MikroTik

Railander

I think the issue is that the feature has to be licensed from Marvell - and that will have a high cost impact.

that would be devastating... wirespeed vxlan would be incredible, would allow us to get rid of most of our EoIPs and skip MPLS entirely.

Railander

RouterOS can produce some really big log messages now. Would it be possible when opening a log message window, instead of having a very long window to have the message instead have automatic line breaks to fit in the box vertically? Additionally, would it be possible to have the same line break feat...

Railander

you can add the new VRF interface (7.14 and newer) to the simple queue, however it counts packets passing in any direction as Rx.

what i ended doing is 2 packet marks per VRF, one for download and one for upload, and then matching these packet marks with simple queues.

Railander

this switch still isn't listed in the L3HW docs page, i'm interested in the size of the TCAM (how many routes can fit in it).

Railander

7.15.2 simplest way i could route leak (to effectively append BGP AS) was with inter-VRF BGP peering. or at least for ipv4. ip ad add address=172.16.0.0 interface=lo ip vrf add name=AS65001 interface=bridge-AS65001 ip ad add address=172.16.0.1 interface=AS65001 ip route add dst=172.16.0.1 gateway=AS...

Railander

with the linux loopback interface being now exposed, the loopback address ::1 shows up in /ipv6/address and /ipv6/route this creates unexpected behavior of OSPF's "redistribute connected" advertising ::1 IPv4 does not have this issue, likely as it does not show up in /ip/address or /ip/rou...

Railander

likely predating to 7.14 when loopback interface was exposed, but i just noticed loopback address ::1 shows up in /ipv6/address and /ipv6/route this creates unexpected behavior of OSPF redistribute connected advertising ::1 IPv4 does not have this issue, likely as it does not show up in /ip/address ...

Railander

@Larsa I have not addressed any question towards you. i'm OP. no need to be passive-aggressive. issue is you could use it before, you cant use it now. this thread would not exist if you could never use it. backup pulls name from identity. identity has reserved characters (such as spaces). automated...

Railander

as far as I understand MT did not discontinue support for file names which include special characters ... only the way one has to work with such file names, was made different). the actual issue is when running /system/backup/save from the CLI, as opposed to from winbox (or, i'd assume, from API) i...

Railander

as this is likely going to go nowhere, i guess i'l just have to fix this on a per device basis as i update them. using this regexp to get the converted filename. :local fileName [/file/get [/file/find name~"$systemDateTime"] name] where $systemDateTime is the variable with time gathered fr...

Railander

i'm just baffled by @mrz answer that "one can download files to other systems not supporting specific characters in filenames". what OS out there does not support spaces in filenames? i don't think anyone is asking for / or : or ; or \ i'd like , if possible but i wouldn't lose sleep over ...

Railander

where programmatic access is used i will ask one more time. please stop muddying the waters. FILE NAMES. are you going to argue that every system in the world should also stop supporting spaces in file names? everyone that works with windows AD should now use _ instead of spaces in file names as we...

Railander

I do have a certain understanding they want to avoid control characters and similar, but not when it comes to common characters like spaces. Problem is: where do you define the bounds. Characters like / : \ can also cause trouble. People have used date/time as part of a filename and ran into "...

Railander

But I guess it just seems odd to add more "file system things" like /file/add, ROSE/SMB, and DLNA now...while also adding restriction on stuff like spaces in file names. e.g. imagine someone one day may want to rename some movie with a space on RouterOS DLNA server... very good point. @ja...

Railander

i genuinely don't understand the issue. windows, every linux, every bsd, mac, all of these have supported spaces in filenames for a very very long time without any issues. what is this breaking exactly? why is this an issue exactly? regarding programming, you are correct that you need a safety check...

Railander

the v7 implementation of VRF seems to break queues.

would like an official statement on the matter.

as a dirty workaround, manually create and configure a separate routing table with routing rules.

Railander

MikroTik has once AGAIN managed to break script compatibility by prohibiting something as common as spaces in file names. The common issue seems to be that people uses spaces in their System->Identity and then later use that as a filename. Just don't do that! Something as basic as an Identity bette...

