MikroTik

millenium7

No updates but I'm appalled mikrotik still has done nothing about this. Its a 5 minute task on a Friday afternoon job, literally just move the classification of specific OSPF messages into the correct category, done I guess it's a chicken and egg scenario, which comes first? No one seems to care bec...

millenium7

So.... does anyone actually have a replacement they can share with us? I know technically you can use any 24v power supply with sufficient wattage, but i'm chasing one that actually fits in the original location without having to mess about, no soldering, no 3d printing brackets, no swapping caps et...

millenium7

Is this a bug with RouterOSv7? Seeing this on 7.15 and 7.16 (and possibly below, havn't tested) I've tried L2TP, OVPN and even PPTP and i'm getting exactly the same behavior The client side states 'Status: link established' and the server side log files say that a connection has been established fro...

millenium7

Unsure if its been mentioned but its not pinned in the first post - Indentation with sub-interfaces (i.e. VLANs) is missing i.e. ether2 -ether2.100 - Customer A VRF --ether2.100.20 - VoIP I've always been in the habit of labeling sub interfaces based on the primary. But when logging into a router th...

millenium7

Late to the party, and seeing there's already a lot of comments so I havn't read them all I did read the first post and a lot of others, most things have been covered already. I'll still throw an extra vote in for largely (or even entirely) bringing back tabs as opposed to drop downs In a profession...

millenium7

Give it a go but it's fairly straightforward, Weight is a parameter that will stay locally on your router so you can freely modify it and it won't propagate to other routers. If you start needing to add more complexity, multiple transit providers with equal costs, multiple BGP transit routers etc th...

millenium7

Anyone know when this was fixed? It's working in 7.15.3 but not 7.12.1 or below

millenium7

Wow what an absolute pain in the ass this was. Came across this thread and can confirm this is indeed a bug. Don't know what version of ROS v7 fixed it but 7.12.1 and below definitely has this bug and routing won't work properly. Upgraded to 7.15.3 and it works, so somewhere in between it has been f...

millenium7

This seems fairly straightforward. Just add a routing filter that applies to the IXP and sets BGP weight to 200, as they are only sending you domestic routes is that correct?
Everything else will use the other transit provider

millenium7

I've historically always used point-to-point as its the only mode I know to be reliable on RouterOS Recently have changed a lot of sites to PTMP as they have active-active backup routers, so trying to create point-to-point adjacencies requires a separate VLAN between each router and makes things mes...

millenium7

Seems like a roundabout way to go about it, having to go to an external URL

Can achieve the same internally without reaching out to an external source

:if ([/system resource get uptime] > 00:01:00) do={:put "yes"}

millenium7

TCP is quite a bit more CPU intensive and goes through a different process I don't know the exact mechanism on MikroTik but when you test from a router using BTest then I presume there's some double handling via the CPU. Presumably related to the firewall and connection table, packet order checks an...

millenium7

Here is a method to provide load balancing and/or failover to servers with a MikroTik router There are alternative (and better) methods to achieve this where possible such as Keepalived, DNS, NLB, Failover Clustering etc however I had a niche case where none of these were suitable and I did not want...

millenium7

I'm unsure if they are simplifying it down to 20mhz wide slices, or if its more granular than that and can carve out i.e. multiple individual 2mhz wide slices of the spectrum In either case no it doesn't just screw you, your device can and will at some point transmit even if there is 100% saturation...

millenium7

I can't wait until my neighbor sets up his WiFi 7 AP that uses 40 MHz on 2.4 GHz, 160 MHz on 5 GHz and 320 MHz on 6 GHz, all at the same time, all bands being used together (MLO shit). Then my second neighbor finds that his system that was perfectly functioning yesterday, needs an upgrade. So he to...

millenium7

However, if your L2 network is not segmented, then you'll have hard time to anything useful. Not necessary. It depends on the desired outcome I.e. if you don't actually care about traffic between end nodes and you instead want more of a hub-and-spoke topology where everything can see the router, an...

millenium7

Wifi7 also supports MLO (Multi-Link Operation) so unlike every prior wifi standard, it can simultaneously utilize 2.4ghz, 5ghz and 6ghz. So no it will not be 'shorter range' it will utilize any band that is useful. It may even use 2.4ghz up close for small packets like syn-ack, dhcp, VoIP traffic et...

millenium7

Setting up rules through GUI is less efficient and troublesome where copying a single (or multiple) row(s) and do the changes textual is way faster. What is really inefficient is smashing your head against a wall due to typo's or not fully understanding the syntax The GUI shows you every potential ...

millenium7

Well, or maybe there will be a programmer who can write a shell with his own Address Book, knocking and launching a VPN, which, when initiating a connection, will first work out these preparatory procedures, and then call Winbox in the standard way through the command line with parameters. Here you...

millenium7

Am patiently awaiting Wifi7 which - in theory at least - should make wider channels a genuinely useful and viable thing. Until then, above 40mhz is largely self defeating in most environments and its been a horrible disservice with so many devices defaulting to 80/160mhz wide channels. It's basicall...

millenium7

I assure you posting the config doesn't help. I can take any router and wipe its config, do the absolute bare minimum which is just give it an IP address, and it'll fail on 6.49.x, yet succeed on any other version I remember having an issue with rancid (https://github.com/haussli/rancid) ssh a few y...

millenium7

I don't think this needs to be part of winbox itself It can be done with a PowerShell or python script that prompts for an IP and choose from a list of preset port knock combinations that you create, executes them and then launches winbox and connects for you This should be trivial for ChatGPT or Cl...

millenium7

The client-ID is likely to blame. I actually wish that it DIDNT fill this field out when clicking make static I use a script to periodically to and remove the entry in the client ID field. I can't think of a single scenario where both the MAC 'and' client ID are needed. Maybe there is an edge case b...

millenium7

It's not a config issue, its something inherent to the 6.49.x firmware If I take a problematic router and downgrade it to 6.48.x or upgrade it to 7.x with no changes to the config at all, it works fine Every single device regardless of what it is or what config is in place it does not work with 6.49...

millenium7

I've just discovered a problem with some MikroTik devices where the config poller (Solarwinds NCM in this case) is having difficulty logging in and running commands It can successfully connect, however its not recognising commands being echoed back properly I have narrowed this down to version 6.49 ...

