v7.15.3 [stable] is released!

Thu May 30, 2024 11:59 am

RouterOS version 7.15 have been released in the "v7 stable" channel!

Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 7.15.3 (2024-Jul-24 13:36):

*) lte - fixed possible crash when enabling/disabling config-less modem interface;
*) lte - fixed R11e-LTE no traffic flow when modem with older firmware version is used;
*) routerboard - improved Etherboot stability for CRS320-8P-8B-4S+ device ("/system routerboard upgrade" required);
*) ssh - fixed unsupported user SSH public key import (introduced in v7.15);

What's new in 7.15.2 (2024-Jun-26 14:42):

*) bth - improved system stability;
*) defconf - configure the default-route property for PPP clients only on devices with a built-in modem;
*) modem - fixed modem firmware upgrade for Chateau 5G and Chateau 5G R16 (introduced in v7.15);
*) route - fixed incorrectly handled route distinguisher and route targets (introduced in v7.15);
*) ssh - fixed SSH cryptographic accelerator selection (introduced in v7.14);
*) switch - fixed limited Tx traffic on Ethernet ports for CRS354 devices (introduced in v7.15);
*) system - fixed an issue where routing configuration was missing after performing a reset, adding a new configuration and then upgrading (introduced in v7.15);
*) winbox/webfig - fixed skins (introduced in v7.15);

What's new in 7.15.1 (2024-Jun-07 15:49):

*) bgp - fixed BGP sessions missing vpnv6 afi;
*) bgp - fixed corrupted as-path when received update with empty AS_PATH attribute (introduced in v7.15);
*) bgp - fixed vpnv6 safi;
*) health - fixed board-temperature for KNOT device (introduced in v7.15);
*) health - fixed missing health for CRS112-8G-4S device (introduced in v7.15);
*) install - fixed ARM64 cdrom install (introduced in v7.15);
*) lte - fixed cases where LTE interface would take long time to become ready after bootup for Chateau 5G and Chateau 5G R16 (introduced in v7.15);
*) lte - fixed cases where modem could be handled by multiple dialer instances;
*) modem - fixed unresponsive PPP link recovery when TX bandwidth was exceeding link capacity;
*) poe-out - fixed silent firmware upgrade fail on CRS112-8P-4S device (introduced in v7.15);
*) ppp - fixed dynamic queue default name (introduced in v7.15);
*) route - fixed memory leak (introduced in v7.15);
*) route - fixed some missing route parameters when printing (introduced in v7.15);
*) wifi - fixed signal strength reporting during association (introduced in v7.15);
*) wifi - improved WPA3 PMKSA handling when access-lists with custom passphrases are used;
*) winbox - fixed issue with skin file appearing as unknown in user group menu (introduced in v7.15);
*) winbox - fixed missing system note on login (introduced in v7.15);

What's new in 7.15 (2024-May-29 15:44):

!) system - added support for AMPERE (R) and ARM64 CHR installations (new ARM64 CHR image available);
!) system - added support for AMPERE (R) hardware (new ARM64 ISO file, new ARM64 extra-nics.npk package);
*) bgp - added initial vpnv6 support;
*) bgp - correctly synchronize input.accept-nlri address list;
*) bgp - fixed prefix count when BGP sessions run with multiple AFIs;
*) bgp - fixed selecting local.default-address from wrong VRF;
*) bgp - use IPv6 as default address-family for IPv6 sessions;
*) bgp-vpn - use VRF interface as gateway for leaked connected routes;
*) branding - added option to hide default configuration prompt;
*) branding - added option to hide or replace default caps-mode-script;
*) bridge - added error message if MLAG peer-port is configured with "mlag-id";
*) bridge - added MLAG peer-port events to logs;
*) bridge - added MVRP support;
*) bridge - do not allow multiple bonds with same "mlag-id";
*) bridge - improved protocol-mode STP, RSTP and MSTP stability;
*) bridge - rename monitor property "path-cost" to "actual-path-cost";
*) bridge - reworked dynamic VLAN creation;
*) bridge - use default "edge=auto" for dynamically bridged interfaces (PPP, VPLS, WDS);
*) certificate - added support for different ACME servers for ssl-certificate (CLI only);
*) certificate - added support for importing pbes2 encrypted private keys with aes128;
*) certificate - added trusted parameter for certificate import;
*) certificate - allow replacing certificate with internal import;
*) certificate - delete certificate related files automatically from storage after import;
*) certificate - improved RSA key signature processing speed;
*) chr - allow to "generate-new-id" only while CHR is running on level "free" license;
*) chr - fixed bogus messages printed out while booting up the system (introduced in v7.14);
*) chr - fixed Xen and Vultr missing ethernet (introduced in v7.14);
*) console - added "byte-array" option to ":convert" command;
*) console - added "proplist" parameter to interactive commands;
*) console - added "rows" property for sniffer quick mode;
*) console - added "sanitize-names" property under "/console/settings" menu (option for replacing reserved characters with underscores for files, disabled by default);
*) console - added "type" parameter to ":resolve" command;
*) console - added "use-script-permissions" option when running scripts from CLI;
*) console - added hotkey "F8" to print entire multiline input;
*) console - added link from "/iot/lora" to "/lora";
*) console - added log for script execution failures;
*) console - added multi-line print in "/file" menu;
*) console - added option to get "about" value (dynamically created text field by RouterOS services like CAPsMAN);
*) console - added option to read and change file line endings in full-screen editor;
*) console - added warning log for modified filenames due to reserved characters;
*) console - covert spaces, CR, LF in ":convert to=url" command;
*) console - do not convert string to array in ":deserialize" command;
*) console - fixed ":onerror" behavior when "do" block is missing;
*) console - fixed "export where" functionality in certain menus;
*) console - fixed console prompt when entering hot lock mode with "F7";
*) console - fixed DHCP server "authoritative=no" configuration export;
*) console - fixed do/while implementation not working with variables (introduced in v7.14);
*) console - fixed filtering by "dhcp" flag in "/ip/arp" menu;
*) console - fixed multiple typos in help;
*) console - improved stability;
*) console - optimized configuration export to prevent startup of processes without any configuration;
*) console - remove unnecessary serial ports for Alpine CPUs;
*) console - show system note before serial login if enabled;
*) console - use user permissions when running scripts from WinBox and WebFig;
*) container - do not allow negative number for "ram-high" setting;
*) defconf - do not override default DHCP server lease time;
*) defconf - fixed 5ghz-ax channel width for L11, L22 devices;
*) defconf - fixed unknown topics in log messages;
*) defconf - minor configuration script updates;
*) dhcpv4-relay - added VRF support;
*) discovery - added LLDP MAC/PHY Configuration/Status TLV support;
*) discovery - added LLDP Maximum Frame Size TLV support;
*) discovery - added LLDP Port Description TLV support;
*) discovery - advertise only physical interface name for LLDP PortID TLV;
*) discovery - always send LLDP MED Power TLV if MED was received;
*) discovery - fixed high CPU utilization when "tx-only" mode is set;
*) discovery - optimized LLDP information update;
*) disk - added option to auto configure media sharing;
*) disk - added support for formatting exfat file-system;
*) disk - improved support for file systems with non-ascii characters in file names;
*) disk - improved support for formatting ext4 file-system;
*) disk - improved system stability when adding partition with no parent;
*) disk - improved system stability;
*) disk - the "scan" command will now detect and include USB drives that were previously ejected;
*) dns - added support for "adlist";
*) dns - added VRF support;
*) dns - improved system stability when caching entries;
*) eap - improved eap-peap, eap-mschap2 client authentication (dot1x/wireless/ipsec);
*) ethernet - fixed default names for CRS310-8G+2S+ device (introduced in v7.14);
*) ethernet - fixed interface disable for CRS326-4C+20G+2Q;
*) ethernet - fixed management port disable/enable on CCR2004-1G-12S+2XS, CCR2004-1G-2XS-PCIe, CCR2216, CCR2116 devices;
*) ethernet - improved port speed downshift functionality for CRS326-4C+20G+2Q;
*) fetch - added "idle-timeout" parameter;
*) fetch - changed topic "info" to "error" for permission denied logs;
*) fetch - fixed slow throughput due to "raw" logging which occurred even when not listening to the topic (introduced in v7.13);
*) file - allow adding and renaming files and directories;
*) file - avoid refreshing whole file system during file modification;
*) file - improved external storage detection;
*) health - added "cpu-temperature" for IPQ50xx devices;
*) health - added log for fan state changes on CRS3xx, CRS5xx, CCR2xxx, CCR1016r2, CCR1036r2 devices;
*) health - fixed fan behavior for CRS310-1G-5S-4S+ (introduced in v7.14);
*) health - fixed rogue voltage on CRS510-8XS-2XQ-IN;
*) install - cdrom and hdd install images contain additional packages that can be interactively selected;
*) ipv6 - properly initialize default ND "interface=all" entry;
*) leds - fixed LEDs for L22 device;
*) lora - removed LoRa WinBox and console functionality duplication (moved to IoT package since v7.11);
*) lte - added "at-chat" support for DELL T99W175 (PID: 0x05c6 VID: 0x90d5);
*) lte - added support for concatenated AT commands in "modem-init" string;
*) lte - added support to set "modem-init" string for "dialer-less" modems;
*) lte - apply the same configuration for Microsoft branded EM12-G modem (Surface Mobile Broadband) as for Quectel EM12-G;
*) lte - do not show persistent interfaces for multi-apn slave interfaces;
*) lte - dropped support for R11e-LTE-US FOTA firmware update;
*) lte - fixed R11e-LTE-US modem dial-up;
*) lte - fixed situation where link is not restored after Quectel MBIM modem firmware update;
*) lte - improved FG621-EA modem APN authentication;
*) lte - make interface persistent (unused interface configs can be removed, allow to export and examine current configuration without the device present);
*) lte - removed 2 APN restriction for RG520F-EU modem;
*) lte - use the correct network interface for multi-interface LTE modems;
*) media - added support for DLNA;
*) metarouter - removed support;
*) modem - send APN authentication for BG77 modem also if ppp-client interface created manually;
*) netinstall - improved stability;
*) netinstall-cli - fixed incorrect server address assignment (introduced in v7.14);
*) ovpn - fixed import ovpn config when remote port is missing;
*) ovpn - fixed minor typo in error message;
*) poe-out - added LLDP power management support for devices with single PoE-out port;
*) poe-out - fixed powering devices if input voltage is lower than 12V for hEX PoE (introduced in v7.9);
*) poe-out - improved firmware upgrade stability for AF/AT controlled boards;
*) poe-out - moved "PoE LLDP" property from "/interface/ethernet/poe" to "/ip/neighbor/discovery-settings" and enable it by default;
*) ppp - added "enable-ipv6-accounting" option under PPP AAA menu;
*) ppp - added log when disconnecting a client due to "WISPr-Session-Terminate-Time" RADIUS attribute;
*) ppp - allow underscores in domain names;
*) ppp - enabled monitoring of registration state, RSRP, RSRQ, SINR, PCI, CellID for BG77 modem;
*) ppp - fixed "Framed-IPv6-Pool" usage when received from RADIUS;
*) ppp - fixed "on-down" script running even when tunnel was not up;
*) profiler - added "neighbor-discovery" task;
*) qos-hw - added "offline" tx-manager (CLI only);
*) qos-hw - added "profile" and "map" support for CPU port;
*) qos-hw - added congestion avoidance support for 98DX8xxx, 98DX4xxx, 98DX325x switch chips (CLI only);
*) qos-hw - added ECN marking support for compatible switches;
*) qos-hw - added per-queue traffic shapers (CLI only);
*) qos-hw - added Priority Flow Control for compatible switches (CLI only);
*) qos-hw - added support for QoS profile assignment via ACL rules;
*) qos-hw - added WRED support for compatible switches;
*) qos-hw - fixed port "print stats/usage" when using "from" property;
*) qos-hw - replaced buffer with bytes in QoS monitor;
*) queue - improved system stability (introduced in v7.6);
*) quickset - only show LTE mode for devices without other wireless interfaces;
*) radius - added "require-message-auth" option that requires "Message-Authenticator" in received Access-Accept/Challenge/Reject messages;
*) radius - include "Message-Authenticator" in any RADIUS communication messages besides accounting for all services;
*) route - do not allow routes with empty "dst-address";
*) route - do not redistribute loopback address as connected route;
*) route - fixed bgp-vpn prefix import with the same route distinguisher (RD);
*) route - improved system stability;
*) route - rework of route attributes;
*) route - show route-distinguisher (RD) in route print;
*) route-filter - allow setting different AFI gateways;
*) route-filter - fixed ext community list matcher;
*) sfp - added "100M-baseFX" link mode support for compatible devices;
*) sfp - added "sfp-ignore-rx-los" setting;
*) sfp - fixed "sfp-tx-fault" state indication for CRS510;
*) sfp - fixed link establishment with 100Mbps optical modules (requires "/interface ethernet reset" or adding "100M-baseFX" modes for advertise or speed properties);
*) sfp - fixed missing Tx traffic at 10Gbps rate on CCR2004-16G-2S+ in rare cases;
*) sfp - ignore SFP RX LOS signal for modules with bad EEPROM;
*) sfp - improved "sfp-tx-power" value monitoring in certain cases;
*) sfp - improved auto-negotiation linking for some MikroTik cables and modules;
*) sfp - improved system stability for CR2004-1G-2XS-PCIe (introduced in v7.14);
*) sfp - improved system stability with some GPON modules for CCR2004 and CCR2116 devices;
*) smb - added logs for share connection requests;
*) smb - do not allow setting empty "comment" or "domain" properties;
*) sms - added option to select SMS storage;
*) sms - added SMS PDU to SMS inbox "print detail";
*) sms - added workaround for modems which do not notify regarding new SMS arrival (missing URC);
*) sms - improved SMS handling;
*) sms - removed SMS for SMIPS;
*) sms - use "gsm" logging topic for serial modem SMS logs;
*) snmp - added missing PoE-out status codes to MIKROTIK-MIB;
*) snmp - added new "mtxrOpticalVendorSerial" OID to MIKROTIK-MIB;
*) socks - attempt to parse domain name as IP before resolving;
*) ssh - added support for user Ed25519 private keys;
*) ssh - export host Ed25519 public key;
*) ssh - fixed bogus output;
*) ssh - fixed permissions to run ".auto.rsc" scripts;
*) ssh - require "policy" user policy when adding public key;
*) sstp - added SNI support;
*) sstp - disconnect clients when server is disabled;
*) storage - improved configuration storing process on first system boot after configuration reset;
*) switch - added support for multiple ingress and egress port mirroring on 98DXxxxx switches;
*) switch - added support for RSPAN mirroring on 98DXxxxx switches;
*) switch - fixed L3HW and QoS monitor during switch reset;
*) system - added resource values (Product name, File name and File version) for Windows executable files;
*) system - general work on optimizing the size of RouterOS packages;
*) system - show "cpu-frequency" for Alpine CPUs;
*) system - skip configuration upgrade from RouterOS v6 on configuration reset;
*) system - updated office address in RouterOS license;
*) system - updated online manual links from "wiki" to the help documentation;
*) timezone - updated timezone information from "tzdata2024a" release;
*) traffic-flow - detect IPv4 source address if not set;
*) traffic-flow - improved system stability;
*) userman - added "require-message-auth" option that requires "Message-Authenticator" in received Access-Request messages;
*) userman - include "Message-Authenticator" in any RADIUS communication messages besides accounting for all services;
*) vlan - added MVRP (applicant) configuration option;
*) vlan - ensure that VLAN MTU remains unchanged when adjustments are made to the parent interface MTU, only modifications to the L2MTU might impact VLAN MTU;
*) vlan - fixed MTU reset on bridge after reboot;
*) vlan - limit "vlan-id" range from 1-4095 to 1-4094;
*) vrf - fixed VRF interfaces being moved to main table after reboot (introduced in v7.14);
*) webfig - allow pasting with ctrl+v into terminal;
*) webfig - fixed column preferences for ordered tables;
*) webfig - show inherited properties for wifi interfaces;
*) wifi - added "reselect-interval" support;
*) wifi - changed interface default to "disabled=yes";
*) wifi - do not report disabled state for CAPsMAN managed interface;
*) wifi - fixed configuration export for "disabled" property;
*) wifi - improve channel selection after radar detection events;
*) wifi - improve regulatory compliance for L11, L22 devices;
*) wifi - improved interface initialization reliability on DFS channels;
*) wifi - improved stability of DFS check in the 5GHz-A band;
*) wifi - improved system stability when provisioning CAPs in certain cases;
*) wifi - rename "available-channels" parameter to "channel-priorities" and include desirability rating for each channel;
*) wifi - report current CAPsMAN address and identity on CAP;
*) wifi - show inherited properties with "print" command (replaces "actual-configuration") and added "print config" for showing only configured values;
*) wifi-qcom - added configuration.distance setting to enable operation over multi-kilometer distances;
*) wifi-qcom - updated driver;
*) winbox - added "Download" and "Flush" buttons under "System/Certificates/CRL" menu;
*) winbox - added "Flat Snoop" button under "WiFi" menu;
*) winbox - added "FT Preserve VLAN ID" setting under "WiFi/Configuration/FT" menu;
*) winbox - added "Request logout" button under "System/Users/Active Users" menu;
*) winbox - added "Trusted" checkbox under "System/Certificates/Import" menu;
*) winbox - added drop down menu for "User" property when importing SSH key under "System/User/SSH Keys" and "System/User/SSH Private Keys" menus;
*) winbox - added invalid flag under "IP/DHCP Relay" menu;
*) winbox - added key type and key length column for user SSH keys;
*) winbox - added missing SFP monitoring properties under "Interface/SFP" menu;
*) winbox - added passphrase option for SSH host key export;
*) winbox - added passphrase option for SSH host key import;
*) winbox - allow specifying size and rtmpfs size with M, G units under "System/Disks" menu;
*) winbox - allow to specify "M" or "G" postfix for download, upload or total limits under "User Manager/Limitations" menu;
*) winbox - do not show "Host Key Size" when using ed25519 key under "IP/SSH" menu;
*) winbox - fixed the issue where the skin file fails to appear in the user group menu after creation;
*) winbox - renamed "Channel" column to "Current Channel" under "Wifi" menu;
*) winbox - show "Valid Servers" and "Unknown Servers" column by default under "IP/DHCP Server/Alerts" menu;
*) winbox - show inherited properties for wifi interfaces;
*) winbox - show SIM settings for SXTR device under "Interfaces/LTE/Modem" menu;
*) winbox - updated icons for certain menus;
*) winbox - use correct values for "Jump Target" property under "IPv6/Firewall/Filter Rules" menu;
*) wireguard - added option to mark peer as responder only;
*) wireguard - added peer "name" field and display it in logs;
*) wireguard - do not attempt to connect to peer without specified endpoint-address;
*) wireguard - fixed "auto" argument usage for "private-key" and "preshared-key" settings;
*) wireguard - fixed performance issues showing QR code;
*) wireless - perform shorter channel availability check for 5600-5650MHz if regulatory domain permits it;
*) x86 - fixed ixgbe Tx hang by disabling TSO;
*) x86 - fixed VLAN tagged packet transmit for ice driver;
*) x86 - ice driver update to v1.13.7;
*) x86 - improved stability for RTL8125 driver;
*) x86 - ixgbe driver update to 5.19.9;
*) x86/chr - improved panic saving (increased minimal RAM requirements to 256MB);

