MikroTik

SwissWISP

Hi Angoran yes it's a bit disappointing that I didn't get a reply. I mean a simple "yes it's a known bug, we're working on it", would have been better than what I've got. Sure it seems to be a minor bug, but on the other hand it's quite annoying to administer a system that shows such impos...

SwissWISP

Thank you for the update.
Unfortunately we can't change our network the way you did. Our solution is to remove the brocade routers from our network. They needed to be replaced anyway. Now we have a reason to speed this process up a bit.

- Mat

SwissWISP

A short update: Our problems are most likely related. See debug of the Brocade router: Aug 18 07:52:26.877 BGP: xx.xx.xx.xx received invalid AGGREGATOR attribute flag (0xd0) Aug 18 07:52:26.877 BGP: xx.xx.xx.xx sending NOTIFICATION 3/4 (Attribute Flags Error) Aug 18 07:52:26.877 BGP: xx.xx.xx.xx res...

SwissWISP

Hi, did you find a solution (or a work around) to this problem? We are facing a similar problem on our CCR2216 in combination with a CER2024. In our case the CER closes the session because of an "Attribute Flags Error". It looks like our problems could be related. Unfortunately, Mikrotik s...

SwissWISP

Hi all I stumbled across something that looks like a bug to me. When prefixes get removed from an already running session, "Prefix Count" shows a value of around 4,294,967,295 (32-bit unsigned integer?) and stays in this area until the session gets restarted. As you can see in the image be...

SwissWISP

Thanks guys for the fix! It works great on my Cat S60. Now I reach an air rate of 150Mbps, which is the same speed as in the opposite direction.

- Mat

SwissWISP

Has this ever been resolved?
We see the same problem with RB951G routers.

SwissWISP

Hi

thanks for the reply. I heard of fs.com before. But I also heard that DWDM modules didn't work in the CCRs.
But compared to Cisco they're pretty low priced, that's true.

- Mat

SwissWISP

Hi all,

I need a 10Gbps DWDM SFP+ for one of our CCR1072.
Is there a module on the market, which is known to be working?

Many thanks!

- Mat

SwissWISP

The model in question is the RB951G. The problem is that I need to apply firewall rules between ether1 (Uplink) and ether2/ether3 so I have to use the bridge.
Ok, so it looks like it's the right way to do what I want...

- Mat

SwissWISP

Hi all, I've got a Router which has a "native" VLAN and a tagged VLAN (id=2) on ether1. The tagged vlan is bridged with ether3 so it's untagged on ether3. Ether2 should work the same way as ether1 so I set ether1 as "master-port". It works, but my question is, is this the way it'...

SwissWISP

Thanks for the idea.
But I was thinking of a threshold level which could be adjusted or something.
If I send all "interface,warning" messages in a different file, I could possibly miss other messages.

- Mat

SwissWISP

Hi

Is there a way to disable the "excessive broadcast/multicast..." message in the log?
I've got several hundred Mbps of legitimate Multicast traffic on an Interface, which may look like a Loop to the Router.
This message fills the whole log, which is annoying.

Thanks,
Mat

SwissWISP

Yes, ether8 - PoE in 12-58V
http://i.mt.lv/routerboard/files/CCR-10 ... 083901.pdf

That sounds good.
Thanks for the reply!

- Mat

SwissWISP

Hi all,

can the CCR1009-8G-1S be powered by POE-in like the CCR1009-8G-1S-1S+?

- Mat

SwissWISP

Okay, thanks for the reply.

- Mat

SwissWISP

Sorry to bring this Topic on to again. I just had a similar Problem. But my CCR didn't reboot when I clicked on "Reboot", so an upgrade wasn't possible. Upgrading via "check for updates" did a proper reboot so the upgrade worked. Are you sure that your CCR did a reboot? I just wa...

SwissWISP

Look: http://forum.mikrotik.com/viewtopic.php?f=2&t=98138

SwissWISP

+1 here on two CCR 1016

SwissWISP

Hello, we're facing a strange problem with EoIP tunnels across our Network. This is the current situation in this part of our Network (simplified): EoIP.png There is a EoIP Tunnel between "CCR1009 #1" and "CCR1009 #2" and all Routers are running OSPF. The standard path between th...

SwissWISP

Thanks for your reply Leo.
In my case it's most likely not a memory issue. My CCR has over 1.5GB of free memory space.

- Mat

SwissWISP

By the sounds of it, it's a routing problem of your own subnet. Your router is able to ping 8.8.8.8 because it uses the IP of your ISP to do so. What happens if you set the source IP in PING to the one in your own subnet? I would bet it won't work... Besides some things in your config which (usually...

SwissWISP

[...] What kind of single connection TCP performance can one expect between 2 CCR1036s over 10gig VPLS? Currently one connection can't be distributed over multiple cores. From what you can read in this forum, 1G is about the max a core can push. So I would say that you won't get much more than 1G o...

SwissWISP

where is load sharing solution? Are you talking about real Equal-Cost Multi-Path Routing (ECMP) or do you just want to run a "pseudo load sharing" based on BGP-Paths? Inbound distribution of the traffic happens automatically as soon as you announce your prefixes to your upstreams. Outboun...

