v7.12beta [testing] is released!

Thu Aug 17, 2023 12:37 pm

RouterOS version 7.12beta has been released on the "v7 testing" channel!

Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 7.12beta9 (2023-Sep-25 15:19):

!) ethernet - changed "advertise" and "speed" arguments, and removed "half-duplex" setting under "/interface ethernet" menu;
!) health - removed "temperature" health entry from boards, where it was the same as "sfp-temperature";
!) sfp - convert configuration to support new link modes for SFP and QSFP type of interfaces;
*) bfd - improved system stability;
*) bgp - fixed "input.filter-chain" argument selection in VPN configuration;
*) bgp - improved logging;
*) bluetooth - added basic support for connecting to BLE peripheral devices;
*) console - export required properties with default values;
*) console - improved system stability;
*) console - restrict permissions to "read,write,reboot,ftp,romon,test" for scripts executed by DHCP, Hotspot, PPP and Traffic-Monitor services;
*) l3hw - fixed IPv6 route suppression;
*) led - fixed "interface-status" configuration for virtual interfaces;
*) lora - added LNS protocol support;
*) lte - changed R11e-LTE ARP behavior to NoArp;
*) lte - fixed sub-interface auto-removal in multiple APN setups;
*) lte - show correct data class when connected to 5G SA network;
*) mqtt - added on-message feature for subscribed topics;
*) mqtt - added parallel-scripts-limit parameter to set maximum allowed number of scripts executed at the same time;
*) mqtt - added wildcard topic subscription support;
*) netinstall - added option to discard branding package;
*) netinstall - display package filename in GUI Descption column if package description is not specified;
*) netinstall-cli - added option to discard branding package;
*) netinstall-cli - allow ".rsc" script filenames;
*) poe-out - driver optimization for AF/AT controlled boards;
*) poe-out - fixed rare CRS328 poe-out menu and poe-out port config loss after reboot;
*) route - added "single-process" configuration setting, enabled by default on devices with 64MB or less RAM memory (CLI only);
*) route - added "suppress-hw-offload" setting for IPv6 routes;
*) route - reverse community "delete" and "filter" command behavior;
*) routerboard - added "reset-button" support for RB800, RB1100 and RB1100AHx2 devices;
*) sfp - fixed 25Gbps link with FEC91 (introduced in v7.12beta7);
*) snmp - changed "mtxrGaugeValue" type to integer;
*) switch - fixed packet forwarding between Ethernet ports for CRS354 switches (introduced in v7.12beta7);
*) webfig - fixed timezone for interface "Last Link Down/Up Time";
*) wifiwave2 - correctly add interface to specified "datapath.interface-list";
*) wifiwave2 - fixed re-connection failures for 802.11ax interfaces in station mode;
*) wifiwave2 - limit L2MTU to 1560 until a fix is available for a bug causing interfaces to fail transmitting larger frames than that;
*) wifiwave2 - log more information regarding authentication failures;
*) winbox - added "Host Key Type" setting under "IP/SSH" menu;
*) winbox - added "Key Owner" setting under "System/User/SSH Keys" and "System/User/SSH Private Keys" menus;
*) winbox - added "Remote Min Tx" parameter under "Routing/BFD/Session" menu;
*) winbox - added "Startup Delay" setting under "Tools/Netwatch" menu;
*) winbox - added "Use BFD" setting under "Routing/RIP/Interface-Template" menu;
*) winbox - added MQTT subscription menu;
*) winbox - allow to specify server as DNS name under "Tools/Email" menu;
*) winbox - rename "DSCP" setting to "DSCP (+ECN)" under "Tools/Traffic-Generator/Packet-Templates" menu;
*) winbox - rename "Name" setting to "List" under "IP,IPv6/Firewall/Address-List" menu;
*) winbox - rename "Password" button to "Change Now" under "System/Password" menu;
*) wireguard - added "auto" parameter for "private-key" and "presharde-key" parameters;
*) wireguard - request public or private key to be specified in order to create peer;
*) x86 - igb updated driver to 5.14.16 version;
*) x86 - igbvf updated driver from in-tree Linux kernel;
*) x86 - updated latest available pci.ids;

What's new in 7.12beta7 (2023-Sep-13 09:58):

!) ethernet - changed "advertise" and "speed" arguments, and removed "half-duplex" setting under "/interface ethernet" menu;
!) sfp - convert configuration to support new link modes for SFP and QSFP type of interfaces;
*) api - fixed fetching objects with warning option from REST API;
*) bgp - implemented IGP metric sending in BGP messages;
*) bluetooth - use "g" units when decoding MikroTik beacon acceleration on peripheral devices menu;
*) certificate - allow to remove issued certificates when CRL is not used;
*) certificate - fixed certificate auto renewal via SCEP;
*) chr - iavf updated driver to 4.9.1 version;
*) console - improved randomness for ":rndstr" and ":rndnum" commands;
*) console - improved stability when using "special-login";
*) console - improved system stability through RoMON session;
*) console - improved system stability when using autocomplete;
*) dhcp - fixed DHCP server "authoritative" and "delay-threshold" settings (introduced in v7.12beta3);
*) ike2 - improved rekey collision handling;
*) ipsec - fixed Diffie-Hellman public value encoding size;
*) ipsec - fixed minor typo in logs;
*) ipsec - reduce disk writes when started without active configuration;
*) ipv6 - send RA and RA deprecate messages out three times instead of just once;
*) l3hw - improved system stability during IPv6 route offloading;
*) leds - added "dark-mode" functionality for RBwAPG-5HacD2HnD;
*) leds - added "wireless-status" and "wireless-signal-strength" configuration types for wifiwave2 interfaces;
*) log - improved logging for user actions;
*) lte - fixed 5G data-class reporting for Chateau 5G;
*) lte - fixed APN authentification in multi APN setup for R11e-LTE6;
*) lte - fixed IPv6 prefix for MBIM modems in multi-apn setup when IPv6 APN used as not first APN;
*) lte - fixed RSSI for FG621-EA modem to show the correct value;
*) lte - fixed startup race condition when SIM card is in "up" slot for LtAP mini;
*) mpls - improved FastPath next-hop selection hash algorithm;
*) netinstall-cli - added empty configuration option "-e";
*) netwatch - decreased "thr-tcp-conn-time" maximum limit to 30 seconds;
*) ovpn - improved system stability;
*) pimsm - improved system stability;
*) qsfp - added 50Gbps rate support for QSFP28 interfaces;
*) qsfp - fixed sub-interface EEPROM monitor data output (introduced in v7.12beta3);
*) qsfp - improved auto link detection for 100G CWDM4 modules and AOC cables (introduced in v7.12beta3);
*) qsfp - use sub-interface configuration for establishing link (for 40Gbps and 100Gbps links, all sub-interfaces must be enabled);
*) routerboard - added "reset-button" support for RB800 and RB1100 devices;
*) ssh - improved connection stability when pasting large chunks of text into console;
*) supout - added interface list members section;
*) switch - improved resource allocation for 98DX224S, 98DX226S, and 98DX3236 switch chips;
*) traffic-generator - fixed traffic-generator on CHR and x86;
*) usb - added support for RTL8153 USB ethernet on ARM, ARM64 and x86;
*) vrf - limit maximum VRFs to 1024;
*) vxlan - improved system stability for Tile devices;
*) webfig - fixed "Days" property configuration change under "IP/Firewall" menu;
*) webfig - fixed timezone for interface "Last Link Down/Up Time";
*) webfig - improved Webfig performance and responsiveness;
*) webfig - try to re-establish connection after disconnect;
*) wifiwave2 - added an alternative QoS priority assignment mechanism based on IP DSCP (CLI only);
*) wifiwave2 - added station-bridge interface mode (CLI only);
*) wifiwave2 - do not show default "l2mtu" on compact export;
*) wifiwave2 - fixed PTK renewal for interfaces in station mode;
*) wifiwave2 - fixed sniffer command not receiving any QoS null function frames when using 802.11ax radios;
*) wifiwave2 - fixed untagged VLAN 1 entry when using "vlan-id" setting together with vlan-filtering bridge;
*) wifiwave2 - fixed warning on CAP devices when radar detected;
*) wifiwave2 - implemented an option to transmit IP multicast packets as unicasts (CLI only);
*) wifiwave2 - improved compliance with regulatory requirements;
*) wifiwave2 - make 4-way handshake procedure more robust when acting as supplicant (client);
*) winbox - added "Comment" under "Routing/BFD/Configuration" menu;
*) winbox - added "g" flag under "IPv6/Routes" menu;
*) winbox - added "Name Format" property under "WifiWave2/Provisioning" menu;
*) winbox - changed "MBR Partition Table" checkbox to unchecked by default under "System/Disks/Format-Drive" menu;
*) winbox - fixed "Address" property under "WifiWave2/Remote-CAP" menu;
*) winbox - fixed "Group Key Update" maximum value under "WifiWave2/Security" menu;
*) winbox - fixed entry numbering and ordering under "WifiWave2/Provisioning" menu;
*) winbox - fixed minor typos;
*) wireguard - allow to specify client settings under peer menu which will be included in configuration file and QR code;
*) wireguard - generate Wireguard peer keys and preshared-key automatically, if value is specified but is not base64 string;
*) wireguard - removed "wg-add-client" configuration wizard (introduced in v7.12beta3);
*) wireless - added more "radius-mac-format" options (CLI only);
*) www - fixed allowed address setting for REST API users;
*) www - fixed fragmented POST data for SCEP service;
*) x86 - i40e updated driver to 2.23.17 version;
*) x86 - igc updated driver to 5.10.194 version;
*) x86 - ixgbe updated driver to 5.19.6 version;
*) x86 - Realtek r8169 updated driver;

What's new in 7.12beta3 (2023-Aug-24 12:15):

!) ethernet - changed "advertise" and "speed" arguments, and removed "half-duplex" setting under "/interface ethernet" menu;
!) sfp - convert configuration to support new link modes for SFP and QSFP type of interfaces;
*) bgp - fixed "atomic-aggregate" always set in output;
*) bgp - fixed local and remote port settings for BGP connections;
*) bgp - increase "hold-time" limit to 65000;
*) bridge - fixed fast-path forwarding with HW offloaded vlan-filtering (introduced in v7.11);
*) bridge - fixed untagged VLAN entry disable;
*) bridge - fixed vlan-filtering stability with HW and non-HW offloaded ports (introduced in v7.10);
*) bridge - improved vlan-filtering bridge stability with CAPsMAN (introduced in v7.11);
*) bth - added "Back To Home" VPN service for ARM, ARM64, and TILE devices;
*) calea - improved system stability when trying to add rules without the CALEA package;
*) console - added "transform" property for ":convert" command;
*) console - fixed scheduler "on-event" script highlighting when editing;
*) console - improved multi-argument property parsing into array;
*) console - improved stability when editing long scripts;
*) console - show full date and time in scheduler "next-run" property;
*) dhcp - fixed DHCP server and relay related response delays;
*) ethernet - added "supported" and "sfp-supported" values for "monitor" command;
*) interface - added "macvlan" interface support;
*) ipsec - fixed IPSec policy when using modp3072;
*) ipv6 - fixed IPv6 RA delay time from 5s to 500ms according to RFC;
*) ipv6 - send RA and RA deprecate messages out three times instead of just once;
*) log - improved logging for user actions;
*) lte - added at-chat support and increased wait time on modem at-chat for Dell DW5821e, DW5821e-eSIM, DW5829e and DW5829e-eSIM;
*) lte - added SINR reporting for FG621-EA modem;
*) lte - fixed Sierra modem detection for modems with vendor-specific USB descriptors;
*) lte - fixed startup race condition when SIM card is in "up" slot for LtAP mini;
*) netinstall-cli - prioritise interface option over address option;
*) ospf - fixed adding ECMP routes;
*) ospf - fixed OSPFv3 not working with NSSA areas;
*) ospf - fixed parsing of opaque LSAs used by TE;
*) ospf - fixed translated NSSA routes not showing in backbone;
*) port - add support for Huawei MS237h-517;
*) port - expose NMEA/DIAG ports for Dell DW5821e and DW5821e-eSIM;
*) quickset - fixed "LAN" interface list members if configuration does not contain bridge;
*) rip - added BFD support;
*) rip - fixed session not working in VRF;
*) route - fixed gateway after link restart;
*) route - removed deprecated "received-from" property;
*) sfp - improved interface stability for SFP and QSFP types of interfaces;
*) switch - improved switch chip stability for CCR2004-16g-2s+ devices;
*) tile - improved system stability when using queues;
*) traffic-generator - added "priority" property for "inject" command;
*) wifiwave2 - added comment property for registration-table;
*) wifiwave2 - enable changing interface MTU and L2MTU;
*) wifiwave2 - fixed malformed Interworking packet elements;
*) winbox - allow to set multiple addresses and added IPv6 support under "Interface/VETH" menu;
*) wireguard - added "wg-add-client" configuration wizard (CLI only);
*) wireguard - added "wg-export" and "wg-import" functionality (CLI only);
*) wireless - fixed malformed Interworking packet elements;
*) x86 - added support for Mellanox ConnectX-6 Dx NIC;

What's new in 7.12beta1 (2023-Aug-15 16:14):

*) bgp - fixed typos and missing spaces in log messages;
*) bridge - improved system stability;
*) bth - added "Back To Home" VPN service for ARM, ARM64, and TILE devices;
*) certificate - allow to get and maintain Let's Encrypt certificate in IPv6 environment;
*) certificate - fixed "subject-alt-name" duplicating itself when SCEP is used;
*) certificate - improved certificate validation logging error messages;
*) certificate - log CRL HTTP errors under the "error" logging topic;
*) chr - increased OVA default RAM amount from 160MB to 256MB;
*) console - added ":jobname" command;
*) console - added "as-string" and "as-string-value" properties for "get" command;
*) console - added "terminal/ask" command;
*) console - improved ":totime" and ":tonum" commands and added ":tonsec" command for time value manipulation;
*) console - improved stability and responsiveness;
*) console - improved stability when using "special-login";
*) firewall - added "ein-snat" and "ein-dnat" connection NAT state matchers for filter and mangle rules;
*) ike1 - log an error when non-RSA keys are being used;
*) iot - fixed an issue where applying a script to GPIO pin caused GPIO to stop working;
*) iot - fixed behavior where GPIO output state would change on boot;
*) lte - fixed Sierra modem initialization;
*) lte - use more compact logging messages;
*) modbus - added additional security settings for Modbus TCP;
*) mpls - added option to match and set MPLS EXP with bridge and mangle rules;
*) mpls - fixed "propagate-ttl=no" setting;
*) netinstall - added option to discard branding package;
*) ospf - fixed BFD on virtual-link with configured VRF;
*) ovpn - added "tls-auth" option support for imported .ovpn profiles;
*) sfp - fixed missing "rx-power" monitor with certain modules (introduced in v7.10);
*) ssh - added support for user ed25519 public keys;
*) ssh - allow to specify key owner on import;
*) ssh - fixed SSH tunnel performance (introduced in v7.10);
*) supout - added LLDP power to supout.rif;
*) supout - fixed BFD section;
*) system - improved system stability when MD5 checksums are used;
*) tile - improved system stability when using IPv6 queues;
*) wifiwave2 - list APs with a higher maximum data rate as more preferable roaming candidates;
*) winbox - allow to change port numbers for SCTP, DCCP, and UDP-LITE protocols under "IP/Firewall" menus;

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while a router is not working as suspected or after some problem has appeared on the device

Please keep this forum topic strictly related to this particular RouterOS release.

