RouterOS version 7.17rc has been released on the "v7 testing" channel!

Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during the upgrade process;
3) Device has enough free storage space to download all RouterOS packages.

What's new in 7.17rc3 (2024-Dec-10 09:40):

!) webfig - redesigned HTML, styling and functionality (additional fixes);
*) console - fixed missing arguments in wifi menu in certain cases;
*) container - improved "start-on-boot" stability;
*) discovery - added support for LLDP DCBX (additional fixes);
*) file - improved service stability when accessing files list from other system services;
*) iot - fixed LoRa behavior, where join eui or dev eui could be incorrectly converted during forwarding;
*) ippool - removed maximum "63 bit" prefix length limitation;
*) ipv6 - added support for manual link-local address configuration (additional fixes);
*) qos-hw - improved system stability when enabling QoS;
*) route - improved stability (additional fixes);
*) webfig - Skin Designer moved to centralized page (additional fixes);

What's new in 7.17rc2 (2024-Nov-28 16:09):

!) webfig - redesigned HTML, styling and functionality (additional fixes);
*) bridge - added message for inactive port reason (additional fixes);
*) device-mode - added routerboard, install-any-version and partitions features (additional fixes);
*) dhcpv6-server - fixed DHCPv6 server "address-pool" property showing in command line as "unknown" when real value is "static-only";
*) dns - added option to create named DNS servers that can be used as forward-to servers (additional fixes);
*) file - improved service stability when processing a lot of files (introduced in v7.17rc1);
*) ipv6 - added support for manual link-local address configuration (additional fixes);
*) webfig - allow style.css and script.js in branding packages;
*) webfig - redirect "/help/license.html" to "/license.txt" for backwards compatibility;
*) winbox - clear "Value" field when unset under "IP/DNS/Static" menu;

What's new in 7.17rc1 (2024-Nov-22 11:42):

!) webfig - redesigned HTML, styling and functionality (additional fixes);
*) bridge - added priority setting to manually elect primary MLAG peer;
*) container - do not log start, end events unless logging is enabled;
*) log - fixed e-mail logging (introduced in v7.16);
*) lte - improved recovery after unexpected modem reboot for Chateau's 5G and 5G R16 series devices (additional fixes);
*) netwatch - added "ignore-initial-up" and "ignore-initial-down" properties;
*) netwatch - fixed multiple variables;
*) poe-out - improved PoE-out configuration handling when doing reset-configuration command;
*) ptp - fixed packet receive with enabled igmp-snooping;
*) romon - send uptime in discovery;
*) route - improved stability with static route configuration;
*) winbox - added "Copy to Access List" option under "WiFi/Registration" menu;
*) winbox - added "Max Entries" and "Total Entries" properties under "IP/Firewall/Connections/Tracking" menu;
*) winbox - added missing "bus" option for compatible devices under "System/RouterBOARD/USB Power Reset" menu;
*) winbox - hide LCD menu for devices without display;
*) winbox - hide LTE "External Antenna" menu for devices without switchable antenna option;
*) winbox - show "FEC" property on status tab for interfaces that use it;
*) winbox - updated properties and behavior under "Switch/QoS" menu;

Other changes since v7.16:

!) device-mode - after upgrade, mode "enterprise" is renamed to "advanced" and traffic-gen, partition (command "repartition"), routerboard and install-any-version features will be disabled (additional fixes);
*) 6to4 - fixed issue where 6to4 relay would not forward traffic unless destination address is set;
*) adlist - improved logging;
*) adlist - improved system stability;
*) adlist - optimized import on system with low disk space;
*) api - fixed REST API serialization of binary data;
*) arm64 - fixed for bare-metal servers to be able to access more than 2GB RAM;
*) arm64 - show CPU frequency on bare-metal installations;
*) arm64/x86 - added missing PCI id for mlx4 driver;
*) bonding - hide mlag-id property on non-compatible devices;
*) bridge - add HW offload support for active-backup bonds on 98DXxxxx, 88E6393X, 88E6191X and88E6190 switches;
*) bridge - added interface-list support for VLANs;
*) bridge - added message for inactive port reason;
*) bridge - correctly display PPP interfaces in VLAN menu;
*) bridge - disallow duplicate static VLAN entries;
*) bridge - disallow multicast MAC address as admin-mac;
*) bridge - enable faster HW offloading when detect-internet is disabled;
*) bridge - fixed bridge packet transmit if dhcp-snooping is enabled (introduced in v7.17beta5);
*) bridge - fixed first host table response for SNMP;
*) bridge - fixed incorrect HW offloaded port state in certain cases on MSTI add;
*) bridge - fixed missing slave flag on port in certain cases;
*) bridge - fixed MVRP registrar and applicant port options;
*) bridge - fixed port monitor with interface-lists;
*) bridge - fixed port move command;
*) bridge - fixed setting bridge MTU to L2MTU value;
*) bridge - fixed VLAN overlap check;
*) bridge - ignore disabled interfaces when calculating bridge L2MTU;
*) bridge - improved port handling;
*) bridge - improved stability;
*) bridge - prioritize MAC selection from Ethernet interfaces when using auto-mac feature;
*) bridge - re-synchronize MLAG system-id when bridge MAC changes;
*) bridge - removed support for master port config conversion (used before version 6.41);
*) bridge - update dynamic MSTI priority value when changing configuration;
*) bth - improved stability on system time change;
*) certificate - do not download CRL if there is not enough free RAM;
*) certificate - do not show not relevant values for certificate template (CLI only);
*) certificate - fixed handling of capsman-cap certificates (introduced in v7.16);
*) certificate - removed unstructured address field support;
*) chr - added Chelsio VF driver for PCIID 5803;
*) chr/arm64 - fixed kernel crypto use without crypto extensions for RPi CM4;
*) cloud - changed ddns-enabled setting from "no" to "auto" (service is enabled when BTH is enabled);
*) cloud - improved DDNS and VPN state stability;
*) console - added :range command;
*) console - added group-by property for print command;
*) console - added json.no-string-conversion to :serialize;
*) console - added lf/crlf options to :convert transform;
*) console - added more argument definitions for mac-protocol property;
*) console - added password property to "/system/ssh-exec" command;
*) console - added to/from=num option for :convert command;
*) console - allow clearing history for a specific user;
*) console - allow setting width to supout.rif output;
*) console - clear history when removing user;
*) console - disallow autocomplete hints for user without read policy;
*) console - execute :return command without error;
*) console - fixed endless loop when closing input prompt;
*) console - force print paging when output does not fit terminal width;
*) console - improved printing output in some menus;
*) console - improved scripting system stability;
*) console - increased w60g scan-list size to 6;
*) console - print warning in CLI after enabling protected bootloader;
*) console - removed "chain" names from print parameter list and show all print parameters in "/ipv6/firewall/filter" directory;
*) console - show system-id in export for CHR;
*) container - allow import from .tar.gz file;
*) container - fixed user and group ID range;
*) container - improved container shell;
*) crypto - improve crypto speeds (additional fixes);
*) crypto - use hardware accelerator for GCM cipher in TLS connection on Alpine CPUs;
*) defconf - changed wireless installation from "indoor" to "any";
*) defconf - disable 5GHz secondary channel on RB4011;
*) defconf - do not add default password for CAP mode configuration on older Audience devices without a password;
*) defconf - fixed new port name recognition;
*) detnet - remove dynamic DHCP client creation;
*) device-mode - added "allowed-versions" list which are allowed to be installed without "install-any-version" mode enabled;
*) device-mode - added "basic" mode;
*) device-mode - added routerboard, install-any-version and partitions features;
*) device-mode - allow feature and mode update on x86 via power button and reboot/shutdown from AWS;
*) device-mode - changed "partition" to allow activate and do not allow repartition (introduced in v7.17beta2);
*) device-mode - fixed feature and mode update on ARM64 Hetzner;
*) device-mode - fixed feature and mode update via power-reset on MIPSBE devices;
*) device-mode - limit "/tool/ping-speed" and "/tool/flood-ping" under "traffic-gen" feature;
*) device-mode - limit device-mode update maximum allowed attempt count which can be reset only with reboot or button press;
*) device-mode - provide more precise device-mode update action printout;
*) device-mode - show all features and active restrictions with "print" command;
*) dhcp-relay - added "local-address-as-src-ip" property;
*) dhcp-server - improved stability (introduced in v7.17beta4);
*) dhcp-server - use interface ID for NAS-Port and added interface name to NAS-Port-ID attribute in RADIUS requests;
*) dhcp-server - use single RADIUS accounting session for IPv4 and IPv6 when dual stack is used (additional fixes);
*) dhcpv4-client - correctly handle adding/setting emtpy dhcp-options;
*) dhcpv4-client - fixed crash when releasing disabled DHCP client;
*) dhcpv4-client - respect Renewal-Time (58) and Rebinding-Time (59) options;
*) dhcpv4-server - do not remove options set config when DHCP network is changed;
*) dhcpv4-server - properly detect DHCP server address when underlying interface has multiple IP addresses configured;
*) dhcpv4-server/relay - added additional error messages for DHCP servers and relays;
*) dhcpv4/v6-server - added address-list parameter to which address will be added if the lease is bound;
*) dhcpv6-client - added prefix-address-list parameter;
*) dhcpv6-client - improved system stability when DHCPv6 client is enabled on non-existing interface;
*) dhcpv6-client - log message when response with invalid transaction-id received;
*) dhcpv6-client/server - added support for DHCPv6 reconfigure messages;
*) dhcpv6-server - added IPv6 address delegation support;
*) dhcpv6-server - improved system stability when removing actively used DHCPv6 server;
*) dhcpv6-server - include all existing prefixes (with lifetime 0) in renew reply and new prefix if RADIUS returns different prefix;
*) discovery - added support for LLDP DCBX (additional fixes);
*) discovery - use LLDP description field to populate platform, version and board-name;
*) disk - add support for SWAP, currently allowed on any block device with "set x swap=yes" when container package is installed (CLI only);
*) disk - added "type=file" for file-based block devices, useful for using file as a swap, or when having file-based filesystem images (CLI only);
*) disk - added btrfs filesystems list (CLI only);
*) disk - added mount-read-only and mount-filesystem options to allow read-only mounts and prevent mounting device at all (CLI only);
*) disk - added sshfs client to "/disk" menu (CLI only);
*) disk - allow to configure global and per disk mountpoint template - [slot],[model],[serial],[fw-version],[fs-label],[fs-uuid],[fs] variables supported;
*) disk - auto mount iso and squashfs images;
*) disk - fixed managing and cleaning up mount points;
*) disk - fixed raid role auto selection for up to 64 drives;
*) disk - improve slot naming and improvements for visualizing complex hardware topology;
*) disk - improve test to report zero byte iops;
*) disk - improved system stability;
*) disk - read/show exfat filesystem label;
*) disk - recognize virtual sd* interfaces;
*) disk - remove 32 character slot name limit;
*) disk - save raid superblock and raid bitmap superblock on member devices in 1.2 format/location;
*) disk - show detailed mountpoint users when unable to unmount;
*) disk - show usage as percentage (CLI only);
*) disk - try all NFS versions (4.2,4.1,4.0,3,2) when mounting NFS in that order;
*) disk,nvme - show nvme namespaces if configured more than one on a nvme drive;
*) dns - added option to create named DNS servers that can be used as forward-to servers (additional fixes);
*) dns - do not look up local cache when executing ":resolve" command with specified "server" parameter (introduced in v7.16);
*) dns - DoH whitelist support for adlist using static FWD entries;
*) dns - refactored DNS service internal processes;
*) dns - whitelist support for adlist using static FWD entries;
*) ethernet - improved interface stability for RB4011 devices;
*) ethernet - improved linking after reboot for hAP ax lite devices ("/system routerboard upgrade" required);
*) ethernet - improved stability after reboot for Chateau PRO ax;
*) ethernet - improved system stability for CCR2004-1G-2XS-PCIe device;
*) ethernet - log warning only about excessive broadcast (do not include multicast) and reduced log count;
*) fetch - fixed certificate check when provided hostname is IP address;
*) fetch - fixed large file (over 4GB) fetch in HTTP/HTTPS mode;
*) file - correctly identify mounted disks;
*) file - do not needlessly scan large filesystems, could prevent unmounting;
*) file - improved handling of changes to the file system;
*) file - support files over 4GB size;
*) file - update file size before trying to request content;
*) firewall - added none-dynamic and none-static arguments for IPv6 address-list-timout settings;
*) firewall - added support for random external port allocation;
*) firewall - added warning log for TCP SYN flood;
*) firewall - fixed "dst-limit" and "limit" mathers when using zero value for burst argument;
*) firewall - improved matching from deeply nested interface-lists (additional fixes);
*) firewall - improved matching from deeply nested interface-lists;
*) firewall - removed default mangle passthrough=yes configuration from export;
*) ftp - added VRF support;
*) gps - changed default GPS antenna setting for LtAP mini with internal LTE/GPS combo antenna;
*) graphing - fixed graphing rule removal (additional fixes);
*) graphing - fixed queue graph storing on disk;
*) health - added cpu-overtemp-check on ARM, ARM64 devices (CLI only);
*) health - changed PSU state from "no-ac" to "no-input";
*) health - hide settings in CLI if there is nothing to show;
*) health - removed board-temperature on RB5009UPr+S+IN device;
*) igmp-proxy - refactored IGMP querier (additional fixes);
*) ike2 - improved performance by balancing multicore CPU usage for key exchange calculation also for initiator;
*) iot - added additional debug for LoRa logging;
*) iot - added an option to print out LoRa traffic in CLI (not GUI-only option anymore);
*) iot - added new LoRa traffic FCnt packet counter parameter;
*) iot - added support for USB Bluetooth dongles (LE 4.0+) which enables Bluetooth functionality;
*) iot - bluetooth peripheral device menu now displays correct iBeacon major/minor values;
*) iot - fixed duplicate LoRa payloads in the traffic tab;
*) iot - fixed incorrect LoRa joineui filter export behavior;
*) iot - improvements to LoRa device's stats tab;
*) iot - limit mqtt publish message size to 32 KB;
*) iot - LoRa LNS improvement;
*) iot - LoRa traffic tab RSSI now shows proper values for ARM architecture;
*) iot - modbus rework which improves Tx Rx switching behavior;
*) iot - mqtt improvement to support large payloads and gracefully discard payloads above size limit;
*) iot - removed crc-disabled and crc-error options from the LoRa forwarding;
*) iot - removed LoRa pause traffic option/setting;
*) iot - removed some LoRa radio related parameters (e.g. RSSI-OFF and Tx-enabled) that were not meant to be changed (additional fixes);
*) ipsec - ike2 improved process for policies;
*) ipv6 - added comment property to "/ipv6/nd/prefix" menu;
*) ipv6 - added IPv6 settings related to stale IPv6 neighbor cleanup;
*) ipv6 - added support for manual link-local address configuration;
*) isis - do not disable fast-path when isis is enabled on an interface;
*) isis - fixed console flags;
*) isis - fixed invalid L2 LSP type;
*) isis - make it work when MTU is larger than 1500;
*) isis - update interface MAC address on change (caused neighbor to stuck in init state);
*) kid-control - use time format according to ISO standard;
*) l3hw - improved system stability;
*) l3hw - rate limit error logging;
*) leds - fixed issue where interface LEDs might not properly disable in some cases;
*) log - added basic validation for "disk-file-name" property;
*) log - added hostname support to remote logging action;
*) log - added regex parameter for log filtering in rules;
*) log - use time format according to ISO standard;
*) lte - added option to check/install modem firmware from early-access/testing channel (CLI only);
*) lte - added provider specific firmware update (FOTA) for Cosmote GR networks on Chateau 5G;
*) lte - disabled ims service for Chateau 5G on operator "3 AT" network (PLMN ID 23205);
*) lte - drop operator selection support for R11e-4G modem as it is unreliable;
*) lte - fixed "default-name" property in export when multiple LTE interfaces are used;
*) lte - fixed "lte monitor" signal reporting for RG520F-EU modem when connected to 5G SA network;
*) lte - fixed "operator" setting for EC200A-EU modem;
*) lte - fixed long "PLMN search in progress" for SXT 3-7;
*) lte - fixed LTE band setting for SXT LTE 3-7;
*) lte - fixed network registration for R11e-4G modem (introduced in v7.17beta2);
*) lte - fixed roaming barring (allow-roaming=no) for EC200A-EU modem;
*) lte - fixed signal info reporting for FG621-EA modem in UMTS network;
*) lte - fixed SMS sender parsing;
*) lte - improved modem FW upgrade for Chateau 5G;
*) lte - improved R11eL-EC200A-EU modem firmware upgrade procedure;
*) lte - improvements to modem "firmware-upgrade" command (additional fixes);
*) lte - MBIM increased assignable APN profile count up to 8 then modem firmware allows it;
*) lte - modem firmware update (FOTA), added support to install provider specific version (additional fixes);
*) lte - removed trailing "F" symbol from uicc;
*) lte - set "sms-read=no" and "sms-protocol=auto" as default values;
*) lte - set IPv6 address reporting format in modem init for AT modems and MBIM modems with AT channel;
*) mac-server - allow MAC-Telnet access through any bridged port when bridge interface is allowed;
*) mac-telnet - use ASCII DEL as erase/backspace char instead of BS (fixes mac-telnet backspace for WinBox4);
*) macvlan - improved error when trying to create new interface on already busy parent interface;
*) macvlan - updated driver;
*) modem - KNOT BG77 modem, improved handling of modem unexpected restarts;
*) mpls - added fast-path support for VPLS (additional fixes);
*) mpls - added MPLS mangle support;
*) mpls - added support for "ICMP Fragmentation needed";
*) mpls - do no drop LDP peering session on PW deactivation;
*) mpls - do not reconnect VPLS on name or comment changes;
*) netinstall - removed unused "Get key" button;
*) netinstall - save and restore device-mode configuration on format;
*) netinstall-cli - added "-o" option to install devices only once per netinstall run;
*) netinstall-cli - fixed x86 detection;
*) netwatch - fixed probe toggle when adding a comment;
*) ospf - fixed memory corruption;
*) ospf - improved stability on configuration update;
*) ovpn - added VRF support to OVPN server (server menu now supports multiple entries and previous server configuration is automatically imported);
*) ovpn - improved system stability;
*) ovpn-client - added tls-crypt, tls-crypt-v2 support;
*) ovpn-server - added "user-auth-method" property and allow mschap2 for RADIUS authentication;
*) pimsm - improved system stability after interface disable;
*) poe-out - added low-voltage-too-low status;
*) poe-out - upgraded firmware for CRS354-48P-4S+2Q+ device (the update will cause brief power interruption to PoE-out interfaces);
*) poe-out - upgraded firmware for PSE (BT) controlled boards (the update will cause brief power interruption to PoE-out interfaces);
*) port - display a warning when using invalid log-file with the "remote-access" feature;
*) port - more detailed print command output, include in "USED-BY" property channel number(s);
*) ppp - add routes in matching VRF;
*) ppp - added support for bridge-port-pvid configuration via ppp profile (additional fixes);
*) ppp - added support for bridge-port-trusted configuration via ppp profile;
*) ppp - do not print local/remote pool related errors in log when configuration does not require pool usage;
*) ppp - fixed typos in log message;
*) ppp - reuse link-local IPv6 address for static bindings when possible;
*) ppp - set APN/PDN type "IPv4/v6" according assigned PPP profile protocol setting;
*) pppoe - added support for PPPoE server over 802.1Q VLANs (additional fixes);
*) profiler - classify ppp processing;
*) profiler - improved process classification;
*) profiler - renamed radv process to radvd;
*) ptp - added dynamic switch ACL rules in order to trap PTP packets to CPU instead of forwarding;
*) ptp - added option to configure L2 transport with forwardable and non-forwardable MAC destination;
*) ptp - added PTP support for CRS320-8P-8B-4S+ and CRS326-4C+20G+2Q+ devices;
*) ptp - display warning when none of the PTP ports has a link;
*) ptp - fixed DSCP values for IPv4 packets;
*) ptp - fixed synchronization on QSFP28 interfaces (additional fixes);
*) ptp - make PTP process more stable and deterministic when applying configuration;
*) ptp - restrict configuring g8275 profile with IPv4 transport;
*) qos-hw - allow to disable/enable profiles, disabled or removed profile gets replaced with the default (additional fixes);
*) qos-hw - enabling PFC on port also requires setting egress-rate-queueN;
*) qos-hw - fixed export when changing default Tx Manager;
*) qos-hw - fixed incorrect port byte-use counter;
*) qos-hw - improved PFC behavior (additional fixes);
*) qos-hw - improved WRED and ECN behavior (additional fixes);
*) qos-hw - rename pfcN-pause and pfcN-resume to pfcN-pause-threshold and pfcN-resume-threshold;
*) qos-hw - reworked PCP and DSCP mapping (now supports single, multiple and range values, previous configuration with minimal value mapping is converted to a single value);
*) qos-hw - switch-cpu port trust settings are forced to "keep";
*) queue - improved system stability when too many simple queues are added;
*) quickset - added "LTE AP" quickset profile with one wifi interface;
*) rip - improved stability when changing metric;
*) romon - added dynamic switch rules on devices supporting it when enabling the service;
*) romon - added interface-list support;
*) rose-storage - allow to set iscsi-iqn only when type=iscsi and allow nvme-tcp-name only when type=nvme-tcp;
*) rose-storage - do not allow to format exported disks;
*) rose-storage - enable autocomplete for local-path property in "/file/sync" menu;
*) rose-storage - enable more threads for faster RAID sync;
*) rose-storage - ensure unique nvme-tcp-names for nvme-tcp clients;
*) rose-storage - improved error messages;
*) rose-storage - improved system stability;
*) rose-storage,raid - improved stability of degraded arrays on startup;
*) rose-storage,raid - store superblock in 1.2 format, show raid super block info when detected to help with reassembling arrays;
*) route - fixed discourse attribute print;
*) route - fixed minor typo in failure message;
*) route - fixed possible issue with inactive routes after reboot (introduced in v7.16);
*) route - improved stability;
*) route - increased interface name length limit in log messages;
*) route - removed possibility for IPv6 routes to specify interface in the dst-address;
*) routerboot - fixed boot MAC for devices with Alpine CPU ("/system routerboard upgrade" required);
*) routerboot - fixed boot MAC for MIPSBE CRS3xx and CRS5xx switches ("/system routerboard upgrade" required);
*) routerboot - improved stability for IPQ8072 and IPQ6010 when flash-boot is used ("/system routerboard upgrade" required);
*) routing-filter - fixed subtract and add for numerical values (+x, -x);
*) rsync - fixed when used over ssh and spaces in directory names;
*) sfp - fixed 1Gbps supported rate for RB960 and RB962 devices;
*) sfp - fixed linking with 1Gbps optical modules with "combo-mode=sfp" configuration for CRS312 device;
*) sfp - improved initialization and linking for some SFP modules;
*) sfp - improved initialization for certain SFP modules on CRS309 and CRS317 devices ("/system routerboard upgrade" required);
*) sfp - improved power control configuration for QSFP optical modules according to the EEPROM field;
*) sfp - improved SFP auto-negotiation for L22, L23 devices;
*) sfp - improved SFP28, QSFP28 interface stability using DAC cable for CRS520 switch;
*) smb - stability improvements for client/server (additional fixes);
*) snmp - added wifi fields to MIKROTIK-MIB (additional fixes);
*) socks - fixed comment property for access configuration;
*) ssh - added option to configure SSH ciphers (replaced allow-none-crypto parameter);
*) ssh - do not regenerate host key after update from RouterOS version older than 7.9;
*) ssh - fixed password authentication (introduced in v7.17beta2);
*) ssh - improved logging;
*) ssh - improved speed;
*) ssh - prefer GCM ciphers for arm64 and x86 devices when ciphers=auto;
*) ssl/tls - improved performance;
*) sstp - added pfs=required option to allow only ECDHE during TLS handshake;
*) storage - preserve permissions,owners,attributes when syncing under "/file/sync";
*) storage,rsync - fixed to work with clients passing "-a" option;
*) supout - added BGP advertisements section;
*) supout - added device-mode section;
*) supout - do not create autosupout.rif for second time after system reboot;
*) supout - print non BGP and OSFP routes if route list is too large;
*) supout - reduce minimal RAM required for export to be included;
*) supout - use separate LTE section;
*) switch - added "all" argument for "new-dst-ports" switch rule property for CRS3xx, CRS5xx, CCR2116 and CCR2216 devices;
*) switch - added IPv6 flow label matching in switch rules for CRS3xx, CRS5xx, CCR2116 and CCR2216 devices;
*) switch - allow bond interfaces in switch rules for CRS3xx, CRS5xx, CCR2116 and CCR2216 devices;
*) switch - allow matching network bitmask for IPv4 and IPv6 dst/src-address properties in switch rule;
*) switch - disallow switch-cpu in "ports" and "new-dst-ports" rule properties for CRS3xx, CRS5xx, CCR2116, CCR2216 and RB5009 devices;
*) switch - fixed L2MTU for 25Gbps ports;
*) switch - fixed RSPAN error message when using mirror-target=cpu;
*) switch - fixed rule disable in certain cases for 98DX224S, 98DX226S, and 98DX3236 switch chips;
*) switch - fixed storm-rate accuracy on 98DX224S, 98DX226S, and 98DX3236 switch chips;
*) switch - force "mac-protocol" when matching IPv4 or IPv6 specific properties;
*) switch - improved CPU performance for CRS328-24P-4S+ switch;
*) switch - improved system stability for RB5009 and CCR2004-16G-2S+ devices;
*) switch - make switch rule "ports" property not required and unsettable (allows matching packets on all switch ports);
*) switch - updated dynamic switch rules when using HW bridge with IGMP snooping (224.0.0.0/24 and ff02::/16 destination addresses are forwarded and copied to CPU) (additional fixes);
*) system - make ICMP error source address selection configurable (icmp-errors-use-inbound-interface-address parameter in ip settings);
*) system - make TCP timestamp handling configurable (tcp-timestamps parameter in ip settings);
*) system - moved "/system/upgrade" to "/system/package/local-update";
*) tftp - improved stability;
*) upnp - rename service description file from gateway_description.xml back to gateway.xml;
*) user-manager - improved stability;
*) vpls - added support for bridge-pvid configuration;
*) vrf - fixed packet handling with enabled queues;
*) vxlan - fixed issue causing to loose IPv6 VTEP address setting;
*) webfig - added search option for settings;
*) webfig - allow download from file details;
*) webfig - fixed uploading files with Windows style newlines;
*) webfig - hide inherited wifi password;
*) webfig - improved keyboard navigation (additional fixes);
*) webfig - reduce flickering when table is sorted by column with duplicate values (additional fixes);
*) webfig - Skin Designer moved to centralized page;
*) webfig - status page is deprecated, old status page config will work, but can't be updated or created;
*) webfig - support unicode strings;
*) wifi - add information to each interface, showing which CAPsMAN manages it or which CAP hosts it when applicable;
*) wifi - added a debug log entry when switching channel;
*) wifi - added ability to set security.owe-transition-interface to "auto";
*) wifi - added access-list stats (CLI only);
*) wifi - added configuration.installation property to limit use of indoor-only channels;
*) wifi - added debug log messages on station authentication mismatch;
*) wifi - added extra info to CAPsMAN about message;
*) wifi - added last-activity property in registration table;
*) wifi - added multi-passphrase (PPSK) support (CLI only);
*) wifi - added option to reset MAC address (CLI only);
*) wifi - added station-roaming support (additional fixes);
*) wifi - allow IPv6 LL address in caps-man-addresses;
*) wifi - disabled 802.11h on 2.4GHz station;
*) wifi - fixed "disabled" property in certain cases;
*) wifi - fixed failure to resume operation after DFS non-occupancy period has elapsed;
*) wifi - fixed failure with "auto" peer update on the OWE interface;
*) wifi - fixed occasional failure to bring up management frame protection and channel switch capabilities;
*) wifi - fixed the "no available channels" message still being displayed after a setting change has made some channels available;
*) wifi - improved FT roaming with WPA3 for some Apple devices;
*) wifi - indicate radios' ability to perform a channel switch in their "hw-caps" attribute;
*) wifi - indicate which channels are subject to DFS, or are indoor-only in output of "monitor" command;
*) wifi - re-word the "SA Query timeout" log message to "not responding";
*) wifi - show authentication type and wireless standard used by each client in registration table;
*) wifi - show regulatory limits on maximum bandwidth in output of radio/reg-info command;
*) wifi - when operating in station mode, log more information when AP switches to an unsupported channel;
*) wifi-qcom - added Superchannel country profile;
*) wifi-qcom - updated regulatory info for Ukraine, Australia and United States;
*) wifi-qcom-ac - allow use of channel 144 under "Japan" regulatory domain;
*) wifi-qcom-ac - fix possible conflict between radio and USB initialization on hAP ac2;
*) wifi-qcom-ac - improved CPU load balancing and system stability;
*) winbox - added "Scan" and "Test Disks" features under "System/Disks" menu;
*) winbox - added Enable/Disable buttons under "Tools/Graphing" menus;
*) winbox - added MAC address support for "Group" property under "Bridge/MDB" menu;
*) winbox - added missing properties under "IP/Neighbors" menu;
*) winbox - allow to edit Ethernet MAC address;
*) winbox - fixed duplicate timezone names;
*) winbox - fixed typo in "System/Reset Configuration" menu;
*) winbox - improved stability;
*) winbox - minimal required version is v3.41;
*) winbox - refresh values under "Bridge/VLANs/MVRP Attributes" menu;
*) winbox - renamed and moved "System/Auto Upgrade" to "System/Packages" menu;
*) winbox - renamed wrong invalid interface flag to inactive;
*) winbox - show MLAG settings for CRS326-4C+20G+2Q+ device;
*) wireguard - do not initiate handshake when peer is configured as responder;
*) wireless - added option to reset MAC address (CLI only);
*) wireless - added vlan-id to registration-table;
*) wireless - allow to set Canada2 country profile when locked with US lock package for CubeG device;
*) wireless - enable all chains by default for RB911 and RB922 series devices;
*) wireless - fixed antenna gain for SXT5ac device;
*) wireless - preserve configured country while using setup-repeater, added "country" argument (CLI only);
*) x86 - Realtek r8169 updated driver;
*) zerotier - added debug logging;
*) zerotier - do not show default settings in export;
*) zerotier - upgraded to version 1.14.0;