Railander

common sense would dictate not to use special chars in filenames anyway, especially when one can download files to other systems not supporting specific characters in filenames what system are you talking about exactly where space is a reserved character? every system has supported space in filenam...

Railander

for the quotation explanation, it is even less convincing when you remember you still need to use it for unrelated scripting, such as.

[admin@COB] > :put [ip/ad/find address=10.172.70.18/30]

[admin@COB] > :put [ip/ad/find address="10.172.70.18/30"]
*1

Railander

you can still upload filenames with spaces, even if you can't manually create on directly on the device. again, if there is a good reason for this breaking change, i'd like to see what this reason is. massive headache to go back and fix all scripting with spaces inside quotes. it's especially annoyi...

Railander

*) console - replace reserved characters to backup and certificate export file names with underscores; is there any reason this needs to be done? Yes, having spaces in file names breaks parameter parsing in all CLI implementations I've seen and one has to use workarounds (such as enclosing such fil...

Railander

*) console - replace reserved characters to backup and certificate export file names with underscores;

is there any reason this needs to be done?
this breaks my automated backups throughout my network.

Railander

It's a deliberate change, well published in change logs. Did you read through relevant "new version announcement post" before installing a beta version? i actually read every release notes (i follow through RSS) and didn't see anything regarding backups. reading it again i am assuming it'...

Railander

After updating to 7.15beta6 I noticed that my automated backups were no longer working. Upon closer inspection I noticed the issue is that /system/backup/save no longer accepts names with spaces, and will automatically convert them to _ doesn't seem like it's a file system limitation as i can still ...

Railander

had same issue, here's the workaround i found. after updating to 7.14, noticed that the addesses in EoIP interfaces members of the VRF were falling on main VRF instead of created VRF, thus causing the issue, as reported by others. upgrading to 7.15 beta did not solve it. the solution was deleting Eo...

Railander

*) fixed non-DHCP packet forwarding when Option82 is enabled;

lets go! better late than never.

Railander

i believe this is possible with VRF. apparently prepending a different AS with filters is considered "wrong".
viewtopic.php?t=185852#p933186

Railander

maybe unintuitive. for BGP the default is to accept all routes, but for filters the default is to reject all routes. when you did not set a filter yet for the BGP connection, it will by default receive and send everything, but as soon as you set a filter it will by default reject everything. if you ...

Railander

just to point out that Winbox still has this issue. it appears to be a visual issue on Winbox, not BGP itself. how to replicate: 1) open a device via winbox 2) create a template with AS 123 through winbox 3) disable that template through winbox 4) re-enable that template through winbox functionally ...

Railander

1) only default <own>
2) saves window layout?
3) i'd always wanted to take an existing layout and make it the default for new sessions, every single new device i acess i have to fix window sizes and sometimes fix shown options from context menus.
4) yes

Railander

it wasn't even available in the GPEN21 to be messed up in the first place...

it's in there in my css610, but i have to disable option 82 for DHCP snooping to work correctly.

Railander

DHCP option 82 for IGMP snooping was completely borked in SwOS, is there any acknowledgement on this? from this changelog it doesn't seem like it was fixed.

Railander

in your routes: /ip route add gateway=172.23.251.1@VRF.100 routing-table=VRF.100 vrf-interface=ether8 add gateway=172.23.252.1@VRF.200 routing-table=VRF.200 vrf-interface=ether7 you probably don't want to use vrf-interface at all, unset it: /ip route add gateway=172.23.251.1@VRF.100 routing-table=VR...

Railander

by "crashes" do you mean the device hangs and requires a power cycle?
i'd recommend e-mailing support@mikrotik.com with your supout attached.

Railander

average CPU load is not really helpful, this device has 16 threads so make sure you're looking at individual thread load and none is reaching close to 100% (there's always one thread with way higher load than the others). regarding your question, yes, make sure your bgp peers use affinity=alone for ...

Railander

don't know if this could be supported but it would be great if we could prioritize traffic based on TCP/UDP port.