Changelog edit:
- changed from ":tosec" to ":tonsec".

Larsa · Thu Aug 17, 2023 12:44 pm

*) firewall - added "ein-snat" and "ein-dnat" connection NAT state matchers for filter and mangle rules

Any info/docs on ein-dnat and ein-snat?

ToTheFull · Thu Aug 17, 2023 12:46 pm

Is this the same as 7.12alpha74 ?

loloski · Thu Aug 17, 2023 12:55 pm

ovpn - added "tls-auth" option support for imported .ovpn profiles;
mpls - added option to match and set MPLS EXP with bridge and mangle rules;

been waiting this for a couple of years now :)

mducharme · Thu Aug 17, 2023 12:57 pm

*) mpls - added option to match and set MPLS EXP with bridge and mangle rules;

Any info/docs for this? We want to test as soon as possible.

How are you able to "match" MPLS EXP for incoming packets with mangle rules when MPLS packets bypass the firewall - are these packets no longer bypassing the firewall?

EDIT: I just upgraded my home device to this new version and I'm not seeing these new options at the moment in the CLI.

Thu Aug 17, 2023 1:29 pm

The behavior is the same as in v6 - when an MPLS packet is received, EXP bits are copied to the ingress-priority field and can be matched where ingress-priority matching is available (e.g. bridge or ip firewall). MPLS forwarding process does not traverse any firewalls, so matching can only be done on MPLS egress routers.

Note that MPLS forwarding implicitly performs copying of ingress-priority to priority (as if MPLS had some firewall with one rule that did action=set-priority new-priority=from-ingress for all packets). This way when MPLS switched packet is sent out over the wifi link, WMM AC will be chosen based on MPLS EXP bits.

mducharme · Thu Aug 17, 2023 1:40 pm

Thanks for the details. Yes, I am familiar with the entire ingress-priority and priority process and the automatic copying from v6, but the wording of the change made it sound like it was implemented differently using a separate matcher for EXP instead of being folded under ingress-priority and priority like in v6.

On v6 it also works (even though an unsupported configuration) to have a bridge filter matching ingress-priority for a packet that comes from another router, as long as MPLS fast path is turned off. For example, for a packet going from router [ PE1 ] to [ P1 ] to [ P2 ] to (whatever):

[ PE1 ] ---- (packet with MPLS exp bits) ----> [ P1 regular ethernet interface --> P1 bridge with queue trees and output-chain bridge filter marking packet based on ingress-priority from MPLS EXP bits --> bridge port on ethernet interface ] --> [ P2 ] --> etc.

ex. on the P1 router, on the interface the packet comes in from (facing PE1) it is just a regular ethernet interface, then the packet goes to a single-port bridge with bridge filters (output chain) marking the packet based on ingress priority, and then it passes through the heirarchy of queue trees and goes out the single bridge port, the other ethernet interface going to router P2. It passes through the proper queue tree based on the MPLS EXP value of the incoming packet. Thus it is possible to do priority queueing of MPLS traffic on v6 through this unsupported config, and we've been doing this for years now.

That setup is unsupported on v6 but works, I'd like to make sure it still works on v7. (The part that is unsupported on v6 is that it is not supposed to be possible to read ingress-priority in an output-chain bridge filter for a packet that arrived through other means, such as an interface that is not on the bridge - the "P1 regular ethernet interface" in my example above)

woland · Thu Aug 17, 2023 2:33 pm

@Larsa: Endpoint-Independent NAT: https://help.mikrotik.com/docs/pages/vi ... pendentNAT

mantouboji · Thu Aug 17, 2023 2:36 pm

Very good for these:

*) certificate - allow to get and maintain Let's Encrypt certificate in IPv6 environment;
*) ssh - added support for user ed25519 public keys;

wait for ed25519 private key support。

clambert · Thu Aug 17, 2023 2:55 pm

No IS-IS, no 6VPE. The wait continues...

dadaniel · Thu Aug 17, 2023 3:07 pm

ovpn - added "tls-auth" option support for imported .ovpn profiles;

Great work!

I'm getting the following error messages in log, but the connection seems to work.
Can anyone please comment if they are essential?

unsupported configuration parameter 'ns-cert-type server'
unsupported configuration parameter 'setenv CLIENT_CERT 0'

Larsa · Thu Aug 17, 2023 3:14 pm

@Larsa: Endpoint-Independent NAT: https://help.mikrotik.com/docs/pages/vi ... pendentNAT

Thanks! Care to give a brief usage example?

pothi · Thu Aug 17, 2023 3:27 pm

ssh - added support for user ed25519 public keys;

Thanks. Been waiting for long.

Ulypka · Thu Aug 17, 2023 3:30 pm

Endpoint-Independent NAT
all world call it Full Cone NAT

bommi · Thu Aug 17, 2023 3:45 pm

*) ssh - added support for user ed25519 public keys;

Great to see this one!
I use my openpgp key based on ed25519 on my Yubikey for SSH logins.

bommi · Thu Aug 17, 2023 4:07 pm

I have some more feature requests regarding encryption topics :-)

Since RouterOS 7.7 we can use diffie-hellmann group 31:
*) ike2 - added support for DH Group 31 (EC25519) (CLI only);

But the support is just implemented in ike2 / phase-1, could you please also bring this to ipsec / phase-2?
Is your crypto stack already able to support DH-32 (Curve448)? This would also be a great addition.

woland · Thu Aug 17, 2023 4:13 pm

@Larsa: sry, I did not try it yet, I have seen the strange terminology and it made me curious.
I think it is the same as the thing called in RFCs EIM NAT (Endpoint-Independent Mapping).
AFAIK this is relevant for UDP NAT Traversal (STUN) for SIP (RTP, voice calls).
Here is more info: https://wiki.unify.com/wiki/Network_Con ... _Providers
Maybe other P2P Protocols need it as well.

@Mikrotik, maybe the misleading ein-nat should be changed to eim-nat ? Maybe I got it wrong and this is the Mikrotik special EIN NAT (TM) ?

Larsa · Thu Aug 17, 2023 4:38 pm

Okay, we simply have to wait for a clarification from MikroTik when they decide to update the online manual..

pe1chl · Thu Aug 17, 2023 5:03 pm

Feature request: implement matching on packet-priority in queue tree child items, as an alternative to the present matching on packet-mark.
OR: implement multiple packet-marks per packet (e.g. via some new construct of "packet mark groups" to preserve backward compatibility)

Reason: as it is now, you can use packet marks only for a single purpose. When you decide to use them for priority and queueing, you cannot use them for another purpose anymore.

Amm0 · Thu Aug 17, 2023 5:40 pm

*) console - added "terminal/ask" command;

Ask and ye shall receive...

:put [/terminal/ask "Is there going to be BTH for xMIPSx?"]

Minor issue: the F1 help implies there is a sensitive=, but it's not in the command completion.

Jotne · Thu Aug 17, 2023 5:52 pm

No IS-IS, no 6VPE. The wait continues...

A protocol from 1992. Why not change to OSPF

Ullinator · Thu Aug 17, 2023 5:57 pm

Hi,
*) sfp - fixed missing "rx-power" monitor with certain modules (introduced in v7.10);

after the update from 7.11 stable to 7.12Beta1 my SFP+ module S+RJ10 reports high temperature and is temporary disabled.
(attachted to a CRS326-24G-2S+)
This happens never bevore, the temperature was around 70° Celsius, after the update it´s up to 95° celsious.

hc_023.jpg

On the other side of the cable the same module (S+RJ10) is attached to a CRS328-24G-4S+ without any problems regarding the temperature.

hc_022.jpg

Bug-ticket created: SUP-125388

Amm0 · Thu Aug 17, 2023 6:21 pm

*) console - improved ":totime" and ":tonum" commands and added ":tosec" command for time value manipulation;

In the build it's :tonsec NOT ":tosec", but seems to work:

:put [:tonsec [:timestamp]]                           
1692285621621769359

Now it's this one...

*) console - added ":jobname" command;

I have no clue about.

mkx · Thu Aug 17, 2023 6:29 pm

after the update from 7.11 stable to 7.12Beta1 my SFP+ module S+RJ10 reports high temperature and is temporary disabled.

ROS v7.11, upon which this beta is based, came with "improved fan control on CRS3xx" ... so do verify fan speed. With RJ45 SFP modules it's critical to maintain adequate air flow to ensure cooling, so in your case no fan slowdowns should be accepted. If needed, set minimum fan speed to (fairly) high value to maintain SFP temperature below critical thresholds.

Due to excessive heat, produced by RJ45 SFP modules, Mikrotik issued S+RJ10 general guidance, which specifies recomended placement of such modules.

kalamaja · Thu Aug 17, 2023 6:38 pm

Any luck to see any progesss on NAT64 support, so to move to IPv6-only internal networks and have less dual-stack?

Ullinator · Thu Aug 17, 2023 6:41 pm

Due to excessive heat, produced by RJ45 SFP modules, Mikrotik issued S+RJ10 general guidance, which specifies recomended placement of such modules.

Thanks for the tip , but the CRS326-24G-2S+ doesn't have any fans, it's fanless.
And as I described the temperature was before 7.12Beta1 never higher than max. 75°Celsius.
The problem came up imediatly after the update and was seen never before.

crondrift · Thu Aug 17, 2023 7:35 pm

*) ssh - added support for user ed25519 public keys

I must confess, I got tears in my eyes reading this! :)

pe1chl · Thu Aug 17, 2023 8:11 pm

*) bridge - improved system stability;

Does this meaningless change line refer to the problem introduced late in the 7.11 release (VLAN-filtering bridge problems with 2 switch chips)??

eworm · Thu Aug 17, 2023 8:30 pm

I think no. It is related to dynamic interfaces.

clambert · Thu Aug 17, 2023 11:19 pm

A protocol from 1992. Why not change to OSPF

I prefer mature protocols :)

nichky · Thu Aug 17, 2023 11:20 pm

*) mpls - added option to match and set MPLS EXP with bridge and mangle rules; - need more info pls

mducharme · Fri Aug 18, 2023 1:53 am

*) mpls - added option to match and set MPLS EXP with bridge and mangle rules; - need more info pls

They already answered this question higher in the thread. This isn't really a new feature. They've just restored a missing feature that was there in RouterOS v6 but was missing from v7. The behaviour is now the same as it was in v6. The description made me excited thinking it included some new features we didn't have before, instead it is the bug fix that I already knew was coming because MikroTik sent me an automated email letting me know the bug was fixed.

glueck05 · Fri Aug 18, 2023 8:52 am

Is there a timeframe (a year would be enough for me) for MPLS in HW (the status from ROS6 would also be enough for me). Thanks

pekr · Fri Aug 18, 2023 9:11 am

How long are my 10+ months old hAP ax2s going to be stored in a drawer, because ROS 7 still does not support repeater mode? Tonnes of new features, but still not fully on parity with ROS 6.

rpingar · Fri Aug 18, 2023 9:16 am

MT, do you have any plan to add Mellanox ConnectX6 to x86 driver??
thanks

Fri Aug 18, 2023 9:24 am

How long are my 10+ months old hAP ax2s going to be stored in a drawer, because ROS 7 still does not support repeater mode? Tonnes of new features, but still not fully on parity with ROS 6.

If you have 2 Mikrotiks on each end, it is possible using EOIP on top of the link.
Workaround ? Yes.
But a solution.

Search forum for post from, I think, Amm0 who describes the steps.

pekr · Fri Aug 18, 2023 11:44 am

How long are my 10+ months old hAP ax2s going to be stored in a drawer, because ROS 7 still does not support repeater mode? Tonnes of new features, but still not fully on parity with ROS 6.
If you have 2 Mikrotiks on each end, it is possible using EOIP on top of the link.
Workaround ? Yes.
But a solution.

Search forum for post from, I think, Amm0 who describes the steps.

What I have found was not EOIP solution, but creating a VXLAN interface on both sides, adding those to local bridges, doing few twists to filtering, etc. Will experiment with that - viewtopic.php?t=180369#p990815

Thanks for pointers ....

msatter · Fri Aug 18, 2023 12:13 pm

In the build it's :tonsec NOT ":tosec", but seems to work:
Code: Select all
:put [:tonsec [:timestamp]]                           
1692285621621

Why they did not name it just :toepoch then if it is sec or nsec would be covered.

Larsa · Fri Aug 18, 2023 1:46 pm

Cause they try to avoid the linux naming convention whenever possible! ;-)

fischerdouglas · Fri Aug 18, 2023 2:27 pm

Endpoint-Independent NAT
all world call it Full Cone NAT

I believe there is much more in "full-cone" definition then just Endpoint-Independent NAT.

- Endpoint-Independent Mapping.
- Endpoint-Independent Filtering.
- Application Level Gateway or ALGs, that MikroTik calls /ip/firewall/service-port/ .
- PCP listeners of UPnP.

And maybe much more that I'm not remembering just now.

pe1chl · Fri Aug 18, 2023 2:44 pm

What I have found was not EOIP solution, but creating a VXLAN interface on both sides, adding those to local bridges, doing few twists to filtering, etc.

Well, VXLAN and EOIP are different ways to achieve the same thing: packaging a raw ethernet frame into an IP packet, so you can transfer it over the nontransparent WiFi link and still maintain full functionality like broadcast and VLANs at ethernet level.
Only VXLAN is even more inefficient than EOIP (in terms of header overhead).

pekr · Fri Aug 18, 2023 3:12 pm

What I have found was not EOIP solution, but creating a VXLAN interface on both sides, adding those to local bridges, doing few twists to filtering, etc.
Well, VXLAN and EOIP are different ways to achieve the same thing: packaging a raw ethernet frame into an IP packet, so you can transfer it over the nontransparent WiFi link and still maintain full functionality like broadcast and VLANs at ethernet level.
Only VXLAN is even more inefficient than EOIP (in terms of header overhead).

According to original authoer, EOIP required change to MTU, which transport over wifiwave2 did not allow. I am not an expert on that, in fact EOIP solution came to my mind earlier too, just was lazy to try it out. Might experiment with both, but still wondering, how difficult it might be to add 4 address frame support, especially if it was part of ROS already (although a different wireless stack).

mkx · Fri Aug 18, 2023 3:33 pm

... still wondering, how difficult it might be to add 4 address frame support.

I guess not so easy ... it requires tinkering with (almost) raw wireless frames ... which normally does wireless driver (and MT is using "stock" wireless driver in wifiwave2). If they went with chipset vendor's reference driver because they don't want to tinker with wireless drivers any more, then implementing 4-address mode would effectively revert their decision.

pe1chl · Fri Aug 18, 2023 3:51 pm

4-address mode is not standard in 801.11. each manufacturer that offers it has implemented their own hacks to negotiate and support it, and even when the Qualcomm driver they have imported has some form of 4-address support, it is almost guaranteed to be not compatible with devices running the classic wireless driver. Maybe in the future we will see 4-address support that only works between devices with wifiwave2.