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, please send a supout file from your router to support@mikrotik.com. File must be generated while a router is not working as suspected or after some problem has appeared on the device

Please keep this forum topic strictly related to this particular RouterOS release.

Why are all of my unused network ports now marked with red "not running" errors in WinBox and matching comments in "/interface/bridge/export" output? Unused ports is not an error. I'm not going to remove these ports from the bridge just because there isn't something plugged into them at the moment.

Note that this is not specific to WinBox, else I might believe it's a 4.0beta12 issue instead. I believe it might have appeared in 7.17beta6, not rc1. (Why the rush on getting to RC, by the way?)

It's happening with all three devices here, from very different points in the MT lineup.

Ah, finally a way to manually set link local address! :D

*) ipv6 - added support for manual link-local address configuration;

Why are all of my unused network ports now marked with red "not running" errors in WinBox and matching comments in "/interface/bridge/export" output? Unused ports is not an error. I'm not going to remove these ports from the bridge just because there isn't something plugged into them at the moment.

Yes, that is a bad thing... It may make sense when printing information, but it is terrible for exports. This will cause differing output in export when ever a cable is connected or disconnected, or a wireless client is connected or disconnected. I want to see real configuration changes there only. Exclusively.

I like the colorization, but that's it. Agree with @eworm, it should not be in an export. And not sure the "extra" comments are needed in winbox/webfig if it's already colorized (but the color is kinda handy).

""Yes, that is a bad thing... It may make sense when printing information""

It's bad when just printing too, because "comments" break tabulation, and make the output a lot harder to parse

In the new webfig, I'm not sure the skin designer is working. I cannot seem to figure out how to create a new skin. When I do a "Design Skin", it shows a blank list and I don't see anyway to select things. Either I'm missing something in how to use new webfig's skin support, or it just is broken.

Also, given the device-mode and password are no longer null... can you finally remove the default "admin" username in webfig login screen (since ideally never be admin, and means editing the username every time).

I am running 7.17rc on my 4 HAPAX3 here ... 1 is CAPsMAN, 3 are CAP
All works fine here, about 30 active wifi clients, mostly Apple, some W11, some IOT. No issues

WebUI is nice.
Dark mode is pleanned ?

/graphs need a relooking too.

Is it normal on RB5009 to have this value as no ?

Is it normal on RB5009 to have this value as no ?