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while a router is not working as suspected or after some problem has appeared on the device

Please keep this forum topic strictly related to this particular RouterOS release.

nithinkumar2000 · Thu May 30, 2024 12:06 pm

After Long Wait ROS v7.15 with huge change log is here

baragoon · Thu May 30, 2024 1:03 pm

*) x86/chr - improved panic saving (increased minimal RAM requirements to 256MB);

does this mean that if the free memory is less than 256 megabytes, the router will crash with "out of memory"?

anav · Thu May 30, 2024 1:23 pm

Disappointed not to see a router fix for wireguard coming in on WAN2 when WAN2 is secondary WAN and mangling this traffic does not work.

digitalmaks · Thu May 30, 2024 1:25 pm

on x86, after update, memory occupied about 230mb

nichky · Thu May 30, 2024 1:29 pm

bgp-vpn - use VRF interface as gateway for leaked connected routes

I thing that this is what im after. I will check with my lab.

pe1chl · Thu May 30, 2024 2:11 pm

It appears that the default /ip/firewall/connection/tracking udp-timeout has changed from 10s to 30s but I do not see that in the changelog.

fragtion · Thu May 30, 2024 2:15 pm

Exciting release packed with updates and bug fixes. My whole fleet of routers (30+, various architectures) updated successfully, and good to see over 700kb of free space on my hAP ac2 (from around 300kb on 7.14.3)
Good job dev team :D

ColinM9991 · Thu May 30, 2024 2:29 pm

Very nice update. I did play around with Adlist a bit but, if what I've read is correct, it doesn't work when DoH is enabled and it also consumes a lot of RAM.

It's a nice addition to the ecosystem and hopefully it only gets better over time.

amokkatmt · Thu May 30, 2024 2:35 pm

I have an URL, which returns
< HTTP/1.1 200 OK
< Server: thttpd/2.25b 29dec2003
< Content-Type: text/html; charset=gb2312
< Date: Thu, 30 May 2024 11:32:28 GMT
< Last-Modified: Mon, 25 Dec 2023 07:25:30 GMT
< Accept-Ranges: bytes
< Connection: close

And /tool/fetch is unable to GET it: "failure: there was no content-length or transfer-encoding"

nichky · Thu May 30, 2024 2:36 pm

still delivering def-route via VRF doesn't work

error404 · Thu May 30, 2024 2:43 pm

[DELETED]
PS: Sorry, I am stupid

Amm0 · Thu May 30, 2024 2:47 pm

:local changelog ([/tool fetch "https://upgrade.mikrotik.com//routeros/NEWESTa7.stable" as-value output=user] -> "data");
Since today I get this error:
Download from upgrade.mikrotik.com FAILED: Fetch failed with status 403

Your URL has to two // in it.

pe1chl · Thu May 30, 2024 2:54 pm

Exciting release packed with updates and bug fixes. My whole fleet of routers (30+, various architectures) updated successfully, and good to see over 700kb of free space on my hAP ac2 (from around 300kb on 7.14.3)
Good job dev team :D

Updating an entire fleet of routers within 2 hours after release of a .0 release?
I hope it is a test network...

Chupaka · Thu May 30, 2024 3:00 pm

It appears that the default /ip/firewall/connection/tracking udp-timeout has changed from 10s to 30s but I do not see that in the changelog.

What's new in 7.14 (2024-Feb-29 09:10):

*) firewall - increased default "udp-timeout" value from 10s to 30s;

pe1chl · Thu May 30, 2024 3:06 pm

Ok for me it appeared after an upgrade from 7.14.3 on a test router... it seems I forgot to export after the previous update.

kos · Thu May 30, 2024 3:08 pm

*) ppp - fixed "on-down" script running even when tunnel was not up;

"on-down" script works fine in 7.14.3, but doesn't work in 7.15

rushlife · Thu May 30, 2024 3:51 pm

thx mikrotik, huge changelog

hafte · Thu May 30, 2024 4:09 pm

Script execution seems not fixed.
After update to 7.15, red warnings started in sys log with: "Executing script from scheduler failed, please check it manually"
Scrips seems to be working, but this warning is present.
All scripts with :global or other definitions generate error.

eworm · Thu May 30, 2024 4:12 pm

Scripting works fine. Your errors have always been there, they just have not been reported before.

hafte · Thu May 30, 2024 4:22 pm

@eworm - You are probably right, but how to find where is the specific syntax error, to be able to fix it. Scripts do all what is required and only say check manualy :-)

npeca75 · Thu May 30, 2024 4:30 pm

woooa
CHR, 7.14.3 -> 7.15
free memory decreased significantly

anav · Thu May 30, 2024 4:35 pm

Exciting release packed with updates and bug fixes. My whole fleet of routers (30+, various architectures) updated successfully, and good to see over 700kb of free space on my hAP ac2 (from around 300kb on 7.14.3)
Good job dev team :D
Updating an entire fleet of routers within 2 hours after release of a .0 release?
I hope it is a test network...

Thats Sir James Fragtion to you Sir. He likes living dangerously! :-)

Guscht · Thu May 30, 2024 4:40 pm

Disappointed not to see a router fix for wireguard coming in on WAN2 when WAN2 is secondary WAN and mangling this traffic does not work.

Me too, me too....

Evgeniy29 · Thu May 30, 2024 4:48 pm

hAP ax2 7.15 don't work Access List - this rule don’t work:

/interface wifi access-list
add action=accept allow-signal-out-of-range=always signal-range=-75..0
add action=reject

After update to 7.15 no one can connect via WiFi

eworm · Thu May 30, 2024 4:50 pm

@eworm - You are probably right, but how to find where is the specific syntax error, to be able to fix it. Scripts do all what is required and only say check manualy :-)

It's not about syntax errors, but runtime errors. Probably your script is accessing a configuration item that does not exist. You need to debug that, one way or another. I have to admit that it is not that easy with RouterOS sometimes.

hafte · Thu May 30, 2024 5:04 pm

@eworm - You are probably right, but how to find where is the specific syntax error, to be able to fix it. Scripts do all what is required and only say check manualy :-)
It's not about syntax errors, but runtime errors. Probably your script is accessing a configuration item that does not exist. You need to debug that, one way or another. I have to admit that it is not that easy with RouterOS sometimes.

Important is that sripts are working. Will fight with syntax to tune them later :-)

pe1chl · Thu May 30, 2024 5:19 pm

woooa
CHR, 7.14.3 -> 7.15
free memory decreased significantly

Always read the release notes before you install!

whatever · Thu May 30, 2024 5:36 pm

I decided to skip 7.14, but 7.15 appears to be worth updating. Great changelog.

infabo · Thu May 30, 2024 5:50 pm

woooa
CHR, 7.14.3 -> 7.15
free memory decreased significantly

Probably cause of:

*) x86/chr - improved panic saving (increased minimal RAM requirements to 256MB);

mantouboji · Thu May 30, 2024 5:52 pm

A wonderful update.

SSH ed25519 private key works fine, but why must PKCS8 format?

infabo · Thu May 30, 2024 5:59 pm

hAP ax2 7.15 don't work Access List - this rule don’t work:
Code: Select all
/interface wifi access-list
add action=accept allow-signal-out-of-range=always disabled=yes signal-range=-75..0
add action=reject disabled=yes
After update to 7.15 no one can connect via WiFi

I doubt this is the reason. you pasted two disabled Access List rules.....

nithinkumar2000 · Thu May 30, 2024 6:13 pm

*) ppp - added "enable-ipv6-accounting" option under PPP AAA menu (CLI only);

But i can see the Enable IPv6 Accounting Option in Winbox itself...

Screenshot 2024-05-30 203926.png

Evgeniy29 · Thu May 30, 2024 6:26 pm

I turned them off so that wifi would work

08:87:C7:54:87:F8@wifi1 associated, signal strength 37
08:87:C7:54:87:F8@wifi1 connected, signal strength 37
1C:57:DC:6C:C6:BA@wifi1 associated, signal strength 59
1C:57:DC:6C:C6:BA@wifi1 connected, signal strength 59

in the log the signal strength is greater than zero, but should be less.

hAP ax2 7.15 don't work Access List - this rule don’t work:
Code: Select all
/interface wifi access-list
add action=accept allow-signal-out-of-range=always disabled=yes signal-range=-75..0
add action=reject disabled=yes
After update to 7.15 no one can connect via WiFi
I doubt this is the reason. you pasted two disabled Access List rules.....

Kanzler · Thu May 30, 2024 6:39 pm

@Evgeniy29

viewtopic.php?t=206877#p1075214
viewtopic.php?t=206877&start=300#p1077122

This problem was still in beta version

Evgeniy29 · Thu May 30, 2024 6:51 pm

The wifi driver in the new ROS does not display the connection signal level correctly.

