MikroTik

Murmaider

It's great that you've never run into any issues, however your examples are purely anecdotal. Just because you've never experienced the issue, doesn't mean it doesn't exist. As has been observed through this thread, the issue appears to be related to connection tracking being enabled. Perhaps you a...

Murmaider

I think what this post really says is DON'T USE A MIKROTIK FOR FIREWALLING. Then why are you here? Do you have any solution ? Honestly, we migrating all our hardware to supermicro Embedded superservers running 6wind turbo gate. Their dpdk implementation is just on a whole other level and stands up ...

Murmaider

route cache has been removed from newer linux kernels because of the performance impact under load.
Turn route cache off, your router will survive a bit better in a DDoS with it disabled.

Murmaider

Hello Cha0s. Yes, i understand that. It's the default behavior i used. But this is my problem: I have: - ISP1 - ISP2 - ISP3 - AntiDDoS ISP I want to send all traffic from ISP2 to AntiDDoS ISP. Only that one. If i stop the announcement on ISP2, it goes by default to ISP1, and i don't want that. I tr...

Murmaider

It would be great to see if Mikrotik could include intel's DPDK for the intel NIC's in ROS 7 at a later stage, this would allow ROS to scale up past 100Gbps routing with ease. It's not as simple as just "including DPDK". DPDK is a kernel bypass mechanism where the packets are passed strai...

Murmaider

It would be great to see if Mikrotik could include intel's DPDK for the intel NIC's in ROS 7 at a later stage, this would allow ROS to scale up past 100Gbps routing with ease.

Murmaider

170 updates and changes and not one BGP improvement...

Murmaider

Hi, Argh. Quagga is not for me. Filters and Community is use. On All uplinks. On 4gbit/s is the end near... I will still use mt. I will Look at mum in Vienna for „baltic“ Router and his Speed. I Hope, that there use better intel i9 because i7. I7 is 2 years old... Cheers. Christian Why not put toge...

Murmaider

what size is the range you are advertising to your provider?

if for example it's a /23

advertise the two /24's on R1 and advertise the /23 on router 2, this will force traffic coming in on router 1.

Murmaider

What is the output of the below on all your core and office site routers:

/routing ospf interface print

Murmaider

looks like a new revision of ccr1036 is coming soon

with dual PSU

https://mikrotik.com/product/CCR1036-8G-2SplusEM

ccr1036 revision.jpg

I don't understand the logic behind dual PSU's that aren't hot-swappable.

Murmaider

not sure why it would do that, but you could use the ospf-out route filter and create a default discard rule so it doesn't advertise any routes.

Murmaider

One of the ram modules has probably failed.

Murmaider

Try advertise them as type 2. Setup the ospf-in and ospf-out filters. On the out filters, add the lan ranges you want your router to advertise to the other router. On the in filter, add the lan ranges you want to accept from the other router. Then create a default discard rule on both the ospf-in an...

Murmaider

I'm no expert, however: Could you not setup an IBGP sessions between R1 and R2 and set force-self on R1 when advertising BGP to R2. Create a filter on R2 to set the prefixes received from R1 to R2 to have a local pref of 500 On R11 prepend the routes advertised to R2 if you dealing with a larger ip ...

Murmaider

Can we get a Mikrotik response please. The 1072 is ideal with the redundant PSU's but I cannot be rebooting it once or more a week. At the very least like Doush said, give us a v6.38.xx that is patched. specifically for the CCR1072. I 2nd this, otherwise I'm just going to downgrade to 6.38.7 and fi...

Murmaider

Ours which had been running on version 6.38 for months and months without any issues, was upgraded to 6.42.9 a month ago and today it randomly rebooted with no clear reason why.

Murmaider

We've had a similar issue to this when Dynamic interfaces were making their way into OSPF (like a vrrp interface for example). Our solution was to statically create the OSPF interfaces and set the default to passive. For example in your case: /routing ospf interface add interface=ether2 network-type...

Murmaider

Does this upgrade include the fix for the CCR-1072's that keep crashing when trying to run them at 1200Mhz ? (viewtopic.php?f=3&t=122525)

Murmaider

Anyone running 6.40.9 + the 3.41 firmware on a CCR-1072 ?
If so, have you come across any issues (other than the webserver issue).