millenium7

Are there any plans to bring back a UI for routing filters? I understand some validity in having it as a scripting language, but its also a massive step back. I don't write routing filters every day and don't have the syntax memorized, so working with V7 means having to look up the syntax regularly....

millenium7

Are licenses transferrable by deactivating and reactivating on a new device? Or are they tied to a single installation forever? If the former then there's definitely no reason for any other tiers its ridiculously reasonable. Especially given you can just spin up as many unlimited speed/feature trial...

millenium7

I'm trying to configure a VXLAN tunnel to a cluster of servers running on Proxmox and I can't get traffic to flow across at all, can't ping either end etc I've first verified reachability by IP addresses to all nodes and the remote CHR instance I've then configured Proxmox as follows - On the Datace...

millenium7

Solved. I had legacy IPSec configuration that wasn't in use, V6 correctly identifies that the policies don't apply without an active connection and thus marks them as invalid V7 appears to have different behavior and when upgrading it made those policies active - despite having no active IPSec peers...

millenium7

Have a CHR running as a virtual machine on a QEMU host. Was originally installed with v6 and has had no problem with periodic upgrades I want to move it to v7 as I need to use VXLAN, I can upgrade fine but ether2 breaks..... There's a WAN facing interface (ether1) which works fine, ether2 is connect...

millenium7

Yep, asking about features at this stage is a bit like asking if you can move boxes into the attic of your new house and it's still just a timber frame Nowhere even close yet. Let's get fundamentals in and properly integrated before contemplating anything else. Though I wish MikroTik would put some ...

millenium7

Ah, you set the speed on ether2. It means you end up as 100Mb/s half-duplex. Can you remove the speed setting on ether2? This isn't correct. RouterOS frustratingly puts this line into the config by default but it doesn't mean anything. It's essentially saying "if you untick auto negotiation, t...

millenium7

You're missing the points and issue with MikroTik completely. Re-read this thread one more time. It has nothing to do with $30k routers or switches. And yet you completely missed what I wrote. Maybe try re-reading my post The purpose was to illustrate a simple use case with MikroTik of 1) not needl...

millenium7

I smell an enterprise guy right here from 1995, who's still doing layer 2 access networks and switch daisy chains. No sir, where I come from, we've moved SP, DC and enterprise (offices or campus etc) to 10000% layer 3 routed networks all the way to each access switch in the office room or floors et...

millenium7

Tools->Netwatch handles the sending of pings and defining timeouts without needing to script those However it still requires manual scripting to actually do anything Problem you may have with the routing method alone is that the connection table can break things. NAT in particular can be problematic...

millenium7

One use case is where you want port isolation but the switches don't support it. Port isolation aka Private VLAN is supported in the original Linux bridge codebase, it's also on Tik: https://help.mikrotik.com/docs/display/ROS/Switch+Chip+Features#SwitchChipFeatures-Portisolation I've used this feat...

millenium7

I cannot imagine a situation where you would usefully have a port as an untagged member of multiple VLANs, which is a flexibility that this config provides. Most other manufacturers do not even allow such a configuration. I can't even imagine how such a config would work in practice. Destination IP...

millenium7

Especially complicated when the vlan bridge method changed to be more CPU bound [all vlan bridge], instead of relying on switch chip [specfic models]. Wait, what????.... Old switch menu is horrible. Bridge menu isn't the best and it does not automatically handle certain capabilities in hardware acr...

millenium7

Id be very much against a split segment model One of the best parts of MikroTik is NOT artificially gimping functionality and having a (mostly) uniform OS across the board regardless of what piece of hardware you pick up. Aside from a few things (like wireguard not on MIPS chipsets) you can use any ...

millenium7

This is really annoying, please bring back the 'Make Static' option to the right-click menu under DHCP Server -> Leases Yes I am aware I can double click on an entry and then click the 'Make Static' button however this can't be done for multiple entries simultaneously, and its just an extra step I u...

millenium7

The comparison to Cisco/Juniper/Huawei/etc is not really relevant. May as well go pick on TPLink and ask why they aren't 'Carrier Grade'. I don't think most people would ever bother to try and make the comparison because clearly TPLink is almost entirely residential focused with a few soho grade bus...

millenium7

This ones a bit of a head scratcher Here's the fast and dirty - Customers are getting approx 30mbit/s, though radio's can do at least 180mbit/s, main uplink is capable of 500mbit/s+ and no CPU or ethernet bottlenecks anywhere The network topology for any given customer is... DistRouter -> SwitchA ->...

millenium7

This only happens to a select few routers in the network. There is 1 in particular that is particularly bad for this. Whenever I go to log into it with winbox, I get logged in fine but there are no interfaces listed, no IP's, no neighbors, not even the routers name is shown in the winbox titlebar If...

millenium7

More context options for DHCP leases would be nice. Especially right clicking and choosing mac-telnet, winbox, SSH, HTTPS etc I'm almost exclusively looking in DHCP leases for a particular device that I need to do something with by connecting to it. Cutting out those extra steps of them opening putt...

millenium7

I find the best alignment is the same as what I do with any other radio Lay your phone flat against the top/bottom surface of the dish and use the camera to align it (use an app that gives you a center cross/mark). This'll do your left/right alignment Then rotate your phone around 180 degrees and do...

millenium7

To further add to my 'even mikrotik doesn't know' statement, i've very successfully used a LHG60G as a multipoint that covers a 90 degree spread with 8x other LHG 60G dishes, yet according to them it only has a 3 degree beam width and must be aligned to within 1 degree. It's just blatantly wrong but...

millenium7

Good info. I searched this forum for aiming info and the Microtik setup instructions are pretty short. I'd this stuff documented somewhere? No, much to my frustration I voiced this on this forum several times, even after figuring out exactly how to work with the 60ghz devices and posting detailed i...

millenium7

Start with a rough alignment by eye Log into both radios, open terminal and manually set tx-sector=36 in order to disable beamforming. And if the range is >400m the use 64800 for the frequency. And you'll want the solidmount Then type in 'align 0' to enter alignment mode and give a real-time readout...

millenium7

Don't worry about the alignment arrows, its not the correct way to align the 60ghz products anyway, but at 50 metres it doesn't matter. You can spin the dish 70 degrees to the side and still get over a gigabit

millenium7

Unless I've missed it somewhere... Please for the love of God add a command or hotkey toggle to show all 'sensitive' fields in the console and not have them blocked out When typing or pasting in a command that contains a password, it will blank that entire line out as soon as the enter key is presse...