@Evgeniy29

viewtopic.php?t=206877#p1075214
viewtopic.php?t=206877&start=300#p1077122

This problem was still in beta version

Thu May 30, 2024 7:12 pm

@eworm - You are probably right, but how to find where is the specific syntax error, to be able to fix it. Scripts do all what is required and only say check manualy

Use CLI ... navigate to scripts and then "print" them and the error would be highlited/reported in terminal ... strange synteax checking but better that than nothing

netravnen · Thu May 30, 2024 7:19 pm

*) ptp - added PTP support for CCR2116 device;

:)

[admin@ccr2116] > /system/ptp
bad command name ptp (line 1 column 9)

:-(

The PTP functionality seems to not be accessible in neither Winbox, nor the CLI...

[admin@ccr2116] > /system/routerboard/print 
       routerboard: yes
             model: CCR2116-12G-4S+
     serial-number: ***********
     firmware-type: al64v3
  factory-firmware: 7.8
  current-firmware: 7.15
  upgrade-firmware: 7.15

[admin@ccr2116] > /system/package/print proplist=name,version where name=routeros
Columns: NAME, VERSION
# NAME      VERSION
5 routeros  7.15

infabo · Thu May 30, 2024 8:45 pm

@Evgeniy29

viewtopic.php?t=206877#p1075214
viewtopic.php?t=206877&start=300#p1077122

This problem was still in beta version

another one:

viewtopic.php?t=206877&start=300#p1077877

Screenshot_20240530-194820.png

ivicask · Thu May 30, 2024 9:15 pm

I also have positive signal strenghts issue and roaming is messed up, multiple devices randomly roam from 5ghz to 2ghz 1-2m from ap under full signal(below -40 db ) and then hang on 2ghz, which makes no sense and never had such issues on prev versions.

m4rk3J · Thu May 30, 2024 9:33 pm

AX HW or older ARM AC with wave2 drivers?

ivicask · Thu May 30, 2024 10:12 pm

AX HW or older ARM AC with wave2 drivers?

Hap ax3

PhilB · Thu May 30, 2024 11:02 pm

*) route - do not redistribute loopback address as connected route;

Good lord, why? Why would you do this?

You introduce loopbacks just long enough ago that a bunch of people will have started using them, the vast majority of them will have been configured to be redistributed, and now... they're no longer part of "connected" routes? What are they if not connected? How do you envisage upgrading to this version if you're already relying on loopbacks being redistributed? Who on earth asked for this when as far as I know every other vendor treats loopbacks as connected?

FezzFest · Thu May 30, 2024 11:06 pm

@PhilB, that's exactly what I was thinking. Since v7.14 we finally have a real loopback interface, one release later it's being stripped of its functionality. Guess I'll keep using bridges then?

mrz · Thu May 30, 2024 11:21 pm

??? How not distributing 127.0.0.1 address is "stripping functionality"? It does not even make sense to distribute 127.0.0.1, it is called "localhost" for a reason.

pe1chl · Thu May 30, 2024 11:36 pm

??? How not distributing 127.0.0.1 address is "stripping functionality"? It does not even make sense to distribute 127.0.0.1, it is called "localhost" for a reason.

When you are not distributing 127.0.0.1, you should have written that.
Loopback address is ambiguous as it can refer to the address of the loopback interface, which now can have other addresses than 127.0.0.1 as well.

FezzFest · Thu May 30, 2024 11:49 pm

@mrz: if it's only 127.0.0.1 you're no longer distributing, it makes total sense and my comment/complaint is not applicable.
As @pe1chl mentioned you might want to clarify that changelog entry though:

*) route - do not redistribute 127.0.0.1 as connected route;

Jotne · Fri May 31, 2024 12:00 am

After Long Wait ROS v7.15 with huge change log is here

247 listed. Exactly the same as in 7.14 ;)

optio · Fri May 31, 2024 12:38 am

:retrun command called from script (eg. :return ""), not inside function, used to exit script if some condition matches where script doesn't need to continue executing generates error log "executing script <script_name> from <winbox|scheduler> failed, please check it manually", from terminal doesn't produce error, eg:

{:return ""}

or:

:do {:return ""} on-error={:put error}

Error is not printed.
I had to mute script,error topic to avoid log bloat with these log records mainly generated from short interval schedulers. Please fix this.

PhilB · Fri May 31, 2024 3:13 am

??? How not distributing 127.0.0.1 address is "stripping functionality"? It does not even make sense to distribute 127.0.0.1, it is called "localhost" for a reason.

as others have said, if the changelog entry really means "we won't redistribute 127.0.0.1 as a connected route" then the changelog needs to say specifically that, because now that you have the loopback interface type, "loopback address" is extremely ambiguous!

sirbryan · Fri May 31, 2024 5:36 am

??? How not distributing 127.0.0.1 address is "stripping functionality"? It does not even make sense to distribute 127.0.0.1, it is called "localhost" for a reason.
as others have said, if the changelog entry really means "we won't redistribute 127.0.0.1 as a connected route" then the changelog needs to say specifically that, because now that you have the loopback interface type, "loopback address" is extremely ambiguous!

Seriously, guys, cut them a little slack. Google "Loopback address" and >90% of the results refer to 127.0.0.1 (and a couple to ::1). You'll note that the terse changelog entry said "loopback address" singular, as in the loopback address. It didn't say "loopback interface" or "loopback addresses" or "addresses assigned to loopback."

Besides, had this been a real issue, it would have broken things pretty quickly during the beta cycle.

Fri May 31, 2024 7:35 am

The issue with wifi access-list or in other words, wrong signal levels recognised at the beginning of wifi client connection, has been reproduced, and we will solve it as soon as possible. We are very sorry for any inconvenience caused.

loloski · Fri May 31, 2024 7:36 am

if you have OSPF and assign some local address like 10.255.255.1/32 on loopback (lo) interface this is connected route is this allowed or not? or just the hardcoded (127.0.0.1) is not allowed?

Kanzler · Fri May 31, 2024 8:09 am

@loloski
just 127.0.0.1

Jotne · Fri May 31, 2024 8:17 am

Exciting release packed with updates and bug fixes. My whole fleet of routers (30+, various architectures) updated successfully, and good to see over 700kb of free space on my hAP ac2 (from around 300kb on 7.14.3)
Good job dev team :D
Updating an entire fleet of routers within 2 hours after release of a .0 release?
I hope it is a test network...

Here is one example why I do wait some weeks before upgrade more that some test devices

The issue with wifi access-list or in other words, wrong signal levels recognized at the beginning of wifi client connection, has been reproduced, and we will solve it as soon as possible. We are very sorry for any inconvenience caused.

This is far from the first time some are broken on the first releases of new version.

DjM · Fri May 31, 2024 8:20 am

Hello MikroTik team,

Was the REST API user logout issue solved, please? - topic is discussed here: viewtopic.php?t=207040 , unfortunatelly there was no reply with SUP ticket ID.

Thank you

Update:
Topic will be solved in 7.16.

baragoon · Fri May 31, 2024 8:39 am

@loloski
just 127.0.0.1

What about ::1 ?

Kanzler · Fri May 31, 2024 8:40 am

Are there problems with the access list only in the wifi-qcom driver, or in the others too?

Kanzler · Fri May 31, 2024 8:41 am

@baragoon
If I understand correctly, then there too.
That is, localhost in general

brandaoeb · Fri May 31, 2024 9:56 am

Scripts error is very annoying .... :( and dificult to check :( at least for me.

Fri May 31, 2024 10:20 am

@netravnen, thanks for letting us know. The PTP for CCR2116 devices will be available starting from v7.16.

pe1chl · Fri May 31, 2024 10:40 am

Seriously, guys, cut them a little slack. Google "Loopback address" and >90% of the results refer to 127.0.0.1 (and a couple to ::1).

Well, generally that is what is referred to as "the loopback address".
But in certain circles, certainly the users of OSPF, it is popular to refer to "the loopback address" as a unique address put on each router to have a static and unique address on each router, which is beneficial to the stability/managability of the routing protocol.
As in this case the change log entry is related to the routing, I am not at all surprised that people are confused.

Jörg · Fri May 31, 2024 11:26 am

Hello,
I have to say that after the update my WIFI devices connect much much much better!!! I have three cAPGi-5HaxD2HaxD
Roaming also works better now.
Devices that previously only knew 2 GHz now connect stably to 5 GHz

@ Mikrotik Support - really GREAT WORK!!!

But one device (a Samsung washer) cannot log into the WIFI network. It couldn't do that in any of the older versions either.
Here is a log from 25 seconds:

# 2024-05-31 10:16:46 by RouterOS 7.15
# software id = UGTZ-ZKF4
#
 08:50:35 wireless,info 88:57:1D:4C:9A:B1@A6-CAPax--KG-FL--2-GHz-6 connected, signal strength -47
 08:50:35 dhcp,info dhcp-VLAN32 assigned 10.18.32.51 for 88:57:1D:4C:9A:B1 Samsung-Washer
 08:50:35 script,info DHCP2DNS: registering static domain name Waschmaschine-Samsung-KG-Kueche.32.hnet for address 10.18.32.51 with ttl 00:05:00
 08:50:35 system,info static dns entry added by script:dhcp-lease-script (*30BE3 = /ip dns static add address=10.18.32.51 comment=#DHCP disabled=no name=Waschmaschine-Samsung-KG-Kueche.32.hnet ttl=5m)
 08:50:37 wireless,info 88:57:1D:4C:9A:B1@A6-CAPax--KG-FL--2-GHz-6 disconnected, connection lost, signal strength -47
 08:50:40 wireless,info 88:57:1D:4C:9A:B1@A6-CAPax--KG-FL--2-GHz-6 connected, signal strength -48
 08:50:40 dhcp,info dhcp-VLAN32 deassigned 10.18.32.51 for 88:57:1D:4C:9A:B1 Samsung-Washer
 08:50:40 script,info DHCP2DNS: removing static domain name(s) for address 10.18.32.51
 08:50:40 system,info static dns entry removed by script:dhcp-lease-script/action:5804 (/ip dns static remove *30BE3)
 08:50:40 dhcp,info dhcp-VLAN32 assigned 10.18.32.51 for 88:57:1D:4C:9A:B1 Samsung-Washer
 08:50:40 script,info DHCP2DNS: registering static domain name Waschmaschine-Samsung-KG-Kueche.32.hnet for address 10.18.32.51 with ttl 00:05:00
 08:50:40 system,info static dns entry added by script:dhcp-lease-script (*30BE4 = /ip dns static add address=10.18.32.51 comment=#DHCP disabled=no name=Waschmaschine-Samsung-KG-Kueche.32.hnet ttl=5m)
 08:50:42 wireless,info 88:57:1D:4C:9A:B1@A6-CAPax--KG-FL--2-GHz-6 disconnected, connection lost, signal strength -48
 08:50:46 wireless,info 88:57:1D:4C:9A:B1@A6-CAPax--KG-FL--2-GHz-6 connected, signal strength -48
 08:50:46 dhcp,info dhcp-VLAN32 deassigned 10.18.32.51 for 88:57:1D:4C:9A:B1 Samsung-Washer
 08:50:46 script,info DHCP2DNS: removing static domain name(s) for address 10.18.32.51
 08:50:46 system,info static dns entry removed by script:dhcp-lease-script/action:5805 (/ip dns static remove *30BE4)
 08:50:46 dhcp,info dhcp-VLAN32 assigned 10.18.32.51 for 88:57:1D:4C:9A:B1 Samsung-Washer
 08:50:46 script,info DHCP2DNS: registering static domain name Waschmaschine-Samsung-KG-Kueche.32.hnet for address 10.18.32.51 with ttl 00:05:00
 08:50:46 system,info static dns entry added by script:dhcp-lease-script (*30BE5 = /ip dns static add address=10.18.32.51 comment=#DHCP disabled=no name=Waschmaschine-Samsung-KG-Kueche.32.hnet ttl=5m)
 08:50:48 wireless,info 88:57:1D:4C:9A:B1@A6-CAPax--KG-FL--2-GHz-6 disconnected, connection lost, signal strength -47
 08:50:52 wireless,info 88:57:1D:4C:9A:B1@A6-CAPax--KG-FL--2-GHz-6 connected, signal strength -47
 08:50:53 dhcp,info dhcp-VLAN32 deassigned 10.18.32.51 for 88:57:1D:4C:9A:B1 Samsung-Washer
 08:50:53 script,info DHCP2DNS: removing static domain name(s) for address 10.18.32.51
 08:50:53 system,info static dns entry removed by script:dhcp-lease-script/action:5806 (/ip dns static remove *30BE5)
 08:50:53 dhcp,info dhcp-VLAN32 assigned 10.18.32.51 for 88:57:1D:4C:9A:B1 Samsung-Washer
 08:50:53 script,info DHCP2DNS: registering static domain name Waschmaschine-Samsung-KG-Kueche.32.hnet for address 10.18.32.51 with ttl 00:05:00
 08:50:53 system,info static dns entry added by script:dhcp-lease-script (*30BE6 = /ip dns static add address=10.18.32.51 comment=#DHCP disabled=no name=Waschmaschine-Samsung-KG-Kueche.32.hnet ttl=5m)
 08:50:55 wireless,info 88:57:1D:4C:9A:B1@A6-CAPax--KG-FL--2-GHz-6 disconnected, connection lost, signal strength -49
 08:50:59 wireless,info 88:57:1D:4C:9A:B1@A6-CAPax--KG-FL--2-GHz-6 connected, signal strength -46
 08:50:59 dhcp,info dhcp-VLAN32 deassigned 10.18.32.51 for 88:57:1D:4C:9A:B1 Samsung-Washer
 08:50:59 script,info DHCP2DNS: removing static domain name(s) for address 10.18.32.51
 08:50:59 system,info static dns entry removed by script:dhcp-lease-script/action:5807 (/ip dns static remove *30BE6)
 08:50:59 dhcp,info dhcp-VLAN32 assigned 10.18.32.51 for 88:57:1D:4C:9A:B1 Samsung-Washer
 08:50:59 script,info DHCP2DNS: registering static domain name Waschmaschine-Samsung-KG-Kueche.32.hnet for address 10.18.32.51 with ttl 00:05:00
 08:50:59 system,info static dns entry added by script:dhcp-lease-script (*30BE7 = /ip dns static add address=10.18.32.51 comment=#DHCP disabled=no name=Waschmaschine-Samsung-KG-Kueche.32.hnet ttl=5m)

Is there anything you can do about it?