SwissWISP

So it's not anymore necessary to create a bridge interface then add the port of ether2(trunk) and the vlans?

It depends on what you want to do. In general, this isn't necessary and it wasn't before.

SwissWISP

I'm running out of IPv4 addresses. Hope this will get fixed soon.

+1

SwissWISP

Discarding packet: MD5 authentication failed invalid sequence number I also see this message in the Logs when I enable MD5 authentication between Mikrotik routers, but not between a Cisco and a MTK router. I've sent the bug report to support but after some mails, they stopped updating me about the ...

SwissWISP

Another thing I just realized. There is no active monitoring on the PSU's. The routerboard does not know how many PSU's are actually connected (photo's only show power cables going from the PSU module to the mainboard) so there is no way to check if 1 or 2 power cables are connected and/or working....

SwissWISP

Hi

we run a similar config with two full feeds plus around 100k routes learned via several different peers (15 total) on a CCR1016. The routes take around 650MB of memory.

- Mat

SwissWISP

Hijacking a little - normis can you confirm/deny if dual PSU will make its way to 1036 models?

I would like to know this too.

SwissWISP

Is the licensed link directly connected to the omnitik? We had a similar situation where we had to enable Flowcontrol on the licensed link and the switches between them and the other devices. Some links seem to have big buffers which causes the "buffer bloat" problem if they can't deliver ...

SwissWISP

Thank you for the reply. You're right. In general that would be better.
The problem is that I need to use the firewall to filter some connections. So, it's not possible to use the switch chip.

- Mat

SwissWISP

Hi I want to configure a RB951G to separate the "Native VLAN" and VLAN101 which arrive are both at Ether1 and bridge VLAN101 with Ether5 and the Native VLAN with Ether4. VLAN_Bridge.png My config looks like this: /interface bridge add l2mtu=1598 name=bridge-1 protocol-mode=none add l2mtu=1...

SwissWISP

I had the same problem with a Huawei Modem. Support told me to just configure the LTE port as a dhcp client and it works like a charm now. It looks like some modems don't need the PPP part of the config.

SwissWISP

Most important:

Is the device visible under "/system resource usb print"?

- Mat

SwissWISP

What kind of router hardware do you use?
Is the device visible under "/system resource usb print"?

I use the E3272 on a CCR which is running 6.10. The LTE interface appears shortly after I plug it in.

- Mat

SwissWISP

Correct? Yes, that should work. Btw. This works on all RBs. You've been told to use the Switch Interface on other Platforms because they don't thave not enought CPU power to bridge at wirespeed. So using the Switch chip is more CPU fiendly. As you may know the CCR doesn't have a Switch chip, so usi...

SwissWISP

CCR 6.3 Anything else, 6.6 (based on personal testing and deployment) Our main CCR which is the gateway for our entire network has now been in production for around 1.2 years. We used 6.0 RC6, RC11 and 6.3 only. All were stable. We have 6.7 on our backup CCR and haven't seen any issues with it... h...

SwissWISP

Mikrotik your CCR + ROS 6.x sucks now, will wait to a reliable version. CCR collecting dust for now until a reliable ROS version ... our good old Dell Poweredge x86 ROS 5.25 back on duty .... no more issues no more angry customers ... It's a shame such a nice piece of hardware not being used ... I ...

SwissWISP

It depends on the platform... What I can tell you is, that on the CCR there is no Version, which is really stable.
We had a lot of issues with flapping ports, Negotiation problems and unresponsive routers. Just yesterday we had a "locked up" CCR1016 again.

- Mat

SwissWISP

There seems to be a problem with the Next Hop in BGP, if you use OSPFv3 as IGP. You will see the Next Hop as "unreachable" in the routing table.
You can find some Information in this forum.

- Mat

SwissWISP

Latency outside VPLS is a solid 6ms. Where Latency inside the tunnel is 6-600ms. With an average of 50-60ms Hi, I don't think your problem can be solved this way. What you are seeing is caused by AirMax and also happens when using EoIP, GRE, etc. Tunnels on these devices. It's discussed in the Ubnt...

SwissWISP

Why not a cisco asr while you're at it? Well, an ASR is OK too. :) But you just get more power and much more GigE-Ports (24) for your money. Back on Topic. We run some CCRs in our Network and they are routing full tables. But because of some nasty bugs (port flapping, etc.) and the fact that all ro...

SwissWISP

If you want a very reliable device for this job, I would recommend you to buy a Brocade CER 2000 Series router. Sure, it's much more expensive than a CCR, but they are great devices. Lots of power (Hardware Routing) and stable as a rock. I don't see the EdgeRouter Series as a real alternative to the...

SwissWISP

What kind of wireless link are you using?

- Mat

SwissWISP

The problem is that you can't control the incoming traffic like you need it. Only the outgoing traffic is really manageable. So even if you had BGP full views, it wouldn't help you with this. The routers on the other end (youtube, netflix, etc.) decide by them selves which way to send the traffic. I...