Murmaider

Is this PSU issue still a problem when buying new CCR-1036 units or has this now been resolved?

Murmaider

Hi there, Does anyone know what the limit of the routing table is on the CCR1072-1G-8S+ ? For instance, my current HP HSR6602 can have 4 million routes at max. I am looking to replace this HP with possibly the 1072 as BGP router. Hope to hear from you! Chris On our 1072 we have over 2 million route...

Murmaider

@berlo - did you need to reboot after you disabled route cache?

Murmaider

You can choose, secure router or fast throughput. You are choosing to disable router security? Fastpath is not for all situations. What specifically would you like us to resolve, load of the device when it is doing something? All devices are loaded by all tasks that they perform. Then I would highl...

Murmaider

Yes - that's precisely why the topic says Denial of Service, and not Exploit :lol: Funny how most devices have things like control plane policing, to limit things like this. No it didn't. From the post and from the link: DB Verified: Exploit Standard firewall prevents this. Even if you need to ke...

Murmaider

Yes and now ccr was raised to 28 in all Europe. All are working fine and we never experienced more random reboots. Also we experienced better performance on routes with > 1kk routes installed disabled route cache. You loose some % CPU, about 10% more, but you will not experiencing packetloss/stop f...

Murmaider

Stop asking and switch to another vendor :lol:. I'm currently switching to another vendor. Cumulus on ONIE + router. More than 240Mpps of performance, tested. ;-) 7Tb/s with prefixes that are loaded on TCAM module. Regards, What vendor has routers with ONIE? I thought this was only for sdn switches.

Murmaider

Connect your links to fast 10g switches and then connect your mikrotiks to those switches. So traffic to and from your network goes over the switches. Setup port mirroring on your uplink ports on the switches to mirror to a single port (or a few if it's high traffic) Buy wanguard from andrisoft and ...

Murmaider

The only difference between Ping and Trace (besides the TTL in the ICMP Type 8 outbound packet) is the return packet for the in-between hops. The return packet will be an ICMP type 11 for in between hops for a trace and an ICMP type 0 for the final hop. A ping will always have an ICMP type 0 as the...

Murmaider

On one of our routers we have a strange issue were the mikrotik can't ping anything at all, but is able to successfully traceroute to them. - The router is running the latest 6.38.7 bugfix and has no firewalling enabled on it at all. - All it does is perform BGP / OSPF and nothing else is configured...

Murmaider

For the watchdog reboots, please make sure that you are running your router at 1000Mhz and not 1200Mhz.

We had a lot of random watchdog reboots when the cpu was set to 1200Mhz

Murmaider

Honestly i think they never developed/tested this product at 1200Mhz so they not know what reply on support request. Checking the exact error we see that the issue is related to hardware bug on 1200Mhz (that i think tile fixed on TLR4-07280DG-12CE A0a with 1866 memory support) and not on o.s. level...

Murmaider

hi, yes my previous consideration was wrong, the issue is confirmed on CPU overclock. We identified it keeping serial console opened and after reboot you see a message related to cpu error, something like: "processor error" I would love to get a response from Mikrotik Staff regarding this...

Murmaider

after furter investigation we realized that the issue is not on cpu frequency that was changed 7 days ago, but the flow exporter. We did some changes todat like move from all interfaces to selected one and changing inactive and active timeouts. I reverting back these parameters, meanwhile generated...

Murmaider

Yes, we have downgraded to 1000Mhz and we not had more unexpected reboot

I'm going to give this a try, thanks a lot.

Murmaider

I too am experiencing this.

We do however have our units overclocked to 1200Mhz... I wonder if that may be the issue.

Murmaider

There are 3 different releases: bugfix, stable and release candidate. Is that so difficult to understand? That is precisely what I say. 6.38.7 (Bugfix only) 6.39.2 (Current) "STABLE" 6.40rc24 (Release candidate) The bugfix Should be on the stable (assumption without errors) Umm no, bugfix...