Best regards Jörg

deadmaus911 · Fri May 31, 2024 11:32 am

Nice work!
But, after rebooting the router, the adlist does not load again and it stops working.
Also please specify what memory is used at the moment of adlist loading. I noticed that at the moment of booting, the number in the Sector write since reboot has been increased

mantouboji · Fri May 31, 2024 12:14 pm

In here: https://help.mikrotik.com/docs/display/ ... rivatekeys

you say the private key supports both PEM and PKCS#8 format.

But in fact , 7.15 can only import ED25519 private key in PKCS#8 format, no PEM .

WeWiNet · Fri May 31, 2024 12:22 pm

I turned them off so that wifi would work

08:87:C7:54:87:F8@wifi1 associated, signal strength 37
08:87:C7:54:87:F8@wifi1 connected, signal strength 37
1C:57:DC:6C:C6:BA@wifi1 associated, signal strength 59
1C:57:DC:6C:C6:BA@wifi1 connected, signal strength 59

in the log the signal strength is greater than zero, but should be less.

I doubt this is the reason. you pasted two disabled Access List rules.....

The signal range does nothing, as you allow it "ALWAYS" to be out of range. So whatever the signal range is, this rule will work...

infabo · Fri May 31, 2024 1:12 pm

"allow-signal-out-of-range (time period | 'always')
The length of time which a connected peer's signal strength is allowed to be outside the range required by the signal-range parameter, before it is disconnected.

If the value is set to 'always', peer signal strength is only checked during association."
https://help.mikrotik.com/docs/display/ ... 2Drange%20(,strength%20is%20only%20checked%20during%20association.

ntokos · Fri May 31, 2024 1:13 pm

*) winbox - renamed "Channel" column to "Current Channel" under "Wifi" menu;

A similar change is needed for the "Tx Power" column, currently there are two columns with the same name which results in empty data if you reopen the WiFi window.

pe1chl · Fri May 31, 2024 2:02 pm

*) winbox - renamed "Channel" column to "Current Channel" under "Wifi" menu;
A similar change is needed for the "Tx Power" column, currently there are two columns with the same name which results in empty data if you reopen the WiFi window.

There are many such cases in RouterOS/Winbox! There really should be someone who walks along all property lists and weeds them out.

Fri May 31, 2024 2:04 pm

FWIW upgraded home capsman setup with RB5009 / AX3 / AX2 / AXLite and a separate mAP.
No problems on any of those devices.

Not even with positive signal levels

pe1chl · Fri May 31, 2024 2:04 pm

But one device (a Samsung washer) cannot log into the WIFI network. It couldn't do that in any of the older versions either.
Is there anything you can do about it?

Turn off fast roaming support... that usually fixes connection problems for old or simple devices.
You can create another SSID for only those devices and leave fast roaming on the primary network.

infabo · Fri May 31, 2024 2:29 pm

I observed this positive signal thing already some time ago on 7.13. viewtopic.php?t=205815

aindless · Fri May 31, 2024 2:33 pm

I did play around with Adlist a bit but, if what I've read is correct, it doesn't work when DoH is enabled and it also consumes a lot of RAM.

The Big OISD recommended list consumes ~ 31 MB of ram.

Johann1525 · Fri May 31, 2024 2:33 pm

Hi,

i know this is kind of cosmetic.
Some time ago i filed SUP135576. It was closed with the answer, that this behavior will be fixed in some upcoming version. Unfortunately it seems to persist in this Version.
I think /ping and traceroute should behave like in other OSs so troubleshooting will be more straight forward. And the response is also kind of false.
Since ping can do IPv6 a AAAA should be a appropriate record.

Currently its like this:

[johann@hap1] > :put [:resolve ipv4.ipv64.net] 
144.76.85.238
[johann@hap1] > :put [:resolve ipv6.ipv64.net] 
2a01:4f8:192:1326::bad:c0de
[johann@hap1] > ping ipv4.ipv64.net           
  SEQ HOST                                     SIZE TTL TIME       STATUS                                                                                    
    0 144.76.85.238                              56  56 72ms269us 
    1 144.76.85.238                              56  56 72ms587us 
    2 144.76.85.238                              56  56 72ms662us 
    sent=3 received=3 packet-loss=0% min-rtt=72ms269us avg-rtt=72ms506us max-rtt=72ms662us 

[johann@hap1] > ping 2a01:4f8:192:1326::bad:c0de
  SEQ HOST                                     SIZE TTL TIME       STATUS                                                                                    
    0 2a01:4f8:192:1326::bad:c0de                56  58 17ms516us  echo reply                                                                                
    1 2a01:4f8:192:1326::bad:c0de                56  58 17ms93us   echo reply                                                                                
    2 2a01:4f8:192:1326::bad:c0de                56  58 17ms252us  echo reply                                                                                
    sent=3 received=3 packet-loss=0% min-rtt=17ms93us avg-rtt=17ms287us max-rtt=17ms516us 

[johann@hap1] > ping ipv6.ipv64.net              
invalid value for argument address:
    invalid value of mac-address, mac address required
    invalid value for argument ipv6-address
    failure: dns name exists, but no appropriate record
[johann@hap1] >

Thank you very much for looking into this and the awesome work in this release.

h1ghrise · Fri May 31, 2024 2:54 pm

*) smb - do not allow setting empty "comment" or "domain" properties;

Does this include fix to SUP-146116 (RB5009 crashes when accessing SMB share)?

Ca6ko · Fri May 31, 2024 3:32 pm

hAP ax2 7.15 don't work Access List - this rule don’t work:

/interface wifi access-list
add action=accept allow-signal-out-of-range=always signal-range=-75..0
add action=reject

After update to 7.15 no one can connect via WiFi

Setting signal-range=-75..120 should solve the problem

pe1chl · Fri May 31, 2024 3:39 pm

Setting signal-range=-75..120 should solve the problem

I am surprised that people do not have that already. In the manual it says that the default range is -120..120 so I would expect that one starts from there.
However, there appears to be a (new?) bug as now, when creating a new access rule with signal level, the initial range is 0..0.
That is of course not good. It looks like this bug was introduced with the wifi-qcom drivers.

Ernst · Fri May 31, 2024 4:01 pm

!) system - added support for AMPERE (R) and ARM64 CHR installations (new ARM64 CHR image available);

--> So ROS will run on Raspberry Pi? That would be nice :)

Fri May 31, 2024 4:12 pm

i updated some CRS-317 switches from 7.12.1 to 7.15 without problem, and enabled qos-hw-offloading just to see the counters with default configuration and all good
but
One switch which had the following ACL on interface towards provider cease to forward traffic on that interface after enabling qos-hw-offloading

/interface ethernet switch rule
add dst-mac-address=01:80:C2:00:00:00/FF:FF:FF:FF:FF:FF new-dst-ports="" ports=sfp-8 switch=switch1

started to show sfp-8:0 discarding sfp-8:0 learning in logs

just disabling qos-hw-offloading issuing the following command solves the situation

interface/ethernet/switch/set qos-hw-offloading=no switch1

sorry i dont tried removing that ACL to test, but thats the only relevant difference in config between the switch which presented the issue and other switch

mkx · Fri May 31, 2024 4:31 pm

!) system - added support for AMPERE (R) and ARM64 CHR installations (new ARM64 CHR image available);
--> So ROS will run on Raspberry Pi? That would be nice :)

As long as your R Pi runs a hypervisor (CHRs run as virtual machines, not on bare metal).

krafg · Fri May 31, 2024 5:00 pm

Upgraded without issues.

Thanks and regards.

sergiot77 · Fri May 31, 2024 6:52 pm

I try today v7.15 on 3 different 4011.
VPLS vs 7.14 2216 doesn't go running.
After dowgrade it to 7.14 interface goes up with no configuration change.
Anyone noticed this issue?

kiboi · Fri May 31, 2024 7:48 pm

RB4011iGS+ seems to shut ethernet ports randomly.
CRS518CRS518-16XS-2XQ, CRS326-24S+2Q+, and CRS106-1C-5S are experiencing lags, timeouts, and reduced throughput
Downgrade back to 7.14.3 all fine is fine.

Jörg · Fri May 31, 2024 8:05 pm

Turn off fast roaming support... that usually fixes connection problems for old or simple devices.
You can create another SSID for only those devices and leave fast roaming on the primary network.

Hello pe1chl,
Thank you very much for your help!
But the log posted is with a single CAP, with a single SSID and without roaming.
I've had the CAPs since late last summer. Since then I've read tons of forum posts, wikis, user manuals and watched videos. I've tried all of the tips recommended there. ALL of them didn't work. The device won't log into the WIFI with a CAP.
This isn't a problem with the configuration, it's a problem that only Mikrotik support can solve.
By the way, the washer connects to an AVM Fritzbox 7590 or 7530 without the slightest problem.

Best regards, Jörg

Jörg · Fri May 31, 2024 8:14 pm

RB4011iGS+ seems to shut ethernet ports randomly.

I have the same device and that's why I checked specifically; I haven't seen any port failure for about 18 hours.

best regards
Jörg

vovan700i · Fri May 31, 2024 8:46 pm

!) system - added support for AMPERE (R) and ARM64 CHR installations (new ARM64 CHR image available);
--> So ROS will run on Raspberry Pi? That would be nice :)

Does it also mean ZeroTier finally comes to CHR? Has anybody tried to install zerotier.npk on ARM64 CHR?

cashwu · Fri May 31, 2024 8:56 pm

CHR：
/system/routerboard disappeared?

nmt1900 · Fri May 31, 2024 9:03 pm

hAP ax2 7.15 don't work Access List - this rule don’t work:

/interface wifi access-list
add action=accept allow-signal-out-of-range=always signal-range=-75..0
add action=reject

After update to 7.15 no one can connect via WiFi
Setting signal-range=-75..120 should solve the problem

If you want to reject connections when signal level is under -75 dBm, then only one rule should be needed which rejects signals in range -120..-75. Anything not matching the rule would be accepted.

signal-range=-120..-75 allow-signal-out-of-range=10s ssid-regexp="" action=reject

mp3turbo · Fri May 31, 2024 9:30 pm

>> RB4011iGS+ seems to shut ethernet ports randomly.
>> CRS518CRS518-16XS-2XQ, CRS326-24S+2Q+, and CRS106-1C-5S are experiencing lags, timeouts, and reduced throughput

most likely it's something in your configuration ; these are too much different hardware and would be already reported by massive amounts of people.
Dare to say more or post configuration without private/sensitive data ?

mozerd · Fri May 31, 2024 9:39 pm

CCR1009 RoS v 7.15 stable
All my scripts shown below run without error when launched from scripts or CLI or from scheduler under RoS 7.14.2

Under RoS 7.15 if they are launched from scheduler I get an error in log to check manually … when run from scripts or CLI no issue

I have a STARTUP script
:delay 10
/system script run dynu
:delay 5
/system script run roguevpn
:delay 5
/system script run RogueIP
:delay 5
/system script run pulldiff
:delay 5
/system script run fileiptik

DL7JP · Fri May 31, 2024 10:47 pm

CCR1009 RoS v 7.15 stable
All my scripts shown below run without error when launched from scripts or CLI or from scheduler under RoS 7.14.2

Under RoS 7.15 if they are launched from scheduler I get an error in log to check manually … when run from scripts or CLI no issue

Same here, but not consistently each time it runs, just occasionally.

Network5 · Fri May 31, 2024 11:06 pm

I try today v7.15 on 3 different 4011.
VPLS vs 7.14 2216 doesn't go running.
After dowgrade it to 7.14 interface goes up with no configuration change.
Anyone noticed this issue?

We had to disable MPLS on all our 2216 because of substantial packet drops on 7.14.3. The VPLS tunnels were running but unusable due to packet loss, which was also present in packets routed on the core network. We are still investigating, cause the issue is present only on 2216. There has been no reply from support jet.

DL7JP · Sat Jun 01, 2024 2:22 am

Something is weird with 7.15: I had lots of dropped packet on some ports on a RB1100AHx4, downgrading to 7.14.3 solved the problem. This happened after the router ran for several hours on 7.15. Re-booting did not help. Very weird - I did not investigate it in more details, since it more or less brought down the whole LAN.

The warning about checking the script execution manually also disappeared after downgrading to 7.14.3.

narapon · Sat Jun 01, 2024 6:45 am

Disappointed not to see a router fix for wireguard coming in on WAN2 when WAN2 is secondary WAN and mangling this traffic does not work.

Disappointed too, tried mangling and route rules, all goes back to main route table, hope to see this in the next release!

t0mm13b · Sat Jun 01, 2024 11:01 am

Any chateau LTE 12 users with 16Mb flash upgraded to this release?

davetickem · Sat Jun 01, 2024 11:22 am

RB4011iGS+ seems to shut ethernet ports randomly.
...

Upgraded a pair of RB4011 here, selected as one is original and other is a rev2. Ethernet ports stable for 24 hours - early days. Will keep monitoring ...

ps. off topic I know, but anyone else experience the rev2 rb4011 running about 10deg cooler? (al31400 vs al21400 ? )

optio · Sat Jun 01, 2024 12:35 pm

Any chateau LTE 12 users with 16Mb flash upgraded to this release?

I did, only issue I have so far is this. I'm still using legacy wireless package since I was unable to install combination of wifi-qcom-ac with containers and larger custom config on 16MB device. Now I noticed that some space is freed (approx. 450KiB free before, now 1040 KiB) and maybe wifi-qcom-ac will fit now, will try it when I find time.

Sit75 · Sat Jun 01, 2024 1:03 pm

Did you fix the memory leak issue in 7.15 final? I'm still running 7.15RC3 to prove to this forum that RouterOS 7.x has a SERIOUS memory problem for the non-believers. Now after about 18 days I only have 15.8 MiB memory free (from 256 MiB). And the memory constantly and regularly decreases.

Cha0s · Sat Jun 01, 2024 1:11 pm

There seems to be stability issues with Chateau 5G after modem firmware and ROS upgrade.

After upgrading the modem firmware to the latest version along with upgrading to ROS v7.15 the modem has become very unstable with either randomly resetting itself with error “lte1 mbim: modem's control interface have reset (4)” in the logs or with completely getting into an invalid state with repeated “lte1: no response for: AT E0 V1” errors in the log and needing to restart the whole device to recover itself.