SwissWISP

Hi

usually this isn't a problem in a home environment. As long as you don't create a switch loop in your network, you should be fine.

- Mat

SwissWISP

CCR-1016 still port-flapping in more obvious way. before 6.6 ports were going down and that's it now it flaps ports many times before restart by watchdog. first week on 6.6 was very stable I thought it is final holy aid.... no... We are also seeing port flap on CCR1036 and RoS 6.6, FW 3.10 +1 Our C...

SwissWISP

First you should check if basic connectivity works. So assign a static IP to a host (no via DHCP) and check if the connectivity is OK. A second thing you should check is, if connection tracking in the firewall is active. I must say, that I never used dhcp-relay over a "nated" Router, but b...

SwissWISP

Did you set a static route to 10.10.8.0/22 on your linux box? Additionally I would set the local address of your relay to 10.10.10.1

SwissWISP

I'm not quite sure if this is a bug. It may also be a limitation of the driver or hardware. There are other network devices like for example the Cisco ASA 5510, which aren't able to handle 65k.

- Mat

SwissWISP

+1

-Mat

SwissWISP

Well, at the moment the bridge is transparent. After the change it isn't really transparent, that's true. My goal isn't a 100% transparent bridge. My goal is that the host appears with the mac of the bridge. But I think I found a possible solution for that. Proxy-arp may do what I need. Thanks! - Mat

SwissWISP

Hi all, I've got a transparent Bridge between one host and a Network. What I want to achieve is, that all packets from the host behind the Bridge look like they were originated from the Bridge itself (on Layer2 not IP) or maybe a 3rd MAC-Address. The Idea is that the Network always sees the same MAC...

SwissWISP

Hi all, there is something strange happening on our Routers (CCR). Several times per day, the router logs a "Invalid sequence number / MD5 authentication failed" message. (see attached Picture) It looks like the router receives an OSPF packet that is too "old" and the problem get...

SwissWISP

Hi Does RB1100AHx2 capable to handle full-duplex 1GB throughput on all 10 port simultaneously? This would only be possible if you use it as a Switch with two Groups (Switch chips). As soon as you send traffic over the CPU (bridging, Routing, etc.), the Performance Drops quickly. What about full-dupl...

SwissWISP

Thanks for your reply, Ivan!
At least I'm not the only one who needs this OID.

- Mat

SwissWISP

Hi There are some strange entries in the Log of my CCRs (v.6.3): "Discarding packet: MD5 authentication failed source=x.x.x.x Invalid sequence number mine=253202 received=253201" The session doesn't get dropped but it looks untrustworthy. :? Btw. This happens only between Mikrotik Routers....

SwissWISP

How are the network segments configured? e.g. Is a DR/BDR election involved or are the neighbours static. Just wondering where the delay is coming from...

It's DR/BDR. Do you think that it will speed-up the convergence when static neighbours are used?

SwissWISP

Hi, I just installed some CCR1016 in parallel to our existing core routers (different VLANs) so I can test them on real WAN links. The Network is built like a ring and consists of 5 routers. There are about 50 routes in the table. After setting everthing up, I was very happy that everything worked l...

SwissWISP

Hi

is there an OID for the total CPU usage on the CCR?
I found the usage of each Core but I Need to log the Total.

Thanks,
Mat

SwissWISP

How's the reliability of your CCR been for you with that amount of bandwidth? Would appreciate any feedback you have (good or bad). I'm afraid to put mine in production :/

+1

Thanks

SwissWISP

Hi all, we've had similar problems and it turned out to be a bufferbloat problem on one of our licensed links. Our Setup looked like this: [Server] <----GigE----> [C2960G] <----GigE----> [Licensed_150Mbps_Link] <----GigE----> [C2960G] <----FastE----> [Ubnt_RocketM5] <----300/300 Mbps----> [Ubnt_NB5M...

SwissWISP

Is it possible? Yes it is. Depending on your requirements even a smaller RB could do this. Is it fast enough? Well, it depends... What are your requirements? If you just get a default route and/or some routes from a local IX, you will be fine. But if you get full tables from several Peers you won't...

SwissWISP

I don't see any peer configuration on Mikrotik you have to configure at least one peer so BGP can do anything

+1

You need to configure a peer.
Example:

/routing bgp peer
add name=TEST remote-address=172.31.55.29 remote-as=[REMOTE-AS] ttl=default

- Mat

SwissWISP

Hey Mat. Thanks for your good news. Could you please tell me what ROS version you use?

Currently we use 6.2.

SwissWISP

I have 6 CCRs and we are using those routers for PPPoE server. I have a plan to enable BGP on that routers. Anyone tried to use BGP with Cisco using v6.2, please share your experience here. Thanks. We run several sessions between our CCRs and some Ciscos and even a session to a Brocade CER. No Prob...

SwissWISP

I can confirm szaszans observations.

SwissWISP

Do you also experience one core almost always at 100% load? How much does it take a route state-change to be applied? On my CCR (3 IPv4 full views and 3 IPv6 full views) it takes almost 20 minutes.

We see this too. It's because BGP runs on one core only.

