MikroTik

StubArea51

Most every other vendor does this, plenty of options to choose from if that's what you're after. IMO, it would be a huge mistake for MikroTik to become too focused on verticals. MikroTik is unique because the same device can be used in an ISP, a large enterprise, a small enterprise, a mom and pop sm...

StubArea51

I hope we get an update from MikroTik on the controller soon and that it uses the new UI/UX style from Winbox 4 :D

StubArea51

Y'all did an amazing job on this. Well done MikroTik.

Would love to see an IS-IS menu under routing in the next release :)

StubArea51

I know it's been mentioned as a suggested priority by several people in the MikroTik community that are close to the dev team. I've advocated for it since day one of the Marvell chips being introduced. My guess is that if it's not added in 7.16 beta, there is prob some blocker they have to work on t...

StubArea51

The loopback 10.10.240.0/32 is duplicated on R3 and R4. It shows as a connected route on both.

StubArea51

Type 11 is listed in the docs type 11 - Opaque LSA which is flooded throughout the AS (scope is the same as type 5). It is not flooded in stub areas and NSSAs. https://help.mikrotik.com/docs/display/ROS/OSPF#OSPF-LSATypes But i've not seen a Type 11 LSA actually generated when testing MPLS and TE. I...

StubArea51

There was an update to PIM in 7.12beta7 about stability. *) pimsm - improved system stability; Might be worth mentioning that PIM-SM isn't listed as functional in the Routing Protocol Overview page. Status is "initial support" https://help.mikrotik.com/docs/display/ROS/Routing+Protocol+Ove...

StubArea51

How many routes do you have?

StubArea51

If you're looking for professional support:

https://iparchitechs.com/ecosystem/mikr ... onsulting/

If you want help in the forums, you'll need to describe the use case and what you want to configure

StubArea51

Is the peering iBGP or eBGP between the routers?

What address are you trying to ping and where does it stop if you traceroute?

StubArea51

I am ecstatic about IS-IS making it's way into RouterOS.

You and me both

StubArea51

I think this is a good addition for MikroTik as long as the forum stays. Discord lends itself well to deep technical discussions/debates that are harder to have in a forum and it's a little more fun on the interaction side (gifs, reactions, ec). But the forum is still my top choice for technical/sup...

StubArea51

Trying to get an idea of the "official" MikroTik answer here. As far as I can tell, unless you're redistributing connected, rip, bgp, static, etc , it's not possible to filter routes for LSA types that aren't external In ROSv6 the official answer to filtering routes outbound for an LSDB wi...

StubArea51

Everyone here knows how BFD is important to you all. Development has many stages. Fortunately now BFD is in active internal testing stage, so - very close. When it was "in development" previously, it was in research / theory phase. In retrospect, it was probably a bad idea to release v7 w...

StubArea51

This is great news! I can't wait to test it

StubArea51

3 proxmox servers ... 3 SSIDs ... 7 VLANs at home?

I run MPLS/VPLS at home across more than 10 mikrotik devices. Why not?

StubArea51

The most stable way to accomplish this in prod is to use scripting to keep one of the VPLS tunnels down at the redundant termination point and tie it into VRRP master/backup state.

StubArea51

I've been able to use 1500 bytes with ROSv7 and VPLS for quite a while with no issues. It' actually how my home network is built which has been running VPLS on ROSv7 for more than a year. We've also got some ISP clients using it in prod. What hardware is this running on? The image looks like GNS3/CH...

StubArea51

In modern network deployments, we avoid two things: 1. Fully-meshed iBGP/Route reflector bullshit. 2. BGP confederation bullshit. We should use is-is/OSPF or underlay of learning loopbacks between adjacent neighbours. Then use iBGP for adjacent neighbours using loopbacks on each side. Now for anyth...

StubArea51

ZeroTier was just updated yesterday to version 1.10.3 in ROSv7.9beta4

StubArea51

CCR2216 is what you want for MPLS PE or P roles which has to be processed in CPU. The CRS518 is better suited for L2 switching or more basic L3 configurations without MPLS.

StubArea51

We've tried Cisco and Juniper in our lab and couldn't ever get it to work with static VTEPs. Most likely we'll need to wait for EVPN to be added to MikroTik as that's what all the major vendors want you to use anyway.

StubArea51

When we upgraded to version 1.10.3 it was the latest one. We can't upgrade and release on the same day. We need to test it too :) Super excited about this!! Thanks to MikroTik and ZeroTier for getting that updated :) Just upgraded an RB4011 and RB5009 i'm using as ZT gateway routers in our corp net...

StubArea51

Huge fan of EVE-NG. We have an entire cabinet in our DC dedicated to network modeling and EVE-NG hosts.

But we use ZeroTier for access into EVE via a CCR2004 that acts as a ZT GW into the DC - it peers into the DC BGP RRs for reachability.

StubArea51

you are asking too much for this switch honestly, just make it layer2 switch and put a router in front, just my 0.2$ I'm not sure I agree with this statement. All of the CRS3xx series do a good job of L3 switching with either static or dynamic routing. I use it at my office, my home and in client I...

StubArea51

Hw offload is disabled. When we activate it, nothing changes on the CPU side. fw offload has some limitations that hw offload does not have - if you're trying to run connection tracking or NAT, then fw offload is what you're trying to do. Here is more detailed info: https://forum.mikrotik.com/viewt...

StubArea51

If you're doing fw offload (as opposed to hw offload) then all of the ports need to be disabled for hw offload in the switch menu and it doesn't look like that's configured.

