MikroTik

LifeGame

It depends on how Palo Alto has actually implemented it, but it might be possible to set the "peer identification" field to type "DNS" or "FQDN" and value to whateverisyourserial.sn.mynetname.net and do an appropriate change at the Mikrotik side - /ip/ipsec/identity/se...

LifeGame

Actually, I don't have a problem with VPN. The problem occurs when I add the real public IP to the address list in order to make VPN. From your description and configuration it seems to me that the actual issue you need to address may be different. The tik is sitting on some NAT behind the public IP...

LifeGame

I don't have such a chance. There is no gsm operator in the region that provides static ip.

LifeGame

Mikrotik goes online via lte1. lte1 ip looks like 10.92.201.134 but actually the real ip is 176.89.208.201. I need to add the real ip to the address list to do ipsec with the center. It also checks the constantly changing public ip address with a script and corrects it automatically. It works as lon...

LifeGame

Thanks for the information..
Did this answer help you?

Yes .. He explained to me that I couldn't do what I wanted to do ...

LifeGame

Veeam will take backup over this connection. As far as I understand from your description, the speed will not exceed 1g+ as it will create a single connection in veeam. Yes. Unless Veeam has a way to use multiple TCP connections for a single host-backup, that is what will happen. Thanks for the inf...

LifeGame

Balancing-rr is the only bonding method that sends packets from the same connection across different interfaces in the bond. But that isn't hardware offloaded, which is why the CRS CPU maxes out. 802.3ad is offloaded to the switch chip, but will send all packets belonging to the same connection acr...

LifeGame

Hi, I'm trying to increase bandwith by bonding. I tried 802.3ad dynamic, Balance-rr and Balance-xor. All give the same speed (about 950mbps) Mikrotik 802.3ad dynamic Speed: 950Mbps CPU: %4-6 Mikrotik Balance-rr Speed: 950Mbps CPU: %90-95 interface/bonding/print detail Flags: X - disabled; R - runnin...

LifeGame

@bpwl
This information is very useful for me. I understand mikrotik better. Thanks for your patient answers...

@jaclaz
Good idea. I'll try it.

LifeGame

@bpwl So you're saying that; 1- These devices are powerful devices. So lower the antenna gain; interface/wireless/set wlan1 antenna-gain=8 2- Use the right channels. For NV2 to work correctly; ap bridge 70.4 /interface wireless channels add band=5ghz-onlyac extension-channel=Ceee frequency=5500 list...

LifeGame

New and working topology.. (image delay problem persists) @jaclaz Each cam connected to AP wired. Cameras work with microtik poe. There is almost no wireless signal in the area where the system works. I'm the only one here :) As the number of connected clients increases, the lag problem also increas...

LifeGame

Hi again; I think I need help with the wifi channels... (i m using 2 ap bridge and 5 station bridge) My configs for ap-bridges. Bridge -1 [admin@70.4] > interface/wireless/print advanced detail Flags: X - disabled; R - running 0 R name="wlan1" mtu=1500 l2mtu=1600 mac-address=78:9A:18:4E:CA...

LifeGame

Hi; I built bridges using microtics for the camera project. Modem : RBD53GR-5HacD2HnD Switch: CRS326-24G2S+ ap bridge : RBOmniTikPG-5HacD station bridge : RBOmniTikPG-5HacD The microtics are powered by a 48v 2.5a adapter. Cameras work with POE on microtics. My Problems; The system becomes very slow ...

LifeGame

When you have setup the GRE tunnel (that seems OK) of course then you need to add a route to the destination network via the remote IP on the GRE tunnel (10.10.6.2). i found the mistake.. after adding palo alto site netword to miktorik adress list all done !!! . [ud@Al] > ip address/print 0 192.168...

LifeGame

Your Palo Alto is probably doing "VTI". MikroTik does not support that. Instead you can use a GRE tunnel over IPsec transport. I tried gre first too; [admin@MikroTik] > interface/gre/print Flags: X - disabled; R - running 0 R name="gre-tunnel" mtu=auto actual-mtu=1398 local-addr...

LifeGame

Hi, There is an ipsec tunnel running between mikrotik and palo alto. In this topology Mikrotik sends all traffic to the tunnel. Everything as i want, 1.png Now, i want to route some ip traffic Palo Alto to Mikrotik.. I did it with Policy Based Forwarding. Source: 192.168.101.34 -> Destination: 35.20...