[SUP-154766]

On every other device that I've installed v7.15 (CCR2116, CCR2004, CCR1036, CRS326, CRS318, RB5009, RB4011, RB3011, hAP Lite, CHR), I've got no issues whatsoever.

entepcetfevo · Sat Jun 01, 2024 1:40 pm

hAP ax3, 7.15 and Chromecast strange behaviour.
When I cast a movie from my smartphone to my TV via Chromecast, in a few seconds —no more than 10–20 seconds— all the WiFi devices in the house get disconnected. I mean all of them, 2 phones, 1 laptop and Chromecast itself.
Downgrading to 7.14.3 solved the problem.

Sat Jun 01, 2024 1:53 pm

No such issue here with ax2/ax3 and Chromecast ?

templeos · Sat Jun 01, 2024 2:22 pm

There seems to be stability issues with Chateau 5G after modem firmware and ROS upgrade.

I also noticed that there's a firmware upgrade for RG502Q-EA. From RG502QEAAAR13A03M4G_02.001.02.001 to RG502QEAAAR13A03M4G_02.002.02.002

No mention in the changelog as always, I haven't upgraded yet.

Cha0s · Sat Jun 01, 2024 2:51 pm

Anyone has a link for the previous firmware version RG502QEAAAR13A03M4G_02.001.02.001 so I can downgrade?

optio · Sat Jun 01, 2024 3:11 pm

Anyone has a link for the previous firmware version RG502QEAAAR13A03M4G_02.001.02.001 so I can downgrade?

https://upgrade.mikrotik.com/firmware/R ... .001/image
Double check if RG502Q-EA is correct modem model on your device.

JL2000 · Sat Jun 01, 2024 3:54 pm

#anav, #narapon, #Guscht, im also waiting for this fix.

In the meantime i'm using workaround to force wireguard traffic getting response from WAN2 if it was intiali send to WAN2. So you can say that there is a way to get properly working wireguard wtih two wan's which allows some users by contected to wan1 and some to wan2 in same time. It's done by mangle rules with little trick/hack. Tested on ROS 7.12 and below, gonna test it next week on 7.15, i'm almost sure its still gonna work.

Cha0s · Sat Jun 01, 2024 5:31 pm

Anyone has a link for the previous firmware version RG502QEAAAR13A03M4G_02.001.02.001 so I can downgrade?
https://upgrade.mikrotik.com/firmware/R ... .001/image
Double check if RG502Q-EA is correct modem model on your device.

Thanks!

Sit75 · Sat Jun 01, 2024 5:56 pm

Did you fix the memory leak issue in 7.15 final? I'm still running 7.15RC3 to prove to this forum that RouterOS 7.x has a SERIOUS memory problem for the non-believers. Now after about 18 days I only have 15.8 MiB memory free (from 256 MiB). And the memory constantly and regularly decreases.

Small memory leak update. The kernel crashed apparently out of memory with the autosupout.rif file generated. I uploaded it to an existing open ticket SUP-147911. I hope Mikrotik engineers find the cause and fix it.

jaxed7 · Sat Jun 01, 2024 7:44 pm

jspool · Sat Jun 01, 2024 7:50 pm

MQTT no longer works after upgrade to 7.15

qatar2022 · Sat Jun 01, 2024 8:41 pm

Disappointed IOT does not get connection to the internet and when I downgrade to 7.14.3 connected again to the internet

narapon · Sat Jun 01, 2024 11:20 pm

#anav, #narapon, #Guscht, im also waiting for this fix.

In the meantime i'm using workaround to force wireguard traffic getting response from WAN2 if it was intiali send to WAN2. So you can say that there is a way to get properly working wireguard wtih two wan's which allows some users by contected to wan1 and some to wan2 in same time. It's done by mangle rules with little trick/hack. Tested on ROS 7.12 and below, gonna test it next week on 7.15, i'm almost sure its still gonna work.

Do show us how you did it, i'll try it out on 7.15 too to see if it works the same

Cha0s · Sun Jun 02, 2024 12:36 am

Anyone has a link for the previous firmware version RG502QEAAAR13A03M4G_02.001.02.001 so I can downgrade?
https://upgrade.mikrotik.com/firmware/R ... .001/image
Double check if RG502Q-EA is correct modem model on your device.

Unfortunately I cannot get it to downgrade.
It downloads the firmware, it starts installing it and then the interface goes in invalid state and it never recovers. After a reboot the newest firmware is still installed.

 > /interface/lte/firmware-upgrade lte1 upgrade=yes firmware-file="https://upgrade.mikrotik.com/firmware/RG502Q-EA/RG502QEAAAR13A03M4G_02.001.02.001/image"
  status: firmware timeout

optio · Sun Jun 02, 2024 1:36 am

Unfortunately I cannot get it to downgrade.
It downloads the firmware, it starts installing it and then the interface goes in invalid state and it never recovers. After a reboot the newest firmware is still installed.

Did you try download image with fetch and set image filename for firmware-file instead url?

Cha0s · Sun Jun 02, 2024 1:46 am

Yes I tried it that way too but the result is the same.
I also tried downgrading to 7.14.3 and then trying to downgrade the firmware but no luck either.

In fact, on 7.14.3 the interface lte1 instead of going into an invalid state, it completely disappears.
Some times it gets back on its own after a few minutes, or... not.

One thing I noticed, is that after a fresh boot, if I never open the lte1 interface on winbox, it seems more stable, as in it doesn't disconnect or disappears so often.

jsadler · Sun Jun 02, 2024 2:08 am

Since (probably) 7.15 the ‘Board Temperature’ of the KNOT (RB924i-2nD-BT5&BG77) is being reported as 0 degrees at all times.

I know it was OK at 7.13, I think it was OK at 7.14.3 but don’t have a screenshot. It is broken at 7.15.

See screenshots...
https://imgur.com/a/cs218RW

eguun · Sun Jun 02, 2024 12:10 pm

@eworm - You are probably right, but how to find where is the specific syntax error, to be able to fix it. Scripts do all what is required and only say check manualy :-)
It's not about syntax errors, but runtime errors. Probably your script is accessing a configuration item that does not exist. You need to debug that, one way or another. I have to admit that it is not that easy with RouterOS sometimes.

thanks eworm for this pointer, was facing those errors popping up since 7.15 upgrade.

on my end it's because some of my scripts were testing conditions (with 'if') and if condition met, then would quit the script by calling ':error'
This was to avoid many nested if: instead of nesting if conditions to execute the desired code (and many tabs), I prefixed the desired code with exit conditions.
With 7.15, using ':error' or ':quit' in a script run with scheduler triggers this log warning.

I wish routerOS would have a simple break command in a script that we can call without triggering an error

optio · Sun Jun 02, 2024 1:19 pm

I agree, commands like :error, :quit, :return are valid and it should not produce such error in log.

Pudpoh · Sun Jun 02, 2024 1:22 pm

There seems to be stability issues with Chateau 5G after modem firmware and ROS upgrade.
I also noticed that there's a firmware upgrade for RG502Q-EA. From RG502QEAAAR13A03M4G_02.001.02.001 to RG502QEAAAR13A03M4G_02.002.02.002

No mention in the changelog as always, I haven't upgraded yet.

I upgraded to this modem version with my chateau 5g and use three UK, aggregates b1 + b3 +n78@100mhz +n78@40mhz. Still on 7.13.5, I've not upgraded to 7.15 yet, waiting for other with 16mb flash devices to go first.

m4rk3J · Sun Jun 02, 2024 3:58 pm

OK, so the signal strength indicator has been broken in wifi-qcom-ac since day one and now it's also broken in the .ax drivers? Okay :D

This is how it looks for me - RB4011 as capsman controller, cAP ac as Wi-Fi APs. ROS 7.15. Signals just.. it doesn't make sense.

ac_signal.png

leonardogyn · Sun Jun 02, 2024 5:03 pm

upgrading from 7.14.3 to 7.15 completely broke my webfig skin configs, on all (really, ALL) my MK routers (different models)

backup from 7.14.3:
/user group set full skin=wifiquefunciona7

after upgrading to 7.15
/user group set full skin=*12C

of course the wifiquefunciona7.json file is still there, untouched

on most routers (lots of RB2011s, some 3011s and some 4011s and different CCRs), i could simply choose the skin again, and everything was OK. However, on RB750Gr3, I really cannot select the skin. File is there (where it should be), but not selectable via webfig/winbox. Via CLI, gives me an error.

My experience: upgrading 7.15 completely screwed skin configurations on ALL MK routers and, on RB750GR3, it cannot even be configured anymore (yes, tried rebooting quite a few times), redownloaded the file, everything ... it's just not working on RB750Gr3. I cannot reselect the skin despite everything that made it work previously (like rebooting)

EDIT: this seems to be related to the flash/ path on the RB750GR3, I downloaded my skin file to <root>/skins/wifiquefunciona7,json ... this file will NOT persist a reboot, I know. After downloading on the path without flash/ (basically memory filesystem), I could successfully selected the skin file and it worked fine. So it seems to be somehow related with the 'flash/' path required on the RB750Gr3s ... it's not working at all when skin file is placed there.

[admin@JacoCoelhoAdv] > /system/resource/print
[ .... ]
version: 7.15 (stable)
[ .... ]

[admin@JacoCoelhoAdv] > /file print where name~"skins"
 # NAME                          TYPE             SIZE CREATION-TIME
20 flash/skins                   directory             2024-06-02 10:52:13
23 flash/skins/wifiquefunciona7.json                .json file       3770 2024-06-02 10:57:15
....
[admin@JacoCoelhoAdv] > /user group set full skin=wifiquefunciona7
input does not match any value of skin
[admin@JacoCoelhoAdv] >

eworm · Sun Jun 02, 2024 5:53 pm

on my end it's because some of my scripts were testing conditions (with 'if') and if condition met, then would quit the script by calling ':error'
This was to avoid many nested if: instead of nesting if conditions to execute the desired code (and many tabs), I prefixed the desired code with exit conditions.
With 7.15, using ':error' or ':quit' in a script run with scheduler triggers this log warning.

I wish routerOS would have a simple break command in a script that we can call without triggering an error

Very true, RouterOS is lacking a lot of control structures in scripting. A proper exit command (without error!) comes to mind, elif (as a step between if and else), and possibly most important continue (or next) and break (or last or whatever) in loops.

I have a long standing issue on this topic (SUP-112102). Please open your own, the more the better.

VadiKO · Sun Jun 02, 2024 6:39 pm

Setting signal-range=-75..120 should solve the problem

What is the meaning of this rule?
I never had it, I added it and some of the devices disconnected and more not can connect. It turns out that due to insufficient signal the rule prohibits them from connecting?
It is interesting that without this rule the devices will connect and work well.

P.S. After updating to 7.15 (hAP ax3), my Wi-Fi started to drop out randomly.

YO3IPT · Sun Jun 02, 2024 7:39 pm

I have another issue with wifi, not sure if it's related to 7.15 but here is the behavior:
hAP ax3 with VLAN filtering active on the bridge and datapath VLAN configuration added in the wifi menu. I have wifi1 (master interface) set as AP with one of the datapath selected in the configuration. I have 2 more virtual AP with their respective datapath selected in the config. Up until now everything is working as it should...
However when I add one more virtual interface on the same master, but this one configured as station, without any datapath selected on it (this is needed to get internet from the on premise wireless) it is automatically added to the bridge as slave interface with a vlan ID of 1....
If I disable the datapath configuration, and manually add the wifi interfaces to the bridge with the vlan filtering set manually, obviously everything works as expected (the station interface is not added to the bridge and it connects just fine to the on premise wireless)

eguun · Sun Jun 02, 2024 9:03 pm

on my end it's because some of my scripts were testing conditions (with 'if') and if condition met, then would quit the script by calling ':error'
This was to avoid many nested if: instead of nesting if conditions to execute the desired code (and many tabs), I prefixed the desired code with exit conditions.
With 7.15, using ':error' or ':quit' in a script run with scheduler triggers this log warning.

I wish routerOS would have a simple break command in a script that we can call without triggering an error
Very true, RouterOS is lacking a lot of control structures in scripting. A proper exit command (without error!) comes to mind, elif (as a step between if and else), and possibly most important continue (or next) and break (or last or whatever) in loops.

I have a long standing issue on this topic (SUP-112102). Please open your own, the more the better.

I am growing doubtful of raising of SUP-xxx resulting in material change, as there's countless raised SUP-xxx which failed to bring routerOS on par with linux-based counterparts:

still no way to extract content from regex

can't generate certificates with EC25519 or IPSec to support DH group 31 (EC25519)

below par error handling on scripts

struggling with fixing bugs induced in previous releases: fetch still reports errors "failure: there was no content-length or transfer-encoding" in spite of fixes since 3-4 releases, similar to wireguard error "Handshake for peer did not complete after 20 attempts" when peer has no endpoint

This comes on top of the discussed issue of lacking graceful exits of scripts like "exit" or similar.

I wish so much that your SUP-xxx proves me wrong.

StupidProgrammer · Sun Jun 02, 2024 9:07 pm

P.S. After updating to 7.15 (hAP ax3), my Wi-Fi started to drop out randomly.

And this is why I'm still on 7.13 :(

Jotne · Sun Jun 02, 2024 9:33 pm

MQTT no longer works after upgrade to 7.15

I may have some to do with this:
viewtopic.php?t=207215

It was not mention in the change log, but its not the first time small changes are not mention in the log.

slav0nic · Sun Jun 02, 2024 9:35 pm

P.S. After updating to 7.15 (hAP ax3), my Wi-Fi started to drop out randomly.

same for AX2

Sun Jun 02, 2024 9:43 pm

P.S. After updating to 7.15 (hAP ax3), my Wi-Fi started to drop out randomly.
same for AX2

Ax3, ax2, ax lite ... no issues here. Nada.

blacksnow · Sun Jun 02, 2024 10:04 pm

Same no issues here (ax3, ccr2216). In general there seems to be a lot of anger towards recent releases, I think Mikrotik team is doing a decent job. Nothing is perfect and nothing ever will be, but they are consistently and regularly making updates, which is more than can be said by a lot of vendors. I wish more people would test during the beta/rc periods with their nuanced setups. I mean if you are willing to upgrade to stable and encounter issues there what's the difference between that and upgrading to beta or rc (beta/rc has never bricked a router from my experience)? Obviously I understand some people are running these routers in businesses or ISP/WISP etc. but still no room at all to do a little testing? One last thing, I recommend as part of your troubleshooting steps for any particular issue (after trying everything else) save off your config with "sensitive" and then wipe/netinstall the router to the latest stable and rebuild the config using the commands you saved off. Often times there are changes that impact older configs due to how some settings are setup and they are not updated when you update the router.