Hw offload still needs to be enabled globally.

StubArea51

1. Put NAT on a separate router - separation of network functions is key to good network design (https://stubarea51.net/2022/05/02/webinar-isp-design-separation-of-network-functions/) 2. Does your provider support BGP communities for traffic engineering? This is the best way to influence traffic and...

StubArea51

he is looking for someone that can talk one or more lingos aka Danish, Norwegian, German

Mein Deutsch ist nicht sehr gut, aber es ist ok

StubArea51

IP ArchiTechs has several engineers in Europe that work on MikroTik projects. Visit the contact page or use our consulting e-mail address to setup a meeting to discuss your project. We've done work in Denmark before. https://iparchitechs.com/ecosystem/mikrotik-network-consulting/ https://iparchitech...

StubArea51

ZeroTier interface management is pretty much set and forget. As far as firewall rules, you could manage them on the Tik locally or you could use ZeroTier's centralized flow rules which allow you to push policies to each endpoint and create tags for reusing components. It's a great way to centrally m...

StubArea51

Hi IPANET, one day I will get to a proficient level of zerotier use.................initial forays were not productive and experimenting on family is not a good practice. I am quite comfortable now with wireguard so perhaps its time soon to start on the zerotier methods......... You'll like ZeroTie...

StubArea51

the business value (as for example as a management network, IOT, etc) would be enormous if Zerotier could be implemented on a broader range of devices. Agree 100% , I'm a huge fan of ZeroTier and I think too much focus is based on throughput as the only metric by which a VPN is useful. Most busines...

StubArea51

I don't understand why MikroTik doesn't release it also for MIPSBE and MMIPS :( Most likely because throughput and speeds on mips are not very high and it would create more support issues with people complaining about speeds. That said, I see an enormous amount of value in enabling it on processor ...

StubArea51

Routing over MLAG is typically something you want to avoid even in mature MLAG implementations like Cisco and Juniper. MikroTik's implementation is really only intended for L2 and even when L3 over MLAG is officially supported, i would still avoid it as a network designer. Here is a great deep dive ...

StubArea51

Any ideas? I'm at my witts end with it. Do I need a peer remote address on IPv6 to advertise IPv6? Right now my advertising AS peer if a v4 remote address. While it's possible to advertise both BGP AFIs over an IPv4 peering, very few ISPs do this. You should have an IPv6 address for peering from yo...

StubArea51

That's prob a better way to say it.

More accurately - you can't use them together on the same set of ports.

StubArea51

This implies that if i use L3 FW offload I can't use L3 HW offload too, FW and HW simultaneously ? I would say that's accurate because in fw offload you have to disable hw-offload on the port level (but enabled at the switch level) so the only way traffic is getting hw-offloaded is if it hits a man...

StubArea51

One thing that would help to disambiguate: l3 hw offload - stateless offload of IPv4/IPv6 routes into hardware l3 fw offload - stateful offload of IPv4 connections and NAT (IPv6 fastpath/fasttrack yet to be implemented) Brief list of what we discovered with fw offload in our lab and in prod for an I...

StubArea51

have the traffic between vlans (inter-vlan) offloaded when possible To be clear. l3 hwoffload works without issue on CRS3xx and CCR2xxx (haven't tried on CRS5xx yet) and can use VLANs and LACP. Inter-VLAN routing, OSPF, BGP, static routes, etc. It's stateless and doesn't try to offload NAT or conne...

StubArea51

I was trying to do fw-offloading, but without NAT. fw-offload took a few versions to stabilize. We sent in at least one ticket to MikroTik support on it. It's been a while since I tested it in the lab, but here were the limitations of fw-offload as of 6 months ago (discovered via testing and prod u...

StubArea51

Please share the solution here, once the problem is solved. I'm really interested if it's a configuration error or a bug. I never could get L3 offloaded inter-vlan routing working on my 2116, reading the wiki page dozens of times, and trying every possible configuration. IP communication worked, bu...

StubArea51

Those that want a long-term version: what is the requirement for that? It's definitely not a new concept in network engineering. Going back over 20 years, Cisco produced safe harbor code that turned into their "star" code for the most stable release within a major version. Just like any o...

StubArea51

We've migrated a lot of client networks to ROSv7 or to mixed ROSv6 and ROSv7 environments A lot of it hinges on the complexity of routing in the existing network - simpler OSPF/BGP/MPLS networks seem to be running well on 7.7. Those with more complicated feature sets seem to uncover bugs faster due ...

StubArea51

CPU is still required for the control plane, so I don't think you'll achieve quite the same results as the 2216 if you need lots of BGP Peers, ARP entries, etc. For simpler networks with lower route / arp / mac table counts, I think you'd probably experience similar results for throughput since it's...

StubArea51

Static neighbors are typically for situations where the multicast groups that OSPF depends on can't be used easily or have issues that don't affect unicast traffic.

Common examples are VPNs, PTP RF links that don't support multicast well or Layer 2 circuits that have multicast restrictions.

StubArea51

Zerotier is not that easy

In close to three decades of doing this stuff I don't think I've ever found a VPN as easy as Zerotier for non-technical users or entry level tech people.

Curious what parts of ZeroTier you find to be complicated to operate/configure?

StubArea51

If you add the hAPax3 running a Plex (or similar DNLA thing) container, you'd be able stream movies from your own library (e.g. container using NFS on hAP to get CCR files). I'm already doing this on my CCR2116 at home. I put a 512GB nvme drive in it and loaded the plex container. It's also tied in...