Amm0 · Fri Aug 18, 2023 5:04 pm

Why they did not name it just :toepoch then if it is sec or nsec would be covered.

The current name ":tonsec" is "number of seconds since epoch" – so they could have pick any part of that ;)

:tonsec makes sense to me. :tosec implies you get just the seconds part from a time – which NOT what this does – so that I'd say :tosec is the only wrong choice (and that's only a type in RN). While I really don't care... :toepoch seems a bit esoteric, and "nsec" kinda implies it's a num type.

FWIW, :totime now takes a "nsec" (or any number type) to convert seconds to a time time – essentially the reverse.

:put [:totime 60]     
00:01:00

And alternatively, :totime now takes a string type, to get a "time" type.

:put ([:totime "2023-08-18"] - [:timestamp]) 
-13:46:04.114613691

which diff from midnight in GMT to "now" (at ~time of posting)... It be 06:46:04 in PDT – but ISO dates assume GMT – so this is right.

Anyway changes are pretty guessable from the just the RN... so must somewhat intuitive. Good work here.

Only thing is... the "T" in the middle is a valid ISO-8601 string, but :totime doesn't like the "T" part...

:put [:totime "2023-08-18T00:00:00"]
# blank / nothing is output with a T, but a space works...
:put [:totime "2023-08-18 00:00:00"]
2798w1d00:00:00

Amm0 · Fri Aug 18, 2023 5:31 pm

4-address mode is not standard in 801.11. each manufacturer that offers it has implemented their own hacks to negotiate and support it,

That why I'm not sure using a tunnel isn't such a bad option. It does let you treat wireless same as wired, vs using Wi-Fi specific WDS-like things.

The bigger issue today with doing tunneling over wifiwave2 is the interface won't sent packets larger than 1500*, even if the MTU is set higher – so tunnels get fragmented.

* I don't have any wifiwave2 devices here to check specific in 7.12, so maybe it's fix, but been open 2 years.

pe1chl · Fri Aug 18, 2023 5:57 pm

A nice workaround would be when to have support for an "ethernet over ethernet" protocol that allows you to make a fully transparent ethernet tunnel over an ethernet connection that does silly MAC and VLAN translations, without incurring the overhead of IP. Just package ethernet frames in another ethernet protocol, with fragmentation/reassembly support (maybe the latter would not be required when the MTU on the actual link could be increased to 1520). That would incur only ~16 bytes of overhead instead of 40-70 bytes.

Amm0 · Fri Aug 18, 2023 7:44 pm

Interesting. But you have 1500 MTU, exactly, today...so even 16 bytes is too many ;)
I'm surprised you didn't mention the lack of BFD on a static /ip/route via check-gateway=bfd on a wifiwave2/etc interface. ;)

Guscht · Fri Aug 18, 2023 7:56 pm

*) firewall - added "ein-snat" and "ein-dnat" connection NAT state matchers for filter and mangle rules;

@Mikrotik, will be there a dedicated Flag in the Connection-Tracking for EIN-Flows too?
At the moment I see for the outgoing flow(s) Cs and for incoming flow(s) Cd. If there is a own NAT-state-matcher, there should be a dedicated flag too?!

pe1chl · Fri Aug 18, 2023 8:03 pm

Interesting. But you have 1500 MTU, exactly, today...so even 16 bytes is too many ;)

No, you can set a higher MTU on a wireless interface (limit in old wireless is 1600, don't know what it is in wifiwave2) to have some headroom to allow 1500 byte MTU for the tunneled traffic...

I'm surprised you didn't mention the lack of BFD on a static /ip/route via check-gateway=bfd on a wifiwave2/etc interface. ;)

We do not use that. We have use-bfd=yes on BGP peers (that are over wireless). That would still work with a tunnel over wireless or wifiwave2.

Amm0 · Fri Aug 18, 2023 8:06 pm

No, you can set a higher MTU on a wireless interface (limit in old wireless is 1600, don't know what it is in wifiwave2) to have some headroom to allow 1500 byte MTU for the tunneled traffic...

Oh you can set MTU no problem on wifiwave2, that ain't the problem. It does nothing if you look in sniffer, still 1500. Regardless if you set tunnel and interface higher. The wifiwave2 maxes at 1500.

And I'd be happy if I was wrong, but did a bunch of testing a while back on this one...

pe1chl · Fri Aug 18, 2023 8:24 pm

Ok I cannot test that here because I have no device that realistically can be used with wifiwave2...

Amm0 · Fri Aug 18, 2023 8:53 pm

Ok I cannot test that here because I have no device that realistically can be used with wifiwave2...

Me too.. All the wifiwave2 things are in the field right now. I got a RB1100AHx4, wAPacRs and CHRs right now, and all work with the v7.12beta ;)
And on a positive note, good news is not had any complaints about "regular" Wi-Fi on Audience/ax2/ax3's either in field. Although there not at 7.11/7.12 yet.

But wireless bridging two of AX devices is a long standing problem... And I've had a bug open on wifiwave2's MTU and hasn't been closed – so presume it's not fixed.

pe1chl · Fri Aug 18, 2023 10:12 pm

Ok I cannot test that here because I have no device that realistically can be used with wifiwave2...
Me too.. All the wifiwave2 things are in the field right now. I got a RB1100AHx4, wAPacRs and CHRs right now, and all work with the v7.12beta ;)

My pet peeve is that my RB4011iGS+5HacQ2HnD, the flagship home router, which has a supported 5GHz radio and all the storage and RAM required for wifiwave2, cannot use wifiwave2 because installing that driver stupidly disables the wireless driver so the 2GHz radio isn't recognized anymore...

leonardogyn · Sat Aug 19, 2023 4:12 am

And here I am, once again, begging on my knees, for Mikrotik Dev team to reconsider the inline comments on the webfig. Please give us AT LEAST the option to choose among inline comments or the "newline" old behavior. Forced inline comments, for those not using very wide monitors, totally trashed the use of comments. It's indeed useless with inline comments.

Please get the webfig AT LEAST on par with winbox, in which you can choose inline of "newline" comments. Please do not force inline comments without giving us the option to choose which one fits best our use case.

bratislav · Sat Aug 19, 2023 1:30 pm

Endpoint-Independent NAT
all world call it Full Cone NAT

Actually Cisco calls it Restricted Cone NAT, but for example Juniper, Fortinet and many BSD variants call it Endpoint Independent mapping NAT...
Here is one explanation that describes it pretty well...
https://docs.netgate.com/tnsr/en/latest/nat/modes.html

marlab · Sat Aug 19, 2023 11:23 pm

ovpn - added "tls-auth" option support for imported .ovpn profiles

Wow, it feels like Christmas... :D

xkubus · Sun Aug 20, 2023 8:46 pm

viewtopic.php?t=172400 please fix this.

K0NCTANT1N · Mon Aug 21, 2023 2:04 am

How long are my 10+ months old hAP ax2s going to be stored in a drawer, because ROS 7 still does not support repeater mode? Tonnes of new features, but still not fully on parity with ROS 6.

Are you sure?! My doubts

Jotne · Mon Aug 21, 2023 7:57 am

viewtopic.php?t=172400 please fix this.

You have posted this to support@mikrotik.com and got a sup number, if not, nothing will happen.

mducharme · Mon Aug 21, 2023 10:31 am

What I have found was not EOIP solution, but creating a VXLAN interface on both sides, adding those to local bridges, doing few twists to filtering, etc. Will experiment with that - viewtopic.php?t=180369#p990815

Yes, VXLAN is the way I work around this at the moment, and it is working very well for me. I would recommend that approach until such a time as they have real four-address-mode support.

infabo · Mon Aug 21, 2023 11:07 am

*) console - improved ":totime" and ":tonum" commands and added ":tosec" command for time value manipulation;

Heureka! Finally I can do timstamp-based comparison in scripts (without all these huge custom helper-functions). Thanks MT

DeGlucker · Mon Aug 21, 2023 7:02 pm

MT, are you going to fix WiFi on x86 platform ? It was broken since ROS 7.7

pe1chl · Mon Aug 21, 2023 7:29 pm

MT, are you going to fix WiFi on x86 platform ? It was broken since ROS 7.7

For remarks that broad you should at least reference a SUP number.

DeGlucker · Mon Aug 21, 2023 9:31 pm

MT, are you going to fix WiFi on x86 platform ? It was broken since ROS 7.7
For remarks that broad you should at least reference a SUP number.

No problem. That's it: SUP-104565
It was opened already since ROS 7.7 was released.
And all this time MT feeds me unsubscribes that the fix is not ready yet.

parham · Thu Aug 24, 2023 2:11 pm

Hi Dev,

Thanks for your all hard work, I have two request:

1- update the Zerotier package to latest 1.12.1 (https://www.zerotier.com/blog/zerotier- ... se-1-12-0/)

2- add the ping to any ip in the route (ip route add gateway=x.x.x.x check-gateway=ping host=1.1.1.1 )

Thanks
Parham

Thu Aug 24, 2023 3:58 pm

What's new in 7.12beta3 (2023-Aug-24 12:15):

!) ethernet - changed "advertise" and "speed" arguments, and removed "half-duplex" setting under "/interface ethernet" menu;
!) sfp - convert configuration to support new link modes for SFP and QSFP type of interfaces;
*) bgp - fixed "atomic-aggregate" always set in output;
*) bgp - fixed local and remote port settings for BGP connections;
*) bgp - increase "hold-time" limit to 65000;
*) bridge - fixed fast-path forwarding with HW offloaded vlan-filtering (introduced in v7.11);
*) bridge - fixed untagged VLAN entry disable;
*) bridge - fixed vlan-filtering stability with HW and non-HW offloaded ports (introduced in v7.10);
*) bridge - improved vlan-filtering bridge stability with CAPsMAN (introduced in v7.11);
*) bth - added "Back To Home" VPN service for ARM, ARM64, and TILE devices;
*) calea - improved system stability when trying to add rules without the CALEA package;
*) console - added "transform" property for ":convert" command;
*) console - fixed scheduler "on-event" script highlighting when editing;
*) console - improved multi-argument property parsing into array;
*) console - improved stability when editing long scripts;
*) console - show full date and time in scheduler "next-run" property;
*) dhcp - fixed DHCP server and relay related response delays;
*) ethernet - added "supported" and "sfp-supported" values for "monitor" command;
*) interface - added "macvlan" interface support;
*) ipsec - fixed IPSec policy when using modp3072;
*) ipv6 - fixed IPv6 RA delay time from 5s to 500ms according to RFC;
*) ipv6 - send RA and RA deprecate messages out three times instead of just once;
*) log - improved logging for user actions;
*) lte - added at-chat support and increased wait time on modem at-chat for Dell DW5821e, DW5821e-eSIM, DW5829e and DW5829e-eSIM;
*) lte - added SINR reporting for FG621-EA modem;
*) lte - fixed Sierra modem detection for modems with vendor-specific USB descriptors;
*) lte - fixed startup race condition when SIM card is in "up" slot for LtAP mini;
*) netinstall-cli - prioritise interface option over address option;
*) ospf - fixed adding ECMP routes;
*) ospf - fixed OSPFv3 not working with NSSA areas;
*) ospf - fixed parsing of opaque LSAs used by TE;
*) ospf - fixed translated NSSA routes not showing in backbone;
*) port - add support for Huawei MS237h-517;
*) port - expose NMEA/DIAG ports for Dell DW5821e and DW5821e-eSIM;
*) quickset - fixed "LAN" interface list members if configuration does not contain bridge;
*) rip - added BFD support;
*) rip - fixed session not working in VRF;
*) route - fixed gateway after link restart;
*) route - removed deprecated "received-from" property;
*) sfp - improved interface stability for SFP and QSFP types of interfaces;
*) switch - improved switch chip stability for CCR2004-16g-2s+ devices;
*) tile - improved system stability when using queues;
*) traffic-generator - added "priority" property for "inject" command;
*) wifiwave2 - added comment property for registration-table;
*) wifiwave2 - enable changing interface MTU and L2MTU;
*) wifiwave2 - fixed malformed Interworking packet elements;
*) winbox - allow to set multiple addresses and added IPv6 support under "Interface/VETH" menu;
*) wireguard - added "wg-add-client" configuration wizard (CLI only);
*) wireguard - added "wg-export" and "wg-import" functionality (CLI only);
*) wireless - fixed malformed Interworking packet elements;
*) x86 - added support for Mellanox ConnectX-6 Dx NIC;

loloski · Thu Aug 24, 2023 4:28 pm

Interface - added "macvlan" interface support;

Wow this is quite a surprise

sergiobeltrao · Thu Aug 24, 2023 4:35 pm

The new release shouldn't be 7.12beta2?

eworm · Thu Aug 24, 2023 4:37 pm

The new release shouldn't be 7.12beta2?

Probably did not pass internal quality testing...

parham · Thu Aug 24, 2023 4:40 pm

Nice job Devs Please add the two request in the next beta:

1- update the Zerotier package to latest 1.12.1 (https://www.zerotier.com/blog/zerotier- ... se-1-12-0/)

2- add the ping to any ip in the route (ip route add gateway=x.x.x.x check-gateway=ping host=1.1.1.1 )

Thanks

Thu Aug 24, 2023 5:03 pm

EdPa

Is it possible and could we ask to elaborate "a little bit more" on changes describing at least what was the main cause of change.
It could let to avoid mistakes and track problems in our configurations easier.

E.g.:

*) switch - improved switch chip stability for CCR2004-16g-2s+ devices; what caused problem with ..... and there one or two sentences of the crucial problem

Please push a liitle life into these dry facts

loloski · Thu Aug 24, 2023 5:05 pm

console died so far i can reproduce this on a spare CCR1036 and CRS317 so this is not architecture specific

2.png

loloski · Thu Aug 24, 2023 5:22 pm

RB4011 is also affected :( but hapac2 is working

stich86 · Thu Aug 24, 2023 5:54 pm

@EdPa

why no one of your support reply to tickets?
You have an issue with flow control but looks like you are not so much interested on resolve it.
RB5009, CCR2004 (and also X86 build), CRS3xx are useless when need to use flow control in the right way (10G to 2.5G with an asymmetric interface configuration).
Only thing that is working is a CHR virtulised, but in this case all ethernet (like flow control) stuff is done by the hypervisor.
Hope someone here from the support want to investigate and find a solution, I am available for any test :)

Amm0 · Thu Aug 24, 2023 5:59 pm

*) console - added "transform" property for ":convert" command;

Like the approach.

:put [:convert [:convert "long live the emperor" transform=rot13 to=hex] transform=rot13 from=hex]
 # long live the emperor

Maybe SHA256 should be a transform= as well?

pe1chl · Thu Aug 24, 2023 6:01 pm

console died so far i can reproduce this on a spare CCR1036 and CRS317 so this is not architecture specific

Is that on a physical console? (serial port and terminal program)
As I cannot reproduce that on a terminal window...

rpingar · Thu Aug 24, 2023 6:05 pm

many thanks!!!
*) x86 - added support for Mellanox ConnectX-6 Dx NIC;

loloski · Thu Aug 24, 2023 7:39 pm

console died so far i can reproduce this on a spare CCR1036 and CRS317 so this is not architecture specific
Is that on a physical console? (serial port and terminal program)
As I cannot reproduce that on a terminal window...

