CLOUD CORE ROUTER

Wed Mar 20, 2013 2:40 pm

new build posted on above links, please re-download. please check CPU usage on this one. changelog:

What's new in 6.0rc12 (2013-Mar-20 13:37):

*) fixed occasional nand corruption on CCR;
*) ipsec - added ipv4 mode-cfg support for responder;
*) ipsec - fixed some issues with removal of dynamic policies;
*) email - renamed parameter tls to start-tls for send command;
*) wireless - update required when using small width channel RB2011 RB9xx
caveat: update remote end/s before updating AP as both side are required to use new/same version for a link
*) ipsec - generate-policy now can have port-strict value which will use port from peer's proposal
when generating policy or port-override which will always generate policy for any port;
*) ipsec - responder side now uses initiator exchange type for peer config selection;
*) lcd - changed All interface stat screen (bar graphs) to show total bandwidth usage, combine rx/tx together;
*) lcd - removed "all-interface-mode" option;
*) lcd - changed "Interfaces" screen to show interface usage similiar to All interface stat screen;
*) lcd - improved Interfaces -> * -> Info screen, added more wireless information;
*) lcd - added Registration Table screen for wireless interfaces under
Interfaces -> 'wireless interface' -> Registration Table;
*) fixed occasional kernel crashes on CCR;
*) fixed other than only-hardware-queue interface queues on CCR;
*) lte - devices with vendor/product id pair 0x0f3d/0x68AA now uses directip inferface;
*) dhcp client v4 - option add-default-route now supports special-classless value;
*) significantly increased simple queue performance on multi core systems (up to 9x on CCR1036 with at least 32 top level simple queues)
*) ip arp - new property published;
*) web proxy - added new option max-cache-object-size,
upper limit of max-client-connections and max-server-connections is now calculated from system RAM;
*) ospf - fixed inconsistency in external ECMP route calculation;
*) certificates - CA keys are no more cached, every CA operations now requires a valid CA passphrase.
use set-ca-passphrase for scep server to cache CA key in encrypted form;
*) ppp - made MPPE encryption work on tilera (bug introduced in 6.0rc10);
*) tool fetch - https support with optional certificate verification;
*) sstp server - removed test mode which allowed running server without certificate;
*) trafficgen - add support for ipv6 header;

DirectX9 · Wed Mar 20, 2013 5:11 pm

new build posted on above links, please re-download. please check CPU usage on this one. changelog:

What's new in 6.0rc12 (2013-Mar-20 13:37):

*) fixed occasional nand corruption on CCR;
*) ipsec - added ipv4 mode-cfg support for responder;
*) ipsec - fixed some issues with removal of dynamic policies;
*) email - renamed parameter tls to start-tls for send command;
*) wireless - update required when using small width channel RB2011 RB9xx
caveat: update remote end/s before updating AP as both side are required to use new/same version for a link
*) ipsec - generate-policy now can have port-strict value which will use port from peer's proposal
when generating policy or port-override which will always generate policy for any port;
*) ipsec - responder side now uses initiator exchange type for peer config selection;
*) lcd - changed All interface stat screen (bar graphs) to show total bandwidth usage, combine rx/tx together;
*) lcd - removed "all-interface-mode" option;
*) lcd - changed "Interfaces" screen to show interface usage similiar to All interface stat screen;
*) lcd - improved Interfaces -> * -> Info screen, added more wireless information;
*) lcd - added Registration Table screen for wireless interfaces under
Interfaces -> 'wireless interface' -> Registration Table;
*) fixed occasional kernel crashes on CCR;
*) fixed other than only-hardware-queue interface queues on CCR;
*) lte - devices with vendor/product id pair 0x0f3d/0x68AA now uses directip inferface;
*) dhcp client v4 - option add-default-route now supports special-classless value;
*) significantly increased simple queue performance on multi core systems (up to 9x on CCR1036 with at least 32 top level simple queues)
*) ip arp - new property published;
*) web proxy - added new option max-cache-object-size,
upper limit of max-client-connections and max-server-connections is now calculated from system RAM;
*) ospf - fixed inconsistency in external ECMP route calculation;
*) certificates - CA keys are no more cached, every CA operations now requires a valid CA passphrase.
use set-ca-passphrase for scep server to cache CA key in encrypted form;
*) ppp - made MPPE encryption work on tilera (bug introduced in 6.0rc10);
*) tool fetch - https support with optional certificate verification;
*) sstp server - removed test mode which allowed running server without certificate;
*) trafficgen - add support for ipv6 header;

And what is - *) wireless - update required when using small width channel RB2011 RB9xx
caveat: update remote end/s before updating AP as both side are required to use new/same version for a link

How I can see on my devices (Groove2, Metal2, SXT2, RB711UA-2Hnd) - really have a troubles with roaming within the same SSID but in different WIFI channels. Now it is about 10 seconds. Earlier (FW 2.41) it had been 1 or less seconds.
Now somewhere I have a strong signal but the data traffic is absent!

latuannetnam · Thu Mar 21, 2013 8:34 am

Hi normis,
I still have CPU 100% load problem with 20/Mar build. My configuration as below:

1. IP address
/ip address> print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
2 192.168.89.1/24 192.168.89.0 ether11 => PC 2 connects to this interface
3 192.168.88.1/24 192.168.88.0 ether10 => PC 1 connects to this interface

2. Firewall mangle configuration
/ip firewall mangle> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=prerouting action=mark-packet new-packet-mark=mark_88_out
passthrough=yes dst-address=192.168.89.0/24 in-interface=ether10

3. Queue tree
/queue tree> print
Flags: X - disabled, I - invalid
0 name="queue_88_out" parent=ether11 packet-mark=mark_88_out limit-at=0
queue=hotspot-default priority=8 max-limit=0 burst-limit=0
burst-threshold=0 burst-time=0

My test scenario:
- PC1 sends 600Mpbs traffic to PC2
- CCR: turns of queue and firewall => everything OK
- CCR: turns on queue tree and firewall => after 5 seconds, CPU load of all cores are 100%, Winbox is disconnected from CCR
- PC1 stops sending traffic => CCR returns to normal

I also tried with RC5, RC11, RC12 and the problem is stil existed.
Thanks.

majkel · Thu Mar 21, 2013 1:00 pm

always after 4-5h management problem is back.. on 20 Mar version too.. and I have only 10-15mbit of traffic when starts...

I can restart with traffic 100mbit, and problems backs too after 4h.. so its not traffic problem

EDIT: This build is a massacre .. one ddos attack about 50mbit in TCP and CPU is 100%.. I go back to rc11

UDP attack are ok. Only something wrong is with TCP..