StubArea51

Anyone got any thoughts on what I'm missing? Thanks! There are a few things I would simplify as you can advertise IPv6 BGP prefixes several ways. Here's what I would try 1. disable the static routes for the /48 as unreachable 2. disable the bgp aggregate config 3. remove the synchonize check box on...

StubArea51

i can ping all from all and winbox all from all but not romon ... It sounds like maybe you don't understand why RoMON exists and what it's used for. RoMON was added to RouterOS in 2015 to make it easier to manage routers using L2 only. Previously if you had a routing issue and needed to mac telnet ...

StubArea51

Amazon is a dogs breakfast (in terms of knowing who the vendor actually is), I would be more concerned with a supposedly 'valid' seller storefront online.

In this case, it was a well-known reseller and not some random person.

StubArea51

Where is the device you want to connect to with RoMON - on the home network or work network?

How is it connected to the VPN client or server?

StubArea51

You cannot connect via MAC address over SSTP as it is a Layer3 VPN

You need to use what is called a Layer 2 overlay - examples are: L2TP, EoIP or ZeroTier. Then you will be able to connect via MAC between those locations.

StubArea51

It's not just in Spain, I saw a CCR2116 for almost $2K USD on Amazon last week.

StubArea51

Do you have a drawing of your network?

StubArea51

Enable RoMON on the VPN router

tool/romon/set enabled=yes

Then use the same command to enable RoMON on any router connected to the VPN router or reachable to the VPN mikrotik via routing.

Watching the MikroTik official video on RoMON will help:

https://www.youtube.com/watch?v=Peg6UcSJ_eA

StubArea51

For L3 access (connect via IPv4/IPv6) to a MIkroTik router that can reach RoMON enabled devices behind it

Any VPN will work

For L2 access (Connect via MAC address) to a MikroTik router that can reach RoMON enabled devices behind it

L2TP, EoIP or ZeroTier will work.

StubArea51

RoMON works over Layer 2 but you can connect to a router via Layer3 over a VPN and use RoMON to access the routers behind a VPN gateway that are reachable via RoMON.

ZeroTier or L2TP are good choice if you also want to be able to connect via RoMON at L2 over a VPN.

StubArea51

I would also consider disabling hw-offload and testing purely on CPU to determine if the problem is related to hw-offload and MPLS running together since MPLS traffic is not yet supported in hw-offload. The ISPs that we've done work with running MPLS using ROSv6 and ROSv7 have had mixed results. Som...

StubArea51

And I keep all my interface MTU at 9220 and VLAN interface for MPLS at 9216. The first thing that stands out to me is that your MTU settings are incorrect for the pseudowire mtu you're trying to support. Have you checked for fragmentation? You need a minimum of 26 bytes of overhead between the VPLS...

StubArea51

IPANET, so you can confirm that lets say I am on the road ( be it iphone or laptop ) can connect via zerotier to my home and go out the home internet? Yup, my public IPv4 and IPv6 flip to the datacenter when I use ZeroTier either with a router at home or with the ZT client on the road. You have che...

StubArea51

Typically 400 to 500 Mbps. Until ZeroTier is updated for multi-core in MikroTik's implementation, you won't see much beyond 700 to 800 Mbps which is what I got when I tested locally between the two 2216s we have in the lab. I don't use wireguard / ipsec as much anymore becuase most of the clients I ...

StubArea51

Works great for me but I've also got a data center to send it to and my own IPv4 / IPv6 space. It's also going over a gig symmetric pipe in both locations. I use an RB5009 as a ZeroTier gw at home and a CCR2004-1G-12S+2XS in the data center so i can typically get several hundred meg between the two....

StubArea51

I will wait for some confirmation by others that it works well for thembefore I try this on my CRS317. The warning on the alphas was too scary. I also would like to understand what the reason was for the warning and what change makes this beta suitable for CRS devices again. Seems to be good on my ...

StubArea51

The network statements will be looking for an exact match of the prefix length because you have synchronize turned on which will look for that route in an IGP. For the aggregate statements, you need make sure you have component routes within those ranges that are smaller than the summary. Can you po...

StubArea51

Just upgraded hAPax2 & rb5009 and both are working well.

Using IPv4/IPv6 unicast, OSPFv2, OSPFv3, VxLAN, ZeroTier

StubArea51

Also wanted to bump this to the top and ask about dhcpv6 relay + prefix delegation and dynamic route injection. Any idea when this might be added?

StubArea51

Without more information, it's hard to point to a root cause.

Are you using hardware offload?
Do you have a mixed ROSv6 and ROSv7 MPLS environment?
Have you verified MTU is set correctly after the migration?

Please post your config and throughput numbers.

StubArea51

Short answer is that it interoperates with just about any standards-based network gear and can be highly available in critical environments if designed properly. If you really want to dive into more specific examples, I recorded a podcast with the Packet Pushers that goes into this topic in a lot mo...

StubArea51

Babel has always been interesting to me because I work on a lot of WISPs and presumably, it would be good IGP for that use case. That said, i've not seen a great real-world comparison between babel and ospf, is-is or even eigrp. Not having the ability to easily use MPLS and L2/L3 VPN would be challe...

StubArea51

It might help to post your configs and the routing tables. This type of failover works pretty reliably with OSPF/MPLS/VPLS in MikroTik.