Terminal inside winbox, prior to upgrade both my 1036 and 317 devices is from v7.11

pe1chl · Thu Aug 24, 2023 7:46 pm

Ok, works for me... (RB4011, hAP ac2, CCR1009, CHR)

CTassisF · Thu Aug 24, 2023 8:35 pm

What is layer-dir in /container/config?

Edit: Looks like it's persistent storage for container layers to be reused (in case different containers share some/all layers).

kiloon · Thu Aug 24, 2023 9:02 pm

RouterOS version 7.12beta has been released on the "v7 testing" channel!

Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 7.12beta3 (2023-Aug-24 12:15):

!) ethernet - changed "advertise" and "speed" arguments, and removed "half-duplex" setting under "/interface ethernet" menu;
!) sfp - convert configuration to support new link modes for SFP and QSFP type of interfaces;
*) bgp - fixed "atomic-aggregate" always set in output;
*) bgp - fixed local and remote port settings for BGP connections;
*) bgp - increase "hold-time" limit to 65000;
*) bridge - fixed fast-path forwarding with HW offloaded vlan-filtering (introduced in v7.11);
*) bridge - fixed untagged VLAN entry disable;
*) bridge - fixed vlan-filtering stability with HW and non-HW offloaded ports (introduced in v7.10);
*) bridge - improved vlan-filtering bridge stability with CAPsMAN (introduced in v7.11);
*) bth - added "Back To Home" VPN service for ARM, ARM64, and TILE devices;
*) calea - improved system stability when trying to add rules without the CALEA package;
*) console - added "transform" property for ":convert" command;
*) console - fixed scheduler "on-event" script highlighting when editing;
*) console - improved multi-argument property parsing into array;
*) console - improved stability when editing long scripts;
*) console - show full date and time in scheduler "next-run" property;
*) dhcp - fixed DHCP server and relay related response delays;
*) ethernet - added "supported" and "sfp-supported" values for "monitor" command;
*) interface - added "macvlan" interface support;
*) ipsec - fixed IPSec policy when using modp3072;
*) ipv6 - fixed IPv6 RA delay time from 5s to 500ms according to RFC;
*) ipv6 - send RA and RA deprecate messages out three times instead of just once;
*) log - improved logging for user actions;
*) lte - added at-chat support and increased wait time on modem at-chat for Dell DW5821e, DW5821e-eSIM, DW5829e and DW5829e-eSIM;
*) lte - added SINR reporting for FG621-EA modem;
*) lte - fixed Sierra modem detection for modems with vendor-specific USB descriptors;
*) lte - fixed startup race condition when SIM card is in non-default slot for LtAP mini;
*) netinstall-cli - prioritise interface option over address option;
*) ospf - fixed adding ECMP routes;
*) ospf - fixed OSPFv3 not working with NSSA areas;
*) ospf - fixed parsing of opaque LSAs used by TE;
*) ospf - fixed translated NSSA routes not showing in backbone;
*) port - add support for Huawei MS237h-517;
*) port - expose NMEA/DIAG ports for Dell DW5821e and DW5821e-eSIM;
*) quickset - fixed "LAN" interface list members if configuration does not contain bridge;
*) rip - added BFD support;
*) rip - fixed session not working in VRF;
*) route - fixed gateway after link restart;
*) route - removed deprecated "received-from" property;
*) sfp - improved interface stability for SFP and QSFP types of interfaces;
*) switch - improved switch chip stability for CCR2004-16g-2s+ devices;
*) tile - improved system stability when using queues;
*) traffic-generator - added "priority" property for "inject" command;
*) wifiwave2 - added comment property for registration-table;
*) wifiwave2 - enable changing interface MTU and L2MTU;
*) wifiwave2 - fixed malformed Interworking packet elements;
*) winbox - allow to set multiple addresses and added IPv6 support under "Interface/VETH" menu;
*) wireguard - added "wg-add-client" configuration wizard (CLI only);
*) wireguard - added "wg-export" and "wg-import" functionality (CLI only);
*) wireless - fixed malformed Interworking packet elements;
*) x86 - added support for Mellanox ConnectX-6 Dx NIC;

What's new in 7.12beta1 (2023-Aug-15 16:14):

*) bgp - fixed typos and missing spaces in log messages;
*) bridge - improved system stability;
*) bth - added "Back To Home" VPN service for ARM, ARM64, and TILE devices;
*) certificate - allow to get and maintain Let's Encrypt certificate in IPv6 environment;
*) certificate - fixed "subject-alt-name" duplicating itself when SCEP is used;
*) certificate - improved certificate validation logging error messages;
*) certificate - log CRL HTTP errors under the "error" logging topic;
*) chr - increased OVA default RAM amount from 160MB to 256MB;
*) console - added ":jobname" command;
*) console - added "as-string" and "as-string-value" properties for "get" command;
*) console - added "terminal/ask" command;
*) console - improved ":totime" and ":tonum" commands and added ":tonsec" command for time value manipulation;
*) console - improved stability and responsiveness;
*) console - improved stability when using "special-login";
*) firewall - added "ein-snat" and "ein-dnat" connection NAT state matchers for filter and mangle rules;
*) ike1 - log an error when non-RSA keys are being used;
*) iot - fixed an issue where applying a script to GPIO pin caused GPIO to stop working;
*) iot - fixed behavior where GPIO output state would change on boot;
*) lte - fixed Sierra modem initialization;
*) lte - use more compact logging messages;
*) modbus - added additional security settings for Modbus TCP;
*) mpls - added option to match and set MPLS EXP with bridge and mangle rules;
*) mpls - fixed "propagate-ttl=no" setting;
*) netinstall - added option to discard branding package;
*) ospf - fixed BFD on virtual-link with configured VRF;
*) ovpn - added "tls-auth" option support for imported .ovpn profiles;
*) sfp - fixed missing "rx-power" monitor with certain modules (introduced in v7.10);
*) ssh - added support for user ed25519 public keys;
*) ssh - allow to specify key owner on import;
*) ssh - fixed SSH tunnel performance (introduced in v7.10);
*) supout - added LLDP power to supout.rif;
*) supout - fixed BFD section;
*) system - improved system stability when MD5 checksums are used;
*) tile - improved system stability when using IPv6 queues;
*) wifiwave2 - list APs with a higher maximum data rate as more preferable roaming candidates;
*) winbox - allow to change port numbers for SCTP, DCCP, and UDP-LITE protocols under "IP/Firewall" menus;

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while a router is not working as suspected or after some problem has appeared on the device

Please keep this forum topic strictly related to this particular RouterOS release.

Changelog edit:
- changed from ":tosec" to ":tonsec".

I believe there is a mistake "port - add support for Huawei MS237h-517" it should be MS2372h-517

mantouboji · Thu Aug 24, 2023 9:23 pm

wg-add-client is amazing, but leak MTU and Keepalive arguments.

And “endpoint-address” is the domain name of local MikroTik device and will in [peer] section of client configuration , OK.

nithinkumar2000 · Thu Aug 24, 2023 9:31 pm

I think We can expect IS-IS in Mikrotik Very Soon!!!

ISIS.png

Happy to Fast Developments from Mikrotik Team............

Amm0 · Fri Aug 25, 2023 12:09 am

*) wireguard - added "wg-add-client" configuration wizard (CLI only);
*) wireguard - added "wg-export" and "wg-import" functionality (CLI only);

That's handy. Tiny/minor inconsistencies:
- The /interface/wireguard/wg-add-client prints the QR with an optional file= after generating the peer. But the wg-export requires a file= but does not print the QR.
- The "wg-" in the name also seem redundant, since it's already under /interface/wireguard.

spippan · Fri Aug 25, 2023 3:25 am

No IS-IS, no 6VPE. The wait continues...
A protocol from 1992. Why not change to OSPF

maybe because is-is performes a bit better
[ https://ipwithease.com/ospf-vs-isis/ ]

2023-08-25 02_26_23-OSPF vs ISIS _ Detailed Comparison - IP With Ease — Mozilla Firefox.png

loloski · Fri Aug 25, 2023 4:26 am

This is how it look like, same for 1036,RB4011 i'll try to netinstall them later if i can reproduce the issue

2.PNG

loloski · Fri Aug 25, 2023 5:50 am

Same with our CCR1072 spare in the lab :(

2.PNG

Jotne · Fri Aug 25, 2023 8:08 am

maybe because is-is performans is a bit better

Betamax was better than VHS ;)

mantouboji · Fri Aug 25, 2023 9:32 am

It seems the stability of WireGuard in 7.12beta3 is better than 7.11. In 7.11 the link often break in 2-3 hours.

IMG_3268.jpeg

whatever · Fri Aug 25, 2023 9:46 am

maybe because is-is performans is a bit better
Betamax was better than VHS ;)

No it wasn't, see https://www.youtube.com/watch?v=hGVVAQVdEOs ;)

nkourtzis · Fri Aug 25, 2023 9:49 am

A CRS354-48P-4S+2Q+ connected to a CCR2004-1G-12S+2XS via S+RJ10 modules on both devices (10Gbps link), failed to negotiate a link after upgrading to 7.12beta3. The connection started flapping slowly (every around 30 seconds or so) and after a while stopped working completely. The ethernet ports of the devices worked fine.

Setting speed manual on the CCR side did not work. Downgrading the CCR to 7.11 did not make any difference either. Downgrading the CRS to 7.11 fixed the problem. The problem seemed to be in the swtch though, because the CCR port could successfully connect to a laptop. I will retry the upgrade and post more details at a later time.

jhbarrantes · Fri Aug 25, 2023 10:10 am

7.11 Introudces a vlan polution in bridge vlan table. Default vlan was still there even with frame types = admit only vlan tagged on the bridge. 7.12beta3 still with the same issue. Reported as SUP-125982.

Regards.

donkeyKong · Fri Aug 25, 2023 11:22 am

*) console - added "transform" property for ":convert" command;

What conversions are/will be made available?

I'm looking for MD5 to simplify some scripts.

glueck05 · Fri Aug 25, 2023 11:24 am

I think We can expect IS-IS in Mikrotik Very Soon!!!

ISIS.png

Happy to Fast Developments from Mikrotik Team............

It would be desirable if mikrotik first restored the same range of functions as in ros 6 and only then implemented new features. I'm mainly waiting for MPLS in HW at least at the same level as in ROS6.

thanks, glueck

Amm0 · Fri Aug 25, 2023 3:11 pm

I'm looking for MD5 to simplify some scripts.

:put [:convert "text to hash to MD5" transform=md5 to=hex]

The to= is "hex" for a hexstring. Although you could use the default "to=raw" instead, but MD5 is normally expressed in hex.

What's available is show with <tab> on the CLI... but possible to change since it's a beta...

:convert transform=
ed25519-private-to-ed25519-public
reverse
ed25519-private-to-x25519-private
rot13
ed25519-public-to-x25519-public
sha512
md5
x25519-private-to-x25519-public
none

:convert to=
base32 base64 hex raw url

:convert from=
base32 base64 hex raw url

Fri Aug 25, 2023 4:22 pm

It would be desirable if mikrotik first restored the same range of functions as in ros 6 and only then implemented new features. I'm mainly waiting for MPLS in HW at least at the same level as in ROS6.

What MPLS Hardware functionality was in RouterOS v6 that is not in v7 ?

own3r1138 · Fri Aug 25, 2023 4:38 pm

*) wireguard - added "wg-add-client" configuration wizard (CLI only);
*) wireguard - added "wg-export" and "wg-import" functionality (CLI only);

Thank you very much.

spippan · Fri Aug 25, 2023 4:39 pm

*) wireguard - added "wg-add-client" configuration wizard (CLI only);
*) wireguard - added "wg-export" and "wg-import" functionality (CLI only);

Thank you very much.

yes. that is a welcome addition - hopefully this will come to winbox (and maybe webgui) too

own3r1138 · Fri Aug 25, 2023 4:44 pm

It will be just like this one.
*) Winbox - allows to set multiple addresses and added IPv6 support under the "Interface/VETH" menu;

osc86 · Fri Aug 25, 2023 6:15 pm

yes. that is a welcome addition - hopefully this will come to winbox (and maybe webgui) too

..with support for QR-codes like BTH has.

mducharme · Fri Aug 25, 2023 9:22 pm

What MPLS Hardware functionality was in RouterOS v6 that is not in v7 ?

If I recall correctly the CRS317 supported MPLS hardware offload when acting as a P router in RouterOS v6. I'm not sure if this has been brought to v7 yet.

afink · Sat Aug 26, 2023 1:42 am

Warning:

Watch out with 7.12beta3 if you have 100G ports on a CCR2216 and you use QSFP28 which are attached to a cable (DAC or AOC or so).
We had several links going out of service after upgrading to 7.12beta3. Going back to 7.11 restored the ports. Other nodes who had a optical LR4 transceiver in them did not show this effect.

rplant · Sat Aug 26, 2023 3:05 am

*) dhcp - fixed DHCP server and relay related response delays;

Caused me some grief, had it on Authoritative after 2 Seconds, and things other than windows no longer got an IP address.

glueck05 · Sat Aug 26, 2023 8:19 am

What MPLS Hardware functionality was in RouterOS v6 that is not in v7 ?
If I recall correctly the CRS317 supported MPLS hardware offload when acting as a P router in RouterOS v6. I'm not sure if this has been brought to v7 yet.

that's exactly what I meant. We have decided to exclusively use CRS504 and CRS518 as P-Routers in all new networks (we have also already started to convert old ones). Then the first 10 PoPs were ready and should go into operation and the feature was removed. Currently we have 23 PoPs equipped with the systems (CCR2004 working as PE routers in front of the OLTs) and we are waiting to get started with MPLS. At the moment we switch the whole thing in HW. Against this background, it is a pity that now new features like IS-IS are being implemented although the full range of functions of ros 6 is not yet available again.

pe1chl · Sat Aug 26, 2023 11:03 am

Watch out with 7.12beta3 if you have 100G ports on a CCR2216 and you use QSFP28 which are attached to a cable (DAC or AOC or so).

This apparently is rocket science! MikroTik simply cannot get it working right.
Every new release there are changes in SFP, which fix some problem and it breaks somewhere else.
If it is not DAC cables working right, it is the temperature reading that is wrong, or the speed negotiation failing, or other parameter reading failing.

Well, to be a bit more positive: other manufacturers usually publish a short list of working modules and configurations, and support nothing else.
Maybe after all that is what is required in the world of SFP?

rpingar · Sat Aug 26, 2023 6:26 pm

Warning:

Watch out with 7.12beta3 if you have 100G ports on a CCR2216 and you use QSFP28 which are attached to a cable (DAC or AOC or so).
We had several links going out of service after upgrading to 7.12beta3. Going back to 7.11 restored the ports. Other nodes who had a optical LR4 transceiver in them did not show this effect.

on ccr2216 the 7.12beta1&3 (up to alpha126) break the functionality of our modules qsfp-100-SR4 and qsfp-100-LR4 (tested several kind of manufactures about sr4).
be very carefull!!!!!