millenium7

No way to satisfy all. Sure, but there's a big difference between not trying to satisfy everybody, and releasing total gimp.... .. Like should any device now ever be released with 10mbit ethernet ports? No absolutely not 2.4ghz is not quite on that level, and it has some justification in niche situ...

millenium7

The earlier reply from MikroTik has been that the L009 is intended solely as the replacement for their most successful device ever, the RB2011. .... makes no sense. It's silly to not have put 5ghz in I'm pretty sure people aren't buying the 2011 specifically because it DOESNT have 5ghz in it Should...

millenium7

It does seem very strange to even bother announcing the AP product if the SM isn't ready. It would have some use as an outdoor directional multipoint for a pool/gym/outdoor area, but not as a WISP product, yet that's what they are advertising it as... That said, I don't know how anyone can deploy Mi...

millenium7

Which method would generally be recommended on MikroTik for equal cost bonding? Same destination server, same line speeds

- MLPPP
- Bonding interface with PPPoE on it
- NTH per packet bonding

Advantages/disadvantages to each method?

millenium7

An interesting question here is how many use terminal vs gui to configure the router. I do most config from gui when play around to test stuff. For setting opp multiple routers, terminal is used with copy past, so do not really need all that help. UI is great for individual configuration except in ...

millenium7

I don't think V7 is "worse" than V6. Using "?" as help key, meant that the "?" needed to be escaped if used in command (e.g. like AT command to LTE e.g. "AT+COPS?"). So borrowing the F1 from "windows" kinda make more sense (although in some terminal...

millenium7

The other major pain in the ass is hiding of text when pasting in passwords etc. Surely there is a way to turn this off? It makes debugging frustrating as hell as I can't see the code block I've just pasted in

millenium7

The best we can say about these devices being released today with too little storage and RAM is that it will force Mikrotik to optimise the software, and then everybody will benefit. Is that along the same lines of thinking MikroTik will be forced to make their AC wifi products fantastic when the r...

millenium7

Thats because you are using the 'local' type which confines variables to the scope they are created within (and scopes deeper inside) but cannot exist outside of that scope. Thus as you've found it doesn't exist outside of the 'if' statement Use :global instead of :local or place the :log command in...

millenium7

Does :execute command exists in ROS6? You try with it if does, :if ([/system package get 0 version] ~ "^6") do={:execute "/export terse" as-string} else={:execute "/export terse show-sensitive" as-string} Syntax will not be checked in string for execute, it will only b...

millenium7

Am I missing something or the terminal/cli significantly worse in V7? The ? key does nothing, making it difficult to see all valid commands. And tab completion seems to ignore A LOT of the possible commands, i.e. typing :pi<TAB> will autocomplete it as :ping yet ignore :pick as a possibility Same wi...

millenium7

I thought that professionals had a (self-standing) spectrum analyzer device as a common tool in their toolbox (rather that relying on whatever is built in the device they are installing), just like the rj45 crimper (I am not familiar with any AP/router/switch coming with a built-in crimper). It wou...

millenium7

... as essential of a tool as a RJ45 crimper.... What's wrong with prefabricated UTP patch cables? :wink: Yeah super convenient running those up towers, through wall cavities, conduits and risers etc. Very convenient, especially with the 20m of coiled excess on the roof I suppose whilst we're at it...

millenium7

Seeing the new NetBox 5 AX gives some hope for actually using MikroTik again as an outdoor wireless provider. However without spectrum scanning capability it is completely pointless as you're just playing 'guess a frequency' at random, hoping and praying with zero direction. Every other outdoor play...

millenium7

Surely there are "intended cases" for these L009 devices, but I am struggling to understand what they are. See now you're getting it MikroTik almost always gets about 95% of the way to something great then drops the ball on the last part - L009 wireless is 2.4ghz only, why!???? - CRS PoE ...

millenium7

MMIPS & MIPSBE are by far the most stable and reliable chips in the mikrotik range. HEX & HEX S thus hold value in that regard, hence I use them a hell of a lot and never have to question their stability. ARM chips have gotten better but are still unreliable in their performance metrics and ...

millenium7

That said, perhaps a low hanging fruit that would 'supercharge' this feature for me, is another drop down menu at the top called 'Layouts' for saving/loading presets. One that is usable whilst logged into a router, not beforehand I could then just go to the Layouts drop down menu, choose one of my n...

millenium7

Never once used or knew what this was about. So yes it is very poorly worded That said, i'm almost always logging into routers and then choosing 'Close all Windows' due to the clutter. This is because I didn't even know what 'session' was and never paid any attention to it. But inevitably the winbox...

millenium7

Most people are very short sighted on EIGRP and insist OSPF is a flawlessly optimal protocol. I've had this discussion on this forum and others, it rarely leads anywhere productive. Yet EIGRP absolutely would be a phenomenally better protocol in the WISP world, as it doesn't have the overly restrict...

millenium7

I was desperately hoping that the new CAPSMAN implementation would fix my biggest gripe with it, alas no such luck And that is the needless mess and doubling up of configurations SOLELY because of channels, it's not simple nor neat. As soon as you want any sort of control over channels - as is the c...

millenium7

get 0 Please stop writing on this way, no matter if is only one example. Why? It's entirely valid in this example, there will ALWAYS be at least 1 package, and packages have the same version number (but may change in name, thus 0 is perfectly suited) If it was something like a firewall rule then ye...

millenium7

v7 is still beta at best and definitely not a full replacement for v6

Besides, managing a dozen routers that you own is fine, managing hundreds/thousands of devices it's just not practical to enforce an upgrade to v7 (that then breaks other things) that sort of idea is nonsensical

millenium7

This is a conundrum since MikroTik decided to change the behavior of /export terse I don't mind the change in itself but the problem is how do I handle this with a single line? Using 2 lines will not work as it will include the output in the config backup So at first I thought I could use this, whic...

millenium7

It is stupid that this is still not a thing If nothing else, hash is extremely useful for identifying vulnerable passwords. I.e. old/outdated/common passwords on devices that should be changed. This is EASILY checked if the hash exists in the config, very simple regex or any other comparator that sc...

