MikroTik

iprob

This is great news! Finally we can retire the specialized VM hosts just for routeros and integrate it into our existing Hyper-V environment!!

iprob

I've upgraded several routers to 6.13 and haven't had an issue and the failures related to route cache have stopped. We only have one open bug. That is in a scenario with dual ISP setups and marking PPTP packets. L2TP/IPSec was fixed in 6.13 and PPTP is expected to be fixed in 6.14. I agree with jar...

iprob

We opened up a support ticket about this issue and they indicated it is fixed in 6.13. We're only now beginning to roll it out so I don't have any definitive results yet.

iprob

Thanks for the heads up. We'll test it once 6.13 comes out. Appreciate the post!

iprob

Do you know if this was addressed in version 6? I'm running 6.12 and cannot get the L2TP packets of a L2TP/IPSec tunnel to route over a specific interface. Everything else works fine. I'm using PCC and have tried two specific rules (one for PPTP and one for L2TP). /ip firewall mangle add action=mark...

iprob

Good point, I only saw the issue when using L2TP. I never did see the issue with site-to-site IPSec tunnels, I'm not running any ppp on any "core" BGP routers and I don't use SSTP.

iprob

If you are seeing the same "No buffer space available" then I would recommend contacting support. They reported this bug as fixed in 6.12 and I haven't seen it so far on any of the 26 routers we upgraded to 6.12. Unfortunately, you'll need to be on the router to verify that the problem is ...

iprob

Have you tried version 6.12? I haven't seen the issue yet with 6.12 although I still leave the automatic reboot scripts in place.

iprob

Looks like this issue is much worse in 6.11. We downgraded several routers back to 5.24.

iprob

This problem appears to be much worse in 6.11. See the thread here: http://forum.mikrotik.com/viewtopic.php ... 43#p419643.

All indications are that it is a bug in the PPP code from MikroTik. My problem routers are the ones with L2TP set up.

iprob

Up time was only 5 hours last go around. What version is the suggested downgrade? I'd prefer not to have to go all the way back to 5.24 since the queues are redone for version 6 and all the ipsec configuration scripts had to be updated with "aes-256-cbc" instead of aes-256. I don't know wh...

iprob

I know it isn't nearly as useful as Nathan's detail information...but here is an odd scenario that happened. - The MikroTik running routeros x86 crashed after about 16 hours after the upgrade - Rebooted and one L2TP connection was made - Crashed again within 45 minutes - Two L2TP connections made (s...

iprob

We are seeing this issue with router x86 machines that have a lot of inbound VPN connections. These are a combination of on-demand L2TP and site-to-site IPSec tunnels. Failure occurs in less than 24 hours. We've implemented the check for the route cache to automatically reboot. This issue has been a...

iprob

We are phasing out VRRP. The challenge of getting it to work right with outbound NAT, L2TP, STS IPSec tunnels, and various issues we've run into has made it more a problem that a resolution. We're going to create redundancy via the KVM layer instead and in the meantime, rely on backups which we can ...

iprob

OK, thanks for clarifying. I'm not sure I agree with that strategy but that is clearly Mikrotik's choice. Personally, I think it is too bad. There is a role for virtual routers and firewalls. Routeros is perfect because of the small footprint and powerful platform. The idea of training staff and sup...

iprob

I'm sorry, but I'm not sure I fully understand your post. The part I'm confused about is "Mikrotik can't guarantee routeros will work from release to release". Are you saying something about the upgrade paths of the core routeros that you license to customers? Or are your saying that you d...

iprob

With Ubuntu/KVM, we use the e1000 NIC in our routeros VM's which works well with the gigabit switches we use with the underlying host. We do all the VLAN setup and management on the host OS, not routeros. That's our choice and we have to live with it. As I mentioned, I'm not looking for a supported ...

iprob

I think the Hyper-V graph there is interesting. I guess my question would be why is the only major virtualization platform that isn't supported Hyper-V? Linux distributions have fully embraced Hyper-V by building in the integration components. Apache Cloudstack and other cloud management systems are...

iprob

I read in this thread (http://forum.mikrotik.com/viewtopic.php?f=2&t=51127) that some were running dynamic protocols, and some were not. I noticed on the router that I am experiencing the issue is not running any dynamic firewalls but there are frequent PPTP connections. The PPTP server does cre...

iprob

Isn't this the same issue as discussed here? http://forum.mikrotik.com/viewtopic.php ... 90#p407090

I had this issue happen with 6.7 (route cache is full, networking stops). Is anyone from this thread still experiencing the issue with version 6.5 or later?

iprob

I am experiencing this in 6.7 on one particular router running as an x86 VM. I was able to see the route cache completely full and networking shut down. Since it was a VM, I was able to reboot it and resolve the issue. It does happen regularly with this router. Other than a scheduled reboot, are the...

iprob

Are there no suggestions or ideas on why this is happening with v6? v5.24 and v5.26 work without issue.

iprob

Anyone? No one seems concerned that the connection marks are not getting properly processed in 6.5? Based on the packet flow diagram for v6, these particular rules should work the same under 5.24 and 6.5. They aren't.