OlegM · Thu Mar 21, 2013 6:40 pm

The latest version does not work in the PPTP IP Masquerade and VRRP IP exclamation point.

r0xmachine · Thu Mar 21, 2013 6:59 pm

Hi,

I have 2 CCR1016-12 in production with RouterOS v6.0rc12 Build 06.03.2013, firmware 3.04 (Before I had rc11 with Tx Drops problems)

The first CCR replace Cisco 2901 with 4 mangle rules, 2 gateways, 4 nat rules, 70Mbit's average traffic. No tx drops, No Cpu 100%, No issue.
Uptime : 14d , Packages disabled dhcp,hotspot,ipv6,ppp,wireless.

The second CCR replace Dell x86 server with pptp server with 450 pptp clients, 3 firewall rules, 15 nat rules, 100Mbit's average traffic. No tx drops, No Cpu 100%, No issue.
Uptime : 12d, , Packages disabled dhcp,hotspot,ipv6,wireless.

Notice, I didnt import the configurations, only the secrets for the second CCR.

rwb · Thu Mar 21, 2013 10:59 pm

Hi Normis

Have loaded 20th march v6rc12 update onto my CCR 1036-12G-4s unit and still have 100% CPU problem.
Setup has very simple routing configuration, is in production passing 800Mbit/s data.

We have 3 other CCR 1016-12G units runing queues/nating/etc, way more complicated setups that work superbly.
These are all doing 75~150Mbit/s data.

Any ideas?

thanks

Fri Mar 22, 2013 8:37 am

Hi Normis

Have loaded 20th march v6rc12 update onto my CCR 1036-12G-4s unit and still have 100% CPU problem.
Setup has very simple routing configuration, is in production passing 800Mbit/s data.

We have 3 other CCR 1016-12G units runing queues/nating/etc, way more complicated setups that work superbly.
These are all doing 75~150Mbit/s data.

Any ideas?

thanks

When you have this issue, do you have winbox open? Close it, and connect with SSH, check if the problem is there (reboot router after closing winbox)

DirectX9 · Fri Mar 22, 2013 9:16 am

The latest version does not work in the PPTP IP Masquerade and VRRP IP exclamation point.

Yeah. I Confirm!

Fri Mar 22, 2013 9:18 am

The latest version does not work in the PPTP IP Masquerade and VRRP IP exclamation point.
Yeah. I Confirm!

Please describe in detail, what doesn't work?

DirectX9 · Fri Mar 22, 2013 9:21 am

[quote="normis"]new build posted on above links, please re-download. please check CPU usage on this one. changelog:

[quote]What's new in 6.0rc12 (2013-Mar-20 13:37):

Simple Queue in quantity of 3 is stop working after 36hours.
Disabling queues and enabling them again - works again.

Fri Mar 22, 2013 9:28 am

new build posted on above links, please re-download. please check CPU usage on this one. changelog:

What's new in 6.0rc12 (2013-Mar-20 13:37):

Simple Queue in quantity of 3 is stop working after 36hours.
Disabling queues and enabling them again - works again.

Is this the description of the above VRRP problem, or something different?

DirectX9 · Fri Mar 22, 2013 9:28 am

The latest version does not work in the PPTP IP Masquerade and VRRP IP exclamation point.
Yeah. I Confirm!
Please describe in detail, what doesn't work?

For example:
In in last RC12 from 20.03
Connect from another point through internet to CCR (and all another devices up on MIPSBE) in automatic discovering of routing and protocols which has provided by CCR - local internet routing is changed to CCR routing providing config. RC11 and RC12 untill 20.03.2012 use PPTP connection as the secondary routing - it's correct in most cases.
this is for winXP/vista/W7, W8 is not obey RouterOS yet or RouterOS is not in friendship with W8 networking.

Simple Queue in quantity of 3 is stop working after 36hours.
Disabling queues and enabling them again - works again.[/quote][/quote][/quote]

Is this the description of the above VRRP problem, or something different?[/quote]

I think it's something different. CCR is not at full capacity, may be 3-4%

OlegM · Fri Mar 22, 2013 11:52 am

mrz · Fri Mar 22, 2013 12:32 pm

Contact support with supout files and description on how to repeat the problem.

majkel · Fri Mar 22, 2013 1:16 pm

MikroTik >> Do you have some plans to do optimization for firewall? for 1036?

Now my 36 cores can filtr only UDP packets (tested 8gbit/s ddos) but on TCP DDOS attacks the best score is about 500-550mbit (800k packets) of SSYN and the CPU is nearly 95-100% used.. tested on rc6, rc7, rc9, rc10, rc11 and last build rc12..

Fri Mar 22, 2013 1:19 pm

MikroTik >> Do you have some plans to do optimization for firewall? for 1036?

Now my 36 cores can filtr only UDP packets (tested 8gbit/s ddos) but on TCP DDOS attacks the best score is about 500-550mbit (800k packets) of SSYN and the CPU is nearly 95-100% used.. tested on rc6, rc7, rc9, rc10, rc11 and last build rc12..

please show us those rules, so we can comment on how to optimize them.
yes, optimisation of firewall packet matchers is one of the features that we work on.

tomaskir · Fri Mar 22, 2013 1:49 pm

Normunds, could you please look at Ticket#2013020866000414?

Fri Mar 22, 2013 2:07 pm

Normunds, could you please look at Ticket#2013020866000414?

We have added the L2TP bug to our bugtracker, and it will be fixed.

majkel · Fri Mar 22, 2013 2:08 pm

MikroTik .....
please show us those rules, so we can comment on how to optimize them.
yes, optimisation of firewall packet matchers is one of the features that we work on.

I send you on ticket [Ticket#2013032266000431] RE: firewall rules optim

Thenk u.

tomaskir · Fri Mar 22, 2013 2:29 pm

Normunds, could you please look at Ticket#2013020866000414?
We have added the L2TP bug to our bugtracker, and it will be fixed.

Yes, but what about the NAT work-around that doesnt work?

There was no response on that.

Fri Mar 22, 2013 2:41 pm

Normunds, could you please look at Ticket#2013020866000414?
We have added the L2TP bug to our bugtracker, and it will be fixed.
Yes, but what about the NAT work-around that doesnt work?

There was no response on that.

Our developers and testers do not consider it to be a bug, as they already explained.

OlegM · Fri Mar 22, 2013 4:50 pm

Stopped CPU after the disable and enable the NIC Internet.

blitz · Fri Mar 22, 2013 7:00 pm

Same management problem with latest rc12 and sometimes cpu's looks like this with 150mbps passing.

9%,99%,100%,100%,99%,100%,99%,99%,99%,99%,99%,99%,99%,
100%,99%,99%
free-memory: 1742720KiB

ners · Sat Mar 23, 2013 9:03 am

I'm very disappointed with the CCR-1036, it is being advertised as a carrier grade router, yet it cannot do NAT more than 250Mbit/sec (around 30k packets/sec) without falling throughput

This is probably enough for a small business, but certainly not for anything serious.

tontonalu · Sat Mar 23, 2013 5:26 pm

Weverton my name and I'm from Brazil.

