MikroTik

KBV

Try going back to version 6.45.7.
I'm not sure, but in my opinion there is a difference in the operation of the interfaces with v6.45 and 6.46. Let's check.

KBV

Thanks

KBV

OVPN Server: CHR 6.45.6 OVPN Client: RBD52G-5HacD2HnD 7.0beta1 OVPN Сlient v7 cannot connect to OVPN Server v6.45.6 if the <require-client-certificate> option is set. Сertificates issued by the CHR 6.45.6 specially for this test. Server certificate KeyUsage: digital signature, key encipherment, tls ...

KBV

7.0beta1 Winbox 3.19 RBD52G-5HacD2HnD When creating a record you cannot set an adequate signal level (signal-range). Winbox will throw an error: <Error in Signal Strength - range in [-1;120] expected!> Of course no one can connect with a minimum signal level of -1 )) When using CLI there is no such ...

KBV

As no "OpenVPN client" or "OpenVPN server" usage is standardized for certificates, I would expect "tls-client" or "tls-server" to be required, but you have to check. Also, some clients and servers require a minimum key length and minimum key type (RSA/EC) of ...

KBV

Where were the certificates generated? In my experience, MT generated certificates don't work with the Windows OVPN desktop client (maybe they do now, I haven't tested recently). Maybe, hopefully, if your certificates are MT generated from v6 or older this is an indication that Mikrotik is now usin...

KBV

OVPN is not compatible with the previous v6;
v7 ovpn client does not connect to server v6.45 if certificates are used.

KBV

I had a similar problem on the x86 router.
I was able to reduce the amount of drops experimenting with queues (/queue interface).
But first make sure that the physical interfaces have a "only-hardware-queue" queue

KBV

These look like replies your router sends to incoming packets to unreachable hosts. The router generates those ICMP packets to inform the sender that the host is unreachable. Yes, I read it. But I do not use <Rejection> rules. [admin@MikroTik-3011] > /ip firewall filter print count-only where actio...

KBV

Can you explain what it is? [admin@MikroTik-3011] > /ip firewall filter print Flags: X - disabled, I - invalid, D - dynamic 0 D ;;; special dummy rule to show fasttrack counters chain=forward action=passthrough 1 chain=output action=drop protocol=icmp out-interface-list=WAN-Zone log=yes log-prefix=&...

KBV

What is your configuration? How large is your local subnet and is there a default route to some WAN address? Errors like that can occur when the subnet is large and is being scanned, or when there is no default route and the next hop has "proxy arp" enabled. In such cases there can be man...

KBV

Isn't max-neighbor-entries about IP ARP table? Check it, not Neighbour Discovery

Now (usually) the ARP table contains 11 entries - 9 LAN and 2 from outside (WAN).
---
[admin@MikroTik] > /ip arp print count-only
11
---
But I can check at the time the problem occurs.

KBV

After upgrading my home RB3011 6.40.5 to 6.41RC/ 6.41. Then I increased <max-neighbor-entries> to 16384 and the problem disappeared. But there are only two neighbor devices... [admin@MikroTik] > /log print [...] 07:42:02 warning ipv4 neighbor table overflow, please consider increasing max-neighbor-e...

KBV

I got a brand new RB1100Dh4 a few days ago, I`ve noticed that shes running with only one core at 40~80% while the others are at 0~1% usage i had a RB750G3 before and using all 4 cores doing the same job. It's all so) IMHO If they do the load distribution - there will be problems with reordering the...

KBV

Most likely it happens because of the conflict use the same ports in your system configuration.

A standard snmp port is used...
When I switch snmp to encryption mode, the interfaces disappear in the list.

PS Forgot to say, I monitor the Mikrotik (6.40.5) devices using snmp. hAP lite and CHR.

KBV

Hi!
When I enable SNMP encryption, the interfaces arbitrarily disappear from the list (Dude map->Device->SNMP->Interface) and links loading is not displayed
SNMP authentication works fine.

KBV

Using or not using the hw-offload does not affect the situation.