Now for some of the cool stuff, I have noticed that at heavy loads on CCR2216 the distribution of core usage for routing/networking is much better in 7.15 than it was in 7.14 and I think the biggest difference I saw was between 7.15rc4 to rc5/stable. Before maybe 4-5 cores would be active and now I see all cores active around 10-15% rather than just a few cores active at 50-60%.

ID · Sun Jun 02, 2024 10:12 pm

I wish more people would test during the beta/rc periods with their nuanced setups. I mean if you are willing to upgrade to stable and encounter issues there what's the difference between that and upgrading to beta or rc (beta/rc has never bricked a router from my experience)?

Because no one step forward and take a bullet first even stable releases. Just think about why.

VadiKO · Sun Jun 02, 2024 10:48 pm

Ax3, ax2, ax lite ... no issues here. Nada.

Ax3, have problem wi-fi, always disconnected

skrin.png

ips · Sun Jun 02, 2024 11:21 pm

Maybe related to (the already known) errors in signal levels? Do you have access list rules?

VadiKO · Sun Jun 02, 2024 11:26 pm

No, I dont have access list rules.
I also think Maybe related to (the already known) errors in signal levels

killersoft · Sun Jun 02, 2024 11:35 pm

WORKS ON RASPBERRY PI 5 WITH PROXMOX V8.1.7(arm).
Now to make it run native(ish via adding in inject uefi boot platform ) on a pi-5....
.

MIKROTIK_PI_PROXMOX.jpg

ips · Sun Jun 02, 2024 11:37 pm

I'm observing random disconnections, too. But, fortunately, I notice them only on logs, as reconnections are fast enough. I have an hap ax3 and an hap ax lite.

dvdhngs · Mon Jun 03, 2024 2:12 am

hello! well...
crs326, WITHOUT script... and:
executing script from winbox failed, please check it manually

moiskey · Mon Jun 03, 2024 3:19 am

Hello everyone
I lost the temperature and voltage reading (system > health)
CRS112-8-4S

Kentzo · Mon Jun 03, 2024 5:32 am

I think builtin SMB server causes kernel panic and reboot after certain amount of data is being transferred (it appears in the direction from the Router).

Mon Jun 03, 2024 7:37 am

viewtopic.php?t=208039&sid=9c3dc112466a ... b#p1078346

WireGuard creates a new connection when it communicates to the other end. Thus, standard load balancing will not work which handles replies, not new connections.

A possible solution would be to add-src-address to address list on new connections towards WireGuard UDP port, if received on WAN2. Then add a new mangle rule which marks routing with WAN2 mark for new connection from the router destined to the address list entries which were dynamically added to the list by the first rule.

stmx38 · Mon Jun 03, 2024 7:53 am

ax^3 works fine, single disconnections I see in the logs is related to the device which is the 5 floors away and signal is -86/-90 - so, it is expected.

Ax3, ax2, ax lite ... no issues here. Nada.
Ax3, have problem wi-fi, always disconnected

skrin.png

Mon Jun 03, 2024 7:55 am

When I cast a movie from my smartphone to my TV via Chromecast, in a few seconds —no more than 10–20 seconds— all the WiFi devices in the house get disconnected. I mean all of them, 2 phones, 1 laptop and Chromecast itself.

Please open a support ticket and include a supout file from the device.

Mon Jun 03, 2024 7:58 am

Ax3, have problem wi-fi, always disconnected

Please open a support ticket and include a supout file from the device.

denissMT · Mon Jun 03, 2024 8:15 am

MQTT no longer works after upgrade to 7.15

Tested mosquitto and AWS and both brokers work on 7.15. Please send us a rif file via a ticket:
https://mikrotik.com/support

denissMT · Mon Jun 03, 2024 8:16 am

Disappointed IOT does not get connection to the internet and when I downgrade to 7.14.3 connected again to the internet

Same as above, please send us a rif file via the ticket system:
https://mikrotik.com/support

jspool · Mon Jun 03, 2024 8:36 am

MQTT no longer works after upgrade to 7.15
Tested mosquitto and AWS and both brokers work on 7.15. Please send us a rif file via a ticket:
https://mikrotik.com/support

They do not receive messages sent to the topic that they are subscribed to. Tried on 2116 and knot with same result. Back to 7.14.3 they work normally. Sending some rifs to support.

VadiKO · Mon Jun 03, 2024 8:55 am

ax^3 works fine, single disconnections I see in the logs is related to the device which is the 5 floors away and signal is -86/-90 - so, it is expected.

The devices are located on the same floor at a distance of 5-8 meters and almost on a straight side.
Before update 7.15 everything went without problems.

VadiKO · Mon Jun 03, 2024 10:49 am

has so far solved the problem by disabling wifi2 (2GHz).
Now another device disconnects and reconnects all the time, it's an Iphone 13 Pro Max, and there is an Iphone 12 next to it and it has a stable connection. I don't understand anything anymore...

skrins.png

erlinden · Mon Jun 03, 2024 10:58 am

Can you share your config (if you haven't done already), @VadiKO?

VadiKO · Mon Jun 03, 2024 11:42 am

Can you share your config (if you haven't done already), @VadiKO?

2024-06-03 09:12:51 by RouterOS 7.15

software id = 1N2D-52R9
model = C53UiG+5HPaxD2HPaxD
serial number = HExxxxxADQ
/interface bridge add name=bridge1 port-cost-mode=short
/interface bridge add arp=reply-only comment="for shop" name=bridge_for_shop port-cost-mode=short
/interface wifi set [ find default-name=wifi2 ] channel.band=2ghz-ax .skip-dfs-channels=disabled .width=20mhz configur
ation.country="United States" .mode=ap .ssid=AirPortExtreme mtu=1500 security.authentication-types=wpa2-psk,wpa3-psk .
wps=disable
/interface wireguard add disabled=yes listen-port=51820 mtu=1420 name=wireguard2
/interface wireguard add listen-port=51830 mtu=1420 name=wireguard_contabo
/interface list add name=LAN
/interface list add name=WAN
/interface wifi security add authentication-types=wpa2-psk comment="for shop" disabled=no name=for_shop
/interface wifi security add authentication-types=wpa2-psk,wpa3-psk comment="for 5G" disabled=no name=for5G wps=disabl
e
/interface wifi set [ find default-name=wifi1 ] channel.band=5ghz-ax .frequency=5180,5260,5500 .skip-dfs-channels=disa
bled .width=20/40/80mhz configuration.country="United States" .mode=ap .ssid=MikroTik disabled=no mtu=1500 security=fo
r5G
/interface wifi add configuration.mode=ap .ssid=for_shop mac-address=4A:A9:8A:49:5C:D8 master-interface=wifi2 mtu=1500
name=wifi3_virtual security=for_shop security.encryption=ccmp
/ip pool add comment=my name=pool1 ranges=192.168.1.2-192.168.1.254
/ip pool add comment="for shop" name=pool_for_shop ranges=10.10.10.2-10.10.10.254
/ip dhcp-server add address-pool=pool1 comment=my interface=bridge1 lease-time=1d name=dhcp_my
/ip dhcp-server add add-arp=yes address-pool=pool_for_shop comment="for shop" interface=bridge_for_shop lease-time=12h
name=dhcp_fro_shop
/ip smb users set [ find default=yes ] disabled=yes
/routing table add comment=wg disabled=no fib name=wg_mark
/interface bridge port add bridge=bridge1 interface=ether2 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 interface=ether3 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 interface=ether4 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 interface=wifi1 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 interface=wifi2 internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge_for_shop comment="for shop" interface=wifi3_virtual internal-path-cost=10 pat
h-cost=10
/ip firewall connection tracking set udp-timeout=10s
/ip neighbor discovery-settings set discover-interface-list=LAN
/ipv6 settings set max-neighbor-entries=15360
/interface detect-internet set detect-interface-list=WAN
/interface list member add interface=bridge1 list=LAN
/interface list member add interface=ether5 list=WAN
/interface list member add comment=wg2 interface=wireguard2 list=WAN
/interface list member add comment=wgcontabo interface=wireguard_contabo list=WAN
/interface wifi access-list add action=accept allow-signal-out-of-range=always disabled=yes signal-range=-95..120
/interface wifi access-list add action=reject disabled=yes
/interface wireguard peers add allowed-address=0.0.0.0/0 disabled=yes endpoint-address=185.xx.xx.142 endpoint-port=51
820 interface=wireguard2 name=peer1 persistent-keepalive=10s preshared-key="DC/FSg/dFHC8stXdtixxxxteniF6rtYo
w=" public-key="hT6d1boflhSvG07x+xxxxx//x+lk/IgxAIjc="
/interface wireguard peers add allowed-address=0.0.0.0/0 endpoint-address=85.xx.xx.14 endpoint-port=51830 interface=
wireguard_contabo name=peer2 persistent-keepalive=20s public-key="SHtmJXzPTxocONGuxxxxxrBQGTmi1fULsIkw="
/ip address add address=192.168.1.1/24 comment=local interface=bridge1 network=192.168.1.0
/ip address add address=193.xx.xx.160/24 comment=net-city interface=ether5 network=193.xx.xx.0
/ip address add address=10.167.51.3/24 comment=wg2 disabled=yes interface=wireguard2 network=10.167.51.0
/ip address add address=10.10.10.1/24 comment="for shop" interface=bridge_for_shop network=10.10.10.0
/ip address add address=10.100.10.2/24 comment=wgcontabo interface=wireguard_contabo network=10.100.10.0
/ip arp add address=192.168.1.3 comment=ergo interface=bridge1 mac-address=C6:7B:F2:30:F3:BB
/ip dhcp-server lease add address=192.168.1.252 client-id=1:3c:15:c2:c5:95:98 comment=mac mac-address=3C:15:C2:C5:95:9
8 server=dhcp_my
/ip dhcp-server lease add address=192.168.1.66 comment="terneo 1" mac-address=CC:50:E3:27:3A:96 server=dhcp_my
/ip dhcp-server lease add address=192.168.1.62 client-id=1:30:1b:97:32:4e:d comment=hikvision mac-address=30:1B:97:32:
4E:0D server=dhcp_my
/ip dhcp-server lease add address=192.168.1.61 comment="terneo 2" mac-address=CC:50:E3:C5:93:D8 server=dhcp_my
/ip dhcp-server lease add address=192.168.1.58 client-id=1:30:1b:97:2c:aa:90 comment="hikvision pvr" mac-address=30:1B
:97:2C:AA:90 server=dhcp_my
/ip dhcp-server lease add address=192.168.1.56 client-id=1:30:95:87:e0:39:4a comment=.onn mac-address=30:95:87:E0:39:4
A server=dhcp_my
/ip dhcp-server lease add address=192.168.1.55 client-id=1:0:3:43:80:2:35 comment=KM1 mac-address=00:03:43:80:02:35 se
rver=dhcp_my
/ip dhcp-server lease add address=192.168.1.54 client-id=1:10:2c:6b:c2:50:25 comment=KM6 mac-address=10:2C:6B:C2:50:25
server=dhcp_my
/ip dhcp-server lease add address=192.168.1.67 client-id=1:f4:a4:75:87:50:5f comment=T1000 mac-address=F4:A4:75:87:50:
5F server=dhcp_my
/ip dhcp-server lease add address=192.168.1.9 client-id=1:4a:eb:c0:bf:a8:a0 comment=ergo mac-address=4A:EB:C0:BF:A8:A0
server=dhcp_my
/ip dhcp-server lease add address=192.168.1.8 client-id=1:b8:9a:2a:d:27:c1 comment=yepo mac-address=B8:9A:2A:0D:27:C1
server=dhcp_my
/ip dhcp-server lease add address=10.10.10.3 client-id=1:e0:3f:49:28:7b:88 comment=68u mac-address=E0:3F:49:28:7B:88 s
erver=dhcp_fro_shop
/ip dhcp-server lease add address=192.168.1.29 client-id=1:30:b1:b5:4d:90:4 comment=LG mac-address=30:B1:B5:4D:90:04 s
erver=dhcp_my
/ip dhcp-server lease add address=192.168.1.7 client-id=1:4e:88:97:2e:72:ed comment=ergo mac-address=4E:88:97:2E:72:ED
server=dhcp_my
/ip dhcp-server lease add address=192.168.1.10 client-id=1:78:8a:86:4a:c6:e1 comment=philips_NEW mac-address=78:8A:86:
4A:C6:E1 server=dhcp_my
/ip dhcp-server network add address=10.10.10.0/24 dns-server=94.140.15.15,94.140.14.14 gateway=10.10.10.1
/ip dhcp-server network add address=192.168.1.0/24 dns-server=94.140.15.15,94.140.14.14 gateway=192.168.1.1 netmask=24
/ip dns set allow-remote-requests=yes cache-size=4096KiB servers=94.140.15.15,94.140.14.14
/ip firewall address-list add address=192.168.1.252 comment=mac list=full_wg
/ip firewall address-list add address=192.168.1.67 comment=pc list=full_wg
/ip firewall address-list add address=192.168.1.54 comment=KM6 list=full_wg
/ip firewall address-list add address=192.168.1.55 comment=KM1 list=full_wg
/ip firewall address-list add address=192.168.1.56 comment=.onn list=full_wg
/ip firewall address-list add address=192.168.1.46 comment="my pc" disabled=yes list=full_wg
/ip firewall address-list add address=192.168.1.7 comment=ergo list=full_wg
/ip firewall address-list add address=192.168.1.8 comment=yepo list=full_wg
/ip firewall address-list add address=192.168.1.29 comment=LG list=full_wg
/ip firewall address-list add address=192.168.1.10 comment=Philips_NEW list=full_wg
/ip firewall filter add action=accept chain=input connection-state=established,related,untracked in-interface-list=WAN
/ip firewall filter add action=accept chain=input comment=winbox connection-state=new dst-port=1111 protocol=tcp
/ip firewall filter add action=drop chain=input comment="drop invalid connection" connection-state=invalid
/ip firewall filter add action=accept chain=input comment="defconf: acept ICMP" protocol=icmp
/ip firewall filter add action=drop chain=input comment="defconf: drop all notcoming from LAN" in-interface-list=!LAN
/ip firewall filter add action=accept chain=forward comment="hikvision 9" dst-port=9000 in-interface-list=WAN protocol
=tcp
/ip firewall filter add action=accept chain=forward comment=video dst-port=37777,2222,3333 in-interface-list=WAN proto
col=tcp
/ip firewall filter add action=accept chain=forward comment="hikvision 10" dst-port=8000 in-interface-list=WAN protoco
l=tcp
/ip firewall filter add action=accept chain=forward comment=vu+ dst-port=1100 in-interface-list=WAN protocol=tcp
/ip firewall filter add action=accept chain=forward connection-state=established,related,untracked in-interface-list=W
AN
/ip firewall filter add action=drop chain=forward comment="forvard invalid" connection-state=invalid
/ip firewall filter add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATTed" connection-nat-st
ate=dstnat connection-state=new in-interface-list=WAN
/ip firewall filter add action=jump chain=input comment="jump to ICMP filters" jump-target=icmp protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="allow echo request" icmp-options=8:0 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="net unreachable" icmp-options=3:0 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="host unreachable" icmp-options=3:1 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="host unreachable fragmentation required" icmp-options=3:4 pr
otocol=icmp
/ip firewall filter add action=accept chain=icmp comment="allow time exceed" icmp-options=11:0 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="allow parameter bad" icmp-options=12:0 protocol=icmp
/ip firewall filter add action=drop chain=icmp comment="deny all other types"
/ip firewall mangle add action=change-ttl chain=prerouting comment="ttl for do not detect provider" new-ttl=increment:
1 passthrough=yes
/ip firewall mangle add action=mark-routing chain=prerouting comment=wg new-routing-mark=wg_mark passthrough=no src-ad
dress-list=full_wg
/ip firewall mangle add action=change-mss chain=forward comment="wg2 new mss" disabled=yes new-mss=clamp-to-pmtu out-i
nterface=wireguard2 passthrough=no protocol=tcp tcp-flags=syn
/ip firewall mangle add action=change-mss chain=forward comment="wgcontabo new mss" new-mss=clamp-to-pmtu out-interfac
e=wireguard_contabo passthrough=no protocol=tcp tcp-flags=syn
/ip firewall nat add action=masquerade chain=srcnat comment="masquerade LAN to WAN" out-interface-list=WAN
/ip firewall nat add action=dst-nat chain=dstnat comment=video disabled=yes dst-port=37777 in-interface=ether1 protoco
l=tcp to-addresses=192.168.1.117
/ip firewall nat add action=masquerade chain=srcnat comment="video local" dst-address=192.168.1.0/24 src-address=192.1
68.1.0/24
/ip firewall nat add action=dst-nat chain=dstnat comment=video dst-address=193.xx.xx.160 dst-port=37777 protocol=tcp
to-addresses=192.168.1.2
/ip firewall nat add action=dst-nat chain=dstnat comment="hikvision 10" dst-address=193.xx.xx.160 dst-port=8000 proto
col=tcp to-addresses=192.168.1.62
/ip firewall nat add action=dst-nat chain=dstnat comment=vu+ dst-address=193.xx.xx.160 dst-port=1100 protocol=tcp to-
addresses=192.168.1.11
/ip firewall nat add action=src-nat chain=srcnat comment="to mik 2" disabled=yes dst-address=10.167.51.4 dst-port=2222
protocol=tcp to-addresses=10.167.51.3
/ip firewall nat add action=netmap chain=dstnat comment="to mik 2" disabled=yes dst-address=192.168.1.1 dst-port=2222
in-interface-list=WAN protocol=tcp to-addresses=10.167.51.4 to-ports=2222
/ip firewall nat add action=dst-nat chain=dstnat comment="con to mik 2 ah" disabled=yes dst-address=193.xx.xx.160 por
t=2222 protocol=tcp to-addresses=10.167.51.4 to-ports=2222
/ip firewall nat add action=dst-nat chain=dstnat comment="hikvision 9" dst-address=193.xx.xx.160 dst-port=9000 protoc
ol=tcp to-addresses=192.168.1.58
/ip firewall nat add action=dst-nat chain=dstnat comment="con to mik 2 contabo" dst-address=193.xx.xx.160 port=2222 p
rotocol=tcp to-addresses=10.100.10.4 to-ports=2222
/ip firewall service-port set ftp disabled=yes
/ip firewall service-port set tftp disabled=yes
/ip firewall service-port set h323 disabled=yes
/ip firewall service-port set sip disabled=yes
/ip firewall service-port set pptp disabled=yes
/ip route add check-gateway=ping comment=net-city disabled=no distance=1 dst-address=0.0.0.0/0 gateway=193.107.74.1 ro
uting-table=main scope=30 suppress-hw-offload=no target-scope=10
/ip route add comment=wg2 disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=wireguard2 pref-src="" routing-table=w
g_mark scope=30 suppress-hw-offload=no target-scope=10
/ip route add comment=wgcontabo disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wireguard_contabo routing-table=w
g_mark scope=30 suppress-hw-offload=no target-scope=10
/ip service set telnet disabled=yes
/ip service set ftp disabled=yes
/ip service set ssh disabled=yes
/ip service set api disabled=yes
/ip service set winbox port=1111
/ip service set api-ssl disabled=yes
/ip smb shares set [ find default=yes ] directory=/pub
/system clock set time-zone-name=Europe/Kiev
/system identity set name=ax3
/system leds set 4 disabled=yes
/system leds set 5 disabled=yes
/system logging add topics=wireless,debug
/system logging add disabled=yes topics=dhcp,debug
/system note set show-at-login=no
/system ntp client set enabled=yes
/system ntp client servers add address=0.pool.ntp.org
/system ntp client servers add address=1.pool.ntp.org
/tool graphing interface add interface=ether5
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/tool mac-server ping set enabled=no