StubArea51

What are the outputs of?

 ipv6/address/print
 
 ipv6/route/print
 
 ipv6/neighbor/print

StubArea51

Also if configuration will be successful, this will be a good example for other users. Reddit already has a validated base config: https://www.reddit.com/r/Starlink/comments/xv2p04/starlink_ipv6_config_for_mikrotik_routers/ It seems that IPv6 connectivity is still very much a regional thing as some...

StubArea51

Change your pool prefix length to /64 on the DHCPv6-PD client

Then add an address on the LAN bridge or interface like this:

ipv6/address/add from-pool=StarLink-V6 advertise=yes interface=LAN

StubArea51

I've only been able to get ChatGPT to create ROSv6 configs even though I specifically asked for ROSv7 syntax.

Admittedly, I haven't tried very hard yet. Still, it's a great starting point !

StubArea51

I was getting error 71 but fixed that with turning off graceful-restart long-lived receiver on the juniper. Now I'm getting Unsupported capability received, code: 128BgpStarter{ c=Connection{ ConnId{ 192.168.100.8:44787 -> 192.168.100.7:179 } Socket{ 5 ida } out } readsz=99 } cancel bgp just won't ...

StubArea51

It largely depends on what you value more stability or new platform/features CCR1036 on 6.48.6 is going to be rock solid and can handle 10G + 2 full tables without issue - it just isn't super-fast to converge. That said, Tilera chips are no longer being manufactured and there is a finite supply of t...

StubArea51

I hope to see BFD soon but I remember when MikroTik was working on BFD issues in the CCR1K series maybe 10 years ago. It took several years to fix it. Not sure what the challenge is but i've seen lots of BFD bugs and issues even in recent Cisco/Juniper code. It's not the easiest protocol to implemen...

StubArea51

There's no other way to put this. Even if it's purely software/CPU. Multiple bridges will perform worse than a single bridge. This assumes that maximum data plane performance is the only consideration when building a network. I think this is a case where "it depends" is very relevant. The...

StubArea51

It really depends on what you want to accomplish with a separate routing table from a design perspective. In general, VRF/routing marks are used for: - Multitenancy - Security Zones - Route and subnet overlap - Separating management and OOB networks - Policy based routing (in MikroTik and Linux anyw...

StubArea51

IPoE is legacy like PPPoE. You should use DHCP as is with RADIUS and option 82 + any other option that you need. https://docs.splynx.com/networking/authentication_of_customers/mikrotik_dhcp_radius I wouldn't call IPoE legacy exactly. It's still the primary L2 mode for UNI ports on most of the Metro...

StubArea51

No problem. Another way to solve this is to just ask for an IPv6 block from the RIR. You can use it as common IPv6 space for internal use. A /40 is free from ARIN until 2026. https://www.arin.net/resources/fees/fee_schedule/ *There is a temporary IPv6 fee waiver for organizations in the 3X-Small ser...

StubArea51

I gratefully accept my flogging for the ULA suggestion. I was unaware of the issues.

No flogging needed. The creators of ULA weren't aware of it either until last year when we spent the better part of 6 months convincing them of the issues outlined in the draft on the IETF v6ops mailing list.

StubArea51

NATv6 using the fc00::/7 network reserved for private networks. It's not quite the same as RFC1918, but it does give us some ipv6 space that is not going to be centrally registered, so possibility of collisions if low especially using a random generator. Adding a /64 to each local BRIDGE from this ...

StubArea51

Can you post the config? It's not a combination that we would use in prod (if it did work) considering all of the caveats MLAG has.

StubArea51

What routes are being sent to the v6 router? the current real internet routing table or one you generated? It's an MRT dump from RIPE into a CHR that acts as the upstream peer. MRT files are snapshots of the DFZ at a point in time so they have all of the unique AS paths, communities, prepends, etc ...

StubArea51

Wait hold up - your core router is v7 - the issue i have is v7 sending ibgp routes (ebgp learned and non ibgp-rr configured) to v6 ... v6 sends all routes to v7 fine. If you look at the setup this is happening on edge-02 which is ROSv7. It's sending eBGP learned routes from the Initech upstream via...

StubArea51

Happy New Year to you as well :) The problem with your design is it isn't using the standard ibgp full mesh This is intentional because I modeled it after a prod ISP peering edge and while you would use full mesh between full table routers, the peerings to the core would use route-reflection and fil...

StubArea51

Update, I tested with a ROSv6 box using a CCR1036-8G-2S+ in place of the CCR2004 for edge-01 and got the same results. This is on IPv4 as I still need to fix my IPv6 route gen for full tables - so that will be my next test. But for ROSv6 to ROSv7 peerings on iBGP v4 afi, it appears to be working pro...

StubArea51

I am not a fan of Unifi, but at least at their cheap $400 routers, it is able to graph traffic. Ubiquiti spent all their money on UI polish, MikroTik spent their time on functionality. Neither is perfect, but MikroTik's routing stack is easily 5 years or more ahead of Ubiquiti. I absolutely want fe...

StubArea51

It sounds like you're using different routing marks / vrf to learn each routing table

Is there a reason why it can't all go into the same routing table? Then the best route will be determined automatically via the bgp best path process.

StubArea51

Unfortunately, no. I just tested on IPv6 BGP, i disabled the eBGP peer on the rosv6 router and no routes were added from the v7 router. I think you mentioned earlier you were doing loopback peerings. This won't work with IPv6 between ROSv6 and ROSv7 because routing recursion to resolve the next hop...

StubArea51

The routes are not being sent at all. So.. for example, if the routes learned from eBGP on router 1 are active on both routers and the eBGP session is lost, the inactive eBGP routes from router 2 would need to become active in the local routing table after the failed routes get removed, they would ...