I'm sorry. It seems the problem only occurs when I turn on the hw-offload.

KBV

Hi! I have a simple configuration of the router rb3011 - two software bridges and do not use the master port (there are vlans on ethernet interfaces). The update to version 6.41rc62 is done correctly, but in one of the networks packet loss starts. Communication with the nodes of this network arbitra...

KBV

------------------ [admin@MikroTik] > /certificate crl print detail Flags: E - expired, D - dynamic 0 D cert=cert_export_KBV-CHR-CA.crt_0 url="http://192.168.80.251/crl/4.crl" num=0 revoked=0 signature="********" next-update=dec/09/2018 08:05:30 last-update=dec/09/2017 08:50:44 -...

KBV

Ordinary flash drive is not designed for placing database. This is just to transfer photos to another computer; second flash drive will soon fail too))
Use the SLC flash.

KBV

Dude for x86,
I updated from version 6.37rc5 to rc11 (and back to rc5):

dude Error in history.jpg

Real traffic on the interface - 5-10 Mbps, in version 6.37rc5 is displayed correctly

KBV

Firewall rules with interface list is not updated to version 6.36rc40 [admin@MikroTik-CHR-Dude] > /interface export compact # jul/19/2016 15:29:29 by RouterOS 6.36rc30 # software id = # /interface list add name=TEST /interface list member add interface=ether1 list=TEST admin@MikroTik-CHR-Dude] > /ip...

KBV

interface GigabitEthernet0/6
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 100,200

missing "switchport mode trunk" command

KBV

CRL do not work correctly
Self-signed certificates do not contain CRL when working through winbox - CRL field not available.
When signing via CLI this is no problem.

But CRL is still not working correctly when you export / import the certificate- then CRL contains inappropriate information.

KBV

Never run the "Bandwidth test" on the system under test. It is not clever

You are testing the traffic generator performance.

KBV

Returned old problem - time is not synchronized with the dynamic NTP servers.
After the command "/system ntp client print" synchronization occurs immediately.

It does occur not on all routers. I could not understand what it depends on.

KBV

*) fastpath - eoip,gre,ipip tunnels support fastpath (new per tunnel setting "allow-fast-path"); Not available in Winbox. As a result you can not create tunnel (eg GRE) with IPSEC via Winbox See attach And you can not turn fastpath off /Not available in Winbox/ How to create a tunnel?

KBV

tried running various Internet speedtest's

You do not control all the elements of the test to conclude that the problem is in you router.
What to you allows to draw conclusion what a problem in a RB1100AHx2, but not in hundred other routers in the Internet.

KBV

Yes, you are completely right
With the new version rb850gx2 I got IPSEC speed 150+150Mbps (rx+tx), unlike the old version 50+50mbit
I think this is a very good result (150+150=300 in sum) IPSEC performance.

KBV

rb850gx2 not support Fast path. I think that explains everything

KBV

IPSEC settings are not the same in many places. Where is "PFS Group 2" in Mikrotik (phase 1)? crypto isakmp policy 30 encr 3des authentication pre-share group 2 you set it on Cisco... The default values for "Lifetime" are also different in Cisco and Mikrotik. I'm not sure that th...

KBV

Mikrotik, please repair the routers RB850Gx2

Copy screenshot-2.jpg

KBV

I have simplified the configuration. Now it's just a bridge Server is connected to the interface Ether2. computer to the Ether3. Speed up to 100 Mbit/s :( Copy screenshot.jpg [admin@MikroTik] > /export # oct/22/2015 21:51:02 by RouterOS 6.32.3 # software id = xxxxxxx # /interface bridge add name=bri...

KBV

MTU on interfaces set by default 1500B (in the first message is a complete router configuration) I tried to set 1400, then 1560 on Ether1&2. Nothing has changed. Then I tried the following commands: /ip firewall connection tracking set enabled=auto / ip firewall mangle add action = change-mss ch...