Railander

it's important because at least 1 person came here from google: me.

if the forum moderators would prefer that people don't post on old threads, they can very easily block threads after a certain age. reddit does it.

regarding your attitude, i'd recommend going out and touching some grass.

Railander

Look, the user has been waiting impatiently for your "reply" for 9 years... will never understand these passive-aggressive replies. the reason i found this was because i googled it. and the reason i registered it here was in part due to answering myself and helping anyone else that has to...

Railander

got lookaheads to work.

^[^/]+\$

will match anything not containing /

Railander

*) qos-hw - added QoS marking support for 98DXxxxx switches (CLI only);

could someone expand on this?

Railander

I would love for you to list a few items that are missing or less elegant. not to compare it to v6, but i think OSPF interface-templates would work a lot better for our use-case if you could pick an address-list for the network, like you already can with bgp networks. just some QoL improvements. ca...

Railander

Is still not recommended for CRSs ?
Best Regards from Rome
Andrea

would like to know as well. remember the changelog in the release candidates saying to not use on CRS devices, is that still the case?

Railander

ospf v3 does not work in 7.7, reverts back to 7.6 and everything is fine 7.7 changed OSPFv3 to now actually use authentication options, previously it'd just use no authentication even if you had set it up otherwise in interface-templates, breaking compatibility with ROSv6. solution is setting inter...

Railander

problem persists, can't run wireguard on top of VRF.

Railander

It's also the one of the hardest protocols to get right when developing for an ASIC so tackling easier protocols first is understandable. I'n my view it should be the simpliest. The MPLS FIB is basically Label in & out and swap or pop. yes but it runs on top of conventional routing, so not only...

Railander

So while the request for MPLS HW offloading is certainly a legitimate one, I guess it's pretty low on ToDo list of MT devels. primary use-case is VPLS VPNs for customers. EoIP works great and all but adds tons of overhead and has performance issues at high speeds. would be awesome if we could repla...

Railander

I think that you may have wrong expectations regarding static NS records in RouterOS. If you do e.g.: /ip dns static add type=NS name=xxx.test ns=a.ns.yyy.test Then this works: # host -t NS xxx.test 192.168.80.183 Using domain server: Name: 192.168.80.183 Address: 192.168.80.183#53 Aliases: xxx.tes...

Railander

NS records don't seem to be working, tested in v7.6 as a workaround, i ended up using this FWD entry with regexp. simply type the zone name in the regexp field, put ^* at the very start, put $ at the end, escape every dot with \ and it works like a NS record would (don't add the trailing root dot or...

Railander

I'm having the same type of issue with deleting communities in a route. Here is a received route with a large community [zuul@rtr-core-01.v7.ipa.dev] > routing/route/print det where dst-address=0.0.0.0/0 && bgp Flags: X - disabled, F - filtered, U - unreachable, A - active; c - connect, s -...

Railander

delete bgp-*-communities bgp-*-communities is not a valid term. no idea how you even came up with that. i've tried basically everything possible and nothing works. in fact from my testing i don't even see how anything involving the command delete instead of filter would work. filter removes only th...

Railander

I can't find CCR1036 anymore (with v6 or not). New availability is at November... I'm forced to use a CCR2116-12G-4S+ and I'm afraid to use v7 for BGP… I don't know what awaits me… 😨😨😨 i'm just trying to setup v7 for bgp and for the love of me i cannot do the v6 equivalent of set-bgp-communities=&q...

Railander

exact same issue here. i tried doing a bunch of things with mangle rules and even routing rules but nothing worked. ultimately i settled with L2TP which does have support for VRFs... however it cannot run on a VRF with IPsec enabled, so i had to disabled that. for my use-case i didn't really need IP...

Railander

oh wow, this actually works way better, thanks fam.

Railander

i think your alternative solution to creating a separate list would cause problems for me as i'm using that interface list in ospf interface-templates, i think any change would cause all interfaces to flap. hence why i'm opting to do a check like this.

Railander

i like the shorter form of converting to string, thanks. dunno why i added the + for the regexp matcher, at this point i was a long time at it and just trying the most inclusive stuff possible. however, you do need to add the ; at the beginning and end of array to use as delimeters, otherwise you ma...