StubArea51

So I started working on this because I've had some clients describe the same behavior of not all iBGP routes being learned. At first I thought it might be a bug, but now that I look closer at it in the lab, I think what may be happening is the normal BGP behavior of only announcing active routes to ...

StubArea51

I'd probably check some of the common config issues with that error. A few are listed here:

viewtopic.php?t=176376#:~:text=%22phase ... %20packets.

StubArea51

I would start with the L3 hw offload docs as they describe inter vlan routing and ptp routing pretty well. https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading Here is an example config with the switch behind firewall/NAT https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading...

StubArea51

I would be interested on having a business-level collaboration with you, in order to make this project a reality. Would you undertake it? Since Eduplant mentioned not being interested in contract work, feel free to reach out to IP ArchiTechs if you want professional help. We have engineers in Europ...

StubArea51

CCR1009 is fine if you're not doing full tables. This really comes down to stability vs. features. ROSv7 has come a long way and we have clients using it in prod, but there is still work being done on BGP, MPLS, hw offload, etc. Unless you keep up with the changes in ROSv7 beta and understand what t...

StubArea51

*) mpls - fixed assigning of explicit null label for IPv6; Glad to see the work going into MPLS on IPv6. Being able to build an IPv6 only underlay and deliver v4/v6 services on top of that is the direction overlay networking is headed. I'm encouraged by the amount of IPv6 work that i've seen go int...

StubArea51

Bump. The good news is the flap bug from my first attempt at moving to v7 is gone. The bad news is, me along with several others are still having issues with this one... I have tried every config option and variant to get v7 to announce all its eBGP learned routes to its iBGP peers. Nothing works. ...

StubArea51

From testing in production, there are a number of current limitations for L3FW offload which are more limiting than L3HW offload. This is from 7.6 testing, i've not tried this in 7.7beta9 to see of some of the restrictions have been changed. The limitations we observed (and don't appear to be docume...

StubArea51

Use serial console and netinstall so that you've got a clean install. Any time you get into odd behavior with loading the OS and loss of connectivity on the ethernet ports from a failed upgrade, it's time to netinstall. Here is the step-by-step guide: https://help.mikrotik.com/docs/display/ROS/Netin...

StubArea51

The first thing i'd try is a traceroute from either PC to understand what hop the traffic dies at.

If you're using the virtual PC node with EVE-NG, I don't believe that supports IPv6 SLAAC so make sure the PCs have a valid GUA address and can ping their gateways.

StubArea51

Can you post your config and the output of

routing/bgp/session/print detail

StubArea51

sid123 can you make a separate topic for your issue? this topic is about a specific issue. everyone else - we are seeing something like this too. we are working on a fix in the internal betas right now, so next major v7 release should hopefully resolve the problem. Great to hear that you were able ...

StubArea51

I've not really looked into the specific log messages, but I'm seeing the same thing on my hAP ax2 devices using 7.6 and 7.7beta6.

StubArea51

If you're looking for general design guidance, here are some resources that i've written/recorded from designing and building hundreds of ISPs as a consultant Separation of network functions - a design philosophy that compartmentalizes the config required for certain tasks to enable simpler operatio...

StubArea51

I just tested this on my CCR2116 at home. It's great!

Thanks for all the work you put in

StubArea51

It's a bit strange to begin with IPv4&6 HW offload, and not MPLS. It's not strange at all. LDP requires IPv4 or IPv6 + an IGP to build the forwarding table of label bindings so ensuring that IP forwarding is working correctly with offload is foundational work to enable MPLS and offload. It's al...

StubArea51

It sounds like your problem is more with design than the router. Ideally you should separate network functions so they can scale. For PPPoE, take a look at this article to create multiple MikroTik BRAS routers for the same L2 domain to achieve load balancing and high availability https://stubarea51....

StubArea51

I assume that you'll be using this on connections that does not saturate the CPU. For most remote worker deployments in large enterprise, they care far more about management UI, security policy and ease of deployment vs. throughput. 25 to 50 Mbps is more than adequate for most remote work VPN scena...

StubArea51

I've got 5 of these showing up today. In addition to testing the AX WiFi, I'm also gonna build a small SD-WAN style deployment with ZeroTier. Have been working with an enterprise client on replacing Cisco APs for remote workers with MIkroTik ARM devices to tunnel back to the DC using ZeroTier. These...

StubArea51

I would be very surprised if MT wasn't working on AX versions of WISP gear. I suspect they are just working through the backlog of product announcements while trying to focus on ROSv7.

StubArea51

I would definitely open a ticket with MikroTik on this.

Are any firewall rules in use? Hw offload? Connection Tracking?

StubArea51

One thing to be aware of regarding the Dell switches is they generally have issues when doing interop for Rapid STP with other vendors. We generally use MSTP if interop between MikroTik and Dell or other vendors is needed. Here's a doc that goes over some of the issues as it relates to Dell and Cisc...

StubArea51

I'm also interested to see an example config for this.

I tried using a v4 AFI over an IPv6 only peering back in 7.3 but wasn't able to make it work and didn't have time to troubleshoot.

StubArea51

4 Months Production with L3HW Offload on some 309, 317, 326 with ipv4 and (trying offload on beta) ipv6. Running eBGP Private AS with 200-300 prefixes and some redundant links. From 7.3.1 until 7.6beta10, still got issue if got some Fiber Cut or some bgp session down. Prefixes still there, but traf...