I am facing a problem, I installed a usb modem in CCR 16, rescource recognizes the modem, put into port usb ports appears not only serial port. version of mikrotik and 6rc11.

Thank you for your attention.

dzeisons · Mon Mar 25, 2013 8:29 am

I have the following problems on CCR1016:
1. As i read earlier, i'm not the only, who have a problem with CPU load on management. Version rc12. Winbox was opened all the time.
2. In two different places (two different configurations, two different IS Providers, CCR1016: rc11 and rc12) i have a problem with additional WAN IP addresses: when i add additional addresses from the same subnet to WAN interface, then those additional addresses are reachable only after few hours of waiting. Later, everything is ok, but it is really annoying, when i need to change routers including all NAT services as fast as i can.

Mon Mar 25, 2013 8:43 am

Can you guys close winbox and connect with SSH to confirm if Winbox is not causing the issue?

dzeisons · Mon Mar 25, 2013 8:58 am

Can you guys close winbox and connect with SSH to confirm if Winbox is not causing the issue?

Few minutes after i closed winbox, CPU load still is 50%

Mon Mar 25, 2013 9:03 am

Can you guys close winbox and connect with SSH to confirm if Winbox is not causing the issue?
Few minutes after i closed winbox, CPU load still is 50%

Does that mean that half of your cores are loaded, or one core is at 50% ?

dzeisons · Mon Mar 25, 2013 9:06 am

Can you guys close winbox and connect with SSH to confirm if Winbox is not causing the issue?
Few minutes after i closed winbox, CPU load still is 50%
Does that mean that half of your cores are loaded, or one core is at 50% ?

Eight cores are at 100%, remaining eight cores 0-2%
Yesterday it was about 80% CPU load, then few cores were 0-2%, all other were 100%. After restart - all cores 0-2%

majkel · Mon Mar 25, 2013 9:07 am

The management problem is not problem with winbox... becouse I always get info from people that they cant connect to server, or they disconnecting.. then I login by winbox or ssh, or ticktool and have managemtn problem..

Mon Mar 25, 2013 9:16 am

Can any of you provide us remote access to a router with this issue, especially where management eats more than one core to 100% ? Email support please with SSH details.

majkel · Mon Mar 25, 2013 9:24 am

I Can but I use now rc11 version... becouse I prefer to reset daily at 6am my router to get rid TX drops that appear after 2 days. When I use rc12 version with the management problem its so big that my clients almost killed me..

But I think blitz is still using rc12..

dzeisons · Mon Mar 25, 2013 10:51 am

Can any of you provide us remote access to a router with this issue, especially where management eats more than one core to 100% ? Email support please with SSH details.

Where to send?

Mon Mar 25, 2013 10:52 am

Can any of you provide us remote access to a router with this issue, especially where management eats more than one core to 100% ? Email support please with SSH details.
Where to send?

support@mikrotik.com is the official support email
the forum is mostly for user-user discussions

blitz · Mon Mar 25, 2013 11:57 am

I Can but I use now rc11 version... becouse I prefer to reset daily at 6am my router to get rid TX drops that appear after 2 days. When I use rc12 version with the management problem its so big that my clients almost killed me..

But I think blitz is still using rc12..

Yes, I use now latest (22 MAr) version but the router is in semiproduction and some clients are using it. I cannot keep them connected on the router with problem for too long because i will loose them. When the problem occured even i've stopped pppoe-server clients are not disconnected. I have to reboot the rooter (it works after 3-4 tries). I hope this version will work fine and if the problem will appear i will give support ssh access for few hours.

Andrew

Jetrider · Mon Mar 25, 2013 1:17 pm

Yeah, went back from all them RC12-s to RC11 in our production environment. RC12 too unstable and too fancy problems popping out all the time, customers going mad and managers get grumpy. Only bug here with RC11 is that of management and IP access (MAC access still works). Will just sit and wait for now, better the devil you know than the one you dont.

complete2006 · Mon Mar 25, 2013 1:34 pm

Maybe it would be better to fix the management error in RC11 only and then go to the performance issues. I would see this beast running.

CCR = Cloud Core Router and not Certain Carrier Ruin

xivot · Mon Mar 25, 2013 1:44 pm

Hi all,
I bought a CCR-1016(the small one) to try it instead the bigger CCR.
I updated it to RC10 and the routerboard firmware to 3.04.
After this all was working.
Later, I uploaded the backup file of the bigger CCR into the small one.
After the restore's reboot. The CCR hasn't worked again. It stops in loading kernel.
I cannot enter it via winbox (ip or mac), telnet, etc.
If I try to enter with serial cable it says loading routerboot..
In NetInstall doesn't appear the router and I cannot access it via serial console.
I also tried the reset button and the reset jumper. Anything happens..

Any advice??
Thanks!!!

blitz · Mon Mar 25, 2013 1:45 pm

Maybe it would be better to fix the management error in RC11 only and then go to the performance issues. I would see this beast running.

I did not have problems with management in rc11. For me it was enough to fix for the moment only ospf

majkel · Mon Mar 25, 2013 1:58 pm

MikroTik >> Do you have some plans to do optimization for firewall? for 1036?

Now my 36 cores can filtr only UDP packets (tested 8gbit/s ddos) but on TCP DDOS attacks the best score is about 500-550mbit (800k packets) of SSYN and the CPU is nearly 95-100% used.. tested on rc6, rc7, rc9, rc10, rc11 and last build rc12..
please show us those rules, so we can comment on how to optimize them.
yes, optimisation of firewall packet matchers is one of the features that we work on.

normis this is my rules. Can You check? Today i get ddos atack near 500mbit on TCP, and my CCR get 100%..

7 ;;; Blokada UDP Port 80
chain=forward action=drop protocol=udp port=80

8 chain=input action=accept src-address=80.72.*.*

9 ;;; White Lista
chain=forward action=accept src-address-list=white_list dst-address-list=""

10 ;;; accept established connection packets
chain=input action=accept connection-state=established

11 ;;; accept related connection packets
chain=input action=accept connection-state=related

12 ;;; drop invalid packets
chain=input action=drop connection-state=invalid

13 ;;; detect and drop port scan connections
chain=input action=drop protocol=tcp psd=21,3s,3,1

14 ;;; suppress DoS attack
chain=input action=tarpit protocol=tcp src-address-list=black_list connection-limit=3,32

15 ;;; detect DoS attack
chain=input action=add-src-to-address-list protocol=tcp address-list=black_list address-list-timeout=1d connection-limit=100,32

16 ;;; jump to chain ICMP
chain=input action=jump jump-target=ICMP protocol=icmp

17 ;;; jump to chain services
chain=input action=jump jump-target=services

18 ;;; Allow Broadcast Traffic
chain=input action=accept dst-address-type=broadcast

19 chain=input action=log log-prefix="Filter:"

20 ;;; 0:0 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=0:0-255 limit=5,5