millenium7

Needed a way to occasionally run a bandwidth test on every distribution router in the network to assess real-world link speeds, as well as net backhaul capacity out of the network. Finally get around to writing a script to accomplish this Essentially this will let you specify 1 or more routers by fi...

millenium7

All I can say is FANTASTIC!!!! I won't ask for any concrete information but I do hope its at least IPv4 functionally capable for production use within a years time. OSPF is, always has been and always will be an utterly shit protocol for ISP and especially WISP environments. It's just completely the...

millenium7

This page was updated along with 7.12 release:

I see no mention of it in the patch notes and no routing is-is menu or CLI commands
There is however

/routing fantasy

MikroTik playing a cruel joke perhaps?

millenium7

Ubiquiti manages to do load balancing dramatically better than MikroTik and somehow can utilise all available capacity of all lines (unequal speeds are no problem) without the need to specify bandwidth manually, and will dynamically change the bandwidth split depending on conditions I'm guessing the...

millenium7

If you lock yourself out you may not be able to get to the device to restart it. Almost everything I configure is remote
Problem with separate running/saved Configs is when forgetting to save them, same situation as above. 6 months might go by and the device reboots and loses its config

millenium7

Safe mode is just inherently so unreliable. I'd say I have a 80% success rate with it, but that other 20% it just does not recognize loss of connection at all. It seems especially so when i'm changing anything to do with L2 connectivity, such as VLAN's, DHCP snooping, port isolation etc. And when it...

millenium7

Since Safe Mode is known to be woefully unreliable at detecting the device is no longer being accessed - especially with anything involving Layer2 connectivity changes - can I please suggest MikroTik implement an alternate method that is far more reliable. As well as allowing the user to momentarily...

millenium7

VLANs and switching in general is needlessly complicated. New bridge menu method is 'ok' at best but it's far from optimal. For one I don't understand why they couldn't just make it a very simple tag/untag/exclude option for each port in a bridge instead of the way it's handled. It's not clear, it's...

millenium7

100% agree. There's network engineers and there's vendor-only engineer. If this guy only knows Cisco, he's a Cisco engineer, not a network engineer. About the only viable complaint with MikroTik is their VLAN and Switch menu implementation, its a bit bass ackwards and definitely requires a thought ...

millenium7

I really wouldn't worry about it, if there is a valid use case (practical management is absolutely a viable one) then by all means use multiple bridges. If its just a home based setup with multiple VLAN's sure single bridge is a good idea. However as with everything it depends on the use case. Often...

millenium7

Have used multiple phones and found this to be woefully unreliable, some it works and others it just does not work whatsoever. Multicast routing itself seems to work but evidently multicast routing alone its not the only thing required for chromecast streaming to work 100% of the time (am testing wi...

millenium7

I'm having absolutely no success with getting chromecast to work. Read the entire thread, followed posted examples, not working First question which may answer why its not working: Does all multicast traffic need to be in the same 'bridge' for PIM or IGMP Proxy to work? I've been testing with a lab ...

millenium7

Anyone have an update to this? Is it finally viable to be able to stream to chromecasts across separate networks/VLAN's natively in RouterOS 'without' the need to install docker containers? Main constraint there being this only works on ARM/CHR architecture and thus not devices like the HEX (mmips) ...

millenium7

I've finally had some time to lab it I think the MikroTik help page is wrong, or has bad wording that isn't clear I also think it's just a complete bug, and things are broken and cannot be implemented as expected Here is a direct quote from the site Note: QCA8337 and Atheros8327 switch chips ignore ...

millenium7

I thought it was fairly clear given that I outlined requirements as well as existing bridge mode config Terminology depends on your perspective. As an ISP the customer is on and remains solely in VLAN10 Ether1 is an access port, untagged traffic only. Will end up on VLAN10 by the time it egresses ou...

millenium7

Not to mention MPLS is very broken on MikroTik.... After years of dealing with sporadic mismatches in forwarding table that causes unreachable customers/devices/routers i've resorted to completely ripping MPLS out of our MikroTik network. It's just not the right way to run a business having to rando...

millenium7

I'm baffled as to what the heck is happening when I seemingly configure the switch menu correctly, yet traffic just does not do what is intended At the moment most of our PowerBox deployments are configured solely with the Bridge menu, as it's much simpler to do so. The downside is no hardware offlo...

millenium7

Let me try and clarify with a simple example using 1 company and 2 different sites (they get to the internet through my network) My network leases transit and an IP space of 1.0.0.0/24 to CompanyX CompanyX pays me for 150/150mbit of bandwidth to the internet CompanyX has 2 sites that connect to my n...

millenium7

What is the most effective and straightforward method for rate limiting a BGP neighbor? Little more complicated than an interface queue because there can be traffic from multiple sources, and there are overlapping subnets for multiple neighbors (but more precise /32 routes) In addition, how about ra...

millenium7

at 300m in a multipoint setup (i'm assuming they are more than 5 degrees apart) i'd strongly suggest not using 58ghz. Try 64.8ghz and if thats stable step it down to 62ghz if you have other radio's in the area, or you're using it for a point-to-point backhaul I havn't extensively tested frequency on...

millenium7

I may have a small Mikrotik network, but the number of times I've had a 5Ghz capable client connect to 2.4Ghz radio is extremely ware. This is before the WiFiwave2 package was even released. Yes, a single room is indeed small :D It's a very common thing, it's not just in MikroTik networks but since...

millenium7

You are confusing how port mapping works. MikroTik uses a code logic whereby if 100.64.0.10:1234 traffic comes in towards egress NAT interface, src-nat chain netmap action will map 100.64.0.10:1234 to public:1234. This ensures 1:1 port mapping, eliminating the need for TURN. However, for additional...

millenium7

The latest 7.10beta5 appears to have fixed the issue I was having, can now run upload tests from client side without causing radio disconnections. Note that importantly it never disconnected with a mikrotik btest, it was only specific types of traffic Note also that you only need to update the AP an...

millenium7

I'd like to get some further clarification on a couple of topics RP-Filtering. Can someone explain how loose mode is in any way different to 'none' when a default route exists in the table? From what i've read, MikroTik does consider a default route when performing reverse path lookup. Hence every I...

millenium7

You're overthinking it. There will be zero difference in CPU usage. PPPoE sessions terminate and then must hit the routers CPU. No they are not tied to individual cores or anything like that Just throw everything into a bridge with a horizon value (same on all) to avoid traffic flowing between custo...