Code: Select all

                                 
[admmikrotik@router70a] > /system/device-mode/print 
                 mode: advanced     
           ......
          routerboard: no           

Yes...read the thread.

impossible that webfig skin designer is broken in a RC release.

impossible that webfig skin designer is broken in a RC release.

There was another thread where someone else in beta4 had the same issue. I'll note that it does work fine on a KNOT running 7.17rc1, but I reset the default configuration with the first 7.17 beta on the KNOT. But on the RB1100AHx4, it never show anything - main difference (other platform/arch) is that test RB1100 has been only upgraded, and never netinstalled/reset-configuration ever.
But this is what the RB1100AHx4 shows:

On my CCR2116-12G-4S+, I can no longer connect to L2TP over IPsec VPN server with 7.17. Reverting to 7.16.1 fixed the problem.

*) netwatch - added "ignore-initial-up" and "ignore-initial-down" properties;

what exactly this does?

@webfig: maybe you need to clear browser cache (or open devtools by F12 and disable cache). Just to be sure it is not missing browser cache invalidation in webfig.

What's new in 7.17rc1 (2024-Nov-22 11:42):

*) health - removed board-temperature on RB5009UPr+S+IN device;

Why is it deleted? Is this value going to come back?

Do I understand that in previous versions the data was fictitious?

I had a strange behaviour after updating my both CHR CAPsMAN (AX) from 7.17beta6 to 7.17RC1. Both devices lost their CAPsMAN config. All entries were emty (wifi -> Config, Channel, Security, datapath aso.)
Next I tried to re-import the settings from an RSC-file, but the import hangs while importing the channel-config.
My only solution was to revent an snapshot back to 7.16.1. :-/

that's frightening 🙀

updated now a HAP AC2 from 7.16.1 to 7.17 RC.. All ok but I'm noticing a free space of only 192 KB, before the update I had about 450 Kb free. The only package I have is ROS and wifi-qcom-ac. I have no residues of old configurations as the 7.16.1 was reset from scratch for another problem not related to ROS. Mine is just a report, I don't know if this represents an actual problem.

I also wanted to thank Mikrotik for listening to us regarding the restrictions that were initially implemented in the first versions of 7.17, it would be even more beautiful if in the near future through this forum you could compare with us end users regarding advice and opinions on a new RB device ;) ;)

I noticed that when a DNS forwarder is set up with DoH servers, but DoH server is not used in the DNS settings, forwarding does not work. Is this how it's supposed to work?

I noticed that when a DNS forwarder is set up with DoH servers, but DoH server is not used in the DNS settings, forwarding does not work. Is this how it's supposed to work?

Yes, according to docs these forwarders are used for DNS FWD entries only.

Anybody give an OK for Hap ax2 running capsman, I wouldn't want my config to explode!

Here, I have my 4 HAPAX3 running 7.17rc. Three is CAP, and one is CAPsMAN.
With roughly 30 active wifi clients—mostly Apple, some W11, and some IOT—everything is operating smoothly here. No problems Tiblor

Cheers Nick

Anybody give an OK for Hap ax2 running capsman, I wouldn't want my config to explode!

You can try it without harm. Repartition the hapax2 with two partition, on part0, stay 7.16.1, copy that onto part1 and switch to part1, then upgrade it to 7.17. If it is messed up itself, you can switch back to part0.

Anybody give an OK for Hap ax2 running capsman, I wouldn't want my config to explode!

You can try it without harm. Repartition the hapax2 with two partition, on part0, stay 7.16.1, copy that onto part1 and switch to part1, then upgrade it to 7.17. If it is messed up itself, you can switch back to part0.

I'm not sure that help... Maybe? But it be predicated on unlocking device-mode to change the partition to "switch partition" once at 7.17. So if it theoretically didn't boot, you won't be able to switch.

Cheers Nick

Keen to hear how you get on here!

The new webfig has a similar problem to winbox4 where that status/flags are very difficult to interpret. For example, LINK OK and NO LINK are radically different states - yet the only difference is the text inside.
Being disabled/reversed is what old webfig did and it was far more readable. Or perhaps using colors and/or being positional by state allow you can "see" the different states more visually.

bug report:
Files window is empty in version 7.17rc1 (whatever WinBox v3.x or v4.x), but more than 30000 files could be shown in version 7.16.1.

syue87, Arthur2000 - Please send supout file from your router to support@mikrotik.com.
deadmaus911 - We will look into this forwarders issue.
Ullinator - Please send supout file from your router to support@mikrotik.com. If you refer to the old CAPsMAN - are you sure that wireless package is installed?

In some cases, editing the <default.json> file incorrectly can cause the web page to become inaccessible. However, what surprises me is that the Winbox client also crashes directly. Why does the Winbox client share the same JSON file with the web interface? I can't understand this design choice.

Why does the Winbox client share the same JSON file with the web interface? I can't understand this design choice.

It is possible to create a "skin" ... like hiding certain interface items. And at least winbox 3 did conform to those skin settings. Which probably means that winbox is supposed to read that same JSON. As to crashing due to incorrect settings ... that's something shouldn't happen.

You can try it without harm. Repartition the hapax2 with two partition, on part0, stay 7.16.1, copy that onto part1 and switch to part1, then upgrade it to 7.17. If it is messed up itself, you can switch back to part0.

I'm not sure that help... Maybe? But it be predicated on unlocking device-mode to change the partition to "switch partition" once at 7.17. So if it theoretically didn't boot, you won't be able to switch.

I've just updated My Hap ax2 with the following settings via the normal upgrade path.

Why does the Winbox client share the same JSON file with the web interface? I can't understand this design choice.

It is possible to create a "skin" ... like hiding certain interface items. And at least winbox 3 did conform to those skin settings. Which probably means that winbox is supposed to read that same JSON. As to crashing due to incorrect settings ... that's something shouldn't happen.

What's even more unbelievable is that resetting doesn't resolve the issue, the client keeps crashing, and the only solution is to use Netinstall. Therefore, everyone must remember not to edit the default default.json file. Always create a new JSON file for editing. Never modify the skin files used by the administrator!

just delete the default.json file. did this not help?

device mode with partitions=no only denies creating new partitions, you can still switch partitions like you used to do

And probably delete partitions is restricted as well.

*) winbox - added "Copy to Access List" option under "WiFi/Registration" menu;

YES! Finally this is back.
Thanks Mikrotik!

(adding also the IP address per client in the registration table, as it was in ROS6, would be fantastic).

Updated from 7.16.1, hAP ax^3. Everything works except there was an ovpn server created (not by me); this was reported by someone in one of the earlier betas.

See the changelog:

*) ovpn - added VRF support to OVPN server (server menu now supports multiple entries and previous server configuration is automatically imported);

That first OVPN server that you have is the default server, same as there was one before.

*) winbox - added "Copy to Access List" option under "WiFi/Registration" menu;

YES! Finally this is back.
Thanks Mikrotik!

(adding also the IP address per client in the registration table, as it was in ROS6, would be fantastic).

I seem to remember that in (one if the) previous Capsman(s) there was even name from dhcp server if client registers one.
I'd love to see that next to MAC in Registration table...

syue87, Arthur2000 - Please send supout file from your router to support@mikrotik.com.
deadmaus911 - We will look into this forwarders issue.
Ullinator - Please send supout file from your router to support@mikrotik.com. If you refer to the old CAPsMAN - are you sure that wireless package is installed?

done.
SUP-172313

See the changelog:

*) ovpn - added VRF support to OVPN server (server menu now supports multiple entries and previous server configuration is automatically imported);

That first OVPN server that you have is the default server, same as there was one before.

I'd like to add this:

This shows you the "default configuration". One disabled ovpn-server was/is always there - even if you do not use ovpn server at all.

first time seeing the DEVICE MODE. upgrading from beta2, this was a nightmare.
it didn't want to upgrade by simply copying the npk into files. when i wanted to reboot it into netinstall - it said DEVICE MODE doesn't allow me to do it ! after checking which device mode i'm in - i'm in advanced mode. why it wouldn't let me change boot mode in advanced mode?

then i had to netinstall it manually - and it went back to using the DEVICE PASSWORD that is on the sticker on the device itself. really!? can that default password somehow be deleted forever so it doesn't pop up after 5 years again? because if that happens again, i'll just throw the device in the garbage out of stress.

One disabled ovpn-server was/is always there - even if you do not use ovpn server at all.

Configuration is upgraded and new server is created only if in older version at leat one parameter in server configuration was set by you to non-default value.

can that default password somehow be deleted forever so it doesn't pop up after 5 years again?

You can set a custom configuration with help of branding, or you can choose not to apply default configuration in Netinstall.

One disabled ovpn-server was/is always there - even if you do not use ovpn server at all.

Configuration is upgraded and new server is created only if in older version at leat one parameter in server configuration was set by you to non-default value.

Word. I am going to observe/check once 7.17 final arrives and I upgrade my devices.

One disabled ovpn-server was/is always there - even if you do not use ovpn server at all.

Configuration is upgraded and new server is created only if in older version at leat one parameter in server configuration was set by you to non-default value.

There's the certificate parameter that, once set, can no longer be removed anymore.

The new webfig has a similar problem to winbox4 where that status/flags are very difficult to interpret. For example, LINK OK and NO LINK are radically different states - yet the only difference is the text inside.

Being disabled/reversed is what old webfig did and it was far more readable. Or perhaps using colors and/or being positional by state allow you can "see" the different states more visually.
Screenshot 2024-11-22 at 7.31.38 PM.png

Agreed.

While I appreciate the desire to "modernify" things, let's not do "fancy new stuff" at the cost of usability and "muscle memory" loss.

Graphic designers (and the bosses who approve their decisions) almost never seem to be the type of people who have to use the stuff they design, particularly when under pressure (network down, clients mad, etc.). When you're "under the gun," so to speak, you don't have time to "read" all the words. Your eyes scan the interface for visual clues like different colors, shapes, icons, etc.

In other words, making everything look the same makes it harder to use the product, not easier.

I will repeat my requests from the WinBox 4 thread: we need visual cues like contrast and separation (lines, alternating colors/grays) with such an information-dense environment.

can that default password somehow be deleted forever so it doesn't pop up after 5 years again?

You can set a custom configuration with help of branding, or you can choose not to apply default configuration in Netinstall.

can you elaborate the 1st part? i'm used to mikrotik devices not having a default password. i want the ones i admin to be the same. i'll change the password later on, but the default one should be empty.

In other words, making everything look the same makes it harder to use the product, not easier.

I will repeat my requests from the WinBox 4 thread: we need visual cues like contrast and separation (lines, alternating colors/grays) with such an information-dense environment.