iprob

I have a relatively simple setup where two public IP's are assigned to my ether1 interface. I have an internal interface on ether2. The specifics of this setup is to create two different Dyn DNS internet guide policies. To accomplish this, there is an address list of computers that get the "non...

iprob

I don't believe there is any way to do this on the MikroTik. We have the same situation and use IIS URL Rewrite to redirect to https on Exchange web servers. It is very easy to redirect from http to https on both IIS and Apache. You should approach it on the web server since nothing on the MikroTik ...

iprob

I mis-typed. On options 1 and 2, the CD was the INSTALL CD, not netinstall. That means it was the ISO downloaded from the MikroTik web site.

iprob

Here is some testing that I've done: 1. Tried installing from Netinstall CD with RAID enabled on LSI1064e. CD does not see any drives. 2. Tried installing from Netinstall CD without RAID (drives appear as standard SATA drives). CD does not see any drives. 3. Ran Netinstall on a Windows 7 PC and inst...

iprob

I've read a few posts about people successfully installing RouterOS on an x86 with the LSI1064e controller. I haven't been able to get the install to work. My objective is to install RouterOS on the machine and use it to run many virtualized routers. We do it today with KVM but that is a one-off and...

iprob

Using Proxmox VE isn't really an option. The point is that we shouldn't have to modify our entire VM infrastructure to accommodate a particular vendor. We're standardizing on Hyper-V and System Center so we can use the new Azure recovery manager to simplify data center failover (http://www.windowsaz...

iprob

I would agree, no support, just don't disable if that is possible with the later kernel version. Frankly, I'd be fine with enabling the "Legacy NIC" like in 4.17. I'm even considering running 4.17 if I can. These VM's are just doing basic NAT, firewall, routing features. I think the emulat...

iprob

I had originally thought running a few KVM machines just for MikroTik would be ok. Now we're running about 300 VM's and the only ones that aren't on Hyper-V are the MikroTik VM's. It is making us rethink that we may need to move to something else. We're running about 50-60 MikroTik devices (RB's and...

iprob

I'm wondering if there is a way to check if a service is active on a machine that has a dst-nat rule. Here is what I'm trying to do: 1. Have multiple SMTP servers behind MikroTik (port 25). 2. Want to use PCC to load balance them. 3. If one does down, I want to remove it from the PCC. Netwatch is no...

iprob

I created a new MikroTik VM on the same Ubuntu machine with the problem VM (unable to ping NLB address). This MikroTik x86 didn't have VRRP and had the same interfaces set up. This VM also was unable to ping the NLB (192.168.0.5). I set up another MikroTik VM on the Ubuntu machine that didn't have a...

iprob

I have an odd problem with two of my MikroTik routers. They are running as x86 VMs under Ubuntu KVM. Setup: - Ubuntu 12.04 LTS running KVM. Each firewall is on a separate Ubuntu machine. - Two MikroTik routers running 5.24 - Ether1: Public interface with public IP (dedicated and VRRP). All inbound t...

iprob

Worked perfectly, thanks!

iprob

I've set up a simple queue to monitor traffic to/from an IP using this command /queue simple add name="temporary monitor" target-address="192.168.015" queue="default/default" The queue shows up and traffic is monitored but the "Total Bytes" is always 0. Total ...

iprob

I have a scenario where we are using a MikroTik device at a remote site connected by a layer2 link to our main site. The default gateway for the MikroTik is at the main site. The device at the remote site is set up to do rate limiting with simple queues to prioritize traffic. The setup works great w...

iprob

Anyone?

iprob

I'm doing traffic shaping for VOIP. I've found the best configuration is to use a simple queue setup similar to the export below. I'm running MikroTik OS 5.21 in a KVM hosted on Ubuntu 12.04. The problem I have is that I end up getting less than my full uplink speed when queues are enabled. I suspec...

iprob

Any ideas on why it isn't using the NAT rule? The public IP returned by the L2TP packets is definitely not the VRRP address defined in the NAT rule which is creating the problem.

I'm also open to any possible work around for this issue. Right now, it appears L2TP is broken with VRRP.

iprob

I cleared all connections and rebooted the routers. Now I'm getting replies using the scenario with VRRP. The problem is that the replies are sending the public IP of the ether1 interface, NOT the VRRP IP. This directly violates the NAT rule that I have on the router which says that all traffic goin...

iprob

Here is some more information from packet sniffing: - Scenario to non-VRRP public IP (VRRP is running, router is the master): IPSec is established and L2TP packets are exchanged using the public IP of the interface, NOT the VRRP address. I can see the packets with destination ports of 1701 establish...

iprob

The connections using the VRRP address are not working, so what do you suggest? The rules provided previously in the post do not resolve the problem. So saying to use the VRRP address, which doesn't work, doesn't resolve the problem.

iprob

Further testing shows that the DNS round robin doesn't work either. The problem is that if you connect via L2TP to the router that is not the VRRP master, then the traffic doesn't flow to the internal network. I suspect this is due to a mangle that forces the outbound NAT to be the IP address of the...