SwissWISP

Hi! I run a RB as a bridge between us and the customers firewall. At the moment the customer uses DHCP to get an IP. The problem is that the customer could set the IP manually in the firewall to always have the same IP address. Since this could lead to IP-Address conflicts and other problems I want ...

SwissWISP

You can run two full views on the RB1100AHx2 but you will most likely see higher latency during convergence.

SwissWISP

This is interesting. I've got a 198.x.x.200/30 defined as a Network on MTR2 to announce. On MTR1 I am only seeing a route to .201; GW for the .200/30 network. I should be seeing 198.x.x.200/30 should I not? Yes, you should see 198.x.x.200/30 but just because you add the Network to the list doesn't ...

SwissWISP

Based on the few information you give, I can only guess what happens. But it looks like NAT is configured on MTR 1.

- Mat

SwissWISP

Fixed. Providers fault ! :evil: Ha! That's why I asked if this happens on a specific ISP. But just to make sure you know about a bug in RouterOS: Sometimes, routes get stuck in the table (what you've seen -> None of the routes gets active and also some strange things). I would advice you to follow ...

SwissWISP

Ok, after a restart they are like that :lol: . That's a bug. Search in the forum for "stuck routes". But still can't ping my /24 block only if i disable one of the BGP peers. Does this happen to both peers or do you need to disable a specific peer. Maybe i need the full world table from b...

SwissWISP

The distance for the isp 2 gateway should not be bigger that ISP1 ?
Maybe this is causing the problem.

No, most likely not.

It should look like this:

SwissWISP

Yes it is in production :( Can this be because of the routing filters ? I don't think so. I don't understand exactly how it works. I did this : set isp1 out-filter=isp1-out set isp2 out-filter=isp2-out add chain=isp1-out prefix=myclass/24 action=accept add chain=isp1-out action=discard add chain=is...

SwissWISP

This looks strange. One of the default routes should be "A". I saw that you run RC7, maybe it's a bug. Is this device in production?

SwissWISP

I can't open the pic, so I can't see anything.
http://hostpicture.eu/upload/big/2013/0 ... be23ba.png

"No direct Link permitted"

SwissWISP

I can't open the pic, so I can't see anything.

SwissWISP

This can't work. You need to send the packets from the newer /24 to the correct gateway. The static route overrides a dynamic route. That's why it doesn't work.

I would change the routing so you announce both Prefixes, otherwise the first /24 has no redundancy. And kick the static route.

SwissWISP

well, thank you. But now i have another problems. It seems like i add the ip addresses for BGP 1 provider and BGP2 provider. They can't be pinged from outside my country. It's strange, do i need to make sort of packet marking for each provider gateway ? It's difficult to say what happens but please...

SwissWISP

Hi, What i want is to use both providers i really don't care through the pachets are going, as long the traffic it's shared somehow between them. (I have the same bandwidth from both) How i can do this ? Well, there are several different things that may be tweaked. But you can start with the AS-Path...

SwissWISP

[...] There is a one question to Normis - are your going to make BGP process multicore compatible? +1 on this question Second question about CCR performance with full BGP onload. Is routing procces works fine during BGP establishing full view? It's not a problem to wait full table, but there is a p...

SwissWISP

The CCR has enought CPU power to bridge the ports at wire speed, so I would just bridge them.
Since the CCR has no switch chip, changing the Master of a port doesn't do anything.
The CCR can't be powered via POE, the case has been labeled wrong.

SwissWISP

well i ssh to the ccr and ping from terminal, but yes.

SSH is ok too.

Well, that's really strange... I've never seen that before... I would reset the CCR to factory defaults and start from scratch. I've got some CCRs which are running in similar configs and they do nothing like that.

- Mat

SwissWISP

No. When the CCR is connected to the switch I can ssh to the switch from a desktop on the LAN but can't ping out from router to the internet.

So you can also access the CCR via Winbox but you can't ping a host on the Internet from the CCR (Tools/Ping)? Right?

SwissWISP

It's possible that macs get leaked between the interfaces (maybe a bug), that's why it's important to know if these ports share the same broadcast domain or not. If they are in seperate VLANs we can rule out this situation. If you connect the switch to the CCR, is the CCR able to reach the internet ...

SwissWISP

Are the Ports 1-3 connected to the same Switch? If yes, are these Ports in the same VLAN (on the switch)?

SwissWISP

I assume as this thread has really slowed down as most people are not having as many issues with CCR's since RC12? Looking to put a pair of CCR's into a production environment in the next week. 2 BGP feeds to each. iBGP between them. Handful of firewall rules and a few policy routes. I have had RB1...

SwissWISP

Please post your config, so we can see if something is wrong there.
It most likely isn't a hardware problem.

- Mat

SwissWISP

[...] however you will not have any indication that one of them failed. As I stated above if the PSU with the lower voltage fails, you'll not notice it until the other PSU fails too. So the whole idea is just senseless anyway. A device like the CCR needs a proper dual-PSU setup incl. SNMP Monitorin...

SwissWISP

To limit the connections per IP, you could use the "Connection Limit" feature in the firewall.