21 ;;; 3:3 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=3:3 limit=5,5

22 ;;; 3:4 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=3:4 limit=5,5

23 ;;; 8:0 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=8:0-255 limit=5,5

24 ;;; 11:0 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=11:0-255 limit=5,5

25 ;;; drop everything else
chain=input action=drop

26 ;;; Drop everything else
chain=ICMP action=drop protocol=icmp

27 ;;; accept localhost
chain=services action=accept dst-address=127.0.0.1 src-address-list=127.0.0.1

28 ;;; allow MACwinbox
chain=services action=accept protocol=udp dst-port=20561

29 ;;; allow winbox
chain=services action=accept protocol=tcp dst-port=8291

30 ;;; MT API
chain=services action=accept protocol=tcp dst-port=8728

31 ;;; MT Discovery Protocol
chain=services action=accept protocol=udp dst-port=5678

32 ;;; allow SNMP
chain=services action=accept protocol=tcp dst-port=161

33 ;;; allow DNS request
chain=services action=accept protocol=tcp dst-port=53

34 ;;; Web
chain=services action=accept protocol=tcp dst-port=2222

35 ;;; Allow DNS request
chain=services action=accept protocol=udp dst-port=53

36 chain=services action=return

37 ;;; ETOP DNS
chain=forward action=accept src-address-list=ETOP

38 ;;; ETOP DNS
chain=forward action=accept dst-address-list=ETOP

39 ;;; allow related connections
chain=forward action=accept connection-state=related

40 ;;; Prawid owe pakiety
chain=forward action=accept connection-state=established

41 ;;; drop invalid connections
chain=forward action=drop connection-state=invalid

42 ;;; SYN Flood protect
chain=forward action=jump jump-target=SYN-Protect tcp-flags=syn connection-state=new protocol=tcp

43 chain=SYN-Protect action=accept tcp-flags=syn connection-state=new protocol=tcp limit=1000,100 dst-limit=0,5,dst-address/1m40s

44 chain=SYN-Protect action=drop tcp-flags=syn connection-state=new protocol=tcp

45 chain=forward action=jump jump-target=detect-ddos connection-state=new

46 chain=forward action=log connection-state=new hotspot="" log-prefix="ddos_udp:"

47 chain=detect-ddos_TCP action=return dst-limit=30/1m,5,src-and-dst-addresses/10s

48 ;;; packet size 500-65000
chain=detect-ddos action=add-src-to-address-list address-list=ddoser address-list-timeout=1h packet-size=500-65000

49 ;;; Rate limit UDP
chain=detect-ddos action=return dst-limit=30/1m,5,src-and-dst-addresses/10s

50 chain=detect-ddos action=return src-address=80.72.*.*

51 chain=detect-ddos action=return src-address=80.72.*.*

52 chain=detect-ddos action=add-dst-to-address-list address-list=ddosed address-list-timeout=10h30m

53 chain=detect-ddos action=add-src-to-address-list address-list=ddoser address-list-timeout=10h

54 ;;; Drop from ddoser-list
chain=forward action=drop src-address-list=ddoser dst-address-list=ddosed

55 chain=forward action=drop connection-state=new src-address-list=ddoser dst-address-list=ddosed

mikrobill · Mon Mar 25, 2013 3:13 pm

Hello people, did anyone test the CCR router with PPP users on it ? What is the maximum throughput in Mbps and pps ? Mikrotik is writing about "25 Simple Queues" = throughput is in Gbps. But what will happen if we put there 1000 ppp users and 1 Gbps of traffic ?

We are thinking about buying one-two CCR, but here on forum I didn't find any positive feedback…

DirectX9 · Mon Mar 25, 2013 3:31 pm

Hello people, did anyone test the CCR router with PPP users on it ? What is the maximum throughput in Mbps and pps ? Mikrotik is writing about "25 Simple Queues" = throughput is in Gbps. But what will happen if we put there 1000 ppp users and 1 Gbps of traffic ?

We are thinking about buying one-two CCR, but here on forum I didn't find any positive feedback…

will happen 1mbps on each user in ideal but i think (in example in my situation) 500 users can used connection without problems but more users may have problems with connection.

tontonalu · Mon Mar 25, 2013 9:12 pm

I am facing a problem, I installed a usb modem in CCR 16, rescource recognizes the modem, put into port usb ports appears not only serial port. version of mikrotik and 6rc11.

infused · Mon Mar 25, 2013 11:44 pm

Can anyone help me with a GRE Tunnel issue. Not sure if this is a bug:

I have 4 subnets attached to my main header IP

I have a gre tunnel listening on one of these ip addresses

it does not work.

If I use the same config on a single ip address with no additional ip addresses attached, it works.

I cannot see the issue.

blitz · Tue Mar 26, 2013 5:58 am

Can any of you provide us remote access to a router with this issue, especially where management eats more than one core to 100% ? Email support please with SSH details.

Ok. The problem is there. You have installed debug package and details ar on Ticket#2013031966000464
Please enter and see the problem because i cannot keep clients connected there too much.
Thanks
Andrew

Tue Mar 26, 2013 11:19 am

We have fixed the management CPU usage problem, and NAND read only issue. New test build will be uploaded in 10 minutes.

blitz · Tue Mar 26, 2013 11:24 am

We have fixed the management CPU usage problem, and NAND read only issue. New test build will be uploaded in 10 minutes.

Good news

Tue Mar 26, 2013 11:29 am

here it is: http://www.mikrotik.com/download/share/ ... .0rc12.npk

majkel · Tue Mar 26, 2013 11:49 am

QL

I will be test it too..

@Normis Can you check my rules? I wrote it few posts earlier.. Its strange that 500mbit TCP ddos attack (700k packets/s) is using 100% of all cpu (70%firewall 20% queining)

On attacks near 300mbit-350mbit the cpu is about 60%

When I get UDP DDOS everyting is ok... even if I get 8Gbit/s of DDOS attack

Tue Mar 26, 2013 11:50 am

QL I will be test it too..

@Normis Can you check my rules? I wrote it few posts earlier.. Its strange that 500mbit TCP ddos attack (700k packets/s) is using 100% of all cpu (70%firewall 20% queining)

When I get UDP DDOS everyting is ok... even if I get 8Gbit/s of DDOS attack

Did you enable the TCP syn cookie in firewall connection tracking options ?

majkel · Tue Mar 26, 2013 11:52 am

Dont know.. I think everything was in the rules... How to check this? and enable

EDIT.. I find it.. yes itn enabled..

Tue Mar 26, 2013 11:55 am

ros code

/ip settings set tcp-syncookies=yes

or http://cl.ly/NpQ4

majkel · Tue Mar 26, 2013 11:55 am

Yes its enabled..

Tue Mar 26, 2013 11:56 am

Yes its enabled..

you should make a new topic, about "dealing with massive DDoS"

tontonalu · Tue Mar 26, 2013 1:48 pm

Normis could see the problem of the usb port w CCR 1036 CCR 1016 not recognized in pots of Mikrotik?

