MikroTik

turnip

I agree that it mightn't be necessary in this case, but if you want multiple VLANs on one SSID without using RADIUS, grab a Grandstream access point - they're cheap and support PPSK. Put it on a trunk port on your Mikrotik. I'm designing a large network for some resorts and I'll have one SSID for ev...

turnip

Mikrotik don't have any 12x 40G switches, but FS.com can make custom DAC cables (FS at one end, Mikrotik at the other). You may prefer to keep everything the same brand to simplify management, but it'll work. Mikrotik are leaning towards SFP28 (25GB) and QSFP28 (100GB). If 25GB is enough, you could ...

turnip

FS.com have GPON SFP modules that should work. I haven't tested it, but if you contact them I'm sure they could either test for you or let you return it if it doesn't work.

turnip

The XS+DA0003 supports SFP28, so 25Gbps.
The S+DA0003 is discontinued, the XS+DA0003 is its replacement.
Both are passive cables, so not supported on the RB4011 (although it worked for me with an S+DA0001).

turnip

While it would be useful to see an LLDP-MED based auto-voice VLAN like other brands, on some CRS models you could use a switch rule to catch the phones. Most manufacturers would only have a couple of MAC prefixes. On the older ones, you'd need to enter the MAC address for every phone.

turnip

I've written some Lambda functions and other AWS services to connect Mikrotik devices to a Wireguard VPN, assign an IP, collect Netflow and logs at a central location and store them in S3. Nowhere near finished, and I also plan on taking advantage of the REST API to push out configuration changes. M...

turnip

I'm collecting Netflow data using Fluentd and storing it as Parquet files on AWS S3. I'm then using Athena to query these files using SQL and Grafana to visualise the data. I've tried using Netflow v5, v9 and IPFIX. When I use v5 I can get the timestamps easily: SELECT flow_seq_num, from_iso8601_tim...

turnip

You need to disable source/destination check on the EC2 instance.
Either from Actions -> Networking -> Change Source/Derstination Check, or through the CLI:
aws ec2 modify-instance-attribute --instance-id=<instance-id> --no-source-dest-check

turnip

turnip, this should resolve all issues: https://forum.mikrotik.com/viewtopic.php?f=14&t=32935#p772755 Thanks Normis I'd tried this in a lab and it worked fine with static routing, but the network manager at my ISP reported that they couldn't get it to work with BGP. I haven't tested it myself a...

turnip

Any movement on this? Every IP Transit provider I've looked at provides a /31.

turnip

KNOT looks interesting. Wish it supported Zigbee. I feel like it's the VHS/Betamax issue all over again - Zigbee isn't technically the best, but it seems to be the most common protocol for home automation.

turnip

Yes, it should be possible. I looked at those a while back but they're not certified with the Australian NBN (and all the Australian distributors recently stopped selling Planet gear) so I generally use the Draytek Vigor 130 as a VDSL bridge. I use the Proscend SFP module at home but won't sell it ...

turnip

Hi everyone, with Planet VC-231G/GF is possible to estabilish a VDSL2 connection as a "normal" Modem/Router? I would be use Mikrotik but use it without VDSL2 modem integrated is very difficult in Italy because our infrastructure is almost entirely in copper. Yes, it should be possible. I ...

turnip

I'm wondering if Mikrotik have any plans or interest in developing a wireless access point or module that supports Zigbee, like some of the Aruba access points do.
There's currently very few options on the market, and most of them are expensive, poor quality, or DIY hacks.

turnip

There's the Proscend SFP module - https://shop.duxtel.com.au/product_info.php?cPath=24&products_id=488 They get a little hot and my tests show they don't perform quite as well as a Draytek Vigor 130 in bridge mode (and they're the same price). I use one at home but I only have a 25/5Mbps connect...