SwissWISP

Are there any plans to make the BGP process multi processor capable?

SwissWISP

Since you are routing (I suppose you do), broadcasts are not transmitted. This is just the way routers are working. Netgear seems to have some kind of "Broadcast-Relay" built-in. But I've never seen this on a Mikrotik device. That's why we told you to build a Layer2 tunnel between the rout...

SwissWISP

Try eoip.

Like "gotsprings" said, try a Layer2 Tunneling Protocol such as EoIP. Alternatively you could run WINS Server.

- Mat

SwissWISP

Thanks, I will try that!

- Mat

SwissWISP

I just found a way to make this work. I just configured the VLAN on the bridge. But now I have the problem that I also see the tagged Packets on the bridged port. Is there a way to filter these packets?

SwissWISP

Hi I would like to know if it is possible to bridge all packes from one port to another, except packets from one specific vlan. This specific VLAN should have an IP on the router itself. The problem is, that if I bridge two ports together, the router also bridges the VLAN I want to use for the route...

SwissWISP

how CCR works with BGP, and how to cope with the routing of about 1 Gbps of traffic? Please write, those who used ССR with 2 or more BGP uplinks. I wouldn't use the CCR for BGP routing at the moment. There is a problem with stuck routes: http://forum.mikrotik.com/viewtopic.php?f=14&t=57781 . I ...

SwissWISP

SwissWISP, check if you have not sected different firewall rule ordering. That could explain rules changing order.

That's a good hint. Maybe I have accidentely clicked on that tab. I will keep an eye on that. If it never happens again, it was just my fault.

SwissWISP

please generate supout rif when in one state and afterwards generate another one in altered state. we have not seen anything like that. I just saw why these Jobs are created. It's because a autosupout.rif got created in the background (and partly fails). The stuff that happens to the BGP config is ...

SwissWISP

It runs on RC14 and there are firewall rules to limit access to this router and of course username and password are not default.

SwissWISP

Our CCR acts like it got infected by a Virus. It began to create scripting jobs by itself, changed the position of firewall rules (I was looking at the rules while it was doing it) and deleted my whole BGP config after a reboot. Am I the only one with this problem or did someone else see this too? -...

SwissWISP

Well, I don't see a reason for traffic shaping. To me it sounds a bit like a duplex problem between the RB2011 and the NTU...

SwissWISP

To change the upload, you just have to set the "Set BGP Local Pref." on the "BGP Actions" tab to a value according to the priority. Example: ----------- FIRST: 100 SECOND: 80 THIRD: 60 But this will route ALL Traffic over the FIRST peer (assuming you get the same prefixes over al...

SwissWISP

Hi

It's just like you would add an IPv4 peer. There are just two differences. 1. Use the IPv6 Address as the Remote Address and 2. select only the checkbox "IPv6" on the "Advanced" tab. That's it...

- Mat

SwissWISP

I can confirm (partial) what you are seeing. Our CCR (RC13) is connected to several peers. As soon as I shutdown the session to one peer (with active route), the route disappears completely from the Route List, even though I get this route over serveral(!) other peers too. All routes which get into ...

SwissWISP

Where did You get RC14?

http://www.mikrotik.com/download/share/ ... .0rc14.npk

SwissWISP

Okay, I upgraded to the most recent version (RC14) and will report back if it runs longer than 9 days.

Btw. the CCR I just updated ran ~2 weeks on RC13 without problems.

SwissWISP

I can't confirm your problems. Our BGP Sessions are up since several weeks. But our Routers are in the Lab and don't have to push a lot of traffic around.

- Mat

SwissWISP

What do you plan to run on this router? BGP, OSPF, Firewall or VPN? What are the bandwidth requirements? Since fast path isn't ready, you will not get as much Mbps out of this router as Mikrotik announces, if you plan to use the firewall. But if the bandwidth requirements are not in the multi gigabi...

SwissWISP

Hi The only thing I can say at the moment is: Experiences are different... Some have a lot of problems (hang/reboot), others don't. We don't see any problems running four BGP peers and some EoIP and L2TP Tunnels over our 1036 (in the Lab), but we just test the functions we need in our Network others...

SwissWISP

Yeah. It's a direct connection via fiberoptics.

Well, I would check the connection. It looks like your connection is flapping.
Try to ping the peer for some hours.

SwissWISP

On our 1036 we don't see such problems. We've got BGP sessions that are up since several weeks. Logs: 02:52:10 route,bgp,error HoldTimer expired 02:52:10 route,bgp,error RemoteAddress=8x.1xx.1x.1xx 02:53:08 route,bgp,info Failed to open TCP connection: No route to host 02:53:08 route,bgp,info Remote...

SwissWISP

Hi I need to build a fully transparent layer 2 tunnel (VLAN, CDP, DSCP, etc.) that can handle 1600 byte packets. The problem is that a part of the transit network is only able to transmit 1504 bytes per packet. How can this be done? Btw. I know that the PPS will be double of the original data but it...

SwissWISP

Hi Javii

I would block all traffic to port 80 of your CCR.
If you need port 80 for local administration, you could open it just for your own subnet.