Tue Mar 26, 2013 1:49 pm

Normis could see the problem of the usb port w CCR 1036 CCR 1016 not recognized in pots of Mikrotik?

What have you plugged in there? Do you use v6rc12? Did you contact support about it? For our CCRs USB works fine

tontonalu · Tue Mar 26, 2013 1:53 pm

I'm using a ZTE Modem, In resource he acknowledges, but there is no port usb ports on the RC12

Could you let me know the email or in what part of the forum manages to come about that response?

Tue Mar 26, 2013 1:57 pm

I'm using a ZTE Modem, In resource he acknowledges, but there is no port usb ports on the RC12

Could you let me know the email or in what part of the forum manages to come about that response?

official support is only provided by email to support@mikrotik.com
your ZTE modem is probably not supported. maybe we can add support. we need your supout.rif file. please make it, and send to the above address along with a problem description

blitz · Tue Mar 26, 2013 2:53 pm

here it is: http://www.mikrotik.com/download/share/ ... .0rc12.npk

This version looks fine untill now. I saw also in profile that one process call flash eats permanently about 5 % of one core. I did't see that process untill now. It is normal? It could be from debug package i did't uninstall? I will try tonight to uninstall that package to see if that process is still there.

Tue Mar 26, 2013 2:58 pm

here it is: http://www.mikrotik.com/download/share/ ... .0rc12.npk
This version looks fine untill now. I saw also in profile that one process call flash eats permanently about 5 % of one core. I did't see that process untill now. It is normal? It could be from debug package i did't uninstall? I will try tonight to uninstall that package to see if that process is still there.

Try turning off the LCD touchscreen. This is normal, previously it was not correctly reported. 5-6% on one core sounds correct for the LCD touchscreen which is showing something.

blitz · Tue Mar 26, 2013 3:05 pm

here it is: http://www.mikrotik.com/download/share/ ... .0rc12.npk
This version looks fine untill now. I saw also in profile that one process call flash eats permanently about 5 % of one core. I did't see that process untill now. It is normal? It could be from debug package i did't uninstall? I will try tonight to uninstall that package to see if that process is still there.
Try turning off the LCD touchscreen. This is normal, previously it was not correctly reported. 5-6% on one core sounds correct for the LCD touchscreen which is showing something.

You are wright! I turned off lcd and that process dissapeared.

Thanks
Andrew

majkel · Tue Mar 26, 2013 3:50 pm

How to turn off the touchscreen I cant find it ?

only backlight find..

Tue Mar 26, 2013 4:03 pm

How to turn off the touchscreen I cant find it ? only backlight find..

ros code

[admin@MikroTik] /lcd> set enabled=no

OlegM · Wed Mar 27, 2013 12:32 am

March 20, RC12 working more stable than the last ...

waszi · Wed Mar 27, 2013 12:48 am

Is there any plans to add firewall rules support to fasthpath ? Stateless filters would be enough for us.
RouterOS could become great alternative to high-end boxes. Currently we are considering 8-16 ccr1036 boxes
for ddos mitigation, with this feature it could be only few boxes.

6wind has solution that offers high performance software filtering (more than 60Mpps on standard xeon server)
but it is very expensive piece of software.

stateless TCP synproxy/syncookies would be also a great idea.

Artelisys · Wed Mar 27, 2013 6:03 am

e have fixed the management CPU usage problem, and NAND read only issue. New test build will be uploaded in 10 minutes.

Yes indeed, it has been fixed; I am no longer seeing high core CPU usage; currently running 800Mbps (400Kpps) in routing configuration only, no queues or filters and device is handling very well. Thank you for the hard work in resolving this issue!

Wed Mar 27, 2013 8:41 am

Oleg, you are using an old build. Try March 26 , 5:18PM

latuannetnam · Wed Mar 27, 2013 9:40 am

Hi Normis.
I still have CPU load 100% problem with lasted rc12 on CCR (I posted problem detail already in forum). I have make a ticket [Ticket#2013032766000191] about this problem
Please take a look and try to fix the problem.
Thanks.

majkel · Wed Mar 27, 2013 10:03 am

I had 200mbit of traffic and everything is ok..

latuannetnam Do you update firmware to 3.05 ?

blitz · Wed Mar 27, 2013 10:34 am

I had 200mbit of traffic and everything is ok..

latuannetnam Do you update firmware to 3.05 ?

Do you have March 26 , 5:18PM version or 10:49 ?

Wed Mar 27, 2013 10:38 am

So far, 5:18PM build seems to fix all remaining issues. We are ready to release RC12

majkel · Wed Mar 27, 2013 10:46 am

strange.. I had Mar/26/2013 16:36:39 .. and download it today..

DirectX9 · Wed Mar 27, 2013 10:50 am

Hello Normis
Have a trouble after update to FW 3.05 on CCR1036-12-4S
I have Upload speed limiting at 100Mbit from provider
If I test the speed between my CCR and 951G-2HnD by wire through internet I have upload speed about 97-99Mbit
but if I test the speed from the computer behind NAT (masquerade) by wire (1Gbit connection - no connection or end user cables problems) upload speed which can I see is only 38Mbit max, but really about 27 Mbit.
Changing places CCR with RB1100AHx2 solve the problem, because old firmware and ROS 5.18 on RB1100.
May be something changes in upload connections on CCR or sockets or concurrently channels or something changes in firewall engine of CCR.
Local connection of the my Computer 2xXEON 16GByte RAM with CCR is using Cisco SFP 1Gbit module.
this trouble happened a long time ago but only with CCR.
What have I do wrong?

Wed Mar 27, 2013 10:53 am

Hello Normis
Have a trouble after update to FW 3.05 on CCR1036-12-4S
I have Upload speed limiting at 100Mbit from provider
If I test the speed between my CCR and 951G-2HnD by wire through internet I have upload speed about 97-99Mbit
but if I test the speed from the computer behind NAT (masquerade) by wire (1Gbit connection - no connection or end user cables problems) upload speed which can I see is only 38Mbit max, but really about 27 Mbit.
Changing places CCR with RB1100AHx2 solve the problem, because old firmware and ROS 5.18 on RB1100.
May be something changes in upload connections on CCR or sockets or concurrently channels or something changes in firewall engine of CCR.
Local connection of the my Computer 2xXEON 16GByte RAM with CCR is using Cisco SFP 1Gbit module.
this trouble happened a long time ago but only with CCR.
What have I do wrong?

make a nework diagram showing the issue please. description is hard to follow. do you use march 26 build from 5:08PM ?