millenium7

Or....... I could use any other vendor and it just works without all the fluff The reason for capsman forwarding mode is it's the only one that allows hands-off provisioning Local forwarding mode still requires logging into the AP and manually creating the bridge interface and assigning the interfac...

millenium7

If you want each room to have its own network so that devices can communicate with others in the same room, a VLAN per room might be a better solution than multiple bridges. If there's only a dozen rooms perhaps, when there's 200 rooms that's 200 vlans to configure across a bunch of switches, 200 s...

millenium7

Not sure why this is not a clear concept so i'll try again Here's what i'd like to be able to do: Take any MikroTik AP directly out of the box with no configuration, plug it into a network and have CAPSMAN configure it with the details of the room it resides in Following me so far? The same as any o...

millenium7

It's not niche at all, it's really quite a simple concept and extremely common to have both 2.4ghz and 5ghz treated like the same layer2 segment, so that when you have devices connected on both bands they can still communicate with each other, and not forcefully have to switch bands. This is the way...

millenium7

Not a great solution either way, i'm hoping CAPSMAN gets a complete overhaul and rewritten from the ground up with the concept of multiple radio's and ease of management in mind. It seems to me that it was never designed that way, and assumed only a single radio was ever going to be present. As a re...

millenium7

We updated to the latest RC a couple weeks ago and the AP's stopped soft locking However there's still an issue, not sure if its always been there (I would say so) but we have only just recently narrowed it down to being replicate able Using 3x Cube60Pro AC's in a multipoint setup, when I run mikrot...

millenium7

I could be wrong but the other issue is the device will never boot back to RouterOS if its set to flash-boot (unsure if there's an integrated time-out?) I can see this being a problem, especially if flashfig doesn't work. Your device is essentially soft-bricked and you'd need a console cable to set ...

millenium7

I looked this into a while ago and couldn't find an elegant solution, so here goes again incase I just missed something obvious How can I make CAPSMAN AP's work like every single other wifi device out there on the market, and have both 2.4ghz and 5ghz radio's be treated like a single network? Not th...

millenium7

OCR has been used in critical real-time industry-scale applications for decades. For computer-printed text, it's a solved problem, to the extent that researchers have been focusing on handwriting recognition instead, the original problem from the 1980s considered too easy now. Provided the text is ...

millenium7

The next 10% is please include a barcode for the password Not quite a barcode. But I suspect if the font/size was better, OCR would likely work. I use the iPhone with IMEIs and ICCIDs and surprised how well it works to read them. stick it straight on the box - optionally the product as well I belie...

millenium7

We did also notice the issue with ambiguous characters and bad font. We will find a solution ASAP. One option is to switch to all caps letters only, another is to avoid O/0/I/l/1/8/B. In any case, we are workinng on it. Fantastic! that's a good start, and is 90% of why I originally created the thre...

millenium7

I'm having this problem with a customer as well. The PPPoE server is a MikroTik router, download test are fine but upload is garbage Client PPPoE has been tested as other routers as well direct PPPoE session on PC's and its maxing out at around 200mbit/s Changing to IP connectivity it maxes out the ...

millenium7

I only stick to things that can actually be done without giving a damn about the default password. Nothing more, nothing less. Ahhhh now it's starting to make sense. So if you encounter a situation like a radio/router/switch being factory reset on top of a tower, you just walk away and don't do any...

millenium7

have you read my posts at all? Yes I have, there is some merit in theory but not always in practice 1) I may not have any clue who the original distributor was of equipment that I take over. Or I may not have access to get those records 2) Netinstall/flashfig is a PITA at best, and completely usele...

millenium7

the sticker has only the DEFAULT password which you must change. this is not comparable to "I inherited a router that somebody password protected" Yes it is normis. Re-read what I said as you clearly misunderstood it If I factory reset a device then guess what password it gets? THE DEFAUL...

millenium7

*** I still haven't read a valid example (other than protected-routerboot) where this default password is a problem. But a concrete example, not bullshit. Of course I too could be wrong, but for now I have no data regarding something insurmountable that you haven't made me consider yet. If you havn...

millenium7

@ ponline well, how about try to make a p2p pppoe link for each client, instead of regular broadcast pppoe pool?? 🤔 this setup will be expensive in terms of ip number used, subscription maintenance and each pppoe p2p setup. 1 pppoe server for 1 pppoe client, uses 2 ips. PPPoE is not a broadcast seg...

millenium7

You need to leave connection tracking on Sounds like you probably don't want the absolute most CPU optimal method, and it'd be better to have something that's easily managed. As it sounds like this router is doing other duties, so its best to keep things nicely separated into their own compartments....

millenium7

You are impossible to get through to. No that isn't what I've been saying, you are twisting my words around and clearly you've not gone through any of the scenarios I've proposed and thus it doesn't make sense to you

millenium7

Hang on a sec. Your plan is to have a mode where someone remote can blank out the configuration and provide a new one, including a new non-empty password, in order to get around a regulation passed to avoid having routers completely taken over by LAN worms? Are you proofreading your proposals or ju...

millenium7

I'm no lawyer but I wonder if they would remain compliant if they did revert back to a blank password, but the device is essentially unusable until a new password is set. All routing/switching/wireless functionality is disabled and nothing can be assigned except for very minimal management functiona...

millenium7

Just regarding netinstall... Anything physical is a no-go on remote applications and isn't an appropriate solution. Even if you get a layer2 tunnel to every site (lets be realistic, its just not feasible en-masse nor on most radio tower installs) you need to physically do something to the device, th...

millenium7

If you were expecting to be able to walk up to a router someone else installed and used to manage, but get full admin access on it without a reset of some kind, you're either dreaming or hoping for a world without any security at all. You are completely missing the mark here. Not one person here is...

millenium7

We've done plenty of mergers/acquisitions of equipment. Doesn't matter how perfect 'your' records may be, if you take over responsibility for other equipment you have get absolutely zero documentation and your only option is to factory reset the device to take over control of it. Well now you can't ...

millenium7

What is the story here? I'm confused. Multiple scenario's mixed together? There are plenty of scenario's where random default passwords are atrociously piss poor. The only one i'm addressing specifically in this thread is the difficulty in reading it as its so small and uses ambiguous characters. T...