Btw. it's always a good idea to filter every IP which don't need to access the router.

- Mat

SwissWISP

It`s the wrong way to find problem... becouse I dont have BGP and I have problem always after 2-3 days TX drops..

Yes, I don't think it's related to BGP. We run BGP on our CCR and I don't have such problems.

- Mat

SwissWISP

Thanks for the information.
Netinstall works!

- Mat

SwissWISP

But, if there was more corses to do the bgp. would it be speeded up? Whats really nice, is that each port, don't share internal recourses like the 1xxx series. 1Gig strigt into the core (kernel). Sure would it speed up the building of the routing table. Especially when more peers with full routing ...

SwissWISP

16 GB should absolutely be sufficent.

SwissWISP

Hi Mat, thanks for sharing! Your BGP Sessions are up with Fulltables? I plan to use Mikrotik in my Edge with 3x Uplinks, but i miss 10 GbE Support over SFP+. Hi raz I'm running one full table, one part table and one table from the local IX (~50k). The downstream router gets the "mix" of a...

SwissWISP

I've got the same problem on a RB1100AH which is connected to a Brocade CER. I get the /128 from the CER but not from the Ciscos behind the CER. The Ciscos all get the /128 of my RB however. At the moment it's not a big problem because I can get the /128 via BGP but hopefully it will be fixed soon. ...

SwissWISP

Hey Samsung

were you able to test BGP?
My CCR is currently running 3 Sessions to upstream routers and 1 Session to a downstream router. Uptime is almost a week and I've seen no problems so far.

- Mat

SwissWISP

Hi!

What would be the best queueing method on the CCR?
I read on this forum that on Multi-Core/CPU systems, multi queue PFIFO is the best option (performance wise).
Is this true and if yes, is this also the case on the CCR?

- Mat

SwissWISP

Just add multiple lines using the same Name:

access-list.png

This works for Subnets, Ranges and single IPs.

- Mat

SwissWISP

" MD5 passwords don't work" With latest RouterOS version MD5 should work I'm running RC10 built on 15 Feb. and it definitely doesn't work in this version. I've got a Cisco and a Brocade router connected to this CCR and both session don't work with MD5. I will update to the most recent ver...

SwissWISP

I've got some test results:

- It takes about 30 sec. to load 400k prefixes (one core of the CPU @ 100%)
- MD5 passwords don't work
- As soon as I get more than about 200k prefixes, the "Routes" windows doesnt show all filter options and routes

SwissWISP

This tell to less to conclude annything other than mikrotik is working to get a 100% systeem running. its still to be consider as a beta test system. I'm not 100% sure what you meant, but we do not complain about low performance we're just testing. We know it's in beta. I was a bit disappointed to ...

SwissWISP

At the moment your config does nothing but mark packets and connections. :) You don't need the second mangle (postrouting) btw. 1. You have to set a routing mark -> new-routing-mark=Youtube 2. You need to add a new route for the routing mark So it's more like: (not tested) add action=mark-routing ch...

SwissWISP

It would be nice to buy the CCR with 2 PSUs in the first place. With the CCR you're moving into the data centers where this is standard. +1 If I had a wish regarding the features of future CCRs, I would like to see that: - Redundant, hot-swappable PSUs - AC and DC PSU option - hot-swappable fan tra...

SwissWISP

I just found a video on youtube on which someone sent 4 full feeds to the CCR.

It looks like the load doesn't get balanced over multiple cores. This is what I suspected. It's too bad that we can't use the full potential of this CPU.

SwissWISP

Great, thanks folks! Do you think it will consume many CPU resources?

Layer 7 filters use always more CPU than others. I would say try it and you'll see...

SwissWISP

I will test that it is working. :D Sure. I already tested BGP on the CCR using a RB1100AHx2 so I can say it works in general. 8) I won't put it in production now. I will just set it up as an iBGP peer to see how it performs when a powerful router sends the full table. So I can plan how it can be us...

SwissWISP

This sounds a bit like the very annoying GRE/EoIP problem discussed on the Ubnt forum. http://forum.ubnt.com/showthread.php?t=46874
Maybe they are related.

Unforunately Ubnt doesn't care. I looks like they think it's a Mikrotik problem...

- Mat

SwissWISP

You will need to have route in each router pointing to the other subnet. Hm... he runs the AirRouter in SOHO mode (NAT), so this won't work. If he would route it, you were right. 192.168.253.167 should already be able to access 192.168.1.0/24 since you are running the AirRouter in SOHO mode. It's j...

SwissWISP

Thanks for your reply! I'm very interrested to see your results. What do you plan to monitor? I would look at the different CPU Cores to see if the load gets balanced proprerly and how fast the routing table gets copied to the CCR. If work permits, I will test it by myself within the next two weeks....

SwissWISP

Thanks, was the nat rule :/ jeje. This is the best way to routing public ip range?

Well, it's the correct way of routing... What would you change?

SwissWISP

the better is to use layer 7...

If it can be filtered correctely, I'm sure this is the best solution, because IP-Subnets can change without notice.
Do you have an example config for the thread starter?