StubArea51

Great job on the video...the more content and education we have for IPv6 especially for languages other than English is fantastic.

StubArea51

Where's the promised youtube link?

Hasn't been published to YouTube yet but the video is in the blog link I posted.

We are redoing our corp YouTube channel and there is some stuff they are working on before it drops.

Are you having issues loading the video from our site?

StubArea51

Finally got the webinar published!

https://iparchitechs.com/2022/09/29/web ... deep-dive/

StubArea51

This is with 7.6 beta8

StubArea51

I'm having the same type of issue with deleting communities in a route. Here is a received route with a large community [zuul@rtr-core-01.v7.ipa.dev] > routing/route/print det where dst-address=0.0.0.0/0 && bgp Flags: X - disabled, F - filtered, U - unreachable, A - active; c - connect, s - ...

StubArea51

I'm pretty certain MikroTik has mentioned they are planning to implement VPNv6 at some point, but VPNv4 isn't working reliably yet, so that may be a ways off.

StubArea51

It's also helpful to realize that the 2116 CPU has 4 x 10G lanes into the switch chip

Whereas the 2216 has 4 x 25G lanes from the CPU into the switch chip.

StubArea51

Got power back, its still not up on youtube??

No worries...hope everything is ok with the Hurricane recovery

It will drop to YouTube this upcoming week. The video nerds have to do a little post-production work

StubArea51

@IPANetEngineer
is that on v7.5?

It's on 7.6 beta8 that was just released

StubArea51

Currently, also the output is a large string blob, not really easily usable for filtering let's say by prefixes and communities like in your example. That is why we are asking for as much feedback as possible to know in which direction to move. That makes sense. Sometimes, you know exactly which pr...

StubArea51

Then it seems like it would make sense to put all advertised routes in /routing/route/advertisements and use existing flags to identify what protocol is advertising the route.

That would match the behavior of /routing/route since it already knows about all learned routes

StubArea51

It really depends on what the router is being used for. In a datacenter with a small internal table of BGP routes that will be advertised, the current format is manageable. Let's say that i'm debugging an issue for a downstream transit customer that is having problems with routes from google or face...

StubArea51

not really sure how do you imagine showing, for example, a list of 100 advertised prefixes in the session menu. I'm really excited this is finally done so thanks for getting it in the code. I do, however agree with pe1chl that it should probably be moved to something like: /routing/bgp/session/adve...

StubArea51

I just saw that!

I know that some of the Marvell Prestera chips support MACSEC in hardware - would love to hear from MikroTik if there are plans to put MACSEC into the chip.

I need to add MACSEC in my v7 lab and play with it some.

StubArea51

Awesome! I've been wanting to use CRS switches as L3 devices throughout the network for quite a while and now that the software is catching up, it's going to be a great inexpensive L3 switch. CCR2116 also has a Marvell ASIC in it and is a strong contender for a single device at a tower, distribution...

StubArea51

Yes active/passive is not the 802.3ad LACP standard and is implemented by most operating systems as a proprietary etherchannel/bond

StubArea51

I don't think this is possible. Aside from MLAG, most LACP implementations don't support links of variable speeds because it depends on equal speeds for hashing traffic.

An active/passive bond might be a better fit

StubArea51

routing/stats/adverts/show is the base command publisher - kind of oddly named, but this is the peer you want to see advertised routes from dsts - filter the output by prefix and length It appears that prefixes sharing common attributes are grouped together with the attributes at the bottom. It woul...

StubArea51

Only part of EIGRP was released to open source because Cisco holds patents on some other parts and they can't easily open source it. But to be fair to Cisco, they openly offered EIGRP to the IETF as a standard back in the 90s and the response from the IETF was "we already have enough IGPs"...

StubArea51

Just a reminder, this starts today in just over 1 hour at 10AM Eastern.

Hope to see you there

StubArea51

Having worked with RouterOSv7 in prod quite a bit for ISPs and Data Centers, we are putting together a webinar that's a deep dive on BGP/OSPF for IPv4/IPv6 and touches on l3 hw offload. We'll be highlighting new features as well as differences between ROSv6 and v7. It will be recorded on Friday, Sep...

StubArea51

I'm not aware of any way to set this as of ROSv7.6 beta6

Maybe MikroTik can comment if the command exists

StubArea51

my cell phone when connected to the WiFi gets an IPV6 address from the ISP. Is there a way to block the phone from receiving one ?

Why do you want to disable IPv6?

StubArea51

I did a quick drawing because it made it easier to read the OSPF LSAs. It seems like there is a problem between the OVPN Server and Pisecne because it's not learning any OSPF routes from the server but Prague is. A few things that would be helpful 1. You're using a broadcast network type on a non-br...

StubArea51

Gotcha...now what's the output of

routing/route/print
routing/ospf/export

For all three routers?

StubArea51

What is the output of:

routing/ospf/lsa/print detail

On all 3 routers?

StubArea51

The CCR2216 should easily be able to handle that load both for NAT and throughput.

StubArea51

You'll find more detail in /routing/route

You can select any list of attributes that you want to display by using the proplist command

Here is an example that shows MED and localpref

routing/route/print proplist=dst-address,bgp.med,bgp.local-pref,gateway where 1.1.1.1 in dst-address

StubArea51

Verify MTU, timers and network type all match

I would also disable opaque LSA capability on the Huawei router until you have the neighbor working.

StubArea51

If all you were doing was using it as a basic L2 switch, the 7.x code is definitely fine for that and helped to fix a lot of stability issues in CCR and CRS platforms. Instead of upgrading though, you should netinstall to v7 so that you're not wondering about corruption of the storage/filesystem if ...