KBV

In the program Wireshark I see a lot of messages "TCP out-of-order" and "TCP Dup ACK"

KBV

There is a problem In this scheme I can not get the speed of copying a file from a server to computer more than 150Mbit/s. Router CPU load 5-15% If connect directly - 850mbit/s Configurations very simple- no queues, no firewall rules, no connection tracking etc. No errors, all interfaces of 1Gb/s. [...

KBV

Has this release addressed the constant reboots when using GRE tunnels or has this not been identified yet.

At first glance the problem is solved.
I updated to RC24 without incident

KBV

rc22 released. we have fixed the latest few problems and are getting ready for v6.33 release. You are crazy! 6.33rc21 and 6.33rc22 does not work on rb850gx2. Completely (reboots infinetely). I thought that this is just a beta and nothing serious. But you're going to let release. When users update w...

KBV

First. I have not seen the second.
It would be very interesting to know. If there are no problems with them - I would replace my.

Who has such a device (new version of the rb850gx2)? It is necessary to conduct a small test ...

KBV

The 850gx2 is not working well. I propose to wait until its fixed.

KBV

Это неплохо, но Здесь не наберется столько русскоговорящих пользователей чтобы раздел не помер. И это затруднит решение проблем. Сейчас большой плюс форума- что форум почитывают разрабы, вы в тикете (в техподдержку) можете сослаться на тему, а разраб может ее почитать для уточнения нюансов. А с русс...

KBV

And understand finally what vlan is default - 0 or 1!
I will explain.
When you turn on secure "vlan-mode", you must create this vlan in the table.
Not tagged interface also has a vlan, usually 0.
But on RB850Gx2 this is vlan 1 !!
WTF! How should I know?
Amount of bugs scares me

KBV

Something like this...
Hardware switch works well-108MB/s
Fix the software switch (bridge) pls

copy 108MB-s.jpg

KBV

Thank you. I know it's probably solve the problem.
But there are exist several VLANs, it is very difficult to configure the hardware switch.

Productivity of software switch is enough for me. But this significant failure should be corrected.

KBV

To increase the frequency the CPU radiator needs to be replaced, possibly with active cooling
I do not think that the next ROS can solve it

KBV

And in addition to changing the order I see a small percentage of packet loss.

I do not know will I be able to configure all on the switching chip. It is rather difficult for me

But now this device is not suitable for use

KBV

A significant drop file transfer performance via the software bridge. I spent a lot of time to understand what was happening- File Transfer is up to 20-30MB/s (Megabytes/s). Pings are going well (without losses and delays), but the speed of transmission is very low. I came to the conclusion that the...

KBV

What encryption standards supported Hardware Accelerator?
In addition to the AES128

KBV

It is only encryption performance. RB1100ahx2 roughly twice as powerful. I doubt that you will get so much on RB850Gx2 due to other restrictions.
However in VPN range 100-300mb/s this router must be good.

KBV

RB1100AHx2 nominally not support virtualization.
You have tried to work around this limitation third-party applications?

I do not understand your discussion and conclusions

KBV

5GHz has a narrow application. I'm not sure that the router with the AP 5GHz it right. You can not put RB2011 (or similar device but with a 5GHz) on the ceiling or on the wall in the living room

Really good scheme networks- separate router and a separate AP installed in the proper place.

KBV

Left to repair fasttrack and fastpath

KBV

In the case of Direct delivery routing mechanisms are not used. It uses ARP
Read about the Direct and Indirect delivery of IP

KBV

Read about the Direct and Indirect delivery of IP packets

KBV

It is very strange.
According to the general switching rules in this case frames should be flooded (similar to a broadcast frames). Or new entry replaces the oldest entry in the table; both processes are usually invisible to the user.
Blocking does not occur ever.

KBV

you are somewhere lost x86 "Extra packages" in 6.30(x)

link on the download page is not available, but the package can be downloaded if you enter a direct link

KBV

you need a table of FORWARD, not input

KBV

it's not supported on my router at home which is an RB450G

FastTrack is supported only half router models. So it's normal.