We see the light on sfp, but the interface doesn't go up with same configuration it goes up on 7.11 (we see also the sfp modules seem restarting. we lose sfp dates for a second and then they are back).

regards

msatter · Sat Aug 26, 2023 9:01 pm

Miktotik seems to have a special "Testing department" for this and they update the lists on a regular basis as you can see in the Docs history:

https://help.mikrotik.com/docs/pages/vi ... d=13500447

Sadly the SFP sections are not recently being tested or updated.

In the Wiki you can see QSFP...why that is not transferred to the Docs is not know

https://wiki.mikrotik.com/wiki/MikroTik ... patibility

pekr · Sun Aug 27, 2023 11:30 am

*) wifiwave2 - added comment property for registration-table;

Somehow can't make it working. No Winbox gui button, no luck in terminal either? I have tried to edit particular item, value=comment, editor opens up, put the comment there Ctrl + o, but it's not there ....

Any clues of how to comment a registration table items?

Edit: OK, managed to do it via an access list, setting a simple rule for the particular MAC address. But then - I miss the context menu action "Copy to access list", while at the registration table tab.

stmx38 · Sun Aug 27, 2023 11:48 am

Edit: OK, managed to do it via an access list, setting a simple rule for the particular MAC address. But then - I miss the context menu action "Copy to access list", while at the registration table tab.

A way to do it via ACL works in 7.11(wifiwave2) and worked in 6.x.

Maybe it is something different?

rpingar · Sun Aug 27, 2023 12:27 pm

Miktotik seems to have a special "Testing department" for this and they update the lists on a regular basis as you can see in the Docs history:

https://help.mikrotik.com/docs/pages/vi ... d=13500447

Sadly the SFP sections are not recently being tested or updated.

In the Wiki you can see QSFP...why that is not transferred to the Docs is not know

https://wiki.mikrotik.com/wiki/MikroTik ... patibility

the weird thing is that also the mikrotik qsfp28-sr4 module works on 7.11 and doesn't on 7.12beta..............

msatter · Sun Aug 27, 2023 12:46 pm

And then, you are on a Beta version. Thing get broken all the time by developers so that not weird at all.

Report it support and they will try to fix that...and try also to not break someting else doing that. ;-)

eworm · Sun Aug 27, 2023 5:05 pm

Edit: OK, managed to do it via an access list, setting a simple rule for the particular MAC address. But then - I miss the context menu action "Copy to access list", while at the registration table tab.
A way to do it via ACL works in 7.11(wifiwave2) and worked in 6.x.

The registration table did display the comment, but but you could not filter (print where ...) or access via scripting (find, get, ...).

stevester · Sun Aug 27, 2023 6:45 pm

Thank you for the macvlan support! Works great, now I can finally get multiple public IP's from my ISP using DHCP - without needing to resort to the VRRP hack.

Mon Aug 28, 2023 10:30 am

@rpingar, afink - thanks for the feedback. Can you also share the output from "/interface ethernet monitor" for thouse QSFP modules that do not work?

afink · Mon Aug 28, 2023 12:22 pm

this is the type which does work with 7.11 but not with 7.12beta3
We have multiple instances where this shows up as a problem
https://www.fs.com/products/51709.html? ... &id=431173
The same module also exist with different names.
Q28-AO01
Q28-AO02
Q28-AO03
Q28-AO05 etc

the difference is only the length of the cable.

in 7.11 it shows
/interface/ethernet> monitor 13
name: qsfp28-1-1
status: link-ok
auto-negotiation: done
rate: 100Gbps
full-duplex: yes
tx-flow-control: no
rx-flow-control: no
fec: fec91
advertising:
link-partner-advertising:
sfp-module-present: yes
sfp-type: QSFP28
sfp-connector-type: no-separable-connector
sfp-link-length-copper-active-om4: 1m
sfp-vendor-name: FS
sfp-vendor-part-number: Q28-AO01
sfp-vendor-revision: 00
sfp-vendor-serial: S2106283149-2
sfp-manufacturing-date: 21-06-26
sfp-wavelength: 850nm
sfp-temperature: 37C
sfp-supply-voltage: 3.282V
sfp-tx-bias-current: 5mA
eeprom-checksum: good
eeprom: 0000: 11 07 02 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0010: 00 00 00 00 00 00 25 29 00 00 80 34 00 00 00 00 ......%) ...4....
0020: 00 00 24 a8 25 d9 25 41 24 a8 0b 1b 0b 28 0b 25 ..$.%.%A $....(.%
0030: 0b 21 22 f7 23 20 23 17 23 0a 00 00 00 00 00 00 .!".# #. #.......
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0050: 00 00 00 00 00 00 00 aa aa 00 00 00 00 00 00 00 ........ ........
0060: 00 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0080: 11 cc 23 80 00 00 00 40 00 02 00 00 ff 00 00 00 ..#....@ ........
0090: 00 00 01 00 46 53 20 20 20 20 20 20 20 20 20 20 ....FS
00a0: 20 20 20 20 1f 00 00 00 51 32 38 2d 41 4f 30 31 .... Q28-AO01
00b0: 20 20 20 20 20 20 20 20 30 30 42 68 03 52 46 b8 00Bh.RF.
00c0: 01 07 ff 9a 53 32 31 30 36 32 38 33 31 34 39 2d ....S210 6283149-
00d0: 32 20 20 20 32 31 30 36 32 36 20 20 00 10 67 9f 2 2106 26 ..g.
00e0: 00 00 08 5c 79 93 94 15 23 86 a4 af 85 2a 58 55 ...\y... #....*XU
00f0: 11 10 ca 00 00 00 00 00 00 00 00 00 d2 c9 1c 92 ........ ........

this is the same on a 7.12beta3 router

/interface/ethernet> monitor 13
name: qsfp28-1-1
status: no-link
auto-negotiation: done
supported: 10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1000M-baseT-half,1000M-baseT-full,1000M-baseX,2.5G-baseT,
2.5G-baseX,5G-baseT,10G-baseT,10G-baseSR,10G-baseLR,10G-baseLRM,10G-baseER,10G-baseCR,40G-baseSR4,40G-baseLR4,
40G-baseCR4,25G-baseSR,25G-baseCR,100G-baseSR4,100G-baseLR4-ER4,100G-baseCR4
sfp-supported: 1000M-baseT-full,1000M-baseX,2.5G-baseT,2.5G-baseX,5G-baseT,10G-baseCR,40G-baseLR4,25G-baseCR
advertising: 1000M-baseT-full,1000M-baseX,2.5G-baseT,2.5G-baseX,5G-baseT,10G-baseCR,40G-baseLR4,25G-baseCR
link-partner-advertising:
sfp-module-present: yes
sfp-type: QSFP28/QSFP56
sfp-connector-type: no-separable-connector
sfp-link-length-copper-active-om4: 1m
sfp-vendor-name: FS
sfp-vendor-part-number: Q28-AO01
sfp-vendor-revision: A
sfp-vendor-serial: C2204277219-2
sfp-manufacturing-date: 22-04-21
eeprom-checksum: good
eeprom: 0000: 11 07 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 ........ ........
0010: 00 00 00 00 00 00 21 11 00 00 7f e4 00 00 00 00 ......!. ........
0020: 00 00 2a 0c 2a 0c 2a 0c 2a 0c 00 00 0b b5 0b b1 ..*.*.*. *.......
0030: 0b ae 00 01 24 dc 24 cf 24 c6 00 00 00 00 00 00 ....$.$. $.......
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0050: 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 ........ ........
0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
*
0080: 11 00 23 00 00 00 00 00 00 00 08 00 ff 00 00 00 ..#..... ........
0090: 00 00 01 a0 46 53 20 20 20 20 20 20 20 20 20 20 ....FS
00a0: 20 20 20 20 1f 00 02 c9 51 32 38 2d 41 4f 30 31 .... Q28-AO01
00b0: 20 20 20 20 20 20 20 20 41 20 06 0a 00 00 46 af A ....F.
00c0: 01 07 00 00 43 32 32 30 34 32 37 37 32 31 39 2d ....C220 4277219-
00d0: 32 20 20 20 32 32 30 34 32 31 20 20 0c 00 00 85 2 2204 21 ....
00e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00f0: df 10 01 a3 01 20 00 00 00 00 00 00 00 00 00 00 ..... .. ........

see also SUP-126151

rpingar · Mon Aug 28, 2023 3:33 pm

these are with 7.11 where interfaces are up:
/interface/ethernet> monitor 1
name: qsfp28-1-1
status: link-ok
auto-negotiation: done
rate: 100Gbps
full-duplex: yes
tx-flow-control: no
rx-flow-control: no
fec: off
advertising:
link-partner-advertising:
sfp-module-present: yes
sfp-type: QSFP28
sfp-connector-type: multifiber-parallel-optic-1x12
sfp-link-length-om3: 70m
sfp-link-length-copper-active-om4: 100m
sfp-vendor-name: CISCO-OEM
sfp-vendor-part-number: F24-CI-QSFP-100G
sfp-vendor-revision: 10
sfp-vendor-serial: 3213414606
sfp-manufacturing-date: 21-08-25
name: qsfp28-1-1
status: link-ok
auto-negotiation: done
rate: 100Gbps
full-duplex: yes
tx-flow-control: no
rx-flow-control: no
fec: off
advertising:
link-partner-advertising:
sfp-module-present: yes
sfp-type: QSFP28
sfp-connector-type: multifiber-parallel-optic-1x12
sfp-link-length-om3: 70m
sfp-link-length-copper-active-om4: 100m
sfp-vendor-name: CISCO-OEM
sfp-vendor-part-number: F24-CI-QSFP-100G
sfp-vendor-revision: 10
sfp-vendor-serial: 3213414606
sfp-manufacturing-date: 21-08-25
sfp-wavelength: 850nm
sfp-temperature: 25C
sfp-supply-voltage: 3.277V
sfp-tx-bias-current: 7mA
sfp-tx-power: 0.067dBm
sfp-rx-power: 0.256dBm
eeprom-checksum: good
eeprom: 0000: 11 07 02 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0010: 00 00 00 00 00 00 19 e5 00 00 80 07 00 00 00 00 ........ ........
0020: 00 00 29 71 26 a6 27 62 28 79 0d ac 0d ac 0d ac ..)q&.'b (y......
0030: 0d ac 27 ac 29 74 22 08 26 ce 00 00 00 00 00 00 ..'.)t". &.......
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
*
0060: 00 00 00 00 00 00 00 00 00 00 1f 00 00 00 00 00 ........ ........
0070: 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0080: 11 8c 0c 80 00 00 00 40 40 02 00 07 ff 00 00 23 .......@ @......#
0090: 00 00 32 00 43 49 53 43 4f 2d 4f 45 4d 20 20 20 ..2.CISC O-OEM
00a0: 20 20 20 20 00 00 00 00 46 32 34 2d 43 49 2d 51 .... F24-CI-Q
00b0: 53 46 50 2d 31 30 30 47 31 30 42 68 07 d0 46 5e SFP-100G 10Bh..F^
00c0: 02 00 30 9a 33 32 31 33 34 31 34 36 30 36 20 20 ..0.3213 414606
00d0: 20 20 20 20 32 31 30 38 32 35 20 20 0c 00 67 6f 2108 25 ..go
00e0: 00 00 11 a4 10 ba 0e 88 54 80 a3 e0 04 3a 91 af ........ T....:..
00f0: c1 56 40 00 00 00 00 00 00 00 00 00 59 ba b1 4a .V@..... ....Y..J

/interface/ethernet> monitor 5
name: qsfp28-2-1
status: link-ok
auto-negotiation: done
rate: 100Gbps
full-duplex: yes
tx-flow-control: no
rx-flow-control: no
fec: off
advertising:
link-partner-advertising:
sfp-module-present: yes
sfp-type: QSFP28
sfp-connector-type: LC
sfp-link-length-sm: 10km
sfp-vendor-name: FS
sfp-vendor-part-number: QSFP28-LR4-100G
sfp-vendor-revision: 01
sfp-vendor-serial: G1908173981
sfp-manufacturing-date: 20200615
sfp-wavelength: 1310nm
sfp-temperature: 50C
sfp-supply-voltage: 3.227V
sfp-tx-bias-current: 46mA
sfp-tx-power: 1.913dBm
sfp-rx-power: 0.16dBm
eeprom-checksum: good
eeprom: 0000: 11 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0010: 00 00 00 00 00 00 32 26 00 00 7e 0f 00 00 00 00 ......2& ..~.....
0020: 00 00 28 88 29 9c 38 58 27 c7 5a d1 5d d3 5e 7b ..(.).8X '.Z.].^{
0030: 62 03 3c af 40 ea 42 83 2b ec 00 00 00 00 00 00 b.<.@.B. +.......
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
*
0060: 00 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0080: 11 ce 07 80 00 00 00 00 00 00 00 03 ff 02 0a 00 ........ ........
0090: 00 00 00 64 46 53 20 20 20 20 20 20 20 20 20 20 ...dFS
00a0: 20 20 20 20 00 00 00 00 51 53 46 50 32 38 2d 4c .... QSFP28-L
00b0: 52 34 2d 31 30 30 47 20 30 31 66 58 01 c1 46 20 R4-100G 01fX..F
00c0: 03 00 3f f2 47 31 39 30 38 31 37 33 39 38 31 20 ..?.G190 8173981
00d0: 20 20 20 20 32 30 32 30 30 36 31 35 0c 08 67 35 2020 0615..g5
00e0: 00 00 08 2f bc 3e 30 bf e8 0c 30 51 be a3 6f 89 .../.>0. ..0Q..o.
00f0: 0c 27 02 00 00 00 00 00 00 00 00 00 c7 a7 20 13 .'...... ...... .

these with 7.12beta3 where interfaces are down:
/interface/ethernet> monitor 1
name: qsfp28-1-1
status: no-link
auto-negotiation: done
supported: 10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1000M-baseT-half,1000M-baseT-full,1000M-baseX,2.5G-baseT,
2.5G-baseX,5G-baseT,10G-baseT,10G-baseSR,10G-baseLR,10G-baseLRM,10G-baseER,10G-baseCR,40G-baseSR4,40G-baseLR4,40G-baseCR4,
25G-baseSR,25G-baseCR,100G-baseSR4,100G-baseLR4-ER4,100G-baseCR4
sfp-supported: 10G-baseLR,10G-baseER,25G-baseSR,100G-baseSR4
advertising: 10G-baseLR,10G-baseER,25G-baseSR,100G-baseSR4
link-partner-advertising:
sfp-module-present: yes
sfp-type: QSFP28/QSFP56
sfp-connector-type: multifiber-parallel-optic-1x12
sfp-link-length-om3: 70m
sfp-link-length-copper-active-om4: 100m
sfp-vendor-name: CISCO-OEM
sfp-vendor-part-number: F24-CI-QSFP-100G
sfp-vendor-revision: 10
sfp-vendor-serial: 3213414606
sfp-manufacturing-date: 21-08-25
sfp-wavelength: 850nm
sfp-temperature: 32C
sfp-supply-voltage: 3.276V
sfp-tx-bias-current: 7mA
sfp-tx-power: 0.067dBm
sfp-rx-power: 0.451dBm
eeprom-checksum: good
eeprom: 0000: 11 07 00 00 00 0e 00 00 00 00 00 00 00 00 00 00 ........ ........
0010: 00 00 00 00 00 00 20 75 00 00 7f fb 00 00 00 00 ...... u ........
0020: 00 00 2b 57 16 ce 16 ed 19 a8 0d de 00 00 00 00 ..+W.... ........
0030: 00 00 27 ac 00 00 00 00 00 00 00 00 00 00 00 00 ..'..... ........
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0050: 00 00 00 00 00 00 0e 00 00 00 00 00 00 00 00 00 ........ ........
0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
*
0080: 11 8c 0c 80 00 00 00 40 40 02 00 07 ff 00 00 23 .......@ @......#
0090: 00 00 32 00 43 49 53 43 4f 2d 4f 45 4d 20 20 20 ..2.CISC O-OEM
00a0: 20 20 20 20 00 00 00 00 46 32 34 2d 43 49 2d 51 .... F24-CI-Q
00b0: 53 46 50 2d 31 30 30 47 31 30 42 68 07 d0 46 5e SFP-100G 10Bh..F^
00c0: 02 00 30 9a 33 32 31 33 34 31 34 36 30 36 20 20 ..0.3213 414606
00d0: 20 20 20 20 32 31 30 38 32 35 20 20 0c 00 67 6f 2108 25 ..go
00e0: 00 00 11 a4 10 ba 0e 88 54 80 a3 e0 04 3a 91 af ........ T....:..
00f0: c1 56 40 00 00 00 00 00 00 00 00 00 59 ba b1 4a .V@..... ....Y..J