Murmaider

If you looking for firewalling and packet inspection, then the Fortigate is the way to go, they work brilliantly and we have them deployed all over our infrastructure. However take the fortigate numbers with a pinch of salt. Once you enable things like anti-virus flow filtering and DPI then these nu...

Murmaider

I don't know if it was already sugested.. but mikrotik Traffic Flow could include BGP AS Numbers. It is important to know what is going on with your network, and with the AS included a lot of things can be done. Thanks!! :D this is one of the most highly requested features. It has been promised for...

Murmaider

Doesn't the firewall RAW drop disable ipv4 fastpath? If it does, then the blackhole would appear to be better.

Murmaider

I've setup my test environment again with the static arp and you are 100% correct - I'll update the first post of this topic to reflect this. In my tests I could only get the CPU up to 88%, doing RAW drop managed to get the cpu down to 18%. When doing blackhole with route cache disabled, I managed t...

Murmaider

Interesting, any idea why in my test and video the CPU usage drops to 0% with the blackhole + RP Filter, but with raw the CPU stays at 14% ? I am not sure if your test is correct. If you are getting DDoSed you cannot stop the incoming packets from reaching the router regardless of how you drop them...

Murmaider

100% CPU in all tests. Route cache is just an additional load on CPU. Whenever new packet arrives, it goes through route cache table to find matching hash, if there is no match new src/dst hash entry is generated. Interesting, any idea why in my test and video the CPU usage drops to 0% with the bla...

Murmaider

RP filter in this case doesn't make any difference. But route cache does.
With disabled route cache:
blackhole = 4.45Mil pps
raw drop = 4.2Mil pps

Why does disabling the route cache increase the pps?

What CPU was observered at blackhole 4.45Mpps?

Murmaider

Thanks for replying. I read all of your posts on this forum. I am really new to mikrotik. You are suggesting us to use blackhole which is ip null route right ? That method is that we cant use. we cant null client's ip otherwise they will leave us. We need to protect them no matter what happens. If ...

Murmaider

@Murmaider there seems to be some flaw in your tests. Lets make a real load on the router CCR1072 with 10G link DDOS attack from x.0.0.0/8 different addresses 64byte packet size Attack to routers address (connected route no firewall) = 1.01Mil pps with 100% CPU load Blackhole route = 1.6Milion pps ...

Murmaider

It was meant for an example few posts above, drop in RAW will be significantly faster than routing marks and connection marks. Even in your test compared 18% to 14% it is roughly 30% faster, which is exactly how RAW was advertised and it does not overload connection tracking. Of course blackhole is...

Murmaider

I would suggest to use raw firewall rules to drop DDOS packets.

Hi mrz,

I tested the RAW firewall rules vs normal firewall rules above in this thread (viewtopic.php?f=2&t=114664&p=599485#p568217), and the performance is almost identical.

Murmaider

Can someone post the complete rules for fighting DDoS using "blackhole" ? The rules below are ok ? Smb was saying there should be any mangle rule so it work better. /ip firewall filter add action=jump chain=forward connection-state=new jump-target=detect-ddos add action=return chain=detec...

Murmaider

We run ours at 1200Mhz and it seems to work just fine. we are thinking to buy CCR1072 for just firewall is it a right move ? here our topic: https://forum.mikrotik.com/viewtopic.php?f=13&t=121781 I would definitely not use an CCR as a firewall that you are expecting to take punishment, the cloc...

Murmaider

Interesting use case for Mikrotik. Do you have any strategy in place for DDoS attacks? How well is the 1072 handling that many peers? For DDoS - Andrisoft Wanguard + RTBH and Source-based blackhole - (set RP Filter to Loose is an absolute must - https://forum.mikrotik.com/viewtopic.php?t=114664). Y...

Murmaider

Interesting use case for Mikrotik. Do you have any strategy in place for DDoS attacks? How well is the 1072 handling that many peers? For DDoS - Andrisoft Wanguard + RTBH and Source-based blackhole - (set RP Filter to Loose is an absolute must - https://forum.mikrotik.com/viewtopic.php?t=114664). Y...

Murmaider

We run ours at 1200Mhz and it seems to work just fine.