LifeGame

@Buckeye, @anav

i found my mistake...
ESXi - Networking - Port Groups - Port_Name (which is used for lan) VLAN ID must be "4095".. not "0"

All done now.. Thanks for help ...

LifeGame

/interface list member
add interface=Bridge_Local list=LAN
add interface=vlan1010 list=LAN

Is the only thing I see at first glance that is missing.........

+add interface=vlan1010 list=LAN
The problem continues..

LifeGame

" Where am I doing wrong ? " Yet, you know what to show us ? See the problem.... As per erlindens comment............. /export file=anynameyouwish ( minus router serial # and any public WANIP information ) I am sorry, I was thoughtless /interface bridge add ingress-filtering=no name=Bridg...

LifeGame

Hi, Simple topology; 2.png Conf Mikrotik x86 v7.5 ; /interface vlan add interface=bridge name=vlan1010 vlan-id=1010 /interface bridge add ingress-filtering=no name=bridge vlan-filtering=yes /interface bridge port add bridge=bridge interface=ether2 add bridge=bridge interface=ether3 /interface bridge...

LifeGame

Hi,
My email notifications and printer conters is ok but, I want to send an e-mail about the printer counters on the last day of each month...

How can i do that ?

LifeGame

To be clear, PALO can terminate traffic with a policy-based VPN solution (you need to configure a proxy ID for traffic selectors in PALO). Actually this is only valid for IKE v1. If you use IKE v2, the tunnel is up without entering the proxy id... In my tests; IKE v1 : Must have proxy id on both si...

LifeGame

You need to exclude this traffic, add another policy before existing one, with both src and dst 10.10.5.0/24 and action set to none. You are king !!! /ip ipsec policy add action=none dst-address=10.10.5.0/24 src-address=10.10.5.0/24 add dst-address=0.0.0.0/0 level=unique peer=onurgroup proposal=IPS...

LifeGame

Hi .. Mikrotik LAN : 10.10.5.1/24 Mikrotik WAN : Static IPSec Policy Source Address : 10.10.5.0/24 Dest. Address : 0.0.0.0/0 With this policy ipsec works as i want. I can route traffic with nat policy.. When ipsec policy enable; - I cant connect mikrotik from 10.10.5.1.. i need to use mac adress for...

LifeGame

Hi.. I have RB2011UiAS-2HnD with default firewall rules. Only ipsec vpn on it and all traffic routed to ipsec.. [admin@Home] > ip firewall/nat print Flags: X - disabled, I - invalid; D - dynamic 0 ;;; Routing chain=srcnat action=accept src-address=10.10.2.2-10.10.2.254 dst-address=0.0.0.0/0 src-addr...

LifeGame

Hi, My mikrotik is working but i m trying to understanding it. I especially want to know which rule hits which traffic. 1 hour ago I tried to do dhcp relay... yes I did but my biggest problem was not being able to see where the package was drop ! 67 goes somewhere but where !!!??? Îs there an easy w...

LifeGame

Thete are many ways to build (secure) VPN over internet. If the other end (PA) only supports said combination, zhen other possibilities are out of the game obviously. As soon as you configure GRE with IP address, it becomes a normal network interface from IP point of view and same principles apply ...

LifeGame

You have to make the masquerade rule less greedy. It might be simply the matter of setting out-interface property to only masquerade traffic flowing through your WAN interface. If MT's WAN Interface is used as breakout to internet. If clients are supposed to break out to internet via palo alto, the...

LifeGame

Rule #2 is not disabled. And I have a feeling it might be interfering because as it's shown it masquerades just every traffic passing its routing engine (and that includes IPsec traffic). Yes.. You are right.. Traffic returns to normal when I turn off Masquerade rule but this time the client cannot...

LifeGame

Do you have any NAT rules defined on MT? Yes but disabled [admin@MikroTik] > ip firewall/nat/print Flags: X - disabled, I - invalid; D - dynamic 0 X ;;; IPSec_NAT_Out chain=srcnat action=accept src-address=10.10.5.0/24 dst-address=192.168.100.0/23 log=no log-prefix="" 1 X ;;; IPSec_NAT_In...