StubArea51

Extending the subnet of one site to another isn't really the best way to fix this and will cause long term issues. If the 1100 is learning OSPF routes, that means there is another router (or more) involved. Can you post the /ip/route/print output of the routers that are the L3 gw for 10.10.30.0/24 a...

StubArea51

By cascading do you mean load balancing across multiple routers? Or something else?

StubArea51

Just to clarify terminology, redistribution is a manual config in BGP that is not the default.

It seems like you're describing advertising eBGP learned routes to iBGP peers..is that accurate?

Can you share config and the output of /routing/routes for the routers involved?

StubArea51

Agreed, I'd love to see hardware MACSEC available. Especially for the broadcast video world where it is often required.

StubArea51

If you post the output of

/ip route print

for each router, that would help narrow down where the problem is.

StubArea51

Got IPv6 hw-offload working in my home network. It's great! https://www.reddit.com/r/mikrotik/comments/x6jot3/got_ipv6_hwoffload_working_on_ccr2116_and_crs328/ https://preview.redd.it/twfn7q7ub2m91.png?width=866&format=png&auto=webp&s=31e0b67e6a3c4901e80bac1a165721913866d952 https://prev...

StubArea51

I agree, this is a common scenario and should definitely be developed if possible. vrf support in hardware would be great as it would kill two birds with one stone.

StubArea51

The routes look correct and your zerotier controller route appears to be correct.

Have you tried disabling all firewall/mangle/nat rules that aren't required for Internet access to see if they are messing with the end to end connectivity?

StubArea51

Can you post the output of

/ip/route/print

StubArea51

If you traceroute from the host you're trying to reach to a destination over ZeroTier, where does it stop?

Likewise, if you trace from that destination across ZeroTier and back towards the LAN HOST, where does the traceroute stop?

StubArea51

Try creating a peering over IPv6 instead of passing the AFI for IPv6 over an IPv4 peering and see if the behavior changes.

StubArea51

Hello Members!!! I am looking for the Hardware CCR or CRS which is Quite suitable to run MPLS Backbone in 6 Locations. Traffic Passed over MPLS will be Around 6G-8G... Can anyone Please recommend which Hardware I can use in this case.??? 1. Can i use Mikrotik CRS for MPLS or should i look for CCR S...

StubArea51

My guess is 2023 since it's pretty late in the year to announce a MUM. Even if it was announced today they'd probably want to give at least 90 days notice (if not more) to give people time to plan travel which puts us pretty close to winter holidays. Most of the US and European MUMs i've been to are...

StubArea51

Are you using IPv6 in the underlay as well?

StubArea51

This may help to gauge hardware, resources and throughput although it doesn't specifically relate to LNS/LAC MikroTik CHR – Breaking the 100G barrier https://stubarea51.net/2021/12/13/mikrotik-chr-breaking-the-100g-barrier/ https://stubarea51.net/wp-content/uploads/2021/11/MikroTik-CHR-Breaking-the-...

StubArea51

Are you using the same VLAN on both pairs of switches for MLAG? Also, have you set the STP root for the VLANs to be the switches running VRRP? Ideally you want the VRRP master to be STP root and the VRRP standby to be secondary root. A second bridge won't help as it will disable hw offload on the se...

StubArea51

I'm using bridge VLAN filtering on a number of platforms with 7.3 and 7.4 - it sounds like you might have config issues.

StubArea51

Hard to tell without looking at your config. Have you reviewed this thread?

viewtopic.php?t=183971

StubArea51

TACACS+ support

Free Range Routing to get IS-IS and SR-MPLS support (if possible - not sure how well it will work)

StubArea51

Seems like these are the hardest to find

1. anything with POE
2. Certain ARM platforms
3. Legacy CCR 1K series

StubArea51

Use Google magic

Search
<search terms> site:forum.mikrotik.com
Or alike.

Works pretty well.

Yup, that's exactly what I do - I use this every day.

StubArea51

Tried this in my lab on 7.4beta4 and interestingly enough, it works fine with IPv6 but not IPv4 @MikroTik - is this a known bug? R1 [zuul@ccr2116-01.test.lab.ipa.net] > routing/ospf/neighbor/print Flags: V - virtual; D - dynamic 0 D instance=ospf-instance-v3-ipv6 area=ospf-area-0-ipv6 address=fe80::...

StubArea51

the router model is CCR 1036-12G-4S. The router was purchased 7-8 years ago.

What is the output of

system health print

StubArea51

It's a little unclear as to what exactly isn't working. Where are you seeing the issue?

StubArea51

This isn't normal behavior for a CCR1036, what version of RouterOS are you running and how old is the CCR?

StubArea51

why this wiki pade have been removed ?

Most likely because the wiki is being deprecated in favor of https://help.mikrotik.com/docs/

StubArea51

Can you post your config and ROS version?

StubArea51

User forums have always varied widely in content and quality since the early days of the Internet. We should always strive to improve but the variance will always be there. Your thought process is a little hard to follow though as the first part of your post relates to the specificity of answers giv...

StubArea51

It's not clear exactly what isn't working.

Can you post the relevant IPSEC, NAT configs and platforms w/ software versions

StubArea51

Probably one of the first things you want to verify is whether or not your IPv6 PI space is being advertised to your BGP upstreams? You can put the prefix in here (or any other looing glass) and see if it's learned in the global routing table. https://lg.he.net/ What version of RouterOS are you usin...