Railander

my use-case was adding every interface to an interface-list, except if the interface was already present. :local intf [:toarray ""] :foreach i in=[/intferface/find] do={ :set intf ($intf,[/intferface/get $i name])} :local list [:toarray ""] :foreach l in=[/intferface/list/member/...

Railander

@rextended my example works so you must've seen it wrong. i had to add ; at the start and end of the array to use it as a delimiter and avoid unwanted matchers (10.0.0.1 matching 110.0.0.145, etc). but i'd love to see what is wrong in it. in my case i had to match elements from one dynamic array aga...

Railander

i was trying to do this and very frustrated that the scripting allows you to add elements to an array but not search and remove an element from an array. after a lot of searching i found a workaround in converting the array to string and performing regexp on it. :local array1String (";".[:...

Railander

Would also like to know...

Railander

Anyone know which linux kernel version 7.5b is based off of? Looking forward to full NETMAP support in kernels 5.8+.
7.5beta4 is on Kernel 5.6.3.

how did you find this? is there a CLI command that shows the kernel version?

Railander

There are plans on implementing MPLS hardware offloading at least for Marvell 98DX8xxx switch chip series (CRS317, CRS309, etc.) and CCR2116 . However, please don't expect that soon - we have to finish IPv6 offloading first. Would you know if, when eventually available, it would be able to offload ...

Railander

for winbox, would it be possible to show where a prefix terminates when hovering cursor on it in `ip/firewall/address-list`? very annoying not easily being able to know what something like 10.0.128.0/19 ends at, my workaround is adding the prefix in `ip/address` as disabled and hovering the cursor t...

Railander

I discovered the sessions feature the other day. It's good, but it's not quite there for me... I would still like individual sessions per device. I just want to copy the default session on first connect, rather than starting from a clean slate. Im looking for exactly the same as the user above (and...

Railander

i've got a CSS610 and i'd like to do either tag stacking or QinQ, does SwitchOS support this yet?

searching google i've got no results.

Railander

Please allow us to select Address Lists for the Networks in OSPF interface-templates, we can already do this with BGP.

Railander

GRE offloading would be great, but I find the real deal would be EoIP offloading since you can bridge it to easily deploy PTP links (or L2TP if the other end isn't MikroTik). VPLS would be ideal, but it has many limitations (in the form of expecting every node in between to not only be participating...

Railander

does this update fix the issue introduced in previous version where after updating the firmware, CCRs with simple queues enabled would take way too long to reboot? (~15 mins)

Railander

Hi, Does anyone know what has changed in 6.49 that would stop Rancid from connecting and taking a backup? Initially I thought it was to do with expired user account but have worked through all that and mtlogin can get in but rancid-run fails to pull the config. Thanks. maybe it's related to this? *...

Railander

*) fixed glitches while resizing column widths or reordering table entries;

is this the one where if you were dragging an entry in routing filters, it'd keep being sent down to the last position even though you were still holding the mouse button?
if so, thank god.

Railander

I agree that 4k connections is small number even for a small business let alone for an ISP well that is exactly why i am asking. and i disagree with it being fit for home use since right now my home network is idle and sitting at 300 connections. start a torrent and its already about half the budge...

Railander

if i may ask, what is the expected use case of offloading fasttracked connections? 4k connections seems way too few to me since everything else would be processed on the CPU (which considering the CPUs in these would be effectively dropping all other packets in any decently sized network), unless i'...

Railander

I still don't fully understand why PVID setting is mandatory in practice. @raimondsp writes that omitting to set it keeps the default setting of pvid=1 (which we already know very well), but the argument about bridging the port with other ports with pvid=1 seems moot to me if frame-types property i...

Railander

pvid property of /in/br/port is mandatory. If you omit it, the default pvid=1 is used, meaning the port gets bridged with other ports with VLAN ID 1. We do not want this, so we explicitly set pvid=20. Setting port's pvid leads to a dynamic vlan creation where the port is untagged by default. But we...

