MikroTik

lorsungcu

1. try to use n/ac instead of a/n/ac
2. use local forwarding

Why do you suggest local forwarding? Where can it be seen that this is creating a bottleneck?

lorsungcu

Hello; I've built some mangling/queues and would like someone else's opinion on whether what I'm doing makes sense. The goal is to de-prioritize large downloads and ensure voice traffic has the highest priority. Issue I'm seeing is that it seems no matter what I do, I end up dropping packets on the ...

lorsungcu

Hello I have two ISPs, both static. I have GRE/IPSec tunnels I'd like to have up on both circuits simultaneously. I think I'm having trouble in properly mangling traffic in the output chain. See configs below: /ip firewall mangle add action=mark-connection chain=input connection-mark=no-mark in-inte...

lorsungcu

I would really like the ability to be able to choose where addresses are stored, so I can sync addresses between machines. Also, whoever asked for a download/upload button is right on. Short of releasing a native version for *nix, this would be the next best thing. Currently really breaks usability ...

lorsungcu

Is this seriously still an issue? Is there an official word from Mikrotik?

lorsungcu

Anyone using GNS3 able to shed some light on whether the ability to emulate switch chips is possible, and if so, how? I'm using QEMU, but am open to whatever.

lorsungcu

Any word on a timeline for ros7? This is needed so badly.

lorsungcu

Sorry if this has been asked before, but I am wondering if it's possible to have both a dynamic IPSec peer config, and still have site to site peers. It seems like with this configured, the sites get disconnected every so often; no issues with out the dynamic peer. Dynamic peer is even configured to...

lorsungcu

This is still an issue. When will a resolution be released?

lorsungcu

Yep. Think that should do it.

lorsungcu

Place the WAN address you want for the phones on a bridge or switch that contains a) the port that the ISP is coming in on b) the logical "WAN" port for your voice network and c) the logical "WAN" port for your data network. Only assign the address(es) you want to use on the mikr...

lorsungcu

Google thinks it's the router screwing things up. I am sure it isn't, but I guess it's just not possible. Any idea if RouterOS will support any of the GSS-API stuff?

lorsungcu

Last bump before I give up. Anyone have any ideas?

lorsungcu

Anyone? Mikrotik?

lorsungcu

This might be relevant:

http://forum.mikrotik.com/viewtopic.php?f=3&t=22257

There are also some integrations with things like fail2ban that i've seen that would get you going in the right direction.

http://forum.mikrotik.com/viewtopic.php?f=9&t=54446

lorsungcu

Hello I'm trying to set up some android devices with always-on IPSec VPNs, using IPSec with x-auth/psk. I can connect fine with the devices normally, but when i turn them to 'always on', I get this error in the logs: oct/08 20:12:17 ipsec,debug ipsec =>: rejected authmethod: DB(prop#1:trns#1):Peer(p...

lorsungcu

lorsungcu

Yes, have tried that with only gibberish on the display; it also turns the backlight off entirely when any changes to contrast are made.

lorsungcu

Hmm, doesn't seem to work for me, and the only drivers I see are for the 633. I get garbled stuff all over, but nothing readable.

lorsungcu

Any chance this model will be supported via USB?

lorsungcu

All the offices have cable or DSL connections, nothing fancy, unfortunately.

I'll look at open VPN, although my understanding is that they dropped support for it, and IPSec seems to be getting better with each release. Has that changed?

lorsungcu

Hello I have ~15 remote locations with subnets similar to the following: Location A: 10.0.0.0/29 10.0.1.0/29 192.168.0.0/25 192.168.0.128/25 Location n: 10.0.0.8/29 10.0.1.8/29 192.168.1.0/25 192.168.1.128/25 All locations would be connecting back to location A. Currently we're bridging a single sub...

lorsungcu

Its true that bugs can be frustrating, but you said something that I want to comment on. I owe almost all of my routing and network knowledge to messing with these routers Having used a large array of vendor's products, I can promise you that bugs are just as common everywhere else. The fact of the...