nemavio · Mon Jun 03, 2024 12:32 pm

Clearly, huge memory leak issue with wireguard on RB4011, cf viewtopic.php?t=208104

WeWiNet · Mon Jun 03, 2024 12:51 pm

has so far solved the problem by disabling wifi2 (2GHz).
Now another device disconnects and reconnects all the time, it's an Iphone 13 Pro Max, and there is an Iphone 12 next to it and it has a stable connection. I don't understand anything anymore...

skrins.png

I do have similar problems, which improve if I switch off 2G. I suspect the fast transition or steering going bad.
The key problem with Wifi on Mikrotik is the limited to non-existing logging capabilities in Wifi.
If you had access to more detailed / internal info, one could debug. But without this its trial and error only.

erlinden · Mon Jun 03, 2024 1:45 pm

Think your config is a bit messy, but not that strange @VadiKO.
What you can try:

- set encryption=ccmp on the for5G security settings
- set authentication-types to wpa2-psk only (had some strange stuff going on with combined wpa2-psk and wpa3-psk)
- set dtim-period (part of the configuration) to 3 (which is advised by Apple)

At last...I prefer to use a single bridge, but that is probably not a problem in your case.

rushlife · Mon Jun 03, 2024 2:43 pm

ACHTUNG !!! ALERT !
Do not use this version with CRS354 !!!

Huge packetloss, huge performance drop, unusable on some ports.

Smoerrebroed · Mon Jun 03, 2024 5:10 pm

Running this release for a couple of days, I can conclude that I still have issues with APs locking up when using DFS channels. In that respect, this version is the same as 7.16alpha. :-/

erlinden · Mon Jun 03, 2024 5:18 pm

I'm using this version since the rc came out...never had any problems with the DFS channels. Can you share your config, @Smoerrebroed?

sirbryan · Mon Jun 03, 2024 5:58 pm

ACHTUNG !!! ALERT !
Do not use this version with CRS354 !!!

Huge packetloss, huge performance drop, unusable on some ports.

Oh darnit. I already upgraded my CRS354. And I'm not seeing what you're seeing.

Mine's in an MLAG pair with a CRS312, both connected to a 2116 on one side and another MLAG pair of 317's on the other, and a handful of desktop/office devices spread across both switches. Really low traffic. Working as expected.

Perhaps you could enlighten us as to your use case, such as average throughput, any special configs (q-in-q/tag stacking), quantity of LACP peers, DACS/SFP+' in use, etc.

sxtlhglte · Mon Jun 03, 2024 6:04 pm

have upgrade ARM, ARM64, MIPBE, PPC to 7.15 from 7.14.x all good now

ivicask · Mon Jun 03, 2024 7:11 pm

ACHTUNG !!! ALERT !
Do not use this version with CRS354 !!!

Huge packetloss, huge performance drop, unusable on some ports.

Same, switch stops forwarding traffic properly after few hours, had to revert ..

rushlife · Mon Jun 03, 2024 7:50 pm

hi, more detail on my setup :

single bridge with dhcp client on it
JUST SWITCHING
no wireless package installed
loop protect on all ports
RSTP on default values
ip/services : WINBOX and SSH only
used on private internal it subnets with 24b prefix

fail was found on at least 10pcs of this device

i have no SUP file, I had to resolve this very bad situation FAST

pe1chl · Mon Jun 03, 2024 7:51 pm

*) console - added log for script execution failures;

There clearly is a bug in that. It logs failure even for scripts like '/log info message="host X is up"' called from netwatch as UP-script!
Edit: turned out it works OK, but there was a missing quote in the script (which was present in the ones I checked).

infabo · Mon Jun 03, 2024 8:05 pm

It has built-in AI that knows that "host x is up" is a pure lie and therefore the error 🤣

Kentzo · Mon Jun 03, 2024 8:16 pm

*) smb - added logs for share connection requests

Please revert this change. 99% of my info logs is now `... connect request user:GUEST ...` :/

pe1chl · Mon Jun 03, 2024 8:24 pm

*) smb - added logs for share connection requests
Please revert this change. 99% of my info logs is now `... connect request user:GUEST ...` :/

We are anxiously awaiting improvements in the logging functionality that allow the admin to suppress such messages...
(like adding a unique ID to every message that can be suppressed in logging rules, and/or filtering by regexp)

rkrisi · Mon Jun 03, 2024 8:42 pm

Please revert this change. 99% of my info logs is now `... connect request user:GUEST ...` :/
We are anxiously awaiting improvements in the logging functionality that allow the admin to suppress such messages...
(like adding a unique ID to every message that can be suppressed in logging rules, and/or filtering by regexp)

That would be great... I remember I had some similar case with some of the logs which should be filtered for me, but there were no avail. option, just to remove that whole topic from logging...

pe1chl · Mon Jun 03, 2024 9:00 pm

That is what I mean! It should be "easy" to add a unique 6 or 8-digit hex number as a topic to each unique type of message, so it can be filtered with the existing topic filter.
And it should be "doable" to add a regexp filter to match messages by regexp on the text, too.

TheWitness · Mon Jun 03, 2024 9:23 pm

Hi,

I'm testing with Traffic Flow, and if I'm using IPFIX and then switch to V9, the stream still includes IPFIX packets as well as V9 packets until after I reboot the device. I'm also noting a length error in the V9 packets. I'm still researching.

Larry

expo · Mon Jun 03, 2024 11:28 pm

On 2216 BGP as path is corrupted when upgrading from 7.14.3 to 7.15, locally originated routes have a random 32 bit source ASN that frequently changes

mrz · Tue Jun 04, 2024 8:56 am

Check your routing table, I bet there is a route received from some other peer and is not actually locally originated. Trace where this route is coming from.

expo · Tue Jun 04, 2024 9:19 am

Check your routing table, I bet there is a route received from some other peer and is not actually locally originated. Trace where this route is coming from.

Not sure I follow, but downgrading to 7.14.3 with no config changes fixed our issue, I saw similar reports on facebook wisp talk group

mrz · Tue Jun 04, 2024 9:43 am

There are no reports indicating that actually v7.15 is the one originating this route, from what is known is what I mentioned previously, route is received from other peer, not originated.
Contact support with supout file and /routing/bgp/advertisements output showing the route you are talking about.

expo · Tue Jun 04, 2024 10:03 am

There are no reports indicating that actually v7.15 is the one originating this route, from what is known is what I mentioned previously, route is received from other peer, not originated.
Contact support with supout file and /routing/bgp/advertisements output showing the route you are talking about.

It's routes we originate but the source AS is wrong, it appears as if it's a downstream AS customer of ours but it's a local originated route, the source AS changes frequently

expo · Tue Jun 04, 2024 10:09 am

There are no reports indicating that actually v7.15 is the one originating this route, from what is known is what I mentioned previously, route is received from other peer, not originated.
Contact support with supout file and /routing/bgp/advertisements output showing the route you are talking about.

here is the report from facebook:

Alright I'll be the one to ask the dreaded question after a mikrotik firmware release: Is anyone seeing issues? We upgraded a set of routers (4x 2216s running as a redundant collapsed core) to 7.15 stable and found some really odd BGP issues where the AS path was being modified for no obvious reason. A route originating from internally would be announced with another providers AS as the source. We even had one route originate from a seemingly random 32bit ASN that doesnt exist anywhere. After downgrading to 7.14.3 the problem immediately went away.

mrz · Tue Jun 04, 2024 10:11 am

If it comes from the downstream customer then it is customer originated route not locally originated route. And it should be investigated why the customer is sending you that route only when you upgrade to v7.15, or maybe it is just a coincidence and has nothing to do with v7.15

expo · Tue Jun 04, 2024 10:15 am

If it comes from the downstream customer then it is customer originated route not locally originated route. And it should be investigated why the customer is sending you that route only when you upgrade to v7.15, or maybe it is just a coincidence and has nothing to do with v7.15

We don't have any downstream customer I guess I don't know how to communicate it in a way that you will understand me but a random 32-bit AS was showing as the source with our AS after that, meaning we are originating the announcement but a randomly changing source AS was added

expo · Tue Jun 04, 2024 10:17 am

Bottom line is you have a bug in BGP with version 7.15 and I'm sure you will figure it out in time

mrz · Tue Jun 04, 2024 10:20 am

Like I said contact support with all the relevant info.

Tue Jun 04, 2024 10:21 am

Are you able to run this command successfully in terminal?