1000% agree. I don’t mind a redesign but usability suffers greatly in this new “look” vs the traditional webfig, by FAR. The colors/contrast between buttons/items in the old design was a huge assist. The display was also “denser” and I could see more at a glance compared to this newfangled design…

first time seeing the DEVICE MODE. upgrading from beta2, this was a nightmare.
it didn't want to upgrade by simply copying the npk into files. when i wanted to reboot it into netinstall - it said DEVICE MODE doesn't allow me to do it ! after checking which device mode i'm in - i'm in advanced mode. why it wouldn't let me change boot mode in advanced mode?

then i had to netinstall it manually - and it went back to using the DEVICE PASSWORD that is on the sticker on the device itself. really!? can that default password somehow be deleted forever so it doesn't pop up after 5 years again? because if that happens again, i'll just throw the device in the garbage out of stress.

/system/device-mode settings were applied when you upgraded to 7.17beta2, which is why you are having difficulty on 7.17rc1 after not reading the notes and help pages.

https://help.mikrotik.com/docs/spaces/R ... evice-mode

You didn't have to netinstall to update to 7.17rc1 — you could have just changed your device mode settings.

As for the password when you reset to default, the password is algorithmically assigned based on the product serial number of the device. That was done a while back for newer devices as part of the legislative directives in many locales about not having a static trivial password like "admin" or "default" or <blank/no password> as you may have recalled from the past. The default password on newer devices when reset is unique to your device and was included on the sticker in the leaflet in the box.

Personally, I always think it's a good idea to understand what has changed in (especially beta) software you are installing so as to not get angry over changes that were stated at the time of the beta release…

first time seeing the DEVICE MODE. upgrading from beta2, this was a nightmare.
it didn't want to upgrade by simply copying the npk into files. when i wanted to reboot it into netinstall - it said DEVICE MODE doesn't allow me to do it ! after checking which device mode i'm in - i'm in advanced mode. why it wouldn't let me change boot mode in advanced mode?

then i had to netinstall it manually - and it went back to using the DEVICE PASSWORD that is on the sticker on the device itself. really!? can that default password somehow be deleted forever so it doesn't pop up after 5 years again? because if that happens again, i'll just throw the device in the garbage out of stress.

I agree

The randomized device password on the bottom of the device on "enterprise" series equipment is bullshit. After 12-years we're DONE with MikroTik and slowly moving away, moving to another vendor [Camb...] for these set of customers. [Portion of customers we dont deploy Meraki or Fortinet]

Device-mode, and the randomized password.

We cannot even set a new admin password on reset, have to keep track of EVERY customer MikroTik device - documented/noted in-case device is factory reset.

IE: We had this issue when resetting for CAPS mode, device would have sticker password. Huge pain in ass.

Until MikroTik pulls head out of their ass with this added layer of complexity. They need to look to what other vendors are doing.

For the hAP or SOHO series, sticker password is fine for residential consumers.
CCR, Enterprise level hardware from MikroTik -- we have to ask our Distributors for the device password after purchase, and have it well documented.

Then any outdoor equipment that is exposed to weather and elements. That sticker will fade and not hold up.... RIP

I must say.

if MIkroTik would ADOPT a CLOUD provisioning portal for us WISP/SOHO/Enterprise - make it licensed or free. This would ALL be resolved. We can register the serial and then perform the configuration. That way device is locked to a controller or management, locally made changes will not persist reboots. This is what other vendors do.

Following all the v7.17 topics, between various complaints, it's not clear what are the know issues.
Couple release ago we had an improvement in the changelog, a step further would be nice, as example take a look at TrueNAS or Uptime-Kuma release notes.
https://www.truenas.com/docs/core/13.0/ ... easenotes/
- New features
- Improvement
- Bug
- Know issues
are perfectly understandable.

@Normis is trying a better approach with Winbox 4.
Manual edit of the first post form EdPa, Guntis or other experts is a good start, not only for consumers but also for expert who can't experience issues.
Sometimes @Normis and support suggest to "try" beta release but something could be fixed and else broken.

Thanks!

DEVICE MODE and blocked some features/services/functions - are NIGHTMARE.
MikroTik Team should withdraw that "feature" or leave default enabled all functions.

Following all the v7.17 topics, between various complaints, it's not clear what are the know issues.

Agree on known issues for beta, but by "rc", ideally there shouldn't be any.

Now device-mode does deserve "top billing" with the !) since it changes behavior...

Has anyone gotten

*) dhcpv6-server - added IPv6 address delegation support;

working yet? I see in Winbox where there is now an Address Pool setting. But I can't seem to figure out what the settings for the Pool need to be. It was mentioned in the Beta thread that the prefix length should be 128, but if you attempt to create a pool with prefix-length=128 you get "failure: up to 63bit prefix blocks are supported!"
Does the Interface need a global address, or do I leave it with just it's Link Local address?

Address pool must be /64 or smaller to be divided into /128 prefixes. Currently, IPv6 pool does not support "more prefixes" per pool.

Has anyone gotten

*) dhcpv6-server - added IPv6 address delegation support;

working yet? I see in Winbox where there is now an Address Pool setting. But I can't seem to figure out what the settings for the Pool need to be. It was mentioned in the Beta thread that the prefix length should be 128, but if you attempt to create a pool with prefix-length=128 you get "failure: up to 63bit prefix blocks are supported!"
Does the Interface need a global address, or do I leave it with just it's Link Local address?

Those of you who tried early BETA versions will have entirely different behavior of device mode and other functions. Do not upgrade your production devices to BETA versions to avoid undesired behavior. The experience of upgrading stable to stable will be different. The point of beta versions is to test features, report issues etc. which is why features such as device mode can get entirely different functionality during the beta phase. If you are not prepared for testing and failing, please do not install the betas.

Really hope you made a supout.rif file and sent to support, before downgrading back to beta

"... The default password on newer devices when reset is unique to your device and was included on the sticker in the leaflet in the box. ..."
But only for a while before you lose the box and the labels with your fingers when you download them, like on my ac2. . .

lubomirs, how many things can you lose, especially if you know those things are important? put them in a safe!

label is on 3 different things: device, box, instruction sheet.
password is also available online in your account (or at the distributor).

Upgraded home-RB5009 from 7.17beta6 to rc1, containers, capsman, ...
Winbox3.41

- lots of dialogs with empty info at first (Files, Wireless Registration, Capsman Remote Cap, DHCP Lease, ...). Only after sometimes minutes the info came through.
- some containers started, some not. No reason visible why.
- change of settings on some items not saved
- disconnects from Winbox after some minutes, restores connection and then disconnects again after some minutes.
- overall it feels incredibly sluggish.

Reverted back to 7.17beta6. All normal again.

I had 100% same issue few times now on HAP AX3 after some beta updates where exactly everything was empty as you described, i couldnt create supout no matter how i tried.

Without RIF file, we can't fix issues that only some people have observed.

password is also available online in your account...

How? I don't see any option to add devices/passwords to my account...

If you bought the device from a distributor, not by yourself, you will have to ask the company you bought the device from

password is also available online in your account...

How? I don't see any option to add devices/passwords to my account...

What account are we talking about here? Did I miss something? I'm just a home user, an amateur, but a fan
You can't find a lot of things when downloading :-), but the point was that you can wipe the pressure on the AC2 label with your finger. . . .

Please read my responses, before asking the same thing again.
hAP ac2 is an older product. New product stickers are durable.

DEVICE MODE and blocked some features/services/functions - are NIGHTMARE.
MikroTik Team should withdraw that "feature" or leave default enabled all functions.

I'm inclined to agree...

The end of the year is coming, and so is Black Friday[1]

My suggestion would be something like:
In this upcoming version, implement this compartmentalization of features that is already proposed, but for now, let's go with all of them enabled (or at least almost all of them).
And for the first version of 2025, start selectively disabling the functions.

[1] For the love of God, they're not going to release a stable version on Black Friday like they did sometimes in the past... It's already a hectic day in the life of every network operator... Another little surprise as a software update wouldn't be pleasant.

And ??
You're not letting updates pass through automatically, are you ?
What's the issue then ?

Me? No! I do not!

I don't know if I've ever mentioned this before.
But I really like sleeping! And I hate being woken up in the middle of the night.
Yeah, I know, it's a contradiction for someone who works in Telecommunications, right?

Well, like I said... I don't let updates pass through automatically.

But it's a fact that as ASN operators, the stability of the networks we operate ends up being more influenced by the actions of third parties than by our own.
And since I serve several networks that use RouterOS, the choice of freezing or not ends up directly influencing the interruptions to my sleep...

I don't know if I've ever mentioned this before.
But I really like sleeping! And I hate being woken up in the middle of the night.

You slacker! To the mines with You!
HUEHUEHUE BR BR BR

Address pool must be /64 or smaller to be divided into /128 prefixes. Currently, IPv6 pool does not support "more prefixes" per pool.

Has anyone gotten working yet? I see in Winbox where there is now an Address Pool setting. But I can't seem to figure out what the settings for the Pool need to be. It was mentioned in the Beta thread that the prefix length should be 128, but if you attempt to create a pool with prefix-length=128 you get "failure: up to 63bit prefix blocks are supported!"
Does the Interface need a global address, or do I leave it with just it's Link Local address?

I'm still not understanding somehow. I interpret what you said to be: So, could you give an example of creating a pool that will work as an address pool?

Without RIF file, we can't fix issues that only some people have observed.

Funny, i just upgraded SXTsq to 7.17rc and same thing happend, all menus empty and winbox keeps disconnecting over ip, mac or romon, dont know how to give you any usefull log...

Ah, finally a way to manually set link local address! :D

*) ipv6 - added support for manual link-local address configuration;

Now we just need a way to disable or remove the dynamic link-local address once we've set an administrative one. That's still not there.

My apologies for the "wrong" explanation. I did mean smaller than /64 - 65, 66, ...

Address pool must be /64 or smaller to be divided into /128 prefixes. Currently, IPv6 pool does not support "more prefixes" per pool.

I'm still not understanding somehow. I interpret what you said to be:

Code: Select all

[admin@TestMTik2] > /ipv6/pool add name=IA-Pool_2024-11-26 prefix=abcd:ef12:fffe:ffff::/64 prefix-length=128
failure: up to 63bit prefix blocks are supported!

So, could you give an example of creating a pool that will work as an address pool?

One disabled ovpn-server was/is always there - even if you do not use ovpn server at all.

Configuration is upgraded and new server is created only if in older version at leat one parameter in server configuration was set by you to non-default value.

I installed 7.16.1 from scratch on AC2 without default configuration, gradually applying my changes from the RSC file. Since I've been using ROS I've never used OpenVPN because I was using L2TP and now Wireguard. From 7.16.1 I switched to 7.17rc1 and I find a disabled OpenVPN server and, going to recheck my RSC backup files I don't have any OpenVPN entries. If I understand what you mean, if ROS during the upgrade did not detect any changes to the default configuration it did NOT create any OpenVPN server, but in my case it appeared anyway. Mine is just a report hoping to be of some help

Hi @strods and @normis, problem with device-mode with TR069 without physical access SUP-172578

Is it possible to provide a bit more information on this change?
*) ethernet - improved interface stability for RB4011 devices;
Which problem does it solve and when/why did it occur on previous versions.

*) ethernet - improved interface stability for RB4011 devices;

Any chance this fixes interface flapping which occurs when directly connecting to specific devices, like AVM 6591?

