoft

Thanks dadaniel.
I'll take a look at AP isolation.
As I am not using the switch chip for my ether->vlan activities rather ether->bridge->vlan. Thats why I am looking at bridge firewall rules at this point.

Cheers

killersoft

Hi. I'm running a small campus with about 40 wifi/ether ports devices(Distribution network) for guests that run behind a MT hotspot/firewall. I run a pretty good firewall set on the main router/internet/hotspot box. I'm putting some thought on the internal LAN side of the network and asking the ques...

killersoft

Hmm.
Just noticed that too. The CHR shows up in other MT devices, but winbox does not..
Weird..

killersoft

The crosstalk is cos(angle) related so at 90 degrees there is "theoretically zero" crosstalk (in practice those 20-30dB figures) but at any other angle there is substantial crosstalk. At 60 degrees about half of the signal is present. I suspect that is a correct assumption. If you were tr...

killersoft

3x3 MIMO is for local use, where you have an access point in a room or outdoor area and antennas that can radiate in 3 different patterns. The different clients can each have different use of these patterns. With point-to-point, 3x3 makes no sense. There are no 3 different polarization that you can...

killersoft

Well. Buy it and try and come back here to tell how it works. I suspect that the throughput will be better with central chain off. But maybe it will be so good that three chain could work independently. We cannot judge before the tryout. Its tempting, but I already use a 28dBi + a 30dBi for my 7km ...

killersoft

I hear you, that said, the isolation issue @ 45 degrees must be enough otherwise you would not design such a radio device with 3 chains. The item below is a 17dBi, which they say is better than 26dBi. I think that's pretty good gap as most 2x2 big 30dBi parabolic's have approximately 30-35dBi cross ...

killersoft

Just wondering if someone can tell me why there are no 3x3 MIMO antennas on the market much greater than 20dBi ? I have a couple of RB921UAGS-5SHPacD-NM(triple chain capable) doing about 8KM's point to point, but limited to 2x2 due to antenna limitations(cant find a commercial 28 to 30dBi antenna wi...

killersoft

Thanks Cha0s. I suspect I have 50+ units to manually fix-up when I go to upgrade in regards to IP Neighbor Discovery

killersoft

IP Neighbor Please revert or Alter the NEW functionality of Neighbor discovery. I use specific Bridges/Interfaces ( A management VLAN segment) that see's all devices, but I also have Client Side Bridges/Vlans/Interfaces. I DO NOT want Clients to SEE Discovery Broadcasts. Thus I ask you to Revert to ...

killersoft

Hi. Is there a method to manually initiate a mikrotik device to boot into netinstall mode upon reboot(I still have access to winbox) where I do not require holding down the reset button as the devices are either in other buildings(etc) ? I have found a repeatable bug with a bunch of MT devices(LTE/F...

killersoft

I think there is too.. I'm having a DHCP issues.
I had a power outage on my DYNADISH(doing local DHCP to eth->VLAN) and now with dhcp 'offering' but devices are not accepting..
It was all working before the power outage... Config has not changed..

killersoft

Use current bugfix 6.37.5, or do a full cutover on your second-end routerboard to 6.38.5 This is probably the indirect cause : What's new in 6.38 (2016-Dec-30 11:33): Important note!!! RouterOS v6.38 contains STP/RSTP changes which makes bridges compatible with IEEE 802.1Q-2014 by sending and proces...

killersoft

Hi. I have been running a MT hotspot for work for a number of years(CLASSIC IPv4).. Our ISP has native IPv6 available..(I have tested it on the network, and noted the routeros hotspot service does not touch IPv6 packets, thus client machines can bypass the hotsport service e.g http://ipv6.google.com...

killersoft

Thanks Normis.
Look forward to the detailed response..
Cheers

killersoft

Just a request for RouterOS to add MACSec 802.1AE
To its existing suite..
Regards
Greg

killersoft

Thanks for the information.

killersoft

Hi all. I have a setup, where a MT wireless router is configured without issue on a NON-INTERNET connected network. However, I note from my SYSLOG server that the router reports to that it appears the router in question attempts to automatically DNS request(every 1/2 hr) cloud.mikrotik.com.. WHY is ...

Search found 298 matches