/interface/ethernet> monitor 5
name: qsfp28-2-1
status: no-link
auto-negotiation: done
supported: 10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1000M-baseT-half,1000M-baseT-full,1000M-baseX,2.5G-baseT,2.5G-baseX,
5G-baseT,10G-baseT,10G-baseSR,10G-baseLR,10G-baseLRM,10G-baseER,10G-baseCR,40G-baseSR4,40G-baseLR4,40G-baseCR4,25G-baseSR,
25G-baseCR,100G-baseSR4,100G-baseLR4-ER4,100G-baseCR4
sfp-supported: 10G-baseLR,10G-baseER,25G-baseSR,100G-baseLR4-ER4
advertising: 10G-baseLR,10G-baseER,25G-baseSR,100G-baseLR4-ER4
link-partner-advertising:
sfp-module-present: yes
sfp-type: QSFP28/QSFP56
sfp-connector-type: LC
sfp-link-length-sm: 10km
sfp-vendor-name: FS
sfp-vendor-part-number: QSFP28-LR4-100G
sfp-vendor-revision: 01
sfp-vendor-serial: G1908173981
sfp-manufacturing-date: 20200615
sfp-wavelength: 1310nm
sfp-temperature: 46C
sfp-supply-voltage: 3.26V
sfp-tx-bias-current: 46mA
sfp-tx-power: 1.9dBm
sfp-rx-power: 0.061dBm
eeprom-checksum: good
eeprom: 0000: 11 00 00 00 00 0e 00 00 00 00 00 00 00 00 00 00 ........ ........
0010: 00 00 00 00 00 00 2e 31 00 00 7f 5b 00 00 00 00 .......1 ...[....
0020: 00 00 27 9f 28 b6 34 cf 27 dd 5a d1 00 00 00 00 ..'.(.4. '.Z.....
0030: 00 00 3c 81 00 01 00 01 00 01 00 00 00 00 00 00 ..<..... ........
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0050: 00 00 00 00 00 00 0e 00 00 00 00 00 00 00 00 00 ........ ........
0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
*
0080: 11 ce 07 80 00 00 00 00 00 00 00 03 ff 02 0a 00 ........ ........
0090: 00 00 00 64 46 53 20 20 20 20 20 20 20 20 20 20 ...dFS
00a0: 20 20 20 20 00 00 00 00 51 53 46 50 32 38 2d 4c .... QSFP28-L
00b0: 52 34 2d 31 30 30 47 20 30 31 66 58 01 c1 46 20 R4-100G 01fX..F
00c0: 03 00 3f f2 47 31 39 30 38 31 37 33 39 38 31 20 ..?.G190 8173981
00d0: 20 20 20 20 32 30 32 30 30 36 31 35 0c 08 67 35 2020 0615..g5
00e0: 00 00 08 2f bc 3e 30 bf e8 0c 30 51 be a3 6f 89 .../.>0. ..0Q..o.
00f0: 0c 27 02 00 00 00 00 00 00 00 00 00 c7 a7 20 13 .'...... ...... .

loloski · Tue Aug 29, 2023 8:30 am

This is how it look like, same for 1036,RB4011 i'll try to netinstall them later if i can reproduce the issue
2.PNG

netinstall solved the terminal issue

txfz · Tue Aug 29, 2023 10:20 am

Anyone elaborate on exactly what the terminal/ask parameters are? I can kinda figure it out, but it seems a little strange. prompt is simply a text line that's printed before the rest, preinput is a string that's preprended and fixed/prefilled to the input and included in the resulting value, and value-name is what I actually would call the prompt; the input (including preinput) goes directly after it. So using the command similarly to how other prompt commands work should involve only value-name.

> :local addr [/terminal/ask value-name="Enter IP address: "]; :put "Your IP address is $addr."
Enter IP address: 10.25.0.13
Your IP address is 10.25.0.13.

It was mentioned that a sensitive parameter also exists, but I can't see how that is used.

rpingar · Tue Aug 29, 2023 5:13 pm

@rpingar, afink - thanks for the feedback. Can you also share the output from "/interface ethernet monitor" for thouse QSFP modules that do not work?

alpha137 doesn't fix the qsfp issue.

regards

rpingar · Wed Aug 30, 2023 10:51 am

@rpingar, afink - thanks for the feedback. Can you also share the output from "/interface ethernet monitor" for thouse QSFP modules that do not work?

I have found the root cause of this behavior on 7.12beta or 7.12alpha.
It is related to sub-interfaces qsfp28-x-2/3/4 if they are disabled the main interface is not working propely, it is not able to come up.
To let the qsfp28-x-1 works you must have the subinterface enabled.

This thing is a redical change from 7.11 were subinterfaces were completely not influent on behavior of main interface.

hope to help other users about it.
regards

afink · Wed Aug 30, 2023 10:55 am

they are enabled in my case.

rpingar · Wed Aug 30, 2023 11:00 am

they are enabled on my case

check if fec are disabled on both side.

regards

afink · Wed Aug 30, 2023 11:18 am

fec is configured on switch and mikrotik using fec92 / rs . this is mandatory for link to come up in 7.11. Auto negotiation failed otherwise.

rpingar · Wed Aug 30, 2023 11:21 am

fec is configured on switch and mikrotik using fec92 / rs . this is mandatory for link to come up in 7.11. Auto negotiation failed otherwise.

try to disable auto negotiation and fix the proper speed/mux at least on ccr2216

afink · Wed Aug 30, 2023 11:42 am

Switching off auto negotiation and configuring it for 100G-baseLR4-ER4 brought the interface up.
Interesting...

rpingar · Wed Aug 30, 2023 11:45 am

Switching off auto negotiation and configuring it for 100G-baseLR4-ER4 brought the interface up.
Interesting...

welcome to the 100g qsfp world!! :DDDDDDDDDDDDDDDDD

msatter · Wed Aug 30, 2023 12:11 pm

...nothing changed. This is the FIRST thing to try when a (x)SFP's is not coming up in a Mikrotik.

I recommended in the past, to disable auto negotiation by default.

afink · Wed Aug 30, 2023 12:14 pm

except that you expect this on a new installation, not on something which worked before...

msatter · Wed Aug 30, 2023 4:19 pm

Yeah, but then it is still at the top of the checklist when working with SFP equipment in Mikrotik devices.

snowdogging · Wed Aug 30, 2023 5:29 pm

Thank you so much for fixing the bridge fast-path issue! I spent a whole day troubleshooting why no stateful sessions would work.

But now I am seeing a V2 OSPF problem. Connected NSSA records from a ptp interface are not being propagated to the routing table. They exist in the LSA table. I have to manually them as routes. Routes were automatically created in 7.11 so I think this is a new bug.

DeviceLocksmith · Wed Aug 30, 2023 10:10 pm

I can confirm that FastTrack, which was broken for me on CCR2116 in 7.11 is fixed in 7.12beta3

killersoft · Thu Aug 31, 2023 1:31 am

*) wifiwave2 - enable changing interface MTU and L2MTU;
Now if you can only adjust the wireless MTU to 9000+ Bytes for bridging l2 networks for jumbo frame support(e.g MEF 3 carrier grade connections ) in ptp wireless setups :)

Amm0 · Thu Aug 31, 2023 1:42 am

*) wifiwave2 - enable changing interface MTU and L2MTU;
Now if you can only adjust the wireless MTU to 9000+ Bytes for bridging l2 networks for jumbo frame support(e.g MEF 3 carrier grade connections ) in ptp wireless setups :)

It may let you set that... But still limited by 802.11 specs, so 2290 is max L2MTU.

RouterOS with wifiwave2 has let you set the MTU higher in config for a while — it just didn't do anything – and actual MTU used to max out at 1500 prior to this change.

pe1chl · Thu Aug 31, 2023 12:08 pm

I think the main use for >1500 byte MTU is not to bridge jumbo frames but to allow tunneling protocols to have some headroom to transport a 1500 byte MTU frame without fragmentation.
(e.g. EoIP, VXLAN etc can be used to work around the problem of missing 4-address mode)

afink · Thu Aug 31, 2023 12:16 pm

bigger MTUs can also help in having encrypted traffic being transported over longer distances in fewer packets.
If you have a endpoint which encrypts and can put multiple packets into a jumboframe, there will be less but bigger packet being sent. Hence the transit network has fewer routing decisions to take.

killersoft · Thu Aug 31, 2023 12:42 pm

I need to transport carrier grade ethernet(9000 byte frames) layer-2 traffic that is encrypted at layer2(macsec 802.11AE) as a backhaul using mikrotik's NV2 or NStream modes etc, not classic Wi-Fi mode(which everyone defaults to in these conversations) in a point to point bridge mode only...

Currently I have 2x NetMetal-5's with 30dBi's doing the L2 point to point bridge work in NV2 mode, but a new requirement has come up and now I need to transport jumbo frames, so I need to bin the netmetals and replace with either Cambium or Siklu equipment ( and sort band licensing with the local auth :( ).

pe1chl · Thu Aug 31, 2023 2:35 pm

Yes, jumbo frames over 802.11 is a no-go. You will need to either fragment/reassemble them or find another wireless solution.

Amm0 · Thu Aug 31, 2023 11:29 pm

In the build it's :tonsec NOT ":tosec", but seems to work:
Code: Select all
:put [:tonsec [:timestamp]]                           
1692285621621
Why they did not name it just :toepoch then if it is sec or nsec would be covered.

It's in nanoseconds. So the "n" is nano, not number, of seconds.

:put ([:tonsec 1s]/1000000000)                                  
1

And seconds from epoch is in:

:put [:tonum 1s]            
1
:put [:tonum [:timestamp]]
1693515184

bpwl · Sat Sep 02, 2023 9:15 pm

4-address mode is not standard in 801.11. each manufacturer that offers it has implemented their own hacks to negotiate and support it,
That why I'm not sure using a tunnel isn't such a bad option. It does let you treat wireless same as wired, vs using Wi-Fi specific WDS-like things.

The bigger issue today with doing tunneling over wifiwave2 is the interface won't sent packets larger than 1500*, even if the MTU is set higher – so tunnels get fragmented.

* I don't have any wifiwave2 devices here to check specific in 7.12, so maybe it's fix, but been open 2 years.

I know it is old, very old, but the BCP allows for full 1500byte MTU in a tunneled connection which runs over links with smaller MTU. It is fragmented in transit, but the connection is delivered unfragmented between the bridges. Even the NetFlix algoritms didn't see that the traffic did pass a VPN tunnel, and their content can be forwarded, what could not be done over the normal VPN connection.. BCP is explained in the wiki for PPTP only, but it works with SSTP,L2TP and PPTP. Set MRRU to a higher value (eg 1600) to have the full unfragmented 1500bytes MTU. BCP is Intended for wireless, but I used it also over ethernet as tunnel, to forward NetFlix between different networks. (Netflix tries to detect a tunnel, and then says "something went wrong".) PPTP was faster than SSTP. It was internal in the local network, so security is not facing the public internet.

https://wiki.mikrotik.com/wiki/Manual:B ... _bridging)

HINT: setting the RSTP on the bridges was mandatory, or the BCP link did not appear.

PS ... who knows ... even jumbo frames ??? "MRRU allows to enable multi-link support over single link, it divides the packet to multiple channels therefore increasing possible MTU and MRU (up to 65535 bytes)"

buset1974 · Mon Sep 04, 2023 5:41 am

Can anyone in MT fix the VPLS de fragment on 7.12 please?

please see this topic for detail viewtopic.php?p=1022490#p1022490

thx

rplant · Mon Sep 04, 2023 7:46 am

Another option for 9k frames over wifi is to use eoip.
You can make its frame size big and it becomes fairly efficient when they are big.

Then perhaps a bit of bridge filtering/policy routing, so the larger frames go over the wifi via the eoip tunnel,
while the smaller frames don't.

afink · Mon Sep 04, 2023 8:23 am

eoip and other tunneling protocols would only work if transporting routers along the path fragment packets on the way instead of rejecting and dropping it. on the fly fragmentation is cpu intensive and thus the method of dont fragment packets but inform the sender of a smaller mtu is mostly used (see path mtu discovery). The only exception where tunneling works is if you use tcp as transport where vpn packet boundaries dont reflect payload packet boundaries

jeetlal · Wed Sep 06, 2023 2:23 pm

macvlan documentation with example required

pe1chl · Wed Sep 06, 2023 2:38 pm

eoip and other tunneling protocols would only work if transporting routers along the path fragment packets on the way instead of rejecting and dropping it.

This was mainly about transparent bridging across Wi-Fi point-to-point links. Issues with 3rd parties refusing to transport or fragment them do not apply in that case. You can see the point-to-point link as a /30 IP network with your own routers at the endpoints and a limited-MTU link in between. It is your own decision to use your routers to do fragment/reassemble. (or not to have the functionality)

killersoft · Thu Sep 07, 2023 1:34 am

Why in IPv6 DHCP server POOL option do I get a double static-only entry's listed:

ipv6 dhcp server pool issue.png

mducharme · Thu Sep 07, 2023 4:57 am

Why in IPv6 DHCP server POOL option do I get a double static-only entry's listed:

That's been showing up that way for a while and isn't related specifically to this beta.

Jotne · Thu Sep 07, 2023 7:44 am

If no one make a support case out of it, it will possible stay like this.

pe1chl · Thu Sep 07, 2023 11:14 am

If no one make a support case out of it, it will possible stay like this.

It happens here too, so it will probably be easy to reproduce (my config has a pool from DHCPv6 client but in addition it lists static-only twice).

Kevdevon · Sat Sep 09, 2023 2:54 pm

Mikrotik Audience, WAN2 stops working randomly, could be days or weeks.
Disabling and re-enabling resolves the issues until the next occurrence.