For device-mode, it’s not possible to get/print the value of activation-timeout in cli/script.
The device mode menu is not present on the last winbox beta.

SUP-172644

Is it possible to provide a bit more information on this change?
*) ethernet - improved interface stability for RB4011 devices;
Which problem does it solve and when/why did it occur on previous versions.

.
I have quite a few RB4011s and, to be honest, never faced any problems at all with ethernet interfaces stability or anything like that.

Just attempted to upgrade to 7.17 RC - have to rollback immediately. No devices will connect to 5 GHz - have no time to spend on further investigation, but something appears not to be OK for sure...

Just attempted to upgrade to 7.17 RC - have to rollback immediately. No devices will connect to 5 GHz - have no time to spend on further investigation, but something appears not to be OK for sure...

Next time choose a moment where you can do some investigation. There could be a perfect good reason (DFS scanning for 10 min?) why clients couldn't connect. As well provide relevant info like device model. Did you also upgrade firmware? What config are you using?

What's new in 7.17rc2 (2024-Nov-28 16:09):

!) webfig - redesigned HTML, styling and functionality (additional fixes);
*) bridge - added message for inactive port reason (additional fixes);
*) device-mode - added routerboard, install-any-version and partitions features (additional fixes);
*) dhcpv6-server - fixed DHCPv6 server "address-pool" property showing in command line as "unknown" when real value is "static-only";
*) dns - added option to create named DNS servers that can be used as forward-to servers (additional fixes);
*) file - improved service stability when processing a lot of files (introduced in v7.17rc1);
*) ipv6 - added support for manual link-local address configuration (additional fixes);
*) webfig - allow style.css and script.js in branding packages;
*) webfig - redirect "/help/license.html" to "/license.txt" for backwards compatibility;
*) winbox - clear "Value" field when unset under "IP/DNS/Static" menu;

Just attempted to upgrade to 7.17 RC - have to rollback immediately. No devices will connect to 5 GHz - have no time to spend on further investigation, but something appears not to be OK for sure...

Next time choose a moment where you can do some investigation. There could be a perfect good reason (DFS scanning for 10 min?) why clients couldn't connect. As well provide relevant info like device model. Did you also upgrade firmware? What config are you using?

Well, bad went to worse... My RB5009 router lost a lot of config when reverting... All leases are gone, DHCP is not responding to requests... Need to find a backup file and restore...

Router restored with backup... Now on to figure out what the heck has happened... Seems dangerous to revert from 7.17RC to 7.16 Stable...
Scary... Need to check that my AP´s config is also OK...
Seems like devices are now able to connect to 5G at least, something weird happened in 7.17RC...

Next time partition the router and copy partition before upgrade, then you can simply revert by switching partitions as long as the device isn't completely corrupted...

Will consider partitioning next time... My bad, though....

For device-mode, it’s not possible to get/print the value of activation-timeout in cli/script.
The device mode menu is not present on the last winbox beta.

SUP-172644

Same problem with RC2.

Activation is intended to be "started" while command is being viewed. Thus, the error is not some kind of parameter, but an informative message. Why would you need to get it into a variable?

Yes, device-mode is currently not implemented in GUI. These are not issues/bugs.

Activation is intended to be "started" while command is being viewed. Thus, the error is not some kind of parameter, but an informative message. Why would you need to get it into a variable?

Yes, device-mode is currently not implemented in GUI. These are not issues/bugs.

I need to get this value because the command /system device-mode update activation-timeout=1h ... is launch in a script (default custom configuration). I would like to modify this timeout when router is in "production" but i need to compare value for knowing if i need to run a new command.

Can Mikrotik staff add a feature for set device-mode parameters in branding package?

Next time partition the router and copy partition before upgrade, then you can simply revert by switching partitions as long as the device isn't completely corrupted...

partitioning is a great thing, but... it is not available everywhere, I wish to have it for CHR, but again... but... but... but...

Next time partition the router and copy partition before upgrade, then you can simply revert by switching partitions as long as the device isn't completely corrupted...

partitioning is a great thing, but... it is not available everywhere, I wish to have it for CHR, but again... but... but... but...

The user I replied to has an RB5009 which is well suited to partitioning.
Indeed it would be nice when it would be added to CHR as well, but usually CHR is run under a hypervisor and it already has features for snaphot or image backup.

Just tested with my RB5009 and upgrade to 7.17rc2 went without a problem. I did a config backup just in case.

My apologies for the "wrong" explanation. I did mean smaller than /64 - 65, 66, ...

I'm still not understanding somehow. I interpret what you said to be:

Code: Select all

[admin@TestMTik2] > /ipv6/pool add name=IA-Pool_2024-11-26 prefix=abcd:ef12:fffe:ffff::/64 prefix-length=128
failure: up to 63bit prefix blocks are supported!

So, could you give an example of creating a pool that will work as an address pool?

Requiring that the pool's prefix be longer than a /64 feels weird. The RFCs and IPv6 educational materials all stress assigning a /64 to a point-to-multipoint interface and even say to allocate a /64 when using a pair of /128s for a point-to-point link. But... This does work: Note: When I assigned an IPv6 Address from the IA-Pool to the DHCPv6 server's interface, it assigned abcd:ef12:fff0:ffff::0/128 to the interface, which is reserved as an anycast address for all routers on the link. While I doubt it will cause me any grief, I do think it's worth noting.

Just tested with my RB5009 and upgrade to 7.17rc2 went without a problem. I did a config backup just in case.

Which version did you come from, just curious..

cAP AX/hAP AX updated to 7.17RC2 from RC1 no problems to report.

Just tested with my RB5009 and upgrade to 7.17rc2 went without a problem. I did a config backup just in case.

Which version did you come from, just curious..

7.17beta2

Well, that planned netinstall came earlier then expected.
Wanted to partition my device for future mishaps. Completely bricked.

+1 here

Partitioning deleted the RouterOS Install, which made the router boot loop. (ax3)
Was on rc1 when i partitioned.

I also noticed if you do an export, the "remote-image" variable for containers won't be exported.
And it exported this bridge entry for me: Which it can't import since it doesn't understand what interface *9 is.

*) dhcpv6-server - added IPv6 address delegation support;

Do I understand it correctly that it's for RFC 8415 Section 6.2 DHCP for Non-temporary Address Assignment? Because if it is, then I agree with @RavenWing71 in that it should not have assigned the reserved anycast address (RFC 5453) nor restricted pool's prefix length to be >64.

I have upgraded from 7.17 beta to rc2 and I started to see strange connections to Mikrotik servers every 2-4 minutes:
I think it is related to "Cloud" DDNS settings as it uses same port - https://help.mikrotik.com/docs/spaces/R ... 9929/Cloud
I see there is also change in /IP/Cloud/DDNS Enabled settings - from 'On'/'Off' it changed to 'auto'/'yes' <lol>
Why Mikrotik would turn it on for all devices ?

After upgrading from 7.17rc1 to 7.17rc2 I am not able to connect to the container IP, even ping not working.

Any chance we could update to ZeroTier 1.14.2?
https://github.com/zerotier/ZeroTierOne ... E-NOTES.md

1.14.2 has multithreading if enabled!

Please MikroTik, check SUP-172111 before release 7.17 stable.
SMB is unstable with hAP ac2.
Thanks

In prior versions, this worked:


The intent behind this is to redirect all IPv6 DNS requests from the LAN to the local DNS server on the router in order to force them through the DoH path. I believe this stopped working with rc2.

I've fixed it by giving a to-address naming the full globally routable address of my router, but the problem with that is that my ISP has assigned a different /64 to me from one modem reboot to the next, and likely will again in the future.

I realize this ::1/128 address is somewhat ambiguous. (Localhost where?) What I really want is a way to specify the address of the local DNS server by way of the IPv6 address pool so that when DHCPv6 pulls a different PD, the firewall NAT rule tracks the change automatically.

I've fixed it by giving a to-address naming the full globally routable address of my router, but the problem with that is that my ISP has assigned a different /64 to me from one modem reboot to the next, and likely will again in the future.

You can alternatively add an ULA address to any of the router's interfaces (with Advertise unchecked) and use that as the fixed to-address target.

add an ULA address

Yes, that's a superior solution, because it solves a second, related problem: what to put in for "/ipv6/nd/set … dns=??" Before, I was using ::1 from my ISP-assigned GUA pool, but now I'm telling peers to send it to the ULA. Because the ULA range isn't advertised, none of them know they could be on that /64, but it doesn't matter because DNS is on the default router, and the router of course knows how to get packets to ::1 in the ULA scheme.

I'd still like to know why my old "localhost" scheme now fails, though.

If the setting is set to "auto", then it works as "disabled" unless you enable BTH functionality. If you enable BTH, then it will automtically enable Cloud service, since it can not work without it.

It seems that your router simply tried to reach Cloud. Maybe it was not reachable? Is it working just fine now?

Also, System/Clock time-zone-autodetect uses Cloud.
https://help.mikrotik.com/docs/spaces/R ... Updatetime

I have upgraded from 7.17 beta to rc2 and I started to see strange connections to Mikrotik servers every 2-4 minutes:
I think it is related to "Cloud" DDNS settings as it uses same port - https://help.mikrotik.com/docs/spaces/R ... 9929/Cloud
I see there is also change in /IP/Cloud/DDNS Enabled settings - from 'On'/'Off' it changed to 'auto'/'yes' <lol>
Why Mikrotik would turn it on for all devices ?