Railander

Just an update, apparently you can change the threshold via CLI

interface ethernet set sfp-shutdown-temperature

Railander

Interesting. As another work-around, do you think these types of heatsinks on the SFP module would help? i doubt it'd have much effect, as the temperature rises extremely quickly as soon as the interface is enabled and stays very high. there is no airflow in the places we have this issue, hence why...

Railander

After a recent RouterOS version, a new feature was introduced to automatically disable SFP ports if the module is operating at >=95°C. Obviously this is good default behavior, but is there a way to disable this feature on demand? Some of our equipment are in deplorable places where we can't solve fo...

Railander

bumping because this happens in our most congested routers and it makes troubleshooting general networking issues affecting the whole network much slower than we want them to be.

traffic forwarding doesnt seem to be affected, only winbox management is very sluggish.

Railander

my 1st attempt to upgrade a RB260GS(CSS106-5G-1S) from 2.12 to 2.13 thru a browser failed. Upgrade was visible and started, device prompted "upgrade failed" and did reset tot firmware 2.0 and lost normal settings ... we've had this exact problem for ages with these switches, not just this...

Railander

!) added support for "Cake" and "FQ_Codel" type queues;

very nice!

Railander

With Mikrotik it seems that having possibility to set L2MTU (apart from having max L2 MTU as informational field) is for historical reasons. AFAIK in SwOS you can't set L2MTU any more, it's always set to maximum. Sure, you can set (L3) MTU and is limited by L2MTU ... that makes sense. wish we could...

Railander

anyone? On a layer 2 network you may have another switch that cannot admit frames that are quite as large as what the others can. In that case you may want to limit all switches to an L2MTU equal to the least capable device you have. If you limit the L2MTU to a setting that the least capable device...

Railander

anyone?

Railander

We have complexity issues in our network when trying to make sure OSPF routing remains symmetrical. This is not a problem when there are only 2 nodes in the same broadcast domain (typical router-router connection), but OSPF starts trying to route asymmetrically if there are more than 2 nodes and pat...

Railander

Your question got me wondering, so I thought I'd go read about it. See https://wiki.mikrotik.com/wiki/Manual:Maximum_Transmission_Unit_on_RouterBoards. this does not address my question at all. that article is mostly talking about MTU. my question is regarding why there is both L2MTU and MAX L2MTU.

Railander

I don't understand why every single vendor doesn't just set L2MTU to its max possible value out of the box this is exactly what i'm asking. why don't they just ship "actual L2MTU" at the max possible and scrap the "actual L2MTU" altogether, leaving just "max L2MTU"? th...

Railander

anyone?

Railander

Why does both L2MTU and MAX-L2MTU exist?
Wouldn't it be simpler if L2MTU was scrapped and keep only MAX-L2MTU as L2MTU?

Railander

Currently only one bridge can be hardware offloaded on CRS3xx series.

Is this a hardware limitation? If not, any plans to fix it in the future?

Railander

Very happy to see v7 finally coming together.

What's the kernel version?

Railander

as a workaround, ECMP works perfectly with OSPF instead of BGP, assuming your setup allows for it. alternatively, the tip provided by heribertos using routing filters forcing the "Next-Hop-in" to your desired multipath gateways might work, though you'll lose the fully dynamic aspect of BGP...

Railander

i've required this feature several times already. i understand i could use a route reflector to give all my routes back to me and put then with a different routing mark, but that would require a separate router with extra physical connections, which makes no sense as it should be very easy to do a c...

Railander

still cant change any user names.
introduced in 6.43.0

Railander

Don't know if it's already been mentioned, but I can no longer change the name of a user in /user
It's not only the default user, it applies even to newly created users.

> user set admin name=test
failure: user name can't be changed

Railander

I need to know this as well.

Railander

Feature Request: With the use of interface-lists, set customized permissions to which interfaces a user (and preferably also snmp community) can see or make changes to. Some of our clients like to have read access to our routers, but sometimes it's a router supplying more than one client and giving ...

Railander

Do you have connection tracking turned on? how big is your connection tracking table? I found previously that port scanning created many connections to port 445 filling up connection tracking table and causing CPU spikes. Not sure if this is exposed to the Internet or not and whether you are blocki...