Cha0s · Sun Sep 10, 2023 10:50 pm

Today, after 17days of uptime, snmp started acting up on a CCR2004.

iso.3.6.1.2.1.4.24.4.1.1.185.X.Y.Z.255.255.255.255.0.10.26.35.2 = IpAddress: 185.X.Y.Z
iso.3.6.1.2.1.4.24.4.1.1.185.X.Y.Z.255.255.255.255.0.0.0.0.0 = IpAddress: 185.X.Y.Z
Error: OID not increasing: iso.3.6.1.2.1.4.24.4.1.1.185.X.Y.Z.255.255.255.255.0.10.26.35.2
 >= iso.3.6.1.2.1.4.24.4.1.1.185.X.Y.Z.255.255.255.255.0.0.0.0.0

After a reboot, the issue persists.

When running snmpwalk, it is really slow when processing the routing table (~650routes in total).
At the same time, the routing process takes up 100% of a CPU core until it reaches to the above error.

If I run snmpwalk with -Cc to ignore the oid not increasing, it slowly reaches the problematic prefix, and then it spews out countless times per second the same line

iso.3.6.1.2.1.4.24.4.1.1.185.X.Y.Z.255.255.255.255.0.0.0.0.0 = IpAddress: 185.X.Y.Z
iso.3.6.1.2.1.4.24.4.1.1.185.X.Y.Z.255.255.255.255.0.0.0.0.0 = IpAddress: 185.X.Y.Z
iso.3.6.1.2.1.4.24.4.1.1.185.X.Y.Z.255.255.255.255.0.0.0.0.0 = IpAddress: 185.X.Y.Z
iso.3.6.1.2.1.4.24.4.1.1.185.X.Y.Z.255.255.255.255.0.0.0.0.0 = IpAddress: 185.X.Y.Z

At the same time, the snmp process does ~2mbps traffic and takes up 60-70% CPU on one core.

pe1chl · Mon Sep 11, 2023 11:16 am

Well, maybe you noticed it only now because you were debugging things, but that "OID not increasing" is a bug that has been present for a long time.
Maybe there are other problems now as well...?

Mon Sep 11, 2023 11:34 am

Cha0s,
can you please create supout.rif and shoot ticket to support with all accompanying info required to reproduce this behavior ?
Otherwise it might still be a known bug in version 7.25.6...

pe1chl · Mon Sep 11, 2023 12:13 pm

One way of reproducing this is to have multiple route tables. The SNMP OID does not really provide for that, and it seems RouterOS just merges the output for the different tables which disturbs the sorting and thus the increasing of the OID in walk.

Tue Sep 12, 2023 12:36 pm

mAP - 7.12beta3
when trying to open terminal via winbox connected via ROMON

terminal is not a TTY
died with signal 11 on Tue Sep 12 09:33:36 2023

Connecting via Winbox / WG does allow terminal to be opened.
It worked before on 7.11.2.

Supout created, support contacted (SUP-127788).

Tue Sep 12, 2023 3:31 pm

Additional info:
no such problem on RB5009, AX2, AX3.
mAP and cAP Lite do have this problem, both are mipsbe. Coincidence ?

anav · Tue Sep 12, 2023 4:31 pm

Additional info:
no such problem on RB5009, AX2, AX3.
mAP and cAP Lite do have this problem, both are mipsbe. Coincidence ?

We dont have insight into the testers lab but you may have provided a clue to what they dont use for testing ;-)
MTs way of passively aggressively discontinuing support for products but not stating it clearly, be it anything !ARM LOL.
Otherwise of course, we would get zerotrust cloudflare as an options package for all routers!!

pe1chl · Tue Sep 12, 2023 5:45 pm

The "new devices" listing on the hardware page has a MIPSBE device, with 16MB flash even.

Wed Sep 13, 2023 8:58 am

mAP - 7.12beta3
when trying to open terminal via winbox connected via ROMON
Code: Select all
terminal is not a TTY
died with signal 11 on Tue Sep 12 09:33:36 2023
Connecting via Winbox / WG does allow terminal to be opened.
It worked before on 7.11.2.

Supout created, support contacted (SUP-127788).

Feedback from support:
issue has been identified and already solved in next 7.12beta version (not yet released).

Wed Sep 13, 2023 3:43 pm

What's new in 7.12beta7 (2023-Sep-13 09:58):

!) ethernet - changed "advertise" and "speed" arguments, and removed "half-duplex" setting under "/interface ethernet" menu;
!) sfp - convert configuration to support new link modes for SFP and QSFP type of interfaces;
*) api - fixed fetching objects with warning option from REST API;
*) bgp - implemented IGP metric sending in BGP messages;
*) bluetooth - use "g" units when decoding MikroTik beacon acceleration on peripheral devices menu;
*) certificate - allow to remove issued certificates when CRL is not used;
*) certificate - fixed certificate auto renewal via SCEP;
*) chr - iavf updated driver to 4.9.1 version;
*) console - improved randomness for ":rndstr" and ":rndnum" commands;
*) console - improved stability when using "special-login";
*) console - improved system stability through RoMON session;
*) console - improved system stability when using autocomplete;
*) dhcp - fixed DHCP server "authoritative" and "delay-threshold" settings (introduced in v7.12beta3);
*) ike2 - improved rekey collision handling;
*) ipsec - fixed Diffie-Hellman public value encoding size;
*) ipsec - fixed minor typo in logs;
*) ipsec - reduce disk writes when started without active configuration;
*) ipv6 - send RA and RA deprecate messages out three times instead of just once;
*) l3hw - improved system stability during IPv6 route offloading;
*) leds - added "dark-mode" functionality for RBwAPG-5HacD2HnD;
*) leds - added "wireless-status" and "wireless-signal-strength" configuration types for wifiwave2 interfaces;
*) log - improved logging for user actions;
*) lte - fixed 5G data-class reporting for Chateau 5G;
*) lte - fixed APN authentification in multi APN setup for R11e-LTE6;
*) lte - fixed IPv6 prefix for MBIM modems in multi-apn setup when IPv6 APN used as not first APN;
*) lte - fixed RSSI for FG621-EA modem to show the correct value;
*) lte - fixed startup race condition when SIM card is in "up" slot for LtAP mini;
*) mpls - improved FastPath next-hop selection hash algorithm;
*) netinstall-cli - added empty configuration option "-e";
*) netwatch - decreased "thr-tcp-conn-time" maximum limit to 30 seconds;
*) ovpn - improved system stability;
*) pimsm - improved system stability;
*) qsfp - added 50Gbps rate support for QSFP28 interfaces;
*) qsfp - fixed sub-interface EEPROM monitor data output (introduced in v7.12beta3);
*) qsfp - improved auto link detection for 100G CWDM4 modules and AOC cables (introduced in v7.12beta3);
*) qsfp - use sub-interface configuration for establishing link (for 40Gbps and 100Gbps links, all sub-interfaces must be enabled);
*) routerboard - added "reset-button" support for RB800 and RB1100 devices;
*) ssh - improved connection stability when pasting large chunks of text into console;
*) supout - added interface list members section;
*) switch - improved resource allocation for 98DX224S, 98DX226S, and 98DX3236 switch chips;
*) traffic-generator - fixed traffic-generator on CHR and x86;
*) usb - added support for RTL8153 USB ethernet on ARM, ARM64 and x86;
*) vrf - limit maximum VRFs to 1024;
*) vxlan - improved system stability for Tile devices;
*) webfig - fixed "Days" property configuration change under "IP/Firewall" menu;
*) webfig - fixed timezone for interface "Last Link Down/Up Time";
*) webfig - improved Webfig performance and responsiveness;
*) webfig - try to re-establish connection after disconnect;
*) wifiwave2 - added an alternative QoS priority assignment mechanism based on IP DSCP (CLI only);
*) wifiwave2 - added station-bridge interface mode (CLI only);
*) wifiwave2 - do not show default "l2mtu" on compact export;
*) wifiwave2 - fixed PTK renewal for interfaces in station mode;
*) wifiwave2 - fixed sniffer command not receiving any QoS null function frames when using 802.11ax radios;
*) wifiwave2 - fixed untagged VLAN 1 entry when using "vlan-id" setting together with vlan-filtering bridge;
*) wifiwave2 - fixed warning on CAP devices when radar detected;
*) wifiwave2 - implemented an option to transmit IP multicast packets as unicasts (CLI only);
*) wifiwave2 - improved compliance with regulatory requirements;
*) wifiwave2 - make 4-way handshake procedure more robust when acting as supplicant (client);
*) winbox - added "Comment" under "Routing/BFD/Configuration" menu;
*) winbox - added "g" flag under "IPv6/Routes" menu;
*) winbox - added "Name Format" property under "WifiWave2/Provisioning" menu;
*) winbox - changed "MBR Partition Table" checkbox to unchecked by default under "System/Disks/Format-Drive" menu;
*) winbox - fixed "Address" property under "WifiWave2/Remote-CAP" menu;
*) winbox - fixed "Group Key Update" maximum value under "WifiWave2/Security" menu;
*) winbox - fixed entry numbering and ordering under "WifiWave2/Provisioning" menu;
*) winbox - fixed minor typos;
*) wireguard - allow to specify client settings under peer menu which will be included in configuration file and QR code;
*) wireguard - generate Wireguard peer keys and preshared-key automatically, if value is specified but is not base64 string;
*) wireguard - removed "wg-add-client" configuration wizard (introduced in v7.12beta3);
*) wireless - added more "radius-mac-format" options (CLI only);
*) www - fixed allowed address setting for REST API users;
*) www - fixed fragmented POST data for SCEP service;
*) x86 - i40e updated driver to 2.23.17 version;
*) x86 - igc updated driver to 5.10.194 version;
*) x86 - ixgbe updated driver to 5.19.6 version;
*) x86 - Realtek r8169 updated driver;

Simonej · Wed Sep 13, 2023 4:12 pm

What's new in 7.12beta7 (2023-Sep-13 09:58):

*) wifiwave2 - added station-bridge interface mode (CLI only);

OMG!!!

Wed Sep 13, 2023 4:20 pm

What's new in 7.12beta7 (2023-Sep-13 09:58):

*) wifiwave2 - added station-bridge interface mode (CLI only);
OMG!!!

Indeed. That was also the first thing which catched my eye ...

gigabyte091 · Wed Sep 13, 2023 4:25 pm

That's a lot of changes... good job Mikrotik

pekr · Wed Sep 13, 2023 4:34 pm

Can we say, that Station bridge, having two hAP ax2, can serve a repeater purpose?

yottabit · Wed Sep 13, 2023 4:48 pm

How long are my 10+ months old hAP ax2s going to be stored in a drawer, because ROS 7 still does not support repeater mode? Tonnes of new features, but still not fully on parity with ROS 6.

I have been waiting for this too, so that I can use the Audience with wifiwave2 and wireless mesh. It looks like it has been added finally with this beta!

* wifiwave2 - added station-bridge interface mode (CLI only);

I am not at the location where I have the Audience devices in use, but I will try it out when I get there in a couple weeks.

MikroTik: is this expected to work in an upgrade from the regular wireless package to the wifiwave2 package? In other words, if I upgrade to this beta first, will the Audience wireless mesh config automatically work if I upgrade to wifiwave2?

mkx · Wed Sep 13, 2023 4:59 pm

Can we say, that Station bridge, having two hAP ax2, can serve a repeater purpose?

I'd say that not just yet. We still need ap-bridge mode ... But you can use one ax2 as station-bridge when AP is running legacy wireless driver (e.g. ac2).

markonen · Wed Sep 13, 2023 5:01 pm

qsfp - use sub-interface configuration for establishing link (for 40Gbps and 100Gbps links, all sub-interfaces must be enabled);

This looks like something that will affect me. Currently I've only enabled the -1 interface for each QSFP28 port and explicitly disabled -2, -3 and -4. Sounds like my config would no longer link up at 100G, is that right? The other subinterfaces must just be left enabled, with no other configuration necessary?

Wed Sep 13, 2023 5:01 pm

The station-bridge mode works together with the AP mode, there is no need for a new type of AP mode. The WifiWave2 station-bridge is only compatible with WifiWave2 APs.
Audience configuration won't be automatically converted in this case.

Kevdevon · Wed Sep 13, 2023 5:24 pm

The station-bridge mode works together with the AP mode, there is no need for a new type of AP mode. The WifiWave2 station-bridge is only compatible with WifiWave2 APs.
Audience configuration won't be automatically converted in this case.

Is this the preferred setup for Capsman? Or do we still connect as a station?
I'm about to set this up today, would be nice to have a play and experiment.

yottabit · Wed Sep 13, 2023 5:45 pm

The station-bridge mode works together with the AP mode, there is no need for a new type of AP mode. The WifiWave2 station-bridge is only compatible with WifiWave2 APs.
Audience configuration won't be automatically converted in this case.

That's a bummer on two fronts.

1. I don't see why the upgrade to wifiwave2 couldn't automatically convert the working mesh config already present.

2. I also use old netmetal 5 and hap ac in station-bridge mode to connect to the Audience, but those don't support wifiwave2. So I guess I'm screwed and have to use legacy wireless package on Audience forever?

Amm0 · Wed Sep 13, 2023 7:16 pm

Audience configuration won't be automatically converted in this case.
So I guess I'm screwed and have to use legacy wireless package on Audience forever?

Well, your hAPac and cAPac owners with the hardware, got screwed by the wifiwave2 package size long ago ;)
And CAPsMAN is already incompatible between wifiwave2 and older..

So bridging drivers... seems a bridge too far.

marekm · Wed Sep 13, 2023 7:37 pm

Please, any chance to make the station-bridge mode compatible over the air between different generations of devices?
In both directions - connect older N/AC station-bridge to new AX ap-bridge, or connect new AX station-bridge to older N/AC ap-bridge.
Even if sub-optimal (using only N/AC data rates), it would help to migrate existing networks - no need to replace everything at the same time.
I can see it may be too difficult to implement nstreme/nv2 protocols with wifiwave2, but just 802.11 (with bridge/WDS extensions) will do.
Bonus points if you can make it compatible with UBNT M5 series (802.11n) stations - they work fine with old MT N/AC APs with WDS static mesh mode.
Not asking about UBNT AC stations as then they started the proprietary vendor lock-in game and can only talk to UBNT APs, nothing else.
Also not asking for compatibility with old A/G devices, most of them long gone but N/AC are still widely used.
Historically, MT has always been very good at such over the air compatibility - please continue this tradition with wifiwave2 too.

yottabit · Wed Sep 13, 2023 7:46 pm

I'm getting very close to selling all my MikroTik APs and going to Ruckus for wireless. I'll still use MikroTik for routing, though.

MikroTik wireless is flexible, but just not performant. And this wifiwave2 business is looking to be the last nail in the coffin for me. I've been waiting for years, and now we finally have station-bridge, only for me to find out here that we can't interop wireless station-bridge to wifiwave2 ap mode? So now my capsman wireless bridge setup between 2x Audience, 1x hap ac, and 1x netmetal 5 will be hindered to use the legacy wireless package on the Audience forever. Correct me if I'm wrong, but otherwise I'm in the market to dump MikroTik wireless for something else known to be much more performant since I would have to replace two of my MikroTik APs just to get wifiwave2.

blacksnow · Wed Sep 13, 2023 8:03 pm

Definitely appreciate the hard work on this testing release. Unfortunately, DHCP IPv4 client fails to find or bind (remains in the searching state permanently) after upgrading, this is on my CCR-2216. Had to downgrade back to beta3 version.