Code: Select all

2024-12-01 07:12:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:56093->159.148.147.201:15252, len 66
 2024-12-01 07:14:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:50341->159.148.172.251:15252, len 66
 2024-12-01 07:16:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:41291->159.148.147.201:15252, len 66
 2024-12-01 07:18:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:44424->159.148.172.251:15252, len 66
 2024-12-01 07:20:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:42243->159.148.147.201:15252, len 66
 2024-12-01 07:22:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:56078->159.148.172.251:15252, len 66
 2024-12-01 07:24:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:34422->159.148.147.201:15252, len 66
 2024-12-01 07:26:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:46383->159.148.172.251:15252, len 66
 2024-12-01 07:28:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:43185->159.148.147.201:15252, len 66
 2024-12-01 07:30:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:43861->159.148.172.251:15252, len 66
 2024-12-01 07:32:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:43470->159.148.147.201:15252, len 66
 2024-12-01 07:34:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:53107->159.148.172.251:15252, len 66
 2024-12-01 07:36:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:46675->159.148.147.201:15252, len 66
 2024-12-01 07:38:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:40088->159.148.172.251:15252, len 66
 2024-12-01 07:40:07 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:54119->159.148.147.201:15252, len 66
 2024-12-01 07:42:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:34392->159.148.172.251:15252, len 66
 2024-12-01 07:44:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:45126->159.148.147.201:15252, len 66
 2024-12-01 07:46:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:37292->159.148.172.251:15252, len 66
 2024-12-01 07:48:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:38440->159.148.147.201:15252, len 66
 2024-12-01 07:50:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:41124->159.148.172.251:15252, len 66
 2024-12-01 07:52:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:49589->159.148.147.201:15252, len 66
 2024-12-01 07:54:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:48507->159.148.172.251:15252, len 66
 2024-12-01 07:56:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:33504->159.148.147.201:15252, len 66
 2024-12-01 07:58:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:59985->159.148.172.251:15252, len 66
 2024-12-01 08:00:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:48983->159.148.147.201:15252, len 66
 2024-12-01 08:02:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:47348->159.148.172.251:15252, len 66
 2024-12-01 08:04:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:43148->159.148.147.201:15252, len 66
 2024-12-01 08:06:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:50844->159.148.172.251:15252, len 66
 2024-12-01 08:08:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:50804->159.148.147.201:15252, len 66
 2024-12-01 08:10:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:53287->159.148.172.251:15252, len 66
 2024-12-01 08:12:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:36030->159.148.147.201:15252, len 66
 2024-12-01 08:14:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:47792->159.148.172.251:15252, len 66
 2024-12-01 08:16:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:51584->159.148.147.201:15252, len 66
 2024-12-01 08:18:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:40583->159.148.172.251:15252, len 66
 2024-12-01 08:20:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:60838->159.148.147.201:15252, len 66
 2024-12-01 08:22:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:44444->159.148.172.251:15252, len 66
 2024-12-01 08:24:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:37638->159.148.147.201:15252, len 66
 2024-12-01 08:26:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:35850->159.148.172.251:15252, len 66
 2024-12-01 08:28:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:36910->159.148.147.201:15252, len 66
 2024-12-01 08:30:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:43886->159.148.172.251:15252, len 66
 2024-12-01 08:32:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:56011->159.148.147.201:15252, len 66
 2024-12-01 08:34:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:35554->159.148.172.251:15252, len 66
 2024-12-01 08:36:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:58921->159.148.147.201:15252, len 66
 2024-12-01 08:38:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:35105->159.148.172.251:15252, len 66
 2024-12-01 08:40:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:43739->159.148.147.201:15252, len 66
 2024-12-01 08:42:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:38011->159.148.172.251:15252, len 66
 2024-12-01 08:44:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:60764->159.148.147.201:15252, len 66
 2024-12-01 08:46:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:44064->159.148.172.251:15252, len 66
 2024-12-01 08:48:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:37899->159.148.147.201:15252, len 66
 2024-12-01 08:50:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:51115->159.148.172.251:15252, len 66
 2024-12-01 08:52:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:52500->159.148.147.201:15252, len 66
 2024-12-01 08:54:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:58028->159.148.172.251:15252, len 66
 2024-12-01 08:56:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:43131->159.148.147.201:15252, len 66
 2024-12-01 08:58:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:59525->159.148.172.251:15252, len 66
 2024-12-01 09:00:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:50985->159.148.147.201:15252, len 66
 2024-12-01 09:02:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:38185->159.148.172.251:15252, len 66
 2024-12-01 09:04:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:50388->159.148.147.201:15252, len 66
 2024-12-01 09:06:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:46448->159.148.172.251:15252, len 66
 2024-12-01 09:08:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:41606->159.148.147.201:15252, len 66
 2024-12-01 09:10:08 firewall,info mkt_ output: in:(unknown 0) out:ether1, connection-state:new proto UDP, MYPUBLICIP:40086->159.148.172.251:15252, len 66

Please MikroTik, check SUP-172111 before release 7.17 stable.
SMB is unstable with hAP ac2.
Thanks

I did search the forum to try to see what you are asking for, but there are no post about SUP-172111

Forum users can't check support tickets, so no reason to post ticket numbers here

Please MikroTik, check SUP-172111 before release 7.17 stable.
SMB is unstable with hAP ac2.
Thanks

I did search the forum to try to see what you are asking for, but there are no post about SUP-172111

SUP-172111 is the new ticket for a bug that was already fixed in the 7.15rc (SUP-151054):
viewtopic.php?p=1071424&hilit=151054#p1071424

It's back from 7.17beta: hAP ac2 restarts itself when copying a large file using SMB.

Forum users can't check support tickets, so no reason to post ticket numbers here

You're right Normis, I didn't mean to cause confusion...

Thank you @Strods for reply

I had never used the BTH feature, and the Time Update feature before 7.17 was only sending 4 packets every time the router reboots and not as it is now - doing flood every 2 minutes.
Additionally this statement is as good as the functionality: "If the setting is set to "auto", then it works as "disabled" unless ..."

If the setting is set to "auto", then it works as "disabled" unless you enable BTH functionality. If you enable BTH, then it will automtically enable Cloud service, since it can not work without it.

It seems that your router simply tried to reach Cloud. Maybe it was not reachable? Is it working just fine now?

Also, System/Clock time-zone-autodetect uses Cloud.
https://help.mikrotik.com/docs/spaces/R ... Updatetime

I have upgraded from 7.17 beta to rc2 and I started to see strange connections to Mikrotik servers every 2-4 minutes:
I think it is related to "Cloud" DDNS settings as it uses same port - https://help.mikrotik.com/docs/spaces/R ... 9929/Cloud
...

Before 7.15, there were stability issues with some SFP ONU sticks and CRS305. (Suddenly, TX Power was showing -40.0dBm with FS.com GPON-ONU-34-20 BI).
Issue was fixed in 7.15 (* sfp - improved "sfp-tx-power" value monitoring in certain cases;)
I have updated my CRS305 to 7.17RC2 (firmware upgrade too) and the issue is back (4 crashes in few days, after months of stability).
I have reopened the original ticket on support side.

Forum users can't check support tickets, so no reason to post ticket numbers here

It is of no use for other common forum members, but this way you or other Mikrotik staff happening to pass by and interested in a report on the forum may be able to check in more detail what the issue is, without needing to ask for the ticket number.

I thought it was a good thing to do to cite the ticket number?

it seems that in versions 7.17beta/rc there is some kind of problem that is actively consumes space on a flash

on my ac2, I successfully used 7.16rcX for several months without errors, but after updating to 7.17rc2, less than a day later, dozens of saving errors began to appear
another ac2, located in a different location and with a different configuration, but updated to 7.17beta/rc, faced the same problem

multiple messages: of course, I went to files and saw that 0% of the space was available and 16 out of 16 were occupied, but it was obvious before that
however, it is not at all obvious why this is happening: I almost did not change the configuration and did not upload anything to the files

ROS 7.17 silently disables "Accept Router Advertisements" in IPv6 settings. This caused IPv6 to no longer be able to route to the Internet for my ISP.

I am not sure why it does this. The closest release note item is this one which might be related?

*) ipv6 - added IPv6 settings related to stale IPv6 neighbor cleanup;

it seems that in versions 7.17beta/rc there is some kind of problem that is actively consumes space on a flash

on my ac2, I successfully used 7.16rcX for several months without errors, but after updating to 7.17rc2, less than a day later, dozens of saving errors began to appear

Did you check space after upgrading? Especially on the hAP ac2, space has always been very critical because it is an architecture with relatively large binaries and the flash space is less than 16MB (so it does not conform to specs!).
It may be that after the upgrade you were at almost zero free space...

it seems that in versions 7.17beta/rc there is some kind of problem that is actively consumes space on a flash

on my ac2, I successfully used 7.16rcX for several months without errors, but after updating to 7.17rc2, less than a day later, dozens of saving errors began to appear

Did you check space after upgrading? Especially on the hAP ac2, space has always been very critical because it is an architecture with relatively large binaries and the flash space is less than 16MB (so it does not conform to specs!).
It may be that after the upgrade you were at almost zero free space...

All ARM 32 ac (hAP ac2, cAP, wAP) devices that have 16MB flash have pretty much the same specs (same ipq-4018 SOC and flash chip), use the same binaries and have the same storage space issue and that is if you use wifi-qcom-ac which is almost twice the size (and actually grew up a bit in 7.17) than older wireless package...
My experience so far is that wifi-qcom-ac is just not worth the trouble, it is way more unstable and there is no significant performance gain so if you don't absolutely need new CAPsMAN just stay with the older wireless package...

I disagree.

ROS main package size increased in 7.17. But I think not more than around 200kb. On 7.16.2 it reports 765KiB "free-hdd-space". So not to worry right now. But Mikrotik needs to keep an eye on that. I hope 7.14 was enough of the trouble.

My experience so far is that wifi-qcom-ac is just not worth the trouble, it is way more unstable and there is no significant performance gain so if you don't absolutely need new CAPsMAN just stay with the older wireless package...

I've had much better wireless experience with wifi-qcom-ac drivers on cAP ac when comparing legacy drivers...

Forum users can't check support tickets, so no reason to post ticket numbers here

Basically, this is the way many of us find to make public that there are problems and that they have been documented (not just by the Forum) with the aim of avoiding excuses like "oh, but we didn't know".

Hmm. I can see the secret hidden route (but MT can't).
First, everything looks good: But soon... Where is blackhole with distance=254?!
Anyway. How about route with table=guest?
Well, I can reboot it, but wtf?

I did search the forum to try to see what you are asking for, but there are no post about SUP-172111

SUP-172111 is the new ticket for a bug that was already fixed in the 7.15rc (SUP-151054):
viewtopic.php?p=1071424&hilit=151054#p1071424

It's back from 7.17beta: hAP ac2 restarts itself when copying a large file using SMB.

Forum users can't check support tickets, so no reason to post ticket numbers here

You're right Normis, I didn't mean to cause confusion...

In this specific case I would say that it was justified to post the SUP number publicly here. Causing a reboot just by copying a large file via SMB sounds like a big issue that should be fixed before reaching final. And when there is no response in the ticket system, one must use other channels to get attention.

Causing a reboot just by copying a large file via SMB sounds like a big issue that should be fixed before reaching final.

Well, for me it sounds like an irrelevant issue because a router is not an SMB server and the whole SMB function should not have been there...
For me, the big problems in BGP should be fixed before reaching final, but they are not even touched.

Hmm. I can see the secret hidden route (but MT can't).

But soon... Where is blackhole with distance=254?!

Anyway. How about route with table=guest?

Well, I can reboot it, but wtf?

This smells to be related to the same "thing" that happens when you try to see IPv4 or IPv6 routes and the route count shows the total number of routes. The same thing happens with vpnv4 and vpnv6 routes.

This attempt to abstract what is RIB and what is FIB into a single "thing" seems very weird.

By the way, it is worth mentioning that the syntax between routing and routes is still incongruent:

Causing a reboot just by copying a large file via SMB sounds like a big issue that should be fixed before reaching final.

Well, for me it sounds like an irrelevant issue because a router is not an SMB server and the whole SMB function should not have been there...
For me, the big problems in BGP should be fixed before reaching final, but they are not even touched.

Hmm... I agree, but I disagree!

I agree with you that these extra features, unrelated to the basic concept of a Routing Operating System (RouterOS) should not be in the core of the system.

But if the features are activated through extra packages, it is correct to expect that they work at least in a stable manner.
And more important than working stably, that they under no circumstances affect the functioning of the base system.

This brings me to the succession of suggestions that I have already made through tickets on Jira and also shared in several topics here on the forum... (Posts that have even been deleted. Hello @normis !)