DirectX9 · Wed Mar 27, 2013 10:59 am

Hello Normis
Have a trouble after update to FW 3.05 on CCR1036-12-4S
I have Upload speed limiting at 100Mbit from provider
If I test the speed between my CCR and 951G-2HnD by wire through internet I have upload speed about 97-99Mbit
but if I test the speed from the computer behind NAT (masquerade) by wire (1Gbit connection - no connection or end user cables problems) upload speed which can I see is only 38Mbit max, but really about 27 Mbit.
Changing places CCR with RB1100AHx2 solve the problem, because old firmware and ROS 5.18 on RB1100.
May be something changes in upload connections on CCR or sockets or concurrently channels or something changes in firewall engine of CCR.
Local connection of the my Computer 2xXEON 16GByte RAM with CCR is using Cisco SFP 1Gbit module.
this trouble happened a long time ago but only with CCR.
What have I do wrong?
make a nework diagram showing the issue please. description is hard to follow. do you use march 26 build from 5:08PM ?

Use march 26 12:07
now just try 5:08PM
and write if problem will be exist.
and one question.....
Does the CCR1036-12-4 works with 100Mbit SFP or only 1Gbit SFP?

blitz · Wed Mar 27, 2013 11:05 am

strange.. I had Mar/26/2013 16:36:39 .. and download it today..

Yes. It's 16:36. My mistake.
Management problem seems to be solved for me. I still have 10:49 version and cpus are loaded a little more then before (but maybe now they are showing the reality). I will try tonight 16:36 version if everything seems ok to you.

Andrew

Wed Mar 27, 2013 11:10 am

Latest should be

ros code

10   name="system" version="6.0rc12" build-time=mar/26/2013 17:18:12 scheduled=""

DirectX9 · Wed Mar 27, 2013 11:24 am

And now.
use last built 26march 17:18:12
the bandwidth between CCR and SXT G 2HnD by wire have trouble with duplex - only in one way (TX) I see the speed about 700-800Mbit by UDP traffic with mistakes and another way RX loses speed down to zero. in TCP mode with 20 connection count I see only 50MbitTX/40MbitRX but connection is a 1Gbit (the wires is very expensive 6CAT Belden with 23AWG)

Wed Mar 27, 2013 11:26 am

And now.
use last built 26march 17:18:12
the bandwidth between CCR and SXT G 2HnD by wire have trouble with duplex - only in one way (TX) I see the speed about 700-800Mbit by UDP traffic with mistakes and another way RX loses speed down to zero. in TCP mode with 20 connection count I see only 50MbitTX/40MbitRX but connection is a 1Gbit (the wires is very expensive 6CAT Belden with 23AWG)

how are you testing this? with bandwidth test? where is the client and server? this is not a reliable method of testing

DirectX9 · Wed Mar 27, 2013 11:54 am

And now.
use last built 26march 17:18:12
the bandwidth between CCR and SXT G 2HnD by wire have trouble with duplex - only in one way (TX) I see the speed about 700-800Mbit by UDP traffic with mistakes and another way RX loses speed down to zero. in TCP mode with 20 connection count I see only 50MbitTX/40MbitRX but connection is a 1Gbit (the wires is very expensive 6CAT Belden with 23AWG)
how are you testing this? with bandwidth test? where is the client and server? this is not a reliable method of testing

Yes using MTIK hardware bandwidth test in local network.
Internet connection test is using By speedtest.net with my nearly server of my provider which is connect with me by 10Gbit MetroEthernet Cisco Catalyst by fiber and has no phisics or soft or hardware connection problems with me.

honzam · Wed Mar 27, 2013 12:07 pm

Now there is - build rc12 - 2013-03-27 10:52:10

Will be released today?

coombes69 · Wed Mar 27, 2013 12:13 pm

We are looking to replace our existing firewall in 2 weeks time.

I would like to know if the CCR is stable enough yet for a few firewall rules a few nat rules on a 50mb wan connection with upto 500 concurrent users.

I know this is vague and difficult to answer but i need to make an order today and its either the CCR 1036-12-4s or an 1100ah.

Anyones opinion would be muchly appreciated

DirectX9 · Wed Mar 27, 2013 1:21 pm

We are looking to replace our existing firewall in 2 weeks time.

I would like to know if the CCR is stable enough yet for a few firewall rules a few nat rules on a 50mb wan connection with upto 500 concurrent users.

I know this is vague and difficult to answer but i need to make an order today and its either the CCR 1036-12-4s or an 1100ah.

Anyones opinion would be muchly appreciated

500users - haha
Recommend RB1200 or 1100AH - no difference
if you have only 50Mbit WAN up to 150Mbit
For more there is sense to think about CCR

Wed Mar 27, 2013 1:26 pm

rc12 released.

DirectX9 · Wed Mar 27, 2013 1:33 pm

rc12 released.

LETS TASTE

coombes69 · Wed Mar 27, 2013 3:13 pm

500users - haha
Recommend RB1200 or 1100AH - no difference
if you have only 50Mbit WAN up to 150Mbit
For more there is sense to think about CCR

2000 users - upto 500 concurrent. also 10 regular VPN users.

We are aware that those models may well be up to it, but from what i've heard they don't scale well to DDOS attacks. and i was advised that in our environment the CPU will probably be quite high

We will also be looking at traffic shaping, policy based routing with caching appliance shortly after installing. and 6 months down the line we will most likely be going to gigabit WAN.

I like to buy much higher spec than is required usually for future proofing.

What i would like to know is if the CCR could be classed as stable in our environment.

L

DirectX9 · Wed Mar 27, 2013 3:17 pm

500users - haha
Recommend RB1200 or 1100AH - no difference
if you have only 50Mbit WAN up to 150Mbit
For more there is sense to think about CCR
2000 users - upto 500 concurrent. also 10 regular VPN users.

We are aware that those models may well be up to it, but from what i've heard they don't scale well to DDOS attacks. and i was advised that in our environment the CPU will probably be quite high

We will also be looking at traffic shaping, policy based routing with caching appliance shortly after installing. and 6 months down the line we will most likely be going to gigabit WAN.

I like to buy much higher spec than is required usually for future proofing.

What i would like to know is if the CCR could be classed as stable in our environment.

L

Unfortunately ccr is not stable, cause it doesn't be final commercial product yet

coombes69 · Wed Mar 27, 2013 3:21 pm

Some of you are using these in production though right?

Are there any major issues?

Do they still require regular reboots?

I just dont want to buy a 1100AH2 to then end up buying a CCR a few months down the line, i will if i have to but im willing to take a chance if there are not any known bugs with the firewall, nat at the moment.

DirectX9 · Wed Mar 27, 2013 3:25 pm

Some of you are using these in production though right?

Are there any major issues?

Do they still require regular reboots?

I just dont want to buy a 1100AH2 to then end up buying a CCR a few months down the line, i will if i have to but im willing to take a chance if there are not any known bugs with the firewall, nat at the moment.

A lot of minor issues in CCR - that one big major issue. I have one CCR - top version with 16Gb RAM - it is not ready just for small business but the 1100AHx2 (I have too) doesn't have o lot of issues.
I have full line wireless product in 2Ghz - the best now is rb2011UAS-2Hnd,951G,SXT G-2HnD (somehow Metal)
Wired products that I have is RB1200, RB2011RM, RB450, RB1200, RB1100AHx2 - the best is a last one. RECOMMEND for Core!