lorsungcu

Writing this hoping for a response from Mikrotik. I use a ton of Routerboard stuff. Deploy routers with every install, use your wireless stuff when necessary, etc. Every chance I get. I think that will stop, though. At the moment, there is literally no stable version of the software. Sure, there are...

lorsungcu

Yeah everything died overnight. Router locked up, no response, no telnet, nothing. Had to rebot, downgraded to 5.26. BCP simply does not work in 6.x, but IPSec/L2TP in 5.x is inherently broken. These are both bugs acknowledged by Mikrotik, but with no solution.

lorsungcu

Anyone have any ideas? Have a ticket into Mikrotik, but I'm watching my DHCP leases get closer and closer to renewal, knowing they'll not work out. I need to get this resolved or downgrade to 5.26.

lorsungcu

I think MPLS with TE will do this well; I've been meaning to build a lab for it, this would be a good excuse. I will try this weekend; in the mean time, you may want to check the wiki for information.

lorsungcu

Yeah that sounds like what I'm seeing, although I'm using L2TP. I need 6.x for IPSec but it breaks all kinds of other stuff. This is maddening.

lorsungcu

Found more issues with DHCP in BCP bridging in 6.12. Going to open a ticket but dont expect a fast enough response to matter. I dont see anything in the changelogs between 5.26 and 6.12 that would cause DHCP to break as it has, can someone from mikrotik confirm if anything is different?

lorsungcu

Upgraded a router to 6.12 to fix IPSEC issues, finding that DHCP over BCP doesn't work consistently. Anyone else have these issues? I am utterly sick of dealing with side effects of new firmware. I need the advertised features to work between versions; is that seriously too much to ask?

lorsungcu

dg8ngn - can you go into more detail about what is broken with BCP in 6.13? I need to upgrade (apparently L2TP is broken in 6.12, which is half the reason I upgraded...), but rely pretty heavily on BCP.

lorsungcu

Issue: IPSEC will not connect from 6.12 to 5.26 ROS Description: Using 6.12 on a router and 5.26 on another, unable to initiate a tunnel. Tested on two different devices. Works fine if downgraded to 5.26, or 6.9. Versions affected: 6.12 How to reproduce: Build functioning IPSec/L2TP tunnels in 5.26 ...

lorsungcu

This would be very, very nice.

lorsungcu

I have multiple sites connected back to a datacenter using L2TP and IPSec. This was working fine when using 5.26 on all routers. Upgraded a testing device to 6.12 and it will not connect, regardless of how each side is configured. Below is the configuration at the remote site: /ip ipsec proposal set...

lorsungcu

Yes, VLAN from RADIUS auth would be very very nice.

lorsungcu

6.12 completely broke my ipsec/l2tp tunnels. Not sure what the problem is at this point, but i'll be moving back to 6.11 until i figure it out..

lorsungcu

Not sure if this is actually an issue, but thought I should put it out here in case anyone else is seeing something similar. Customer has a Comcast modem with 5 static IPs; pinging them I get a response, and see the traffic while torching, but I do not see the traffic increment the ICMP rule in the ...

lorsungcu

I think I got it. Thanks.

lorsungcu

Yes. It has no bearing on this.

lorsungcu

Yes, connectivity works fine form all networks out, it's just routing between the 192.x.x.x and 10.x.x.x.

lorsungcu

I can ping devices to/from the 10.x networks, but while on the 192.168.10.0, I can't reach anything on the other subnets. Any ideas? Below is some configuration, please let me know if there's anything else you need:

Thanks
Cullen

Thanks; resolved.

lorsungcu

What interfaces are a part of the bridge? Add the master interfaces for the switches, and try again.

lorsungcu

I've heard from Mikrotik this release should fix the NAT issues with L2TP. This may be what you're seeing, if you have workarounds in place for it.

lorsungcu

I have had trouble with the versions of routerOS that support xauth. Not completely clear on how that would resolve the question of using a single set of keys with many remote, dynamic-ip'ed sites, though, can you clarify?

lorsungcu

That is what I thought. I was hoping to be able to just distribute a single key to a bunch of remote users, but dont think thats possible. Is there a way to do something like that with certificates? I will look more into that as well.

lorsungcu

Right, but it doesn't seem like this could work for dynamic peers. is that correct?

lorsungcu

Continue to hit this issue. Mikrotik, can you please respond with an answer as to how the problem should be properly solved?

lorsungcu

yeah, you're right. How would the third router work, then? Anyone willing to post their configuration?