Murmaider

I'm currently running 6.37.4 on one of our CCR-1072 which is about 6 months old and it randomly reboots with the following in the logs: 02:00:11 system,error,critical router was rebooted without proper shutdown, probably kernel failure 13:30:34 system,error,critical kernel failure in previous boot T...

Murmaider

I guess you are waiting for some specific feature, not the number or the date.

multi-threaded bgp seems to be at the top of the list...

Murmaider

Hello, can you help me? Fastnetmon identifies the attacked IP, but I can not get exabgp to advertise to mikrotik. Hi, There are 2 ways to do this: 1) Use fastnetmon's mikrotik plugin - https://github.com/pavel-odintsov/fastnetmon/tree/master/src/mikrotik_plugin It speaks to the mikrotik API and han...

Murmaider

We are considering buying 2 of these CCR1072-1G-8S+ for our co-location BGP and replace our old servers running vyatta. I've read through the BGP tests on http://www.stubarea51.net and it looks impressive, my only concern is regarding the reliability and stability of this unit. A number of people h...

Murmaider

Your should get that provided you have fathpath on for GRE, it does mean you can't (and shouldn't) firewall on the devices.

Murmaider

Hi, There seems to be some OID's missing on the CCR-1072 (running 6.36.4), for example: > /system health print oid active-fan: .1.3.6.1.4.1.14988.1.1.3.9.0 voltage: .1.3.6.1.4.1.14988.1.1.3.8.0 temperature: .1.3.6.1.4.1.14988.1.1.3.10.0 processor-temperature: .1.3.6.1.4.1.14988.1.1.3.11.0 current: ....

Murmaider

I'm using the 1072 as a core L3 device in an ISP. I'm also using 2 x 1036 as LNSs and they are doing the job pretty well. Each LNS is forwarding 800 Mbps and they are connected to eth1 and eth2 10G interfaces on the 1072. There is almost no traffic between LNSs. Each LNS is mainly talking to the co...

Murmaider

There is a way to resolve situation if we advertising /22 network from both places? Advertise the /22 on both routers. Then advertise each /24 on their "preferred" router. So in your case, the first 3 /24's will be on router 1 and then 4th one on router 2. All /24's are smaller network bl...

Murmaider

This is my view on the wiki approach - http://forum.mikrotik.com/viewtopic.php ... 73#p571073
This is my approach - http://forum.mikrotik.com/viewtopic.php?t=114664

Murmaider

Thanks Murmaider, Actually tonight I stumbled across the last forum post you link to. I have now swapped the drop rule for a blackhole route. But I still have to detect src/dst addresses for the attacks and mangle the packets, that will have a CPU impact as well? I have played a little bit more aro...

Murmaider

Don't firewall a DDoS, it won't work, use blackholes.

http://forum.mikrotik.com/viewtopic.php ... 73#p571073
and
http://forum.mikrotik.com/viewtopic.php?t=114664

Murmaider

You might be able to script it for Observium to monitor your mikrotik through the API. We use Zabbix for monitoring, so for BGP monitoring we have a script with connects to the mikrotik API and returns information which zabbix can monitor. For example: # ./bgpcheck.php exabgp uptime 3w4d12h54m53s # ...

Murmaider

Which one do you run on your Production routers?

Murmaider

That being said - what server can process a single stream of data at 2Gbps? I believe your hard disks will max out way before the network does. :o 2Gbps = 256MB/sec An SSD can easily do 480MB/sec and NVME drives can do up to 3GB/sec (24Gbps) Add some raid to the mix and you can increase these numbe...

Murmaider

Firewall work sequential. Meaning that traffic is matched against each rule in order from top to bottom until a matching rule is found. So if you have for example a rule to allow all traffic to the router and then after it a rule to block traffic, no matching will ever be done on the 2nd rule as the...

Murmaider

I want to build a super powerful router that can handle 30GIG of ddos attack using firewall rules without any problems what do you guys recommend You won't stop a 30Gb/sec DDoS with firewall rules. Firewalls are a access control technology designed to secure unauthorized entry or to limit / restric...