millenium7

Not a QR code, should just be a regular old barcode QR codes work better for things like wifi passwords as it can contain a lot more information (such as URLs) but provide no benefit in this instance and have some drawbacks - most handheld barcode scanners don't do QR codes - much slower to read/rec...

millenium7

Barcodes would go a very long way to helping this situation. Not everyone has a barcode scanner, but it's a pretty easy sell if you have to configure lots of them For individual units and field techs at least they can use a phone to snap a pic and have it convert that to text. At least it would.be c...

millenium7

Convenience is the worst enemy of security. Do it properly or not at all. This goes way beyond 'convenience', these sorts of random passwords absolutely will result in a lot of pointless e-waste, financial waste and needless man-hours solely because the device got factory reset and can no longer be...

millenium7

MikroTik need to keep it for EU compliance, frustrating as hell and should not apply to products sent outside the EU but whatever..... the main issue is make the password readable! Stop using characters like O/0/I/l/1/8/B as trying to decipher what they are gets really old really fast after repeated...

millenium7

The outdoor 5009 has no information on input wattage per ethernet port. Is it only 25w input as well? Or full 130w input is possible? My intention is to replace some Powerbox Pro's that have 60ghz radios hanging off then, as the powerbox is also setup as a router and it struggles. I don't want to ru...

millenium7

Yes, maybe... If you are just using the default/backbone/area0 everywhere then no you cannot do any selective route filtering at all. Every router participating in OSPF will all have the same OSPF routes in memory, it's a hardcoded rule in the protocol itself as its by definition how OSPF actually w...

millenium7

I seem to have a slightly different issue, only recently have I used the newer cube60 pro radio's in a multipoint setup (all radio's are the cube60 pro's, not the cube60sa) and it seems the AP soft locks, it responds to pings but you can't log into it, winbox shows no content, no interfaces etc. and...

millenium7

I have a few sites that are running a powerbox pro as a distribution switch. Fine for lower data rates <200mbit/s but they choke up and limit speeds a lot after that The standard model I use is creating a bridge, adding all the ports, enabling VLAN filtering, assigning VLAN's and port isolation/hori...

millenium7

I don't think this is related to number of connections (could still be wrong though) I converted the router to not need TCP tracking and moved the NAT functionality elsewhere. Problem still exists, TCP connections are dying It's similar to some threads i've managed to come across, except adjust conn...

millenium7

I'm investigating a strange issue in our network thats related to connections seemingly dropping out. I.e. downloading a large file it will just outright fail at some point This seems to predominantly affect international traffic, but that may be related to the fact it takes longer to complete One t...

millenium7

We're seeing the exact same thing with all 60ghz mikrotik products. hot garbage, do not buy, return if you can. No reply what so ever from Mikrotik with issues. Rubbish, in multipoint they are a bit meh but in point-to-point setups they are AWESOME. Just cannot be beaten for anywhere close to the m...

millenium7

Thanks for answering! I was thinking about max distance during perfect clear line of sight conditions, is it 2.4km as they promote them? I accept decrease in performance due to weather (failing over to 5Ghz). Is it still max 6-700m in 60Ghz? /Patricio The problem with the Cube's (and every 60ghz pr...

millenium7

Mikrotik 60 Ghz devices are great thank you guys your Siberian fan You can't say they are great when they just flat out have problems My biggest gripe is MikroTik has done NOTHING in actually educating the community on the ins and outs of their 60ghz products, nor how to use them properly It's frus...

millenium7

Can they be downgraded to ROSv6? I havn't tried the CubeSA yet, but found with other 60ghz mikrotik products that its quite stable with 6.49.6 Other things to think of... /int w60g set 0 mgmt-fix=yes Can try that on the AP, no idea if its supported with the CubeSA products. Not even entirely sure wh...

millenium7

Havn't been following all the 2xxx series closely but am aware of widespread reboot issues especially on the 2004. And have not heard of any actual confirmation that its been completely fixed Unsure of any specifics on other models, and whether to be looking at hardware or ROSv7 specific issues (Sti...

millenium7

Something we do quite often is accessing internal devices such as a switch, access point, VoIP phone etc We often don't manage a customers internal network - hence we don't have remote access agents etc. But we do manage quite a few devices such as the above, as well as their main router If we manag...

millenium7

Yeah I read it completely backwards. Edited my post

millenium7

Why did you install v7 on a v6 device? There is no advantage over the Cube. Using netinstall, with no default configuration, reset the password to blank. Wanted to try V7. However latest V7 release breaks links and misses some stability improves in the latest V6 release, hence why I went back to V6...

millenium7

Stickers were long since removed and thrown away That was the WORST decision you ever made! You should at least have noted down the passwords and saved them somewhere. Get used to this, it will likely be introduced in ALL models, because due to EU directive it will be forbidden to sell devices with...

millenium7

This is the WORST design decision mikrotik has made, flapping randomized admin password. I downgraded a couple of Cube60 radio's from ROS 7.4 to 6.49.7 and its reset the user accounts so now I cannot log in. Stickers were long since removed and thrown away How can I access these radio's now? I have ...

millenium7

Yeah its a crap design decision/issue/bug/feature from MikroTik. I would REALLY REALLY REALLY REALLY like for all user accounts including MD5/SHA hashes of passwords to be included in /export It's way too easy to replace a faulty router, load the backup config and 'forget' to change the user details...

millenium7

Can you set up the cubes as ptmp with out the Mikrotik wAP 60Gx3 AP?