Thanks again.

lorsungcu

Changing to PSK, and everything came right up. I must be screwing the key configuration up... Steps to set up IPSEC with RSA: Generate key on Router01 (r1_key) Export public key (r1_key.pub) Set Router01 IPSEC peer key=r1_key remote-key=r1_key.pub Generate key on Router02 (r2_key) Import Router01 pu...

lorsungcu

Removing the IPSEC policy restores L2TP service. One thing I noticed was that a remote peer on the client side (2.2.2.2) gets configured for an the gateway address at my ISP. Below is an example: /ip ipsec remote-peers> print 0 local-address=2.2.2.2 remote-address=1.1.1.1 state=message-3-sent side=i...

lorsungcu

IPs are set up just as they are anywhere else, and I have a NAT rule to force them out the correct address. I'm going to review/rebuild everything again today, I'm sure I missed something somewhere.

lorsungcu

Is it possible to use the same key with multiple remote peers? If I have 10 connections I need to make, for instance, can I just distribute the router1 public key? Below is my current config; I am unable to get L2TP connected with this configuration. Router 01: /ip ipsec proposal set [ find default=...

lorsungcu

Thanks, I have a good grip on how VPN works. Neither of the links covered what I asked for clarification on. I have no issue getting it working with PSK. I am looking for info on getting RSA key auth working for IPSEC between two routerboards.

lorsungcu

I am looking for a good working example of site to site VPN using IPSEC/L2TP, using RSA keys for IPSEC authentication. I've looked through the wiki and manuals, and can't find anything complete, or that actually seems to work. Both sides of the VPN are routerboards. I'll post what i've got as far as...

lorsungcu

Anyone from Mikrotik able to tell me whether IKEv2 is supported, which version supports it, and if not, will it be supported, and when? Can't find a solid answer to this.

Thanks!

lorsungcu

lorsungcu

Something has seriously got to be done about how these are released. I killed a brand new 2011 upgrading it before a new installation this week. Please, please stop releasing features until what exists now works 100%. It's killing my faith in the stuff, and I'm starting to have fond memories of Cisco.

lorsungcu

I am trying to regex match a string like this: video11.ord01.justin.tv The digits can increment, "video" can be 'video' or 'media', and "ord" can be a number of things. Here's the regex I've come up with: ^.*(get|GET)\s+((video|media)\d+\.)((ams|fra|lhr|arn|iad|mia|jfk|ord|dfw|la...

lorsungcu

Got a reply from Mikrotik. It is indeed a bug, and they said it "will be fixed in the future", which i'd guess is code for never.

lorsungcu

Yeah I spent 4 days undoing an upgrade to a router. DHCP was acting weird after the upgrade, although L2TP/IPSEC was better than in 5.26. Also experienced all the issues with winbox and syntax changes. What an unfortunate mess :/

lorsungcu

The issue was that the traffic for the L2TP connection was not hitting the input chain. They were experiencing the same issue described here: http://forum.mikrotik.com/viewtopic.php?f=2&t=40751 That was posted 3 years ago. Am I doing something wrong, or is this seriously still broken? Mikrotik? ...

lorsungcu

Did just notice that the tablet replies with the "Result-Code" of 6, which according to http://www.iana.org/assignments/l2tp-parameters/l2tp-parameters.xhtml#l2tp-parameters-12 means invalid destination. I'll be testing this tonight with osx/windows 7 to see if I can get a different result...

lorsungcu

I have 15+ other L2TP connections to this site. I generally use pptp for mobile connections, but need L2TP for always on van with android. I will test with osx this weekend.