KBV

Yes, on my device it was. Exactly when upgrading to 6.28
After that I was able to upload the new version using netinstall

KBV

Ask your ISP whether has AutoNegotiation fulfilled on the external interface. A consistent interface mode on both sides must be the same (sometimes it is not so)

KBV

Yes, it seems so.
I also tried it on MIPSBE. There are small oddities, but generally works well

On my other platforms it has not yet happened.

KBV

I feel there is some kind of trick

KBV

KBV - Did you use CCR device? FastTrack will work properly on CCR devices starting from 6.29rc14 version

Oh, no. I did not know that it only works on CCR
I tried to run on 850gx2

KBV

Complication of development has its price. Directly and in dollars

And this is leading to market positioning. I think things are not so simple..

KBV

It is not about filter rules, it is also about NAT. Basically it is fastpath solution when connection tracking is necessary Connection tracking can operate without NAT, It is rather a function of the "Full State Firewall" If the FS firewall and NAT is not necessary, tracking is better for...

KBV

When you turn on IPS on the CheckPoint equipment performance drops to 10 times (with a maximum depth checks).
This is normal. IPS is extremely costly task.

On serious firewalls you can control the depth and scope of inspections to look for balance of performance and security

KBV

I added this rule to the top. [admin@RB850Gx2] > /ip firewall filter print Flags: X - disabled, I - invalid, D - dynamic 0 chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix="" 1 chain=forward action=accept connection-state=established,related ...

KBV

I'm sorry

Router RB850Gx2 randomly hangs on reboot. I could not find regularities.
Relationship with the / system console has not been confirmed.
Well, I'll write our support.

KBV

Router RB850Gx2 hangs on reboot if serial port is removed from the /system console [admin@RB850Gx2] > /system console print Flags: X - disabled, U - used, F - free # PORT TERM RouterBOOT booter 3.22 RouterBoard 850Gx2 CPU frequency: 533 MHz Memory size: 512 MiB NAND size: 512 MiB Press any key withi...

KBV

I solved the problem. Thanks to all

The port "switch 1 cpu" was in VLAN-mode "disabled". Tags have been ignored and vlan 81 was in a LAN network

KBV

5. ~150-200Mbps

I checked ipsec throughput RB850Gx2 with ROS 6.28
With routing and some firewall rules:
receiving 120-125Mbps
transmission 112Mbps

Without routing and filtering I believe that will be close to 150Mbps

KBV

Sorry

RB850Gx2 , Atheros 8327 switch chip

/interface ethernet switch port
set 0 - this is the Port 2
set 2 - Port4

KBV

I want to do so: scheme.jpg /interface bridge add name=bridge-DMZ protocol-mode=none add name=bridge-LAN protocol-mode=none /interface vlan add interface=ether2-Server name=Port2-vlan81 vlan-id=81 /interface bridge port add bridge=bridge-LAN interface=ether2-Server add bridge=bridge-DMZ interface=Po...

KBV

Yes of course

L3 routing must be done through the "switch 1 cpu"
I tried to do the following scheme - see below
Evening I'll try again and show what happened - I will be grateful if you help to understand what I'm doing wrong

KBV

Hello
I have tried to implement similar task on rb850x2.
This is easily implemented using software Bridge, but nothing happened on the Atheros chip.
I could not understand the reason (maybe I did something wrong)

If the community is ready to help I am ready to continue the experiments.

KBV

Do not turn on RoMON on productive routers. This can lead to hangs.
On my RB850Gx2 RoMON does not work, and one core hangs after RoMON turning off.
And you have to reboot the router.

KBV

So is there support for the APC UPS or not?
The 10 topics with this issue and silence

KBV

Hi!
I recently bought mAP-2n. There is a question about LED AP / CAP.
The image can be assumed that in AP mode it should light up. In reality, the LED never lights up. In CAP mode it flashes.

Is it possible to make the switching-on of the LED corresponds to the the inclusion of of the access point?

KBV

Who will read your discussion on the Russian?
This interesting presence admins and developers here.

PS как вы занимаетесь IT без Английского? Документацию Гуглом переводите? Сочувствую.

Search found 79 matches