Yes, but you need to buy a Level4 licence through a MikroTik account and then apply it (only on the AP)

millenium7

Also I believe the centre sector pattern is the same as LHG60G with an 8x8 array 27,28 35,36 Are the 4 centre sector numbers.... But id like a mikrotik rep to confirm it is indeed the case All our links tend to favor sector 35 when aligned as best as possible. The beamforming appears to be more stab...

millenium7

We've put a few up The longest is still 1.35km and I've noticed it has dropped out more frequently in moderate to heavy rain, presumably it's moved a tiny fraction but whatever the case it's a 'real world' deployment, with real equipment in real conditions. If it's slipped by 1 degree and that cause...

millenium7

This is on v6.47.9 Have a seemingly phantom route thats stuck in the routing table, I have absolutely no idea where its coming from It's showing 'DAbU' as the flags, with a distance of 20 and no gateway. So it's implying its originating via an eBGP peer. However I specifically have rules to block th...

millenium7

I understand that the default behavior now in ROSv7 is the opposite of v6 and it will reject all routes unless a match is found Thats fine (and probably should have been the default) however........ how exactly do I flip this behavior? or rather how do I add an 'accept all' rule to the bottom of the...

millenium7

The vast majority of CPE facing radios are 24v, hence perfect for PoE out on port1 which is also the internet facing interface. It's literally labelled Internet. Just yet 1 more thing to avoid confusion with customers or even techs. I don't want to change interface assignment at all if I can avoid i...

millenium7

In theory and on paper yes. In reality no The reality is port1 is used for internet connectivity, thats precisely why the factory default config blocks on port1, and almost everyone will use port1 for that purpose There's been plenty of times we've done an installation (or even just pre-provisioned ...

millenium7

I think this one pretty much nails the essentials Yes plenty of other things 'could' have been put in but I feel that Wifi6 and higher gain antenna's are by far the most important thing, and would happily sacrifice everything they have in order to make it happen at a good price point USB is nice to ...

millenium7

I like the idea of passwords being printed on a receipt that change daily. Not practical in all situations though There's not really any good method. I would highly advise NOT implementing any sort of signal strength based denial process, it just will not work as intended Signal strength is affected...

millenium7

anyone who praises CAPSMAN would be blown off their rocking chair. I new Mikrotik AP do not even look at the sticker. :D I connect the point, press reset for 10 seconds to switch the device into CAP mode and go to connect the next one. You just need to set up the Capsmans properly Now create 130 un...

millenium7

Finally someone has found a Grandstream product that works!!! :shock: :shock: :shock: Old ones are shit New Wifi6 gear is fantastic I have zero brand loyalty, I look at individual products on their own merits. Brand loyalty does not work in technology, smart people come and go from a company (often...

millenium7

Easy dont use capsman. I dont and dont regret it all. I have not lost one nanosecond of my life and when I see the gazillion of threads, with hair pulled out, teeth gnashing and the like, I just have to smile, knowing what I avoided. When deploying dozens/hundreds its great. Back in the predominant...

millenium7

And when you think about it, it's logical. 2.4GHz settings are not the same as 5GHz settings. They ARE different interfaces in HW too. I think about every single other wireless controller i've used and how ridiculously illogical CAPSMAN is in its config/provisioning in comparison, its rubbish It wa...

millenium7

CAPSMAN with nothing but 2.4ghz gear, fine, easy, neat However 2.4ghz and 5ghz devices is a total mess and a pain in the ass, but maybe there's something i'm missing? (i'm hoping so) It's really simple, I just want 2.4ghz and 5ghz with the same name, but obviously subtle differences like 20mhz chann...

millenium7

5GHz interface is designed as backup for 0.001% of time when main 60GHz interface is unavailable. it's not designed as Access point for other wireless clients or other uses. A backup for what exactly? listening to an internet radio station? Because it isn't a backup for customer data. That would im...

millenium7

Can't realistically be done due to DNS over HTTPS A lot of websites are now enforcing DNS over HTTPS which effectively means it does not care what DNS servers you set. I.e. google knows valid IP addresses, if any DNS server attempted to redirect google.com to somewhere else, it denies it and instead...

millenium7

We have a link currently doing 1.35km. It has dropped in very, very heavy rain - no idea what that is in mm/H, but think tropical thunderstorm type of rain where you can barely see more than 100m Anything less than that it has stayed up. This actually makes it slightly better than the 60ghz long ran...

millenium7

Well, using the same pair of physical links for two bonds is really an "extremely unusual" approach (my English vocabulary lacks more appropriate expressions ;-) ) It's because MikroTik lacks the appropriate routing techniques to allow selective pathing If you know how to do it via routin...

millenium7

The concept is to provide active/backup over 2 different radio links. 60ghz primary and 5ghz failover Currently using OSPF with BFD on the primary and regular OSPF on the secondary. This technically allows for fast failover but what I want is to treat them like a single link and suppress OSPF events...

millenium7

Seeing multiple private IP's means nothing whatsoever, it does not imply there's multiple layers of NAT going on If customers do a traceroute in our network they too will see multiple private IP's, yet the ones that have been assigned a public will not have any NAT occuring except what is set on the...

millenium7

Is there a way around this? I've noticed if using a Bonding interface in an active/backup setup, it is susceptible to 1 way traffic failures that will not properly failover. One router will correctly fail the active link and fall over to the backup. But the other will not and hence communication is ...

millenium7

Yes it will cost you slightly On the other hand you are asking the ISP to use one of their public IP addresses (which costs money) solely for you, and potentially set up additional routing just for you, for free And since they've already told you no, now you're complaining here on this public forum ...

millenium7

double NAT is not inherently a problem on its own, it depends on the protocols. Vast majority of services these days will handle it, its only when you need a direct connection to someone that it can be a problem (and in some cases VoIP/PBX etc) If you absolutely must have an open connection, VPN doe...

millenium7

Have only skimmed through the thread but i'll try and lay out a simple explanation from an ISP perspective Firstly it doesn't matter that its a WISP. This is not a reason for you to not have a public IP address, however there's a lot more behind-the-scenes going on that can be a very viable explanat...

millenium7

Having (mostly) mastered the fine art of the LHG60G, I feel I now need to figure out the Cube60Pro's since MikroTik has very lacklustre documentation on actual real world usability First and foremost what are people actually managing to achieve with their point-to-point setups? At the moment we have...

millenium7

it doesn't tell you if the existing config is correct, That would be interesting for sure. But might be difficult to implement. What is a correct config? Today one is not sure ROS will act as expected. "Toruble" shooting can take some time, as there are so many settings, and so many thing...

millenium7

Interesting idea. Actually the current experience is already quite good. Managing nearly 100 MT routers at a very remote location, can be done. Can be done yes, but could be done immensely better with a central cloud controller It's not just about number of devices either Relatively simple things l...

millenium7

Lot of this probably been mentioned already but i'll throw my 2c in - Cloud based, absolutely. Something that can just reach a known public server out-of-the-box as long as it gets an internet connection. Make it something that runs over port 443 to get through firewalls and not need ANY config depl...

millenium7

yes but there are no parameters that correspond to a specific interface, nor with a route Only IP addresses are listed, meaning additional steps are required to extrapolate the required information I managed to figure it out, bit of a pain in the ass as I need to extract the information from the 'ga...