lorsungcu

I am attempting to configure IPSEC/L2TP VPNs to various sites on a new Nexus 7, using a cellular connection. I have gotten it working successfully to one site, but when the exact same configuration is copied to another site, the connection will not establish. Both sites have static IPs, no NAT betwe...

lorsungcu

Thanks, I will try this.

lorsungcu

Pings fragment at 1405bytes. Can anyone confirm that what I need to do is even possible the way I'm going about it?

lorsungcu

I was able to get everything working; downgraded all routers to 5.0.25 and BCP took off. MTU between sites is still not where I'd like it, though. I don't know the exact number off the top of my head but its somewhere around 1420 that fragmentation happens. Two sites that I've noticed have less prob...

lorsungcu

I am not able to pass DHCP over the BCP link for some reason. Below are my configurations, your insights are very much appreciated! CLIENT SIDE PPP /ppp profile set 0 change-tcp-mss=no name=default only-one=default remote-ipv6-prefix-pool=none use-compression=default use-encryption=default use-ipv6=...

lorsungcu

I do control all sites; I'd like to use BCP and remove the EOIP all together, but can't just yet. Going to try moving to it tonight, but am not sure how it will impact existing connections and such. I'll post my results here.

lorsungcu

Should update this; you must create a source NAT rule for L2TP that chooses the address. This solved the issue for me.

lorsungcu

I have some transparent bridges set up between locations using EOIP over L2TP. I know I should be using BCP,a nd will be moving to that when I can, but this is what I've got for now. The issue I am having is MTU between sites is wrong, and I'm not able to send packets larger than ~1375 over the tunn...

lorsungcu

I have a PPTP connection to a remote site that has has a tunnel to another site. I am unable to reach some endpoints on the tunneled-to site, and get a duplicate ACK error when I try to. I have the main site with two bridges, for voice and data. Each satellite office has two bridges as well, in the ...

lorsungcu

A customer has 3 sites, and wants a single /24 over all three. All are geographically separate, and no p2p links between them exist. Plenty of bandwidth at each location. I was going to use IPsec and EOIP, unless someone can give me a reason this wouldn't work, or a better solution? Are there any ad...

lorsungcu

I'm messing around with an omnitik, and noticed that in order to access pretty much anything outside of the lan, I need to add a web proxy on the gateway (a 450g), and direct http traffic through it. I've tried everything, and nothing seems to fix it. Anyone have any ideas or directions to go lookin...

lorsungcu

I'm trying to get some L2TP/IPsec tunnels set up, but can't get l2tp to respond to connections with anything but the preferred source address from the routing table. I've looked through the forums and seen many people encounter the same issue, and seen MT acknowledge it, but I haven't seen a solutio...

lorsungcu

^http://yahoo.com$

lorsungcu

Are you referring to open VPN?

lorsungcu

I need to deploy ~75 routerboards as remote VPN clients, so users have ethernet handoffs with their VPN, mainly for VOIP applications. Has anyone else done this, or have any suggestions as how best to accomplish it? The issue's I see are that users will have dynamic internet addresses, these routers...

lorsungcu

I realize the obvious differences between using a bridge and master/slave ports, but can someone elaborate on what is functionally different, and where you would use one over the other? Turned on some new 450s and it struck me that 2-5 are always slaved, and that I didn't know _why_.

Thanks!

lorsungcu

I have an MPLS network with 10.128.11.0/24 on one end and 10.128.12.0/24 on the other. I need to have 11 on both ends; my thought was to put routerboards on either end, run a GRE tunnel between the two, and create only one .11 network. Will this work, or will I need to use VPLS or something? The RBs...

lorsungcu

I have a project coming up where I will need to outfit a large warehouse with some APs. My thought would be Mikrotik router boards with 2 sector/client antennas, and one directional 'uplink' antenna (3 radios). Attached is a simple layout of the building. There are 4 main warehouse rooms and one off...

Search found 81 matches