/tool netwatch
add host=8.8.8.8 type=simple up-script="/log info message=\"host X is up\""

 10:12:53 netwatch,info event up [ type: simple, host: 8.8.8.8 ]
 10:12:53 script,info host X is up

*) console - added log for script execution failures;
There clearly is a bug in that. It logs failure even for scripts like '/log info message="host X is up"' called from netwatch as UP-script!

expo · Tue Jun 04, 2024 10:24 am

Are you able to run this command successfully in terminal?
Code: Select all
/tool netwatch
add host=8.8.8.8 type=simple up-script="/log info message=\"host X is up\""
Code: Select all
 10:12:53 netwatch,info event up [ type: simple, host: 8.8.8.8 ]
 10:12:53 script,info host X is up
There clearly is a bug in that. It logs failure even for scripts like '/log info message="host X is up"' called from netwatch as UP-script!

I also noticed that several scripts that have been trouble free for 15 years (like /export and /backup simple scripts) are reporting failed in log, but running a few times it will be successful. Both 7.14 & 7.15

pe1chl · Tue Jun 04, 2024 10:58 am

(found problem)

Tue Jun 04, 2024 11:59 am

Errors were all the time, a user just did not see that.
This improvement lighted up different issues, for example, missing graceful exit from script.

Are you able to run this command successfully in terminal?
Code: Select all
/tool netwatch
add host=8.8.8.8 type=simple up-script="/log info message=\"host X is up\""
Code: Select all
 10:12:53 netwatch,info event up [ type: simple, host: 8.8.8.8 ]
 10:12:53 script,info host X is up
I also noticed that several scripts that have been trouble free for 15 years (like /export and /backup simple scripts) are reporting failed in log, but running a few times it will be successful. Both 7.14 & 7.15

lomayani · Tue Jun 04, 2024 1:25 pm

There are no reports indicating that actually v7.15 is the one originating this route, from what is known is what I mentioned previously, route is received from other peer, not originated.
Contact support with supout file and /routing/bgp/advertisements output showing the route you are talking about.

I have same problem. sent all details to support with ticket SUP-154594

pe1chl · Tue Jun 04, 2024 1:54 pm

Errors were all the time, a user just did not see that.
This improvement lighted up different issues, for example, missing graceful exit from script.

After carefully checking again, I found in some of the netwatch up-scripts a quote was missing. Indeed good that this is now checked.
What seems to be missing is a "graceful exit" possibility, other than reaching the end of the script, as indicated by others.
It would also be helpful when the syntax-highlighting feature of cmdline would also be available in winbox (and webfig).
That makes it easier to catch errors like the above.

kkeyser · Tue Jun 04, 2024 2:20 pm

ACHTUNG !!! ALERT !
Do not use this version with CRS354 !!!

Huge packetloss, huge performance drop, unusable on some ports.

Not confirmed. Running CRS354-48P-4S+2Q+ about five days with 7.15 without any problem.

pe1chl · Tue Jun 04, 2024 2:40 pm

Check your routing table, I bet there is a route received from some other peer and is not actually locally originated. Trace where this route is coming from.

It appears that 7.15 sometimes claims it originates a route while actually it doesn't.
E.g. I am running a network with several 7.12.1 routers which each originate some local network routes.
The central router has AS 65530 and some leaf routers are also on AS 65530.
Another router is on AS 65533 and it was upgraded to 7.15
Now I have a route in the table that points directly to a leaf router, but in its AS path it says 65533.
That is not the AS of the originating router but the AS of the 7.15 router (which of course also has that route in its table, with AS path 65530).
When I stop and start the BGP connection to the originating router, the route disappears and comes back without AS path.

Cha0s · Tue Jun 04, 2024 3:13 pm

There seems to be stability issues with Chateau 5G after modem firmware and ROS upgrade.

After upgrading the modem firmware to the latest version along with upgrading to ROS v7.15 the modem has become very unstable with either randomly resetting itself with error “lte1 mbim: modem's control interface have reset (4)” in the logs or with completely getting into an invalid state with repeated “lte1: no response for: AT E0 V1” errors in the log and needing to restart the whole device to recover itself.

[SUP-154766]

On every other device that I've installed v7.15 (CCR2116, CCR2004, CCR1036, CRS326, CRS318, RB5009, RB4011, RB3011, hAP Lite, CHR), I've got no issues whatsoever.

MikroTik support logged in to the device and installed RG502QEAAAR13A03M4G_02.003.02.003 which includes fixes related to my 5G provider.
It's been 3+ hours so far without any stability issues.

Pudpoh · Tue Jun 04, 2024 4:24 pm

There seems to be stability issues with Chateau 5G after modem firmware and ROS upgrade.

After upgrading the modem firmware to the latest version along with upgrading to ROS v7.15 the modem has become very unstable with either randomly resetting itself with error “lte1 mbim: modem's control interface have reset (4)” in the logs or with completely getting into an invalid state with repeated “lte1: no response for: AT E0 V1” errors in the log and needing to restart the whole device to recover itself.

[SUP-154766]

On every other device that I've installed v7.15 (CCR2116, CCR2004, CCR1036, CRS326, CRS318, RB5009, RB4011, RB3011, hAP Lite, CHR), I've got no issues whatsoever.
MikroTik support logged in to the device and installed RG502QEAAAR13A03M4G_02.003.02.003 which includes fixes related to my 5G provider.
It's been 3+ hours so far without any stability issues.

Hopefully they will make this version available to everyone quickly as I allowed my modem to upgrade it's firmware about a week ago, mine has stayed connected and I've not noticed any issues, but I haven't upgraded to 7.15 yet. I've deliberately held off after seeing posts of issues with chateau 5g and latest modem firmware with 7.15. My supplier is Three UK, what I have noticed though is it's a bit more fussy about aggregating 2 x n78 bands, I've had to tweak it's position a couple of times to keep 2 x n78 carrier aggregation.

areanod · Tue Jun 04, 2024 4:35 pm

*) bridge - reworked dynamic VLAN creation;

Before I could join a Port untagged to a VLAN by giving it the PVID that I wanted and it would show up in my static created VLAN in /interface/bridge/vlan. Since 7.15 I need to manually add the untagged port to the VLAN settings, otherwise I have the static VLAN with my tagged ports and another dynamic one with the untagged ports.
Is this expected behaviour and if yes: why?

Tested on an L009 and confirmed that the issue does not exist in 7.14.3

pe1chl · Tue Jun 04, 2024 4:53 pm

Before I could join a Port untagged to a VLAN by giving it the PVID that I wanted and it would show up in my static created VLAN in /interface/bridge/vlan. Since 7.15 I need to manually add the untagged port to the VLAN settings, otherwise I have the static VLAN with my tagged ports and another dynamic one with the untagged ports.

Indeed... I see that as well. That seems to be a step backward.

anav · Tue Jun 04, 2024 5:13 pm

Not sure, we are talking about the same thing, but whether or not the untagged vlan shows up on an export is determined by the /interface bridge vlan settings. If you do not manually put them there as untagged, they do not show as they are dynamically created. This is not new!

Tue Jun 04, 2024 5:29 pm

This behavior is expected due to the new MVRP feature, and dynamic VLANs are also needed for wifi-qcom and wireless dynamic VLAN management, such as from access-lists and RADIUS assignments.

Now, the same VLAN ID can appear multiple times, but the same interface will not be included in multiple entries. You can override the dynamic "current-untagged" part with a static configuration, but this is optional.

Additionally, the upcoming RouterOS v7.16 will provide more details about who created the dynamic VLANs. And when you add a VLAN interface to a vlan-filtering bridge, the bridge will automatically be added as a tagged member.

[admin@MikroTik] /interface/bridge/vlan> print 
Flags: D - DYNAMIC
Columns: BRIDGE, VLAN-IDS, CURRENT-TAGGED
#   BRIDGE   VLAN-IDS  CURRENT-TAGGED
;;; added by vlan on bridge
0 D bridge1        99  bridge1

Amm0 · Tue Jun 04, 2024 5:56 pm

Code: Select all
*) bridge - reworked dynamic VLAN creation;
Before I could join a Port untagged to a VLAN by giving it the PVID that I wanted and it would show up in my static created VLAN in /interface/bridge/vlan. Since 7.15 I need to manually add the untagged port to the VLAN settings, otherwise I have the static VLAN with my tagged ports and another dynamic one with the untagged ports.
Is this expected behaviour and if yes: why?

In V7.15, setting pvid= on .../bridge/port still works to dynamic add it as untagged to a .../bridge/vlan. The how changed, I think. It always add these to a dynamic .../bridge/vlan - even if there is a static entry in .../bridge/vlan already for the same VLAN.

So in my case, I have to two entries per VLAN. One static where I manually add the bridge as tagged in .../bridge/vlan & another dynamic (add automatically by pvid=) ../bridge/vlan used by all the ports with a same pvid= (making them untagged).

But it works.

pe1chl · Tue Jun 04, 2024 6:14 pm

Hopefully at some point the PVID per port will disappear and the "untagged ports" in the VLAN configuration will provide this config...

Amm0 · Tue Jun 04, 2024 7:01 pm

I think MVRP forced some changes here. _i.e._ now it not just bridge on the local router that modifies /interface/bridge/vlan, but potentially MVRP too.

Hopefully at some point the PVID per port will disappear and the "untagged ports" in the VLAN configuration will provide this config...

I actually like the automatic untagging of pvid= from the ports to bridge's vlan table.

In fact, I think /interface/vlan should have some option/attribute that automatically adds tagged=bridge (as a dynamic .../bridge/vlan) – so Layer3/IP work without messing with bridge vlan table at all. So whole /interface/bridge/vlans complexity be only needed for hybrid ports or Layer2-only switching cases.

pe1chl · Tue Jun 04, 2024 7:06 pm

Hopefully at some point the PVID per port will disappear and the "untagged ports" in the VLAN configuration will provide this config...
I actually like the automatic untagging of pvid= from the ports to bridge's vlan table.

I don't like that there are 2 ways to configure untagged ports and that they can be contradicting.
Either we have PVID and no "untagged ports" or the other way around. Not both.

mkx · Tue Jun 04, 2024 8:05 pm

Hopefully at some point the PVID per port will disappear and the "untagged ports" in the VLAN configuration will provide this config...

As it's now, /interface/bridge/port defines ingress behaviour ... and PVID can correctly only be set to a single value. OTOH /interface/bridge/vlan defines egress behaviour ... and a single port can be untagged member of multiple VLANs. Further more, some vendors allow state where port with PVID set is not member of that VLAN for egress.
While I'd agree that this kind of setup is not exactly usual, it does allow some flexibility and it would be a pity if itbwas taken away without a good reason (and taking away one property plus implementing a check on another property with possible bugs "to make configuration easier" is IMO not a good reason)

mkx · Tue Jun 04, 2024 8:14 pm

In fact, I think /interface/vlan should have some option/attribute that automatically adds tagged=bridge (as a dynamic .../bridge/vlan) – so Layer3/IP work without messing with bridge vlan table at all. So whole /interface/bridge/vlans complexity be only needed for hybrid ports or Layer2-only switching cases.

I'd rather see bridge "the CPU facing port" become a distinct item ... just like switchX-cpu port in switch chip configs. IMO this would prevent quite some confusion which arises from the fact that there are 3 different items (switch-like entity, CPU-facing port and interface) all named the same, while config, related to each of them, is interleaved.

Behaviour where bridge port would become tagged member of every VLAN, mentioned on any member port config, would also mean reduction of security of ROS devices when used as L2 switch ... because this would make a step closer to make device a router (by making two further steps: creation of corresponding VLAN interfaces and assigning L3 addresses to those). And all of that without clear benefit.

tdw · Tue Jun 04, 2024 8:25 pm

In fact, I think /interface/vlan should have some option/attribute that automatically adds tagged=bridge (as a dynamic .../bridge/vlan) – so Layer3/IP work without messing with bridge vlan table at all. So whole /interface/bridge/vlans complexity be only needed for hybrid ports or Layer2-only switching cases.

From what is said in post #190 that will happen in v7.16. If untagged= still exists for special use cases, but in general the dynamic membership based on pvid= is used for untagged then it will be a case of only having to add tagged= membership for the non-CPU trunk/hybrid ports.

tdw · Tue Jun 04, 2024 8:34 pm

I'd rather see bridge "the CPU facing port" become a distinct item ... just like switchX-cpu port in switch chip configs. IMO this would prevent quite some confusion which arises from the fact that there are 3 different items (switch-like entity, CPU-facing port and interface) all named the same, while config, related to each of them, is interleaved.

Whilst having a different name would be nice I expect that an automated configuration conversion may break things, from experiences with some of the older master-port to bridge conversions not going well.

Behaviour where bridge port would become tagged member of every VLAN, mentioned on any member port config, would also mean reduction of security of ROS devices when used as L2 switch ... because this would make a step closer to make device a router (by making two further steps: creation of corresponding VLAN interfaces and assigning L3 addresses to those). And all of that without clear benefit.

Having the CPU-facing port automatically added as a tagged member when an /interface vlan is attached to a bridge does seem like a reasonable compromise, as long as all of the other port members require explict tagged membership to become trunk or hybrid ports.

mkx · Tue Jun 04, 2024 8:41 pm

Having the CPU-facing port automatically added as a tagged member when an /interface vlan is attached to a bridge does seem like a reasonable compromise

I agree with this idea.

pe1chl · Tue Jun 04, 2024 9:31 pm

In fact, I think /interface/vlan should have some option/attribute that automatically adds tagged=bridge (as a dynamic .../bridge/vlan) – so Layer3/IP work without messing with bridge vlan table at all. So whole /interface/bridge/vlans complexity be only needed for hybrid ports or Layer2-only switching cases.
From what is said in post #190 that will happen in v7.16. If untagged= still exists for special use cases, but in general the dynamic membership based on pvid= is used for untagged then it will be a case of only having to add tagged= membership for the non-CPU trunk/hybrid ports.

It already was like that! When you only set a PVID on a port, it automatically becomes an untagged port on that VLAN.
However, before the untagged port would be listed on the same VLAN line in the bridge VLAN list, and now it creates a duplicate line with the same VLAN number but a D (dynamic) flag, and adds the port to that. Confusing.