millenium7

Having some difficulty with scripting this properly I'm about to implement a failover script that uses netwatch and tests for reachability of a public IP address. If a route is unreachable it'll purge the firewall connection table The problem is this is not selective, it will purge the entire connec...

millenium7

This is a routing engine problem. It will not replace an existing route if they are an exact match I.e. 10.0.0.0/8 will not be replaced with another 10.0.0.0/8 even if its substantially better This applies to differing route types, i.e. static and BGP, OSPF and BGP, OSPF and static etc If it's the s...

millenium7

I mount this inside the netpower and supply with 48 volts. the output goes to 24 volt input. the 48 volts goes to 48 volt input. direct replacement for ubnt. works awesome. https://www.ebay.com/itm/110730441396?hash=item19c80c72b4:g:Wj0AAMXQigBR7Mve This is a step in the right direction but the net...

millenium7

I suggest get rid the 'powerbox' entirely as its a stupid product, who wants 100mbit ports just to save a tiny amount Then rename the PowerBox Pro to just 'PowerBox' Now release PowerBox Pro v2 that is actually a 'pro' model, with 24/48v switching (with a single 48-60v input on eth1, not silly dual ...

millenium7

Perhaps you can use Docker on your Mikrotik model to run exactly a instance of a DHCP Server that supports your needs. So you do not need an extra device for this job. This requires learning how to work with docker, setting up a new DHCP server etc. It's a lot of administrative overhead as I want t...

millenium7

I have a request: please add optional circuit ID and remote ID fields for user accounts, without needing to specify MAC address or any other options We really need DHCP option 82 functionality to authenticate guests by port/location, not by voucher code which is pointless in our case Use cases are t...

millenium7

This has been a huge limitation for us for a long time, being unable to do leases via DHCP Option82 parameters I saw in RouterOS v7 that User Manager has had an overhaul, i'm wondering if its now possible to somehow use this (or just the base DHCP server) to assign addresses based on either the Circ...

millenium7

Bumping this up. MikroTik please implement this in the next firmware update. It should be an incredibly simple and easy thing to do, the messages are already there, just literally take the 'up' message (and all other key state changes) and assign it into the 'ospf, info' category. Very simple, 30 mi...

millenium7

It may not be MTU related but to check if it is, you want to do a ping from the customer (or closest router if possible) do a 1500 byte ping with the 'do not fragment' box ticked, out to furthest possible point, end of where MPLS stops at least Then - very importantly - also do the same in reverse. ...

millenium7

Nothing against passive PoE, just passive PoE 'detection' You don't need to use the 'auto' mode, just manually turn it off/on In addition passive PoE detection doesn't always work when it is supposed to either. Powering a Cambium radio from a MikroTik for example, most of the time it will not detect...

millenium7

802.3af/at standard PoE detection works properly every time passive PoE detection I do not like at all and I really wish it wasn't a thing. I've had several times when i've plugged something in and passive PoE has decided to kick in and supply power. This absolutely can and likely will kill end devi...

millenium7

This is still present in 6.49.2, config diffs are all useless as i'm just getting spammed with change notifications all the time when nothing has changed, because its logging every character as its typed (sometimes multiple times and not exactly repeated hence a change notification) How are others d...

millenium7

Do you have links to any good resources for learning about it and the best way to set it up? i.e. tutorial series or step by step guides
What about FreeACS?

millenium7

This is something i've been wanting to setup and deploy in hotels and for many locations in our private network. Hotels especially as we use a mixture of vendors equipment and I really would like the ability to simply plug any vendors DSL or Ethernet ether into the wall and have it automatically con...

millenium7

doesn't work. When adding 'e' solarwinds fails to recognize a successful login

This really needs to be fixed. Right now we're blind to config changes because its just emailing through a tonne of garbage

millenium7

If you are using full tables, OSPF can't handle those, so you will want to iBGP peer those two routers to make sure that they have the same view of the global routing table. If you are only getting a default route, that probably isn't necessary. I wouldn't be advertising the BGP table across the li...

millenium7

I would do this by simply advertising the /24 at both physical locations. And then have your own connection between these 2 locations and run iBGP or OSPF between the routers (you can use EoIP or any other tunnel for this in the meantime) so i.e. you have 1.2.3.0/24 advertising out both locations, b...

millenium7

we're using +ct2000w, tried +cte2000w and it fails

I'll have to troubleshoot later

millenium7

Yes, they have recently changed some things. What are you using to backup the config via SSH?

Solarwinds NCM

What version did MikroTik change this?

millenium7

There are information about windows malware, that knows how to connect to MT router with default password and make a configuration changes to add it to botnet. So admin: no password to local network are not safe anymore. Well this has to be changed by MikroTik anyway, as it will be forbidden to sel...

millenium7

In anything since 6.44.x onwards Noticing a lot of our devices are now screwing up with config exports and the software is logging individual characters as a line / /e /ex /exp /expo /expor /export /export /export t /export te /export ter /export ters Wondering if anything at all has changed in the ...

millenium7

The alignment information can be very misleading The best way to align these radio's is to login and type /int w60g set 0 tx-sector=36 To force it only use the middle of the grid antenna Then go into alignment mode /int w60g align 0 And finally run a UDP bandwidth test with direction=both to fully s...

millenium7

I've trialed the TPLink EAP620 and it's actually surprisingly really good with fantastic range. Only thing is it's physically enormous and quite off-putting. But I have to say I think I prefer its performance over a Cambium XV2 (if you don't need any of the fancy features and management). And in an ...

millenium7

This comment tells me you don't understand how MikroTik works as a company. Without specifics nothing will change. If all you want to do is share your frustration and anecdotal results with the WiFi performance, no big deal, but it doesn't really benefit anyone. What specifics do you actually want?...

millenium7

Here's really the bottom line: Anyone can go out and do their own testing in their own environments But when doing those tests don't 'only' test peak bandwidth with iPerf because as anyone should know thats only part of the equation. 500mbit/s is great but not if your latency is fluctuation +/-80ms ...

millenium7

Problem though is you can't test and apply exact measures with wifi because every single environment is different. The best you can do is manage relative comparisons and approximations RF environments are not like ethernet or fiber where you can go 'yep she's good to XXX metres at exactly that speed...

Search found 587 matches