Murmaider

IP => Settings Switch RP Filter => Strict Could this cause any problems? The default setting is disabled and I just want to make sure that nothing else will be affected by this. Strict mode can cause problems in asynchronous routing (traffic going in one router and coming out of another router) - i...

Murmaider

IP => Settings

Switch RP Filter => Strict

Murmaider

Do you have a forwarding rule to allow Established & Related connections?

/ip firewall filter
add action=accept chain=forward connection-state=established,related

Murmaider

Just an interesting side note, I do BGP on MIkroTik every day and I can't say I've run into this very often, but I do a soft-refresh in and out every time I change the filter because MikroTik isn't the only one who has this issue. I've been burned by similar behavior on Cisco 6500, 7600, ASR and Ne...

Murmaider

When this is so efficient then it is may interesting to transparent for the users to use a different screen to input this. Since short we have the RAW option that should be more efficient but is not that much of a difference. So a user could enter this in the RAW section and an added "action&q...

Murmaider

Why can't they LACP trunk the 2 ports together to give you 200Mb?

Murmaider

Source address can be an individual ip or a network range. Oh, so is there an easy way to do this for all IPs in a address-list without using mangle/filter/etc before? To use the address list, the interface has to accept the packet first in order to mangle it (by using the firewall). What I mean is...

Murmaider

I think the last question I have about this for Murmaider is: Will your RP-based blackhole approach work where there are multiple valid routes (learned by BGP) to external addresses, but only one is "active" in the RouterOS routing table? With RP Filter set to loose it should. Loose RP Fi...

Murmaider

Can you please share the code for this source based blackhole? From above I can see that I have to packet mark so filter is still involved?! For the mikrotik, enable RP Filter under IP => Settings (set to loose) Then to add a blackhole use: /ip route add distance=1 dst-address=<source address> type...

Murmaider

Ah interesting. How does the Wanguard get the traffic in the first place to determine what is an attack? Is it working off NetFlow/IPFIX data? Or is it connected to a mirror port or something? It supports both Flow Sensors or Packet Sensor. We use the Packet Sensor (create a mirror port on your swi...

Murmaider

we are currently handling 4Gbps of traffic using an old cisco router, which we are removing now. we want to use microtik due to its versatility. confused what to buy, CCR1072-1G-8S+ or a supermicro server with Xeon E5 Single processor 2640v4 10 cores with 2 x 3 10G NIC cards ? The price comes to sa...

Murmaider

Do you not lose fastpath by doing this though? Yes, but in our use case that isn't something I'm worried about. I need to use an address-list (so lose fastpath) so that I can redirect abusive traffic: 1) to display a "stop typing your password wrong!" message to customers failing to log t...

Murmaider

Hard data prooves... I have expected better results. Good job. Just to be sure I've tested a few different attack variations with the initial tests being syn flood attacks. I've now tested: - udp flood attacks - syn attack with random source and spoofed source - udp attack with random source and sp...

Murmaider

While I agree that having lots of "/ip firewall filter" entries will slow your router down (CPU has to go through each rule in sequence), using an address-list should consolidate a lot of blocked IPs into one firewall rule. I believe address-list is implemented as the Linux kernel's IPSET...

Murmaider

Nice. What about to drop in raw table according to the blacklist while an attacking ip address was identified by firewall rules and put on the list? By this I assume you mean what is referred to in this post - http://forum.mikrotik.com/viewtopic.php?f=2&t=54607&start=50#p463532 which refer'...

Murmaider

EDIT : There was an initial flaw in my testing, jump to this post https://forum.mikrotik.com/viewtopic.php?f=2&t=114664#p599689 which shows that using the firewall RAW DROP has the same efficiency as source-based blackhole + route cache disabled - thanks mrz & cha0s Disclaimer: I am by no m...

Murmaider

It is more than 2 and a half years since we talk about v7 Longhorn...

Longhorn / Unicorn.. a huh a clue..

Murmaider

As the route-reflector is not directly connected, try adding multihop=yes

routing bgp peer add remote-address=1.1.1.1 remote-as=65000 address-families=vpnv4 update-source=lo1 multihop=yes
You will also need to enable multihop on the route-reflector.