Railander

Do you have any masquerade rules? What is your OSPF topology like, is there anything that would cause frequent LSA's like /32 routes for PPP tunnels? Also I am wondering about the bonding - fastpath apparently on works with bonded interfaces on receive, and apparently even then only since RouterOS ...

Railander

OK.. also, good idea to check for certain bad settings that can kill your performance, for instance turning on "Use IP firewall" in the bridge settings kills the CPU, good to identify whether there might be some issue like that.

Good one.
In my case it was already disabled in all routers.

Railander

Trying to experiment with IPFIX instead of NetFlow, my monitoring software reported flows from 1504215292 seconds ago and promptly discarded them. First I thought it was some misconfiguration but after trying to change back to NetFlow and seeing everything working fine, it ocurred to me... As it tur...

Railander

OK.. also BTW I think you misunderstand fastpath - fastpath is automatically active when it is enabled and you have no firewall rules. Fasttrack is kindof a 'fastpath-lite' where you can fastpath some traffic in situations where you need to have firewall rules and other such things. It is not as ef...

Railander

Can you paste your config with the hide sensitive option? What did you learn from the profiler? You should be able to see when a CPU is maxed what process is maxing out that CPU. I need to update RouterOS, the current version in that CCR doesn't support per-core profiling. Will do that later tonigh...

Railander

What volume of traffic are you pushing through these?

5Gbps tops, adding all interfaces.

Railander

We're trying to activate a new peering connection with a partnet but we're being denied because, according to them, our SNMP is answering requests on v3 and this can be abused for DDoS attacks. Here's the results with snmpwalk. [root@dnslookup ~]# snmpwalk -v1 -c public 10.112.194.2 Timeout: No Resp...

Railander

Hello. From checking the logs this might indeed be the problem (the current RouterOS version doesn't support this, I'm yet to update it). http://puu.sh/xoj8D/fd901a6b65.jpg Also, I noticed that disabling IP Flow in this CCR (1016) reduced CPU usage from ~20% to ~15%, while on another CCR (1072) enab...

Railander

We have several CCRs and noticed small levels of packet loss (anywhere from 0.3% upwards of 2%) whenever CPU utilization is above 5%. One thing we noticed is the only scenario the packet loss doesn't happen is when the CCR is using Fast Path for all its traffic. If Fast Path is disabled (firewall ru...

Railander

I'm trying to get both VLAN Trunking and Q-in-Q working at the same time but to no avail. I can do either one just fine, the problem is configuring both at the same time in the same CRS. I cannot find any documentations on how to get it done, the ones for them separately do not help much as the conf...

Railander

Winbox has a bug - in Windows 10 64-bit with Anniversary Update cannot click on buttons inside DialogBoxes. can confirm this bug, though i suspect it's a windows bug rather than winbox. dialog/confirmation boxes cannot be interacted with on windows 10 creators update. examples of such boxes are &qu...

Railander

Railander

based on our own needs here, i'd like to especially have more ports in a single router (given the CPU can handle it). example 1 (medium thoughput, actual router, not CRS): 24 SFP 2 SFP+ example 2 (high throughput): 8 SFP 8 SFP+ example 3 (very high throughput): 8 SFP+ 4 QSFP in all three cases, both...

Railander

did a quick search and only found a very old thread.

Add OID for SFP-specific port information such as:

Rx Power
Wavelength
Link Length
Connector Type
Vendor Name
Vendor Part Number
Vendor Revision
Vendor Serial
Manufacturing Date.

Railander

Thanks!

I didn't test it under load but the queues at least seem to be working.
Another question, is it possible to only limit the /32 host at 25 Mb/s if the /24 network is under full load but if it's using 0 Mb/s let the /32 host use as much as he wants, up to the 100 Mb/s?

Railander

Good evening. I'm having trouble with a certain QoS configuration. I've looked online for the past couple of hours but could not find anything that addresses it. My needs are very simple: I have a bandwidth traffic for a certain network, lets say 100 Mb/s for 10.0.0.0/24 . Keeping that queue above, ...

Search found 112 matches