turnip

I have a slightly different setup, my local public Ip is a dynamic adress, is it also possible to connect a site-to-site vpn with azure? I'd probably suggest a different solution, like running CHR in Azure and using L2TP/IPSEC rather than using Azure VPN Gateway. I have the same problem. I can PING...

turnip

LLDP-MED would indeed make this easier, but in the meantime you can use MAC based VLANs to achieve the same result. On the older ones (eg CRS125) you'll need to add the MAC address of each phone, but on a CRS3xx series you can use a rule to match the first part of the MAC address (eg older Polycoms ...

turnip

Sorry for the silence, I've been on holiday.
Thanks for your help- seems to have worked. I think there may be some other issues so I'll update the router onsite when I get a chance. I've got it working in the lab though.

turnip

Thanks, already tried that though.

turnip

I've just tried disabling the provisioning entry for this device, and the behaviour is the same. This indicates that it's not picking up any configuration from CAPsMAN (although it's definitely connecting to CAPsMAN). I've checked the RADIO MAC is correct, and also tried using 00:00:00:00:00:00 to c...

turnip

Hi Zacharias Groove's don't have two separate wireless interfaces, they have a single interface and it can do either 2.4GHz or 5GHz (not both at the same time). In CAPsMAN on the router, I've chosen the 2ghz-b/g/n band and I've tried leaving all other settings as default as well as specifying freque...

turnip

I have two GrooveA-52HPn's at a client site that have been there for a few years. They're managed by CAPsMAN on a hEX r3. All the devices onsite are running ROS 6.42 One of the Groove's is damaged (cable won't click in) and the other has suspect behaviour (Ethernet link dropping out randomly), so I ...

turnip

Thanks very much, that will serve to reduce my stress level today.

turnip

Does anyone have an up-to-date guide to connect RouterOS to an Azure VPN? My client's router is running 6.45.3, and I could only find documentation for older versions. I've done it before but it's been long enough that I can't remember how, and there's been a few changes in RouterOS.

turnip

I installed a new switch and access points at a client site yesterday running 6.45.1. The existing equipment onsite is all running 6.42.7. I wasn't able to upgrade it at the time (would have caused an interruption). While onsite, I didn't have any problems, but now that I'm back in my office and try...

turnip

Biggest problem I had with the Dude is that I'd upgrade a router and it'd stop working. If my router doesn't survive an upgrade, I can fix it straight away. If my client's router doesn't survive an upgrade, I have to go and see them and they're not going to be happy. If I upgrade them all at the sam...

turnip

You can run EoIP over the top of L2TP. I do this when I'm connecting clients into my network who don't have public or static IPs, or who have multiple connections with failover.

turnip

BTW, are there any cheap mini-PCI VDSL
I haven't been able to find a mini-PCI(e) VDSL interface at any price, never mind cheap.
Draytek VigorNIC 132F (from memory)

Just realised my memory isn't quite right. The Draytek isn't mini-PCIe.

turnip

BTW, are there any cheap mini-PCI VDSL
I haven't been able to find a mini-PCI(e) VDSL interface at any price, never mind cheap.

Draytek VigorNIC 132F (from memory)

turnip

I was also fairly confident based on those specs, and thankfully my confidence has paid off. It works nicely.
This opens up a lot of options for remote OOB access to devices that previously wouldn't be accessible.

turnip

So something like this... http://au.rs-online.com/web/p/interface-development-kits/0537420/ Honestly, I have no idea if that would work or not.. I suppose it would depend on how it presents to the USB controller. But USB connection at both ends, but operating at TTL levels? Why would it matter what...

turnip

I agree with Jebz, but perhaps you'd be better off using an x86 server? Depends what you have available and what else you're trying to achieve. EDIT: The CCRs all support The Dude, but you may or may not have enough storage space if you have a large database. I use a CCR1009 and it's fine, but it's ...

turnip

https://wiki.mikrotik.com/wiki/Manual:T ... stallation

System requirements for server package
RouterOS:

v6.34rc13 or newer
Hardware:

Tile - CCR series hardware
ARM - RB3011, RB1100AHx4 Dude Edition (RB1100Dx4)
mmips - hEX (RB750Gr3)
RouterOS x86 installations
RouterOS CHR environment

turnip

I have the RB411U connected to the router by serial cable. I can ssh to the RB411 which has a 3G card in it (as long as it's connected and working) and use that to connect to the router. I can use EoIP to do a netinstall from my laptop remotely. Yesterday I did this when a customer's CRS109 switch h...

turnip

The Omnitik isn't ideal for PtP, since it's omnidirectional. I have one on the roof of a motel and SXT's pointing to it from the other buildings. I've also got an RB911 sitting on a window sill in the house next door. SXT's are a good choice, but you'd need to find some way to mount them. The wAPs (...

turnip

I wouldn't use an Omnitik for that. I'd use a wAP AC at either end, and then whatever APs you want inside the buildings.
If I could mount it outside, I'd use SXTs.

turnip

That sounds pretty handy. Would be awesome if there were 4G and Ethernet versions. I'm using some RB411U's with 3G cards in them to give me console access to routers that are >400km away (and I just used it to do a recovery this afternoon). Once I add in the mobile broadband card, case and antennas,...

turnip

Duxtel in Australia are also working on it. They'll have some available in the next few weeks for testing and use on internal networks. Still needs more compliance testing done before we can connect them to the National Broadband Network. https://shop.duxtel.com.au/product_info.php?products_id=489 <...

turnip

I haven't used them, but Axiomtek have some interesting options

turnip

We've been working on one, but it's still quite a long way off finished. We'd planned to integrate it with Duxtel's Internet Commander, but I'd like to make it flexible enough to work with other systems (eg Userman). At the moment, we've only had limited interest so it's something we're only spendin...

turnip

I've had a similar issue with some sites that use PPPoE. I don't know your setup, but it it's the same thing I encountered, try this: Set the PPP profile to use change-tcp-mss=yes /ip firewall mangle add action=change-mss chain=forward comment="Clamp MSS to PMTU for Outgoing packets" new-m...

turnip

The CRS range will switch at wirespeed. The CPU only becomes an issue if you want to do routing. What may be an issue is the feature set, eg the CRS125 can't do access control lists at the switch level. Also, the configuration is quite a bit different to most other switch brands, so take the learnin...

turnip

I enable dhcp-client on the Ethernet interface that the bridge is on but don't get dns or default route from it. Or you can set an IP manually. I hope MT will make a DSL SFP module one day, it's a pain having an external bridge.

Sent from my HTC_0PJA10 using Tapatalk

turnip

You need to get the statistics from the DSL bridge using SNMP or some other method. I've tried using a TP-Link TD-8817, but it doesn't appear to have useful information like that available by SNMP.

turnip

I've heard that the ToughSwitch had a lot of problems. One of my clients has one, and it regularly stops responding to ping. Still seemed to work but I didn't mess around with it, just replaced it.

turnip

Those two CRSs support PoE input, not output.
I'm afraid I can't answer the original question, sorry.

turnip

I have a number of routers - physical and virtual (x86, not CHR), and every few days one of them will stop responding to Winbox or The Dude. I can still SSH in, and routing etc keeps working, but just can't connect via The Dude or Winbox. Most of my devices are running 6.38 but one is a CCR1009 runn...

turnip

Is the CRS328-24P-4S+RM Gigabit or Fast Ethernet?

turnip

That was it, thanks very much!

turnip

Where can I get v2?

turnip

I can confirm that the Draytek Vigor 130 connected to NBN using VLAN100, but it wasn't in bridge mode. I was just testing the connection before the customer moves office. I don't forsee any issues when I put it in bridge mode and introduce the RB3011, I'll just create a VLAN interface and attach the...