Simonej · Wed Sep 13, 2023 9:07 pm

@yottabit this is little bit OT but, MT is pushing hard on Wifiwave2, like station-bridge was unexpected implementation, it's clear from a long time that legacy and new driver are incompatible (or they don't have enough resources to make it working).
Based on my recent experience, wireless devices are OK for enthusiasts and decent for business, if you always take care of keep up to date with changelog and fixing issues with clients.
Want something that simply works? MT devices are not for you, at least for now.

Complain will not help, appreciate the improvements, it is what it is...

pe1chl · Wed Sep 13, 2023 9:11 pm

Please, any chance to make the station-bridge mode compatible over the air between different generations of devices?

bridge mode is already incompatible between manufacturers. basically you have to see wifiwave2 devices as a different manufacturer.
when you require transparent bridging over different models/manufacturers devices, look at the possibility of adding a tunnel layer on top of a normal wifi connection, as explained elsewhere in this and other topics.

Wed Sep 13, 2023 9:17 pm

*) wifiwave2 - added station-bridge interface mode (CLI only);

... it simply works

AX Lite (LTE, but disabled that itf for this test), connected in station mode to AX3 with SSID on VLAN.
Via CLI changed mode to station-bridge.
AX Lite interfaces in bridge, DHCP client on bridge.
Bridge gets IP lease in correct subnet.
PC connected via ethernet to AX Lite gets correct IP.
Iperf3 test from PC to NAS with iperf container: +-400 Mbps (which is the expected result for AX Lite wifi)

Didn't touch AX3 config at all.
It simply works.

Wed Sep 13, 2023 9:21 pm

Complain will not help, appreciate the improvements, it is what it is...

Agree.
There was a time we only had 2.4GHz wifi.
Is everyone also going to complain when wifi7 comes out because wifi6/5/4/... can not be used anymore then in combination with those devices ?

Deal with the cards which have been given.

pe1chl · Wed Sep 13, 2023 9:44 pm

Again I had the problem that my RB4011 hangs during update. It appears to happen "after some uptime" only. It was running 7.12beta3 for 20 days, I did the update, and it shuts down but does not perform the update. Of the 10 ethernet ports, only the LED on port 10 remains on. That one is doing PoE to a LHG XL.
After powercycling the router reboots but is still at the previous version, repeating the procedure makes it work OK.
The log (there is logging to a file) shows absolutely nothing between the last log lines before the reboot and "router rebooted", when it works OK the package install log is shown there.
No idea how to debug this, maybe next time I'll disable ether10 before upgrade.

marekm · Wed Sep 13, 2023 11:01 pm

bridge mode is already incompatible between manufacturers. basically you have to see wifiwave2 devices as a different manufacturer.
when you require transparent bridging over different models/manufacturers devices, look at the possibility of adding a tunnel layer on top of a normal wifi connection, as explained elsewhere in this and other topics.

There is some compatibility "over the air" between MT and UBNT, and MT should certainly be able to make their own products compatible with itself. Tunnels have their own issues, such as MTU overhead. In my small WISP network (mix of UBNT, MT and Cambium radios) I can easily bridge even slightly larger "mini jumbo" frames - RFC4638 PPPoE over VLAN just works, no fragmentation. It's a pity that WDS/bridge has not been made an official WiFi standard even after all these years, it's an useful feature in widespread use.

Thu Sep 14, 2023 8:28 am

I also use old netmetal 5 and hap ac in station-bridge mode to connect to the Audience, but those don't support wifiwave2. So I guess I'm screwed and have to use legacy wireless package on Audience forever?

You can configure an L2 tunnel (EoIP, for example) to run on the wireless link, then bridge that tunnel on the AP and the station.
It's more complicated to set up and the performance won't be as good, but doable in principle.

serogo · Thu Sep 14, 2023 10:59 am

Failed to create the L2TP Server Binding interface

Router OS version: 7.12beta7
Steps for reproduce:
1) Open router webfig web interface. Lead to menu: Interfaces > [Add New] - select option L2TP Server Binding.
2) Set "name" and "username" (optional)
3) Click to save.
4) It show an error: "Couldn't add New Interface - unsupported device type (6)"

Expect the interface to be created and it can bed used it in IP > Routes

Ullinator · Thu Sep 14, 2023 12:27 pm

Update from 7.12Beta3 to Beta7 went smooth on all my devices. Uptime now >20h.
No new problems detected.

hc_049.jpg

@new AP and Bridge mode: I can´t understand when MT implements a new feature in the WifiWave2 package some of your guys start grumbling why this new feature can´t do this and that also.
Instead to be glad that MT hasn´t finished the journey in development. :-)

pekr · Thu Sep 14, 2023 2:23 pm

I'm getting very close to selling all my MikroTik APs and going to Ruckus for wireless. I'll still use MikroTik for routing, though.

MikroTik wireless is flexible, but just not performant. And this wifiwave2 business is looking to be the last nail in the coffin for me. I've been waiting for years, and now we finally have station-bridge, only for me to find out here that we can't interop wireless station-bridge to wifiwave2 ap mode? So now my capsman wireless bridge setup between 2x Audience, 1x hap ac, and 1x netmetal 5 will be hindered to use the legacy wireless package on the Audience forever. Correct me if I'm wrong, but otherwise I'm in the market to dump MikroTik wireless for something else known to be much more performant since I would have to replace two of my MikroTik APs just to get wifiwave2.

Will you install completly different generations of Ruckus, to be on pair with your MT complaints? If you are ready to buy new Ruckus-everything, go scrap your old MT stuff and go wifiwave ax full-force too?

yottabit · Thu Sep 14, 2023 3:38 pm

Will you install completly different generations of Ruckus, to be on pair with your MT complaints? If you are ready to buy new Ruckus-everything, go scrap your old MT stuff and go wifiwave ax full-force too?

My point was that if I'm going to have to buy new MikroTik APs to get better performance, I may as well buy Ruckus instead since they dramatically outperform MikroTik in speed and coverage.

In one location I already replaced 3 MikroTik full-power/gain APs with a single Ruckus and I have the same coverage and faster speeds. It's well known in the industry that Ruckus has the best coverage of all vendors, and nearly the fastest (I think Aruba was faster at short range, iirc).

Ruckus supports wireless bridge, which is what I really need at the other location where I'm currently using 4 MikroTik APs. And they allow setting DTIM to help with mobile power saving, which almost all vendors except MikroTik have supported for ages. This particular feature has been requested from MikroTik as far back as I can remember, and I started using MikroTik around 15 years ago. I've installed hundreds of MikroTik routers and APs in homes and businesses, but I think it's time to move on from the wireless side unless cost is the most important factor. But I digress.

pekr · Thu Sep 14, 2023 6:06 pm

Will you install completly different generations of Ruckus, to be on pair with your MT complaints? If you are ready to buy new Ruckus-everything, go scrap your old MT stuff and go wifiwave ax full-force too?
My point was that if I'm going to have to buy new MikroTik APs to get better performance, I may as well buy Ruckus instead since they dramatically outperform MikroTik in speed and coverage.

In one location I already replaced 3 MikroTik full-power/gain APs with a single Ruckus and I have the same coverage and faster speeds. It's well known in the industry that Ruckus has the best coverage of all vendors, and nearly the fastest (I think Aruba was faster at short range, iirc).

Ruckus supports wireless bridge, which is what I really need at the other location where I'm currently using 4 MikroTik APs. And they allow setting DTIM to help with mobile power saving, which almost all vendors except MikroTik have supported for ages. This particular feature has been requested from MikroTik as far back as I can remember, and I started using MikroTik around 15 years ago. I've installed hundreds of MikroTik routers and APs in homes and businesses, but I think it's time to move on from the wireless side unless cost is the most important factor. But I digress.

Once again - you are using crapload of mixed generation of devices and complain. Throw it out and stick to wifivave2, as it will improve over time. Noone's going to fix the old stuff.

And btw - we use Aruba at work, 11 locations. Don't get me even started upon multiple generations of those devices not being operable together with various firmware generations.

buset1974 · Fri Sep 15, 2023 5:30 am

version 7 was an anti-climax for Mikrotik, not as expected.

Network5 · Fri Sep 15, 2023 8:57 am

I have some TCP performance issue on a CCR2004 (Router B) running 7.12beta3 and beta7, but just on forwarding plane.

This is the result of a simple speed test to and from the router itself:
Router A (CCR2216) <-> Router B (CCR2004)
status: done
time-remaining: 0s
ping-min-avg-max: 9.44ms / 9.49ms / 9.81ms
jitter-min-avg-max: 0s / 33us / 343us
loss: 0% (0/200)
tcp-download: 801Mbps local-cpu-load:19%
tcp-upload: 947Mbps local-cpu-load:18% remote-cpu-load:9%
udp-upload: 959Mbps local-cpu-load:15% remote-cpu-load:8%

Router B (CCR2004) <-> Router C (CCR2004)
status: done
time-remaining: 0s
ping-min-avg-max: 366us / 420us / 911us
jitter-min-avg-max: 0s / 48us / 523us
loss: 0% (0/200)
tcp-download: 583Mbps local-cpu-load:14%
tcp-upload: 690Mbps local-cpu-load:15% remote-cpu-load:57%
udp-download: 639Mbps local-cpu-load:6% remote-cpu-load:59%
udp-upload: 695Mbps local-cpu-load:12% remote-cpu-load:59%

And finally Router A (CCR2216) <-> Router C (CCR2004)
status: done
time-remaining: 0s
ping-min-avg-max: 9.78ms / 9.87ms / 10.4ms
jitter-min-avg-max: 0s / 96us / 609us
loss: 0% (0/200)
tcp-download: 501Mbps local-cpu-load:37%
tcp-upload: 23.0Mbps local-cpu-load:21% remote-cpu-load:8%
udp-download: 590Mbps local-cpu-load:8% remote-cpu-load:11%
udp-upload: 660Mbps local-cpu-load:22% remote-cpu-load:11%

Anyone having similar issues?

Jotne · Fri Sep 15, 2023 9:52 am

version 7 was an anti-climax for Mikrotik, not as expected.

Stupid comment without telling why.
I do find this thread about your problem, but do not see any support number on the problem.
viewtopic.php?t=194895
Forum only will not solve it.

For me and many other v7 works fine.

pe1chl · Fri Sep 15, 2023 10:25 am

I have some TCP performance issue on a CCR2004 (Router B) running 7.12beta3 and beta7, but just on forwarding plane.

You say forwarding but then you are testing from router to router?
To test forwarding performance, put an end-system (e.g. a PC) at each end behind the routers, and test between the PCs.
E.g. running iperf3 on each of them.

ToTheFull · Fri Sep 15, 2023 11:18 am

I have some TCP performance issue on a CCR2004 (Router B) running 7.12beta3 and beta7, but just on forwarding plane.

Anyone having similar issues?

No, how far away is that router 10ms?

status: done
time-remaining: 0s
ping-min-avg-max: 192us / 242us / 524us
jitter-min-avg-max: 0s / 29us / 279us
loss: 0% (0/200)
tcp-download: 927Mbps local-cpu-load:93%
tcp-upload: 920Mbps local-cpu-load:62% remote-cpu-load:57%
udp-download: 944Mbps local-cpu-load:41% remote-cpu-load:42%
udp-upload: 957Mbps local-cpu-load:55% remote-cpu-load:29%

cAP ax >> Hap ax

status: done
time-remaining: 0s
ping-min-avg-max: 168us / 227us / 509us
jitter-min-avg-max: 0s / 38us / 295us
loss: 0% (0/200)
tcp-download: 932Mbps local-cpu-load:64%
tcp-upload: 934Mbps local-cpu-load:42% remote-cpu-load:84%
udp-download: 943Mbps local-cpu-load:26% remote-cpu-load:58%
udp-upload: 955Mbps local-cpu-load:36% remote-cpu-load:48%

ToTheFull · Fri Sep 15, 2023 11:19 am

dazmatic · Fri Sep 15, 2023 11:20 am

FYI - Fibocom NL952 modem stopped working in 7.12 beta.

going back to stable appears to have resolved it.

mszru · Fri Sep 15, 2023 1:16 pm

hAPac2 failed to boot normally after the RouterBOOT upgrade from 7.11.2 to 7.12beta7.

I had to reset it via Reset button and then it booted without any default configuration. At the end I've downgraded to 7.11.2 and restored the backup.

Network5 · Fri Sep 15, 2023 8:30 pm

I have some TCP performance issue on a CCR2004 (Router B) running 7.12beta3 and beta7, but just on forwarding plane.
You say forwarding but then you are testing from router to router?
To test forwarding performance, put an end-system (e.g. a PC) at each end behind the routers, and test between the PCs.
E.g. running iperf3 on each of them.

The router that I'm having issues with is router B, the one in the middle, which is running 7.12beta7. The other two are running 7.10.2. I was testing from router to router to actually see if there are issues on links. The last measurement is end to end, and the CCR (Router B) is the only router in the middle. These are two segments of our core network.

The link with 10ms is a L2 link, approximately 500km long.

afink · Sat Sep 16, 2023 12:45 pm

What's new in 7.12beta7 (2023-Sep-13 09:58):

!) sfp - convert configuration to support new link modes for SFP and QSFP type of interfaces;
*) qsfp - added 50Gbps rate support for QSFP28 interfaces;
*) qsfp - fixed sub-interface EEPROM monitor data output (introduced in v7.12beta3);
*) qsfp - improved auto link detection for 100G CWDM4 modules and AOC cables (introduced in v7.12beta3);
*) qsfp - use sub-interface configuration for establishing link (for 40Gbps and 100Gbps links, all sub-interfaces must be enabled);

Forgotten line:

*) sfp - broke negotiation of working SFP28 completly. Now we can not even find any combination of setting to get SFP28 to work. We had several CCR2004 which we could only revive by doing a downgrade to 7.11.2. Downgrading to 7.12beta3 would also have worked but you can't download that release anymore.

*) qsfp - didnt fix auto-negotiation of QSFP28 transceiver and AOC cables. While in 7.11.2, autonegotiation works, in 7.12beta3 it needed manual settings. In 7.12beta7 this is still the case, despite above claim.

Cha0s · Sat Sep 16, 2023 2:36 pm

Downgrading to 7.12beta3 would also have worked but you can't download that release anymore.

https://download.mikrotik.com/routeros/ ... a3-arm.npk

afink · Sat Sep 16, 2023 3:22 pm

doesnt help. I need arm64 and the other packages as well. but thanks for sharing... Ill try again with 7.12 release when mikrotik finally figured out all its (Q)SFP negotiation mysteries.

Kanzler · Sat Sep 16, 2023 3:37 pm

@afink

https://download.mikrotik.com/routeros/ ... -arm64.npk

https://download.mikrotik.com/routeros/ ... 2beta3.zip

Cha0s · Sat Sep 16, 2023 3:40 pm

doesnt help. I need arm64 and the other packages as well. but thanks for sharing... Ill try again with 7.12 release when mikrotik finally figured out all its (Q)SFP negotiation mysteries.

Just change the URL to whatever version/arch you need.
The files are all there. You take the official latest link and modify it.