Features such as SMB/CIFS/DNLA and similar should be removed from the system's base package and placed only as additional packages.

In addition to possibly reducing the size of the base package (which has been a problem for some hardware models), it would certainly result in fewer system malfunctions due unwanted interactions of extra functions that may be misbehaving.

Furthermore, these complementary functionalities mentioned, as well as others that are not dispensable(such as routing, or Queues) that needs to be in the base package, should be runs in the backend in a container regime (as in Junos-Evo, IOS-XR, even in VyOS) and imposing reservations and limits on the use of computing resources...

Any chance we could update to ZeroTier 1.14.2?
https://github.com/zerotier/ZeroTierOne ... E-NOTES.md

1.14.2 has multithreading if enabled!

I would love to see this as well!

Any real world experience with the VPLS fastpath?

Wondering how much CPU improvements are realized on CCR2xxx devices.

I don't even know where to look if FastPath is active for VPLS.
Hopefully they will update the documentation with information about what limitations exist for enabling FastPah for VPLS.

Any real world experience with the VPLS fastpath?

Wondering how much CPU improvements are realized on CCR2xxx devices.

I don't see any difference between 7.16 or earlier and 7.17rc

hope only they fix some crash about crr2216 and traffic that goes slowpath-fastpath in mpls (vpls tunnels dounw/up due to poor links) (kernel failure) in 7.16.x

regards

As I had severe issues with my RB5009, which using Capsman locked all users out from 5GHz - anyone having similar experiences?

Unfortunately, I did not investigate a lot and rather reverted ASAP to 7.16.2, BUT then my RB5009 went crazy with lots of config gone. Had to use a fresh backup.

So, is something wrong with 7.17RC for RB5009 with Capsman? Or was I just very unlucky for some reason?

So, is something wrong with 7.17RC for RB5009 with Capsman? Or was I just very unlucky for some reason?

I'm using the exact same setup and have not experienced any such issues whatsoever.

I would like to try again, but maybe only initially upgrade my RB5009 Capsman and leave CAPs on 7.16.2?

I would like to try again, but maybe only initially upgrade my RB5009 Capsman and leave CAPs on 7.16.2?

I had all my cAp ax units on 7.17rc1 and upgraded the RB5009 to 7.17rc1. The only issue I had was the change in IPv6 settings I mentioned in an earlier post.

OK, will wait until I have a calm state with no critical users - my wife.... Would like to see that my issue with 5GHz network hopefully does not reappear...

Any real world experience with the VPLS fastpath?

Wondering how much CPU improvements are realized on CCR2xxx devices.

I don't see any difference between 7.16 or earlier and 7.17rc
hope only they fix some crash about crr2216 and traffic that goes slowpath-fastpath in mpls (vpls tunnels dounw/up due to poor links) (kernel failure) in 7.16.x

I was doing some tests in the LAB on CCR2216, because we had huge problems with MPLS. If using it as a Provider router, jitter (or packets drop) is introduced if the interfaces are part of the bridge and VLANs are on it. There are no jitter or drops if the interfaces are not part of the bridge. But I have to test it more extensively. In other words, when LDP is enabled and running on the transport interfaces, these interfaces drop packets randomly, only on CCR2216. But this is my experience.
I reported the problem long ago; it was acknowledged, and the ticket was closed. No changes since then.

I upgraded my two hAP ax2 devices at home, and it looks like I'm seeing a regression. Apple iPhone devices seem to be disconnecting and reconnecting rather frequently, even when sitting on a desk three feet from the unit. It's very odd. I didn't see this with 7.17rc1.

I was doing some tests in the LAB on CCR2216, because we had huge problems with MPLS. If using it as a Provider router, jitter (or packets drop) is introduced if the interfaces are part of the bridge and VLANs are on it. There are no jitter or drops if the interfaces are not part of the bridge. But I have to test it more extensively. In other words, when LDP is enabled and running on the transport interfaces, these interfaces drop packets randomly, only on CCR2216. But this is my experience.
I reported the problem long ago; it was acknowledged, and the ticket was closed. No changes since then.

To which bridge do you add the LDP interfaces?

@clambert: The one bridge with hardware offloading.

Most of my configurations use one bridge for the core network and one for the overlay network. Thus, I can use L3 HW Offload for the core network.

Ah, I understand. However, please note that MPLS is not supported by L3HW offload feature.

OK, will wait until I have a calm state with no critical users - my wife.... Would like to see that my issue with 5GHz network hopefully does not reappear...

Upgraded again, after a couple of hours Capsman devices are unable to connect to 5GHz or they connect but are isolated and cannot connect to Internet anymore...
I have created a supout file...

Can you share your config, @epkulse? And anything in the logging that could explain the situation?

There is nothing spcific present in the log. But my MAC and iPhone do not get a IP-address so something strange is happening with the DHCP-server...
Which is the best way to share config to you?

The standard way is:
Remove serial and any other private info and post between code tags by using the </> button.

Always good to have more eyes watching.
Can you als supply all involved (MikroTik) hardware?
Did you also upgrade firmware besides the RouterOS upgrade?

Can i pass it on to you?

Will try to reboot the router now... Can´t wait anymore... Worst case, I have to revert to 7.16.2...

Checked another laptop which could connect to wifi on 5G, So, actually rebooted my MAC and it works now... Also iPhone connects OK... So, I didn´t check everything properly it seems. Have not rebooted the router - will leave it for now...

Well, I have to give up. My MAC refused again to connect, or basically the DHCP-server did not provide an IP-address. Other devices encountered the same and I am not able to figure out what happened.
And, again, when reverting my RB5009 to 7.16.2 some config was lost - especially it seems to be related to the DHCP-server as the configured static lease table was empty.
Enough hassle now for a full day. Will create and supplement data to Support - and I will be very careful to upgrade to 7.17. Probably need to do a complete fresh start then...

My experience so far is that wifi-qcom-ac is just not worth the trouble, it is way more unstable and there is no significant performance gain so if you don't absolutely need new CAPsMAN just stay with the older wireless package...

I disagree.

+1 on disagreeing. MAJOR difference in performance between wireless and wifi-qcom-ac given identical HW devices.
It has nothing to do with using capsman or not. Even as standalone AP the difference is really noticeable.
Using capsman there are some quirks to pay attention to (mainly when using VLANs) but even that can be handled.

You are correct on the size issue and I haven't paid attention yet on the fact it got bigger (current setups capable of using it are still on 7.16.2) so that's a good one to keep in mind.

Would be interesting to see what that MAJOR difference in performance is, for example connect 10 users to the same AP and share the average results in speeds with wireless vs wifi-qcom-ac package...

You cannot manage devices using old wireless package with the new capsman that is compatible only with wifi-qcom, so what I meant to say is that if you absolutely need to manage all your devices within a single capsman instance you must upgrade all to wifi-qcom-ac... but since VLAN assignment doesn't work with wifi-qcom-ac devices you would still need to make separate configuration in capsman and also in bridge on every single device for those so it makes it more troublesome for me than maintaining separate capsman instances...

And, again, when reverting my RB5009 to 7.16.2 some config was lost - especially it seems to be related to the DHCP-server as the configured static lease table was empty.

Do yourself a favor: partition the device. This way You can boot the "backup" partition, copy it over the "production" one, and go from there. Much easier than playing around with netinstall.

OK, have never tried that. Fortunately, I was able to access it and restore a backup...

Ah, I understand. However, please note that MPLS is not supported by L3HW offload feature.

Yes, I know, but regular traffic is supported. I don't understand why, in this specific configuration, the CCR2216 is dropping packets / introducing jitter if LDP is enabled.

HAP AC2 with 7.17rc2: I have a 128GB USB stick formatted in Ext4. SanDisk stick just discarded new. via IP>SMB I shared a folder. If from a phone connected to wifi I copy any file of average size 296MB, the transfer starts well but randomly in a percentage that is always different, the router goes into kernel panic and restarts completely. I formatted in ROS if it can be a detail.. Serious BUG !!

HAP AC2 with 7.17rc2: I have a 128GB USB stick formatted in Ext4. SanDisk stick just discarded new. via IP>SMB I shared a folder. If from a phone connected to wifi I copy any file of average size 296MB, the transfer starts well but randomly in a percentage that is always different, the router goes into kernel panic and restarts completely. I formatted in ROS if it can be a detail.. Serious BUG !!

Even using fat32 and extfat the problem occurs again, the first moments it also reaches a good speed for being USB 2, I see the CPU reach even 40% then everything dies. From the LOGs I read "kernel failure".. In my opinion a serious bug to be fixed before the stable release!

HAP AC2 with 7.17rc2:[...] If from a phone connected to wifi I copy any file of average size 296MB, the transfer starts well but randomly in a percentage that is always different, the router goes into kernel panic and restarts completely. I formatted in ROS if it can be a detail.. Serious BUG !!

Even using fat32 and extfat the problem occurs again, the first moments it also reaches a good speed for being USB 2, I see the CPU reach even 40% then everything dies. From the LOGs I read "kernel failure".. In my opinion a serious bug to be fixed before the stable release!

You might want to collect a supout.rif and submit a ticket if you're seeing a panic, as the supout.rif should have more info for Mikrotik to figure it out.

Could the 7.17rc version of Design Skin be as intuitive and straightforward as 7.15.1? The editing method in 7.17 is frankly a bit ridiculous...

it seems that in versions 7.17beta/rc there is some kind of problem that is actively consumes space on a flash

on my ac2, I successfully used 7.16rcX for several months without errors, but after updating to 7.17rc2, less than a day later, dozens of saving errors began to appear

Did you check space after upgrading? Especially on the hAP ac2, space has always been very critical because it is an architecture with relatively large binaries and the flash space is less than 16MB (so it does not conform to specs!).
It may be that after the upgrade you were at almost zero free space...

unfortunately, I did not look at the place immediately after the update.
but after analyzing the size of the packages with ROS, I came to the conclusion that the difference is about 300 kb. there are still 2 MB free, which is in 7.16.2, which is in the current 17rc2.

this is not so small, in the MT device, the size of a regular configuration is unlikely to ever exceed 100Kb, judging by the size of the backup, so this is hardly a problem.

It still seems to me that this is some kind of mistake that leads to running out of space.

the current status of both my devices is: they are loaded (with a power reboot) and they are working. they don't soft reboot: system reboot, package downgrade, and upgrade don't do anything in either winbox or the cli. it seems the only option is netinstall

upd: just netinstall 7.17rc2 on one of devices with keep old configuration - 348kb free space. I'm watching

Yes, that is quite low, my hAP ac2 runs with 1400 kB free at the moment, but it does not have wifi-qcom-ac installed.
I noticed that the "Total HDD size" is now reported as 16.0 MiB while I am sure it was like 15.2 MiB before, so that has changed in some recent release.
No idea if they really found a few hundred KB extra HD space, it may well be that not the entire chip was mapped into the address space or that a too-large area was reserved for bootloader or so. But it seems that the free space is now more than it was around the 7.13-7.15 era, when this device was nearly dying.