SwissWISP

OK, I did some work for you... 8) This is what Google announces to us: 8.8.4.0/24 8.8.8.0/24 8.34.208.0/21 8.34.216.0/21 8.35.192.0/21 8.35.200.0/21 64.233.160.0/19 64.233.168.0/23 66.102.0.0/20 66.249.64.0/19 70.32.128.0/19 72.14.192.0/18 74.125.0.0/16 89.207.224.0/21 108.59.80.0/20 108.170.192.0/1...

SwissWISP

Thank you for reply. Do you know how can I get the list of youtube IP addresses? I googled "Youtube IP address list" but I wasn't able to find it.

Well... that's the problem. Maybe you can find a list of all Subnets announced by AS15169.

SwissWISP

In general this should be possible. You could do NAT between the public IP of your cheap connection and your public subnet. If you configure your router to use the cheap connection for youtube the packet would be sent out the cheap connection and therefore it will get back over this connection too. ...

SwissWISP

Yes it is still an old code, but we did some major fixes.

Thanks for your reply.
But what about the bug this thread is about? Is it fixed?

SwissWISP

Hi! Since you are routing a public IP-Range, you don't need "masquerade". Everything else looks good. First thing you should check is, if your RB is able to ping your GW, which is AA.BB.CC.101 in your example. If this isn't possible your problem lies between your RB and your ISP. If you've...

SwissWISP

Hi All

was someone already able to test the BGP performance of the CCRs using full internet routing tables?
I wonder how well it could handle route flaps on a 1 Gig Internet connection.

- Mat

SwissWISP

What would be the best queueing method on the CCR?
I read on this forum that on Multi-Core/CPU systems, multi queue PFIFO is the best option (performance wise).
Is this also the case on the CCR?

SwissWISP

We would like to see a CCR with 24 copper GigE and 4 SFP+ with two hot-plug PSUs (DC and AC option).
This would be a real enterprise/ISP device.

- Mat

SwissWISP

if you have configuration as i described where main PSU output is higher than backup, then when main PSU fail it will switch to backup one, that already should an indication that things are going wrong. When both of them fail, router will be offline. I think you misunderstood me. If the main PSU fa...

SwissWISP

Hi, is it possible to connect CCR1016-12G to 220V and PoE at the same time to achieve power redundancy in case the internal power supply dies? (Similar question was asked in this thread but not answered.) @beamer Perhaps interesting for you? http://forum.mikrotik.com/viewtopic.php?f=3&t=69422 O...

SwissWISP

you can monitor only active PSU. However if you have them with different rated voltages, then reading what voltage will give you what PSU you are using. Well, the problem is that if the backup PSU fails, we will never know. Maybe you can put this on the "wishlist" of additional features o...

SwissWISP

Thanks for your reply janisk!

Do you know if we can monitor the voltage of the second PSU via SNMP?

- Mat

SwissWISP

Hi

does someone know if the socket on the attached picture could be used (or is maybe designed) to connect a secondary PSU?

Thanks!
- Mat

SwissWISP

Thanks for your reply!
Hopefully it will be implemented at some time because it seems to be able to solve some problems at bottlenecks.

- Mat

SwissWISP

Hi

is CoDel already implemented? If not, are there any plans?

- Mat

SwissWISP

I would afraid of traffic and not the routes. 440k routes should eat no more than few hundred megs of RAM. I'm with "wpeople". Traffic and CPU load caused by BGP updates are more important. The main question I would ask is: Is this router able to handle two full feeds when they are flappi...

SwissWISP

Hi thanks for sharing your results! Did you check the load on the individual cores of the CCR? Does the load get balanced over multiple cores? I ask this because it's possible that the CCR shows just 1-2% total CPU load but one core is at its limits and you can't route more traffic even though it lo...

SwissWISP

If you wan to have a look on and you are able to spend 1 minute please give me your vote for that under:
http://forum.mikrotik.com/viewtopic.php?f=3&t=66090

I already voted.

SwissWISP

I emailed Mikrotik about 8 months ago with photos of a similar arrangement on Juniper EX switches. I got a response back saying they were considering it for future products.

Well, that sounds good. Thanks for your reply!

SwissWISP

Hi Since it's to easy to accidentally pull the power cord out of the socket, I would really like to see a power cord retainer on the CCRs. Maybe something like the ones used by Cisco (example): http://www.cisco.com/en/US/i/100001-200000/150001-160000/157001-158000/157706.jpg I think it's a "mus...

SwissWISP

i have a lost packet's when pinging myself :) the router is really dumb It's because "ping" has a very low priority. A Router has more important things to do... ;-) Even very big and expensive routers drop pings. The best way to check if a router or a link between two routers is causing t...

SwissWISP

Perhaps it was more related to my poor English language skills, it was sounding rude, but not in the meaning of mine.

Or maybe my english skills... I didn't even understand everything in your last post

Anyway. I think everything related to this topic is said.

SwissWISP

I don't think he was rude, he was just asking for ideas for a future model. If he was rude or just a bit unfriendly is a matter of taste. Swiss and Germans have different views of that but let's go back on topic. He statet that a imaginary device which may be available in the future is better for t...