LifeGame

Hi; 1.jpg My ipsec and gre is working... traffic is routed via GRE. But ... all traffic to paloalto comes from 10.0.0.2(Mikrotik GRE adress 10.0.0.2/30). How can i fix it ? i need to see clients LAN ip adress. Mikrotik v7.5 Conf; /ip ipsec mode-config set [ find default=yes ] src-address-list=local ...

LifeGame

You want to change existing address, not add new ones and let them pile up. You can mark it using unique comment as I've shown, and then you can use that to access it. Otherwise it's the right direction. Hııımmm... U mean ; [admin@Home] > ip address print Columns: ADDRESS, NETWORK, INTERFACE # ADDR...

LifeGame

I already posted a hint how you can script that. Yep.. This is working :) :local NewIP [/ip cloud get public-address] /ip address add interface=UpLink address=$NewIP /ip ipsec peer set onurgroup local-address=$NewIP and scheduler 1h ... i want to improve this.. i want to do; find new ip and check i...

LifeGame

But it will not work when you set your public IP as the local IP in IPsec when in fact you are behind NAT! In that case you have to set it to the local IP (RFC1918) you got behind NAT. Also, when you have double NAT (e.g. because you have a local router that does NAT and then you have carrier NAT a...

LifeGame

Hey guys.. @Sob, @pe1chl My problem is not about ipsec. Actually this is a normal problem.. Because Mikrotik behind nat. I need script :) How can i add my public ip to; /ip address set interface=UpLink address="Public IP" /ip ipsec peer set myvpn local-address="Public IP" Note: P...

LifeGame

But it is. That is just IPsec. Look at your Palo Alto. It is complicated too. And it cannot even communicate with NATted GRE/IPsec peers. When you do not want all this fuss you either need to find a connection without NAT (what about IPv6?) or not use IPsec. yep.. there's a lot missing in paloalto....

LifeGame

Modem needs to be doing srcnat (which I'd assume should be default when it's in router mode), then anything from 192.168.1.15 to internet will have source changed to 176.41.x.x and config on the remote device will match. On the other hand, if your original config works and you're happy with it, you...

LifeGame

Why don't you accept that you're behind NAT and live with it? If modem has the public address, it shouldn't be duplicated on your router. Leave the Local Address empty. IPSec can handle it. Afer leave the local address empty my palo alto says "the is no config for 192.168.1.15 bıla bıla bıla.....

LifeGame

At the local address, I don't think so. Can you config your modem in bridge mode or perhaps you could use "Site to Site GRE tunnel over IPsec IKEv2 using DDNS" https://help.mikrotik.com/docs/display/ROS/IPsec#IPsec-SitetoSiteGREtunneloverIPsec(IKEv2)usingDNS My ISP dont allow Bridge Mode ...

LifeGame

Hi, My Mikrotik behind modem; Modem Public : 176.41.xxx.xxx (Dynamic) Modem Lan : 192.168.1.0/24 Mikrotik - UpLink(ether1) : 192.168.1.15/32 (WAN) Mikrotik - bridge - Lan : 10.10.5.1/24 (eth 2-3-4-5) i have a working ipsec vpn but when the modem is reboot my public ip changing. For ipsec vpn to work...

LifeGame

Hi, Miktorik to Palo Alto ipsec is active and working. I want to route all traffic over ipsec. How can i do that ? top.jpg My Conf: # apr/25/2022 18:30:26 by RouterOS 6.49.6 # software id = SM8Q-MVJ5 # # model = 2011UiAS-2HnD # serial number = xxxxxxxx /ip firewall address-list add address=10.10.5.0...

LifeGame

Hi,
Is ther a way to install Dude Server on RB960PGS-PB ?

LifeGame

Please add

ipsec vpn interface

LifeGame

Hi all.. I need help about route traffic. Brunch Site: Microtik RB951G-2HnD OS:6.37 Lan : 192.168.7.0/24 WAN : 188.111.111.111 Center: CheckPoint R77.30 Lan : 192.168.100.0/23 WAN : 82.222.222.222 Brunch comes center with ipsec vpn and now vpn is up. I can ping center site servers. I want to route b...

Search found 44 matches