StubArea51

In ROS v7 BGP and OSPF are separate processes, so that may improve things a bit. Is there any internal prioritization for the routing processes in ROSv7 so they remain stable under high CPU load? Cisco and Juniper apply a DSCP marking to routing protocols to keep them prioritized as well as giving ...

StubArea51

fwiw, you can also combine queries using the && operator to specify only IPv6 or any other attribute as well as the community search. Here is an example with large communities. [zuul@sw-core-01.jan1.us.ipa] > routing/route/print detail where afi=ip6 && bgp.large-communities="650...

StubArea51

Have you tried this on 7.4beta4 as well?

StubArea51

If you erase the default config that it comes with, you can create a basic AP and bridge config for the audience like any other MikroTik device and NAT won't be enabled.

StubArea51

MikroTik has a great example on mvoing from v6 OSPF to v7 OSPF. Here is a basic OSPF setup for IPv4 and IPv6 referenced from that link. You should be able to use this to modify your config. Alternatively, you could create a ROSv6 CHR, paste your config in and then upgrade to ROSv7 and the config wil...

StubArea51

Short, text version?

It's an hour-long podcast and I don't think the transcript is available. If it is, it wouldn't be short

StubArea51

If you haven't seen it, I thought that I would share this podcast here. Packet Pushers is one of the largest network engineering podcasts out there and has a huge reach in the enterprise and data center space. They've had more and more feedback that MikroTik is becoming increasingly common in the En...

StubArea51

We tried this with Cisco Nexus and didn't have any success. EVPN was the major hurdle as most Cisco designs leverage EVPN as a control plane for VxLAN. However, even though it's possible to do VxLAN without EVPN, that static VTEP config in MikroTik did not work in the interop testing we tried. We ha...

StubArea51

If you're taking full tables, you can block the outbound traffic by installing routes for that ASN as blackhole routes using a routing filter.

For inbound, you'd have to talk with your upstream and see if they have BGP communities that will allow selective 'no-export' for the ASN in question.

StubArea51

Are you using hardware offload on the CCR2216?

StubArea51

I would like someone to help me, I really need to do a filter to announce my ipv6 block to the operator, and block the millions of routes received by her. Here is an IPv6 filtering example for advertised prefixes from a blog post I wrote: https://stubarea51.net/2021/08/24/mikrotik-routerosv7-first-...

StubArea51

For what it's worth... I ran a large Cisco carrier network that covered 3 US states and 10,000 subscribers when I first learned about MikroTik 12 years ago. I had recently finished my CCNP route/switch (which i still have active) and was not afraid to tackle incredibly complex routing/switching desi...

StubArea51

End hosts and systems unlikely to loop can be assigned the edge role so that they don't affect the STP topology and go into forwarding immediately. They plug $20 NetGear switches into single-drop wall jacks to get more ports, and then in their ignorance create a loop the dumb switch is incapable of...

StubArea51

I agree, wireguard is great for technical people and infrastructure, but it's not a great client facing VPN for non-technical people. ZeroTier excels at this use case and is perfect if you want a solution that you don't have to spend much time "administering" it just works. It also scales ...

StubArea51

NVR access externally is a great use case for the ZeroTIer VPN protocol which was just added to MikroTik on ARM based devices last year. If you're unfamiliar with ZeroTier - here is an overview of it (before MIkroTik support was added) https://stubarea51.net/2020/03/10/remote-workers-rapid-and-cost-...

StubArea51

STP is really only needed on switch ports that have a potential for a loop or broadcast storm. Typically, I turn STP off on the port when a router is connected and then leave it on when connected to a switch or bridge. End hosts and systems unlikely to loop can be assigned the edge role so that they...

StubArea51

Just finished up an article on ROSv7 and LDPv6 for MPLS operation over IPv6 networks. It's got config examples and some notes on hardware offloading since a CCR2116 was used in the testing. Enjoy! https://stubarea51.net/2022/05/16/mikrotik-rosv7-vpls-over-ipv6-mpls-with-ldpv6/ https://stubarea51.net...

StubArea51

Many ASNs will ignore prepends in the DFZ these days because they set a default localpref or modify the localpref based on the peer the routes were learned on.This is likely why your prepending solution isn't working as expected. Either advertise more specific routes as someone mentioned or use traf...

StubArea51

When using routers, you typically don't want to just bridge the traffic through for a single subnet. If you need to keep a /24 intact across multiple routers, VPLS is much better for that. Here is an example topology for that https://stubarea51.net/wp-content/uploads/2020/03/routing-design-iBGPOSPF-...

StubArea51

I haven't tried it yet but I think it's something like this

ROS v7 accepts this syntax

add chain=test rule="if (dst in 200:co1d:c01a::/48) { set bgp-path-peer-prepend 5;accept}"

StubArea51

Curious to know where PIM is in the order of priority for ROSv7 development?

Tried to use it on ROS 7.3beta37 to support BUM replication & VxLAN interop with Arista - it's definitely still non-functional.

StubArea51

This is a normal behavior and is designed to protect your privacy online. It's a function of Windows (and other operating systems) and is not due to a setting on the MIkroTik. The temporary addresses will eventually expire and are called "privacy extensions" https://www.internetsociety.org...

StubArea51

I've had this issue with Comcast as well where the DHCPv6 client doesn't auto recover on a number of different ROS versions across 6 and 7. I suspect a packet capture would be needed to figure out which part of the conversation is missing. I've never been able to pin it down because it only happens ...

Search found 1753 matches