SwissWISP

Hey, why so rude...? I didn't say that a CCR will never be as good as a CER or something. I love the CCRs and I'm sure they will outperform a lot of the "big" routers on the market. But we are talking about the current CCR and "lexlvivs" need for SFP+. Not what could be available...

SwissWISP

Hi since the CCRs don't support SFP+ at the moment, I would use a Brocade CER 2024F or 2024C with a dual 10Gig Module. It's a 65Mpps device (hardware routing) and would do the job nicely. Though it's much more expensive than a CCR but it's a very good device and at least it costs less than a Cisco. ...

SwissWISP

Okay, I misunderstood your post.

Maybe this Link could be helpful: http://wiki.mikrotik.com/wiki/Generate_ ... ting-marks
I think this is what you want... (more or less)

- Mat

SwissWISP

It's a quite old post but maybe you didn't find a solution for this. What you would like to do, doesn't work with BGP. You can filter which prefixes you accept from your Neighbour, but you can't tell them to which ASes your prefix(es) should be announced and to which not. And even if it would work. ...

SwissWISP

Do you get these results in both directions?

SwissWISP

Hm... does really no one know how to disable the reset button or how to install a default-config with a non-standard password?

- Mat

SwissWISP

Yes, you have more devices but on the other side it has the advantage that a lightning would rather kill your midspan (less or no config) than your router/switch. A damaged router/switch would usually need more time and knowledge to replace. Some midspans also have a built-in surge protection such a...

SwissWISP

We use 19" Midspans for this. They are also available in 24V so you can power Ubnt and MT devices. Example: http://www.digital-loggers.com/poe24.html
Sure, they are more expensive than a couple of poe injectors but they also give you more control.

Just an idea....

- Mat

SwissWISP

anyone?

SwissWISP

Hi

is it possible to change the factory-defaults of a RB?
The goal is to prevent our customers from reseting the router so they can gain access via default user and pw.
Is this possible?

Many thanks for your help!

- Mat

SwissWISP

Hi, we installed about 60-80 RB7xx and I only know of one device that failed (loose contact at the RJ45 Port). We also installed some RB493 and RB450 and all of them are running trouble-free. The only troubles we had were software related. I heard that some people had problems with the PSUs. Since w...

SwissWISP

Thanks normis

this helped a lot.

- Mat

SwissWISP

Hi As I read in this forum and in the Manual, it's better to split connections with higher load (ex. Backbone) between the two internal switches. Port 11 seems to be connected directely to the CPU and Ports 12+13 are connected over PCI-E. But in other threads some people write that one should avoid ...

SwissWISP

I don't know if Half-Duplex GigE is supported by Mikrotik (or by the vendor of the Transits router) but that looks like a duplex mismatch. I may be completely wrong here but that was my first thought.

Do you have 3 GigE Interfaces with a CIR of 1 Gig on each Interface or is the CIR lower?

SwissWISP

Hi mrz,
Thanks for your prompt reply.So, can we expect this feature in near future?

I would like to use this feature too. Is there an ETA?

SwissWISP

Same issue here. Unfortunately it makes it difficult to find the source of other problems because it fills the log very quickly so there is no room for other entries.

- Mat

SwissWISP

Just found another problem. I don't know if it is some kind of bug or just the way it has to work: I've got a DHCP-Relay configured on the main system which is disabled at the moment. When I try to import the config file the device whants me to define an Interface because there's no Interface config...

SwissWISP

I just found the main problem. I had to remove the "mac-address" in the interface part of the file. But there seem to be more problems in the file where it gets stuck.

- Mat

SwissWISP

Hi Aug thanks for your reply! When I import the file, I don't get any errors: [admin@MikroTik] > import file-name=er1.bac_neu.rsc Opening script file er1.bac_neu.rsc Script file loaded successfully But only a part of the configuration is there after the import. When I just copy/past the script from ...

SwissWISP

Hello I've got a problem with my RB1100s. I want to backup the config of one RB1100 and import it on the second RB1100 so I can replace the first one should it fail. I used the command "export" at "/" to export the whole config. The file I get looks OK to me. Then I copy the file...

SwissWISP

It looks like a very uncommon setup. To me it still doesn't make much sense. But I don't know their network.

Anyway, thank you mhosts for the clarification.

SwissWISP

Why are you using loopbacks for eBGP between providers (loopbacks are typically used in iBGP configuration)? +1 That doesn't make much sense. It only makes sense when you're using an IGP to manage multiple links between the routers which would cause the source IP to change when the main link goes d...

SwissWISP

Hm... well it looks like I'll have a lot to read/learn now.

Thanks for your reply!

- Mat

SwissWISP

Hi all

I need to limit the bandwidth of a single switch port of my 750GL to 20 Mbit/s.
In WinBox there seems to be a value under "Interfaces" that limits the bandwidth. But this values maxes out at 10 Mbit/s.
Is there a way to set a limit of more than 10 Mbit/s??

Many Thanks!

- Mat

Search found 186 matches