turnip

I have two CyberPower OR600ELCDRM1U UPSs with RMCARD205 monitoring cards that I'd like to monitor with The Dude. I've configured them to use SNMPv3, and SNMPwalk is working fine from The Dude, but when i put OIDs in the label, it doesn't display anything (blank, no error). I've tried various OIDs an...

turnip

Do you have Dial On Demand enabled on the Mikrotik? If so, disable it.

turnip

I haven't tried v7, but on v6 I had a problem that I've kept in my notes: XenServer 6.2 (and perhaps earlier) added "Viridian" to support Windows 8. RouterOS won't boot if this is enabled. Run xe vm-list to find UUID. xe vm-param-set uuid=<UUID from first command> platform:viridian=false

turnip

Sorry, only just noticed your answers (didn't see the notification).
That string works nicely. Thanks for your help.

turnip

Has anyone tested a Mikrotik DAC cable with a Planet switch?

turnip

Depends on how many devices are on the network and how much bandwidth you have etc, but probably. I've just installed a CCR1009-7G-1C-PC on a client site with 10 VLANs and a little under 100 devices on a 50Mbps/20Mbps connection, and it's sitting at <1% CPU usage

turnip

Sounds like you need to enable NAT

/ip firewall nat
add action=masquerade chain=srcnat out-interface=<your WAN interface>

turnip

No, Metarouter isn't supported on the CCR series. I'd use x86. Maybe something like http://www.axiomtek.com/Default.aspx?Me ... +Appliance or http://www.mini-itx.com/store/?c=112

turnip

The default baud rate on Mikrotik devices is 115200.

turnip

I haven't used them, but the new RB750Gr3 (hEX) would be a cheap drop-in replacement.

turnip

We use Duxtel's Internet Commander (http://www.duxtel.com.au/duxtel_internet_commander.html) to manage a hotspot in a motel, but it can do all those things too. It's not perfect, but Mike at Duxtel is always very helpful when we have any issues.

turnip

That's right, the DAC has built in SFP+. I'm sure you could sell the S+85DLC03D's on eBay, or hold onto them for another job.

turnip

It's a bug in 6.38, but it's a false report. The CPU is fine and you can ignore the warning.

turnip

Is there any documentation, or can anyone give me an example showing the syntax for device labels? I want to do something like this: [ros_command(":put [/system identity get name]")] OR [Device_Name] (ie, if it's an ROS device, get it's identity, otherwise use it's name in The Dude). Thanks

turnip

Never mind, just noticed this:
Changes in v6.39rc7:

*) Fixed - Tool fetch didn't work with notification - execute on server

Upgrading now

turnip

That's a great solution... I'm having trouble though - I can run the /tool fetch command from the command line and it works fine, but nothing happens when I run it from The Dude. I've tried pressing Test, and I've tried unplugging a router to see what happens, and the command never executes. Can't s...

turnip

I don't have a good explanation as to why. Someone who understands Microsoft's implementation of DNS can have a go at that. But I solved this by creating a conditional DNS forwarder with L7 firewall rules. Let's say your domain name is contoso.com, your router is 192.168.1.1 and your domain controll...

turnip

11 and 12 have a hardware bypass feature - you can use this for example if your RB1100 is switched off and you have a backup router connected to it. If you're not using it like that, you could use 11, 12 or 13. Those ethernet interfaces are PCIe. Same as a network card in your computer might be PCI ...

turnip

Without knowing more about your configuration and Internet connection, it's hard to say what the problem is. I wouldn't use 1-5 or 6-10 for the WAN though because they're connected to the CPU via a switch, which means you're limited to 1Gbps for the whole switch. Port 11 is a good choice. Have a loo...

turnip

I'm not sure if I'm following exactly (perhaps a diagram would help). But broadly speaking: Create a bridge for each network and put whichever ethernet/wireless ports in it that you want. Use Mangle to create a Prerouting rule to create a routing mark and apply it to a bridge. (eg '/ip firewall mang...