Murmaider

Have you assigned an address to your loopback and set the router-id for OSPF to be this loopback address?

It's always best to assign OSPF to the lookback address as this "interface" never goes down.

Murmaider

Thanks I will try this I do have like 60 firewall rules shoe I leave only the DDoser and DDosed rule in place? I would remove all firewall rules entirely and disable connection tracking as this will enable Fastpath on the router automatically (You can confirm by going to IP => Settings). Let Wangua...

Murmaider

Yes I do have other firewall rules but only blocking ports and access list. As to fasttracking connection how do I set that up. I will also ask my provider for the BGP info Ok so the performance you are getting is exactly on par with what Mikrotik advertises. Go here https://routerboard.com/CCR1072...

Murmaider

Getting DDos attack on my new 72 Core CCR I already implemented the rule below and still kills my router I have a 10G backbone and when it hits 3gig of DDos it dies on me. Also when I call my provider it never reach 10Gig. Any idea what to do??? or just get a better router /ip firewall filter add c...

Murmaider

Are you not being DDoS'd ?

Murmaider

BUT what if the active route for 8.8.8.8 is 8.8.8.0/23, then your example would miss it. And then if there's multiple routes at different sizes and different local prefs you could potentially get a range of active routes and you'd still have to figure it out. I need to know what the current active ...

Murmaider

Mikrotik BGP has a memory leak... I have this on my ccr1016 and CHR ... Then 1-2 peer with full table are reconnect, used memory increased by 300-400mb and Mikrotik doesn't reply on winbox and SSH only mac-telnet work... In this case one core is at 100% load and there are random troubles with routi...

Murmaider

I wonder if Miro holds the CCR-1072 PSU's since they hotswap? I guess the only real option is to find an online spares supplier and ship a couple spares to keep on hand. Ah, but isn't that the distributors job? Then I may just as well stop supporting the distributors and import everything myself......

Murmaider

I wonder if Miro holds the CCR-1072 PSU's since they hotswap?

I guess the only real option is to find an online spares supplier and ship a couple spares to keep on hand.

EDIT : here is one place - http://shop.meconet.de/MikroTik-Router- ... anguage=en

Murmaider

Yes, I'm not disputing that they CAN get them. The point is they WONT get them. Fundamental difference between the two

Does Miro honestly not stock them? What about Scoop, they sell Mikrotik hardware.

Murmaider

Is it not just a cosmetic thing?
Is the RJ-45 module working as expected?

Murmaider

Allow input for established and related packets
Allow outgoing packets for all

Murmaider

Where are the IP SERVICE rules located?

Murmaider

On the forward chain:
- create a rule to allow traffic from anywhere to the server and specify the destination ports on the server.
- create a rule to allow traffic from your server to anything.
- create a rule to drop all traffic to the server.

Murmaider

If you don't have a very dynamic routing environment (for example traffic coming into the network on one router and leaving through another router) then you can enable Reverse Path Filtering. Go to IP -> Settings Set RP Filter to strict. If you do have a dynamic routing environment, then create some...

Murmaider

Lets take a step back, can you elabotate on "interfering with this system once every while" What happens on this mail server(s) and why do you think its unwanted traffic? How do you fix the problem currently? The thing with filtering the traffic is it helps to know what exactly you looking...

Murmaider

Make life easier for yourself and rather just have a default deny rule on the input chain.
The only explicitly allow access on the input chain for yourself and/or your network.

Also move your services (ssh, winbox, etc) off the default ports. For example run ssh on port 22222.

Murmaider

Generally I like to follow the principal of "don't firewall on your routers and don't route on your firewalls" But in saying that, there is a use case whereby you want to limit ip access to the router itself. An example would be limiting ip access to your BGP peers and your management netw...

Murmaider

I fully agree with @ZeroByte. But I need to say that my experiences with VyOS are horrible (reboot - BGP config gone, OSPF routes are propagated to other routers but not shown in the propagating router's table, SNMP crashing and reboot is needed, ....). I would for sure prefer RouterOS over VyOS. V...