Wed Mar 27, 2013 3:25 pm

The CCR hardware will not change. Only software update could be required from time to time. Current RC12 release has many improvements and the CCR is quite usable.

Wed Mar 27, 2013 3:26 pm

Some of you are using these in production though right?

Are there any major issues?

Do they still require regular reboots?

I just dont want to buy a 1100AH2 to then end up buying a CCR a few months down the line, i will if i have to but im willing to take a chance if there are not any known bugs with the firewall, nat at the moment.
A lot of minor issues in CCR - that one big major issue. I have one CCR - top version with 16Gb RAM - it is not ready just for small business but the 1100AHx2 (I have too) doesn't have o lot of issues.

Did you upgrade to RC12, or you mean the minor issues that were fixed in RC12?

DirectX9 · Wed Mar 27, 2013 3:34 pm

Some of you are using these in production though right?

Are there any major issues?

Do they still require regular reboots?

I just dont want to buy a 1100AH2 to then end up buying a CCR a few months down the line, i will if i have to but im willing to take a chance if there are not any known bugs with the firewall, nat at the moment.
A lot of minor issues in CCR - that one big major issue. I have one CCR - top version with 16Gb RAM - it is not ready just for small business but the 1100AHx2 (I have too) doesn't have o lot of issues.
Did you upgrade to RC12, or you mean the minor issues that were fixed in RC12?

Yes Normis. I've already upgrade to RC12 but I have troubles with routing and upload speed which is happened when use wire connection. I don't speak about wireless problems because it's not correct to tell about it now - think something wrong in my config or my mind.

Wed Mar 27, 2013 3:37 pm

I've already upgrade to RC12 but I have troubles with routing and upload speed which is happened when use wire connection. I don't speak about wireless problems because it's not correct to tell about it now - think something wrong in my config or my mind.

It would be nice if you contacted support about these issues, so we can fix them for you. Please email support@mikrotik.com with problem description and supout.rif file. Make a new ticket (not reply to old one)

DirectX9 · Wed Mar 27, 2013 3:38 pm

I've already upgrade to RC12 but I have troubles with routing and upload speed which is happened when use wire connection. I don't speak about wireless problems because it's not correct to tell about it now - think something wrong in my config or my mind.
It would be nice if you contacted support about these issues, so we can fix them for you. Please email support@mikrotik.com with problem description and supout.rif file. Make a new ticket (not reply to old one)

OK

Beeski · Wed Mar 27, 2013 3:55 pm

500users - haha
Recommend RB1200 or 1100AH - no difference
if you have only 50Mbit WAN up to 150Mbit
For more there is sense to think about CCR
2000 users - upto 500 concurrent. also 10 regular VPN users.

We are aware that those models may well be up to it, but from what i've heard they don't scale well to DDOS attacks. and i was advised that in our environment the CPU will probably be quite high

We will also be looking at traffic shaping, policy based routing with caching appliance shortly after installing. and 6 months down the line we will most likely be going to gigabit WAN.

I like to buy much higher spec than is required usually for future proofing.

What i would like to know is if the CCR could be classed as stable in our environment.

L

We have had one of our Towers managed by a CCR on rc9 for more than 45 days without a reboot.
Approx 100Mbps of traffic, 300 customers, vlans and firewall rules.
I would say go with the CCR.

coombes69 · Wed Mar 27, 2013 4:06 pm

Thanks beeski & normis.

I think i will try out the CCR. worst case scenario is i swap patch leads over to our old firewall i suppose.

Attila · Wed Mar 27, 2013 5:08 pm

Dear Normis!

Ticket#2013020566000411: Multicast routing (PIM-SM) same source (IPTV channel) with different client IP (Set Top Box) not working in CCR1036 (RC6,RC7,RC8,RC9,RC10,RC11,RC12). Same ROS version (RC6,RC7,RC8,RC9,RC10,RC11,RC12) and same configuration (1. RP, 3. Interface) working correctly in RB2011.

Please investigate this problem...

Thx.

Attila

caiot5 · Wed Mar 27, 2013 6:00 pm

EDIT: I forgot to mention the RoS version and the firmware: RouterOS: v6.0rc11 , Firmware: 3.02

We have several CCR boards running on our company (ISP) and we noticed that everytime we restore a backup from another routerboard like the RB1000 the lcd panel shows that it is booting but freezes on "loading services" screen.
I can access and use the RB normally but without any lcd function.

I have tried to enable it by the console but it freezes too and after a while prints an error:

/lcd set enabled=yes
action timed out - try again, if error continues contact MikroTik support and send
a supout file (13)

Can somebody give us a help?

Thanks in advance.
Best regards,
Caio

Leo72 · Wed Mar 27, 2013 9:09 pm

hi all

we upgraded today our CCR1036 with reboot problems, to RC12 (yesterday build); let's see

I will keep you updated

regarding the CCR1016, 35days in production and still no issue

B/R

Leo72 · Wed Mar 27, 2013 9:19 pm

hi again

we got some days ago our 3rd CCR, a CCR1016. We updated the ROS and then loaded the configuration of our CCR1036, of course there was a small issue, because the 4 SFP interfaces are missing, but we did not think this to be a big problem

anyway, after the configuration was restored, the CCR1016 seems "dead"; no way to access it either via IP address or via MAC

any idea? connecting it to a PC via serial port, it does not show anything (tested at 115200 bps 8N1 no flow control); the LCD stops at "loading kernel"

I opened a ticket (#2013032566000443) but still no answer

pushing the reset button seems not to produce any effect (but I don't know which exact procedure my colleague followed, I can't ask now because he has holidays)

do we have to return it ?

DirectX9 · Thu Mar 28, 2013 7:42 am

EDIT: I forgot to mention the RoS version and the firmware: RouterOS: v6.0rc11 , Firmware: 3.02

We have several CCR boards running on our company (ISP) and we noticed that everytime we restore a backup from another routerboard like the RB1000 the lcd panel shows that it is booting but freezes on "loading services" screen.
I can access and use the RB normally but without any lcd function.

I have tried to enable it by the console but it freezes too and after a while prints an error:

/lcd set enabled=yes
action timed out - try again, if error continues contact MikroTik support and send
a supout file (13)

Can somebody give us a help?

Thanks in advance.

Please update FW to 3.05 - it would be better.
Best regards,
Caio

greek · Thu Mar 28, 2013 11:01 am

*) sstp server - removed test mode which allowed running server without certificate;

Oh, why ?

mrz · Thu Mar 28, 2013 11:20 am

*) sstp server - removed test mode which allowed running server without certificate;
Oh, why ?