iprob

As would be expected, the issue is not with the MikroTik router. Doing some additional testing and verification, I found that this particular file had a corruption issue which was causing the problem. I found this out when attempting to move it to a USB drive. So, no issues with my MikroTik setup af...

iprob

I pulled some more statistics. The copy always fails at 58.6% of the copy. The file size is reported at 114.5GB. A 61GB copy of a file in the same directory had no issue. This means the file copy is consistently failing at around 68GB. That number doesn't make any sense to me. But it definitely appe...

iprob

Redundant routers... does the error occur on both? (If you disconnect 1 at a time to force the other to be active). Run memtest86 to test the memory? I've tested with making each router active (different attempts obviously). It doesn't matter which is active, the problem still occurs. I have not tr...

iprob

I have two MikroTik x86 routers running as KVM's on Ubuntu connecting two separate VLAN's. VLAN10 is 10.0.0.0/24 and VLAN100 is 10.0.55.0/24. The routers are using VRRP on the two VLAN interfaces and a public VLAN. I'm doing NAT on the public VLAN only. These redundant routers are the default gatewa...

iprob

We could only get this to work on the non-vrrp addresses. We had to set up DNS round-robin to work around the issue. Doesn't seem to work with VIP addresses.

iprob

This didn't work. I even tried bypassing the mangle and routing all traffic to the remote location to the <vrrp-gateway> which I'm assuming is the IP address of the VRRP public interface? I cannot find a way to get both IPSec and L2TP to use the VRRP IP.

iprob

I think I'm getting there. I was getting repeated "first L2TP UDP packet received" messages in the log and the IPSec SA was only in one direction. Now I see the IPSec SA on both side but no traffic on the outbound SA. I should note that I have VRRP running on the "LAN" side of th...

iprob

We went ahead and setup Ubuntu with KVM to run MT. Works well. We configured an Ubuntu desktop VM running virt-manager to get a simple GUI to the console.

Wish it would work with Hyper-V...but this is a nice option and runs very reliably and fast.

iprob

Sorry, I'm a newbie trying to do this too. I have the same problem and I'm not sure how to construct the mangle rule. Can you put an example?

iprob

I verified that the CA is in the trusted root CA's for the Windows machine. The certificate is used on web sites and that is accepted without any warning. I've opened the certificate on the Windows machine and can see the full chain is trusted. So I don't think this is a CA issue. EDIT: I've decided...

iprob

I attempted to set up SSTP using a certificate from GoDaddy. The certificate was a wildcard cert that we use for web sites and other purposes. I thought it would be nice to use the same cert on our MikroTik firewalls for VPN. Installed the certs and private keys getting the RK status next to the cer...

iprob

I was wondering if there was any news on this? I'm perfectly happy with the legacy NIC. We have a large Hyper-V installation and are looking to create a light-weight firewall/router dedicated to customers. We use a lot of other MikroTik hardware so we'd like to keep the same platforms so our support...

iprob

The answer to this question is that the PPP connection can't get an IP address like it would from RRAS in Windows (which is what we're replacing). So instead, here is what I did. 1. Create a pool on the MikroTik router since this is the only way to get IP's assigned to the inbound connections 2. The...

iprob

That would be if I were using the MikroTik for DHCP, but I'm not. Does the DHCP have to come from the router? Can't it just forward the request to my existing DHCP server and get an IP from it?

iprob

I'm trying to get L2TP to use IP addresses from a DHCP server behind the MikroTik. The L2TP connections come in and successfully authenticate against the Radius server, then are disconnected with "no network protocols running". I'm sure this is because an IP isn't getting assigned since I ...

iprob

I had two questions. One was why the CPU monitor in TheDude is always down. I know SNMP is enabled because I'm using a different software package to monitor SNMP without issue. But when I add in the service monitor for cpu it is listed as down. Also, when I discover the services on the router (RB110...

iprob

I figured it out...I forgot to check the passthrough option so it would go to the next rule.

iprob

I've been having the same problem as listed here: http://forum.mikrotik.com/viewtopic.php?f=2&t=49639 I have 4 mangle rules (IP's masked). The goal is to make sure all VOIP traffic is marked with DSCP 46 and to mark the packets for queue processing later. /ip firewall mangle add chain=forward sr...

iprob

I resolved this by assigning the vrrp interfaces to a separate ether port. The production implementation has a switch downstream of these ports anyway so the configuration works fine as long as the vrrp is assigned to a physical port instead of the bridge. It seems like the vrrp IP addresses should ...

iprob

I'm attempting to set up a basic public router and am a newbie...so my questions are probably pretty dumb. We are replacing a Cisco setup that was using HSRP for redundancy. I'm attempting to set up something similar to the load sharing configuration found here http://wiki.mikrotik.com/wiki/VRRP-exa...

iprob

Thanks for the info!

--Rob

iprob

Eric, Sorry to pick up an old post. I'm a total newbie to MT. I wanted to make sure I understood your post. The solution you are proposing will work for the second option listed in the referenced link, right (Multiple VLAN inside the same subnet)? Cisco won't support that setup but Brocade does. We ...

Search found 66 matches