Murmaider

That's interesting, we currently have 2x VyOS machines each handling 4x BGP peers (2 transit, 2 INX's on each machine) and OSPF for IGP. However we are looking at the CCR-1072 for replacing these, but feedback on the CCR's regarding stability and reliability as a whole seem so mixed with same saying...

Murmaider

ZeroByte,

Judging by your post, it seems that Mikrotik has some real BGP issues. Do you perhaps know why are people then choose to use them as Big Iron or BGP Border routers in a DC type environment?
Surely the instability does not justify the cost saving?

Murmaider

Why does VLAN 3600 and VLAN 3620 have the same network range?

Murmaider

But 1minutes 33 seconds doesn't seem slow at all, it seems rather normal to me.

ROS v7 is a pie in the sky and most people have been waiting 4/5 years for it, we could still be having this discussion in 4/5 years time.

Murmaider

Hi, I am a bit confused regarding this. I have seen many (MANY) posts regarding the BGP convergence time with Full Tables taking a long time. I then see a test by stubarea51 (http://www.stubarea51.net/2015/07/25/mikrotik-ccr1072-1g-8s-review-part-2-bgp-performance/) which shows the 1072 taking on a ...

Murmaider

Awesome, thanks for the responses, I'm going to give the HP DAC cables a try and hope that the Mikrotik works with them. It sounds like the most likely option that will work.

Murmaider

It's the HP 3800 switches - http://www8.hp.com/za/en/products/netwo ... id=5171624
I think that's ProVision

Murmaider

Does anyone know if the HP J9281B 1m DAC cable (http://www8.hp.com/lamerica_nsc_carib/e ... id=4000725) would work with connecting a CCR-1036 to an HP Switch?

Alternatively does anyone know if the Mikrotik 1m DAC cable will work when connecting to the HP switch?

Murmaider

Did you find a solution to this?

How come you not running their 6.32.3 "stable" release?

Murmaider

Between this and the post of random SPF+ ports not working or just dying we are seriously reconsidering whether or not we want to invest in these units. It definitely doesn't instill confidence in the product.

Murmaider

Have you tried forcing the speed of the SPF to 1Gbit rather than auto?
I've seen a couple of posts about needing to do that when using a 1gbit spf in a spf+ port.

Murmaider

Wow, that's a really awesome article, thanks!

Murmaider

Just out of interest, how reliable are the Mikrotik SFP's and SFP+'s or are all SFP's much the same now days?

Murmaider

The device itself also must be made to support ECC, so just using ECC modules will not improve anything (except maybe that ECC modules will be higher quality in general). So would you still recommend the CCR1036's in a data center environment doing bgp/ospf/etc, even though it does not use ECC ram?

Murmaider

CCR1036 uses regular laptop type SODIMM modules. CCR1072 uses soldered-on ECC RAM. Hi Normis, Thanks for confirming that. Do you know if the CCR1036 does support ECC ram (if we had to swop the modules out). Also, I understand the purpose of ECC ram in a server environment, but does ECC ram matter i...

Murmaider

I assume this was the http://routerboard.com/S-85DLC05D module?

On a side note, I don't suppose you know if the CCR1036 uses ECC ram or not, I know the CCR1072 does?

Murmaider

Hi, If you're wanting to connect the CCR1072 via a 10 Gig SFP+ module to an HP switch at 10 gig, then yes it is definitely supported. No I mean if I have an SFP+ transceiver in the Mikrotik and a normal 1G SFP transceiver in the HP switch, will the link work at 1G? I ask because I would rather popul...

Murmaider

Thanks IPANetEngineer for the comprehensive and reassuring response. It's nice to see someone with so much experience responding to questions like mine, it's much appreciated. I've read through a lot of the articles on http://www.stubarea51.net - very awesome site I must say! I agree with you about ...

Murmaider

Response further below... Moderator took very long to publish my reply.

Murmaider

We are considering buying 2 of these CCR1072-1G-8S+ for our co-location BGP and replace our old servers running vyatta. I've read through the BGP tests on http://www.stubarea51.net and it looks impressive, my only concern is regarding the reliability and stability of this unit. A number of people ha...

Search found 126 matches