Because of security reasons.

janisk · Thu Mar 28, 2013 11:52 am

everyone - do not use backup files to move configuration from one router to another.

use '/export compact' and save to file and then adjust it for router you want to import script into. Backup has a lot of router specific stuff that can cause problems.

caiot5 · Thu Mar 28, 2013 1:40 pm

everyone - do not use backup files to move configuration from one router to another.

use '/export compact' and save to file and then adjust it for router you want to import script into. Backup has a lot of router specific stuff that can cause problems.

Thanks for the quick reply.
I haven't tried to use the /export compact command but instead I have used the /ip address export file=xxx , /ip route export file=xxx, etc. Unfortunately both of them are giving an error message "syntax error", I have tried to debug and I found that all the comment fields with accentuation fail to export and even if I delete all of them, it gives the syntax error.
That's why we used the backup function that "at least" works.

I will try to use the /export compact command but, do you really think it will work? I mean, that router is in production state, can I rely on that command?

Best Regards,
Caio.

DirectX9 · Thu Mar 28, 2013 2:28 pm

everyone - do not use backup files to move configuration from one router to another.

use '/export compact' and save to file and then adjust it for router you want to import script into. Backup has a lot of router specific stuff that can cause problems.

Hello
Please tell me about SFP modules (I have some).
All modules (MultiMode or SingleMode) with Gigabit speed are corecctly works with CCR, but SFP with 100Mbit speed is not correctly works - CCR tell that is Gigabit module. What's wrong? Bug in firmware? (CCR1036-12-4 FW3.05 ROS 6rc12 last)

Chupaka · Thu Mar 28, 2013 5:14 pm

all the comment fields with accentuation fail to export

any example?.. what version do you use?

caiot5 · Thu Mar 28, 2013 6:28 pm

all the comment fields with accentuation fail to export
any example?.. what version do you use?

I'm exporting it from ROS 6.0rc7 (RB1000) (I have tried with 6.0rc11 too) and importing in a CCR1036 with ROS 6.0rc11.

An example:

add comment="IP LIGA\C7\C3O TN / 5.8" distance=1 dst-address=187.9.30.176/30 \
gateway=172.31.153.171

This line contains accentuation and will return "syntax error".

majkel · Thu Mar 28, 2013 11:54 pm

I have the question about indicator of CPU use in my 1036

What u Can see in the profile the cpu use is about 8,5%... so why near the clock and in the resources the cpu use is 1%?

Its bug? or what

caiot5 · Fri Mar 29, 2013 1:17 am

hi again

we got some days ago our 3rd CCR, a CCR1016. We updated the ROS and then loaded the configuration of our CCR1036, of course there was a small issue, because the 4 SFP interfaces are missing, but we did not think this to be a big problem

anyway, after the configuration was restored, the CCR1016 seems "dead"; no way to access it either via IP address or via MAC

any idea? connecting it to a PC via serial port, it does not show anything (tested at 115200 bps 8N1 no flow control); the LCD stops at "loading kernel"

I opened a ticket (#2013032566000443) but still no answer

pushing the reset button seems not to produce any effect (but I don't know which exact procedure my colleague followed, I can't ask now because he has holidays)

do we have to return it ?

Probably you're facing the same problem as me, your backup got wrongly restored and all the interfaces have no IP address, and the MAC server is disabled.
But I think you can reset the device, try the following procedure:
1- Turn off the CCR1036
2- Press and hold the reset button
3- Turn it on with the reset button pressed and release it after about 5 seconds.

I think it will reset your CCR.
Please tell me if it worked for you.

Regards,
Caio.

Leo72 · Fri Mar 29, 2013 1:25 am

thanks, I will try tomorrow at work, and report

jedrek · Fri Mar 29, 2013 9:54 am

Hi everyone.

Does any one have a problem with BGP HoldTImer Expired on CCR1016?
From about a week i have 2 BGP flaps in 24h.

Logs:
02:52:10 route,bgp,error HoldTimer expired
02:52:10 route,bgp,error RemoteAddress=8x.1xx.1x.1xx
02:53:08 route,bgp,info Failed to open TCP connection: No route to host
02:53:08 route,bgp,info RemoteAddress=8x.1xx.1x.1xx
02:53:31 route,bgp,info Failed to open TCP connection: No route to host
02:53:31 route,bgp,info RemoteAddress=8x.1xx.1x.1xx
02:53:47 route,bgp,info Connection opened by remote host
02:53:47 route,bgp,info RemoteAddress=8x.1xx.1x.1xx

//EDIT

[admin@JDS-CORE.BGP] > /system routerboard print
routerboard: yes
model: CCR1016-12G
current-firmware: 3.05
upgrade-firmware: 3.05

[admin@JDS-CORE.BGP] > /system resource print
uptime: 7h50m17s
version: 6.0rc12
build-time: Mar/26/2013 17:18:12
free-memory: 1507.9MiB
total-memory: 1940.2MiB
cpu: tilegx
cpu-count: 16
cpu-frequency: 1200MHz
cpu-load: 0%
free-hdd-space: 431.1MiB
total-hdd-space: 512.0MiB
architecture-name: tile
board-name: CCR1016-12G
platform: MikroTik

SwissWISP · Fri Mar 29, 2013 10:14 am

On our 1036 we don't see such problems. We've got BGP sessions that are up since several weeks.

Logs:
02:52:10 route,bgp,error HoldTimer expired
02:52:10 route,bgp,error RemoteAddress=8x.1xx.1x.1xx
02:53:08 route,bgp,info Failed to open TCP connection: No route to host
02:53:08 route,bgp,info RemoteAddress=8x.1xx.1x.1xx
02:53:31 route,bgp,info Failed to open TCP connection: No route to host
02:53:31 route,bgp,info RemoteAddress=8x.1xx.1x.1xx
02:53:47 route,bgp,info Connection opened by remote host
02:53:47 route,bgp,info RemoteAddress=8x.1xx.1x.1xx

The red lines look strange to me. I would say you've got a routing problem before BGP even runs.
Is you peer directely connected or not?

- Mat

jedrek · Fri Mar 29, 2013 10:29 am

On our 1036 we don't see such problems. We've got BGP sessions that are up since several weeks.

Logs:
02:52:10 route,bgp,error HoldTimer expired
02:52:10 route,bgp,error RemoteAddress=8x.1xx.1x.1xx
02:53:08 route,bgp,info Failed to open TCP connection: No route to host
02:53:08 route,bgp,info RemoteAddress=8x.1xx.1x.1xx
02:53:31 route,bgp,info Failed to open TCP connection: No route to host
02:53:31 route,bgp,info RemoteAddress=8x.1xx.1x.1xx
02:53:47 route,bgp,info Connection opened by remote host
02:53:47 route,bgp,info RemoteAddress=8x.1xx.1x.1xx
The red lines look strange to me. I would say you've got a routing problem before BGP even runs.
Is you peer directely connected or not?

- Mat

Yeah. It's a direct connection via fiberoptics.

SwissWISP · Fri Mar 29