turnip

The default configuration has the ports blocked on ether1, so you'll need to connect your PC to it on one of the other ports and remove the default configuration (and configure it the way you want). It's based on the assumption that you'll connect ether1 to the Internet and your computers to the oth...

turnip

May be a silly question, but have you got the cable connected properly?
i.e.
Tx <--> Rx
Rx <--> Tx

turnip

CCR1016-12S-1S+ with copper SFP modules
CCR1036-12G-4S
Or use an FTC converter with any suitable router (eg RB3011)

turnip

That's a fairly broad category, can you tell us more about your requirements? How many ethernet ports do you need? Do you need something rack mountable? Do you have size constraints? Does it need to be silent? Does it need to be cheap? Are you going to use virtualisation, and if so, do you need to r...

turnip

Now that the Abbott/Turnbull government has decimated the NBN here in 'Srayamate and turned it into last century's VDSL2+ (with Vectoring) network, having a MikroTik-compatible (and preferably MikroTik-provided) VDSL2+ GBIC module would be awesome for our Not Broadband Network deployments here. It ...

turnip

The hardware you've chosen sounds appropriate. Of course there's plenty of ways to do it, but I think you're on the right track. I hadn't seen WiFiRanger before, but it looks like it's Mikrotik gear that's pre-packaged and configured. If you're comfortable configuring it yourself you'd save a bit by...

turnip

I don't know the answer to question 1, sorry, but have you considered the https://routerboard.com/RBSXTLTE3-7?
Whichever device you pick, yes, you can create a bridge and add the Ethernet and the LTE interface to it.

turnip

I = W / V
So 1.6A = 20W / 12V
Or 0.83A = 20W / 24V

In the other direction
W = V x I
12W = 15V x 0.8A
Which is under spec (20W according to InoX)

turnip

Do you really need to route at gigabit speeds, or do you just need wirespeed switching for the internal network? There's plenty of cheap options that might suit you if that's the case. I wouldn't recommend having a single high power access point - while it may have a long range, WiFi is bidirectiona...

turnip

Would it be possible to include a comment field for MAC based VLANs on the CRS? We have a large list of devices and no way of quickly identifying which VLAN a device will be on without looking up its MAC.

turnip

I can confirm this - updated 3 routers to 6.28 and enabled RoMON. Tested it then switched it off. CPU usage sits at 100% for single processor (CRS125) and 50% for dual core (x86) router. Switched it back on and disabled all RoMON ports, and it's back to normal. ROS 6.28, RB2011UAS-2HnD try this 1) T...

turnip

I have this same issue. I'm using Draytek Vigor 120's in half bridge mode, but it's a lot of mucking around with MTU settings to make that work. I'd much rather use the Mikrotik as a PPPoE client.

turnip

Would something like this http://www.rfelements.com/en/products/e ... ox-inspot/ be suitable?

turnip

Hi

In the CAPsMAN Security Cfg in WebFig, the passphrase isn't hidden when 'Hide Passwords' is selected. Upon opening the profile, it hidden, but not in the security profile list. In Winbox it's hidden properly.

Regards

Russell

turnip

No, the connection to the internet is via a Draytek Vigor 120 ADSL router configured as a half-bridge (and I've added the appropriate rules to clamp the MSS to the PMTU). No PPPoE or other tunnels are on the Mikrotik gear.

turnip

Hi I've setup a test site (house) with a CRS125-24G-1S-RM and 4x RB951G-2HnD's. I'm using ROS 6.11 on all devices, and I've installed and configured CAPsMAN. Everything's working, except that Apple IOS clients (iPhone/iPad) can't stream HTML5 video (eg YouTube). I've tried using manager forwarding a...

turnip

How about some documentation?

/certificate template> add
name: test
failure: At least one field specifying certificate name must be set!

Not a particularly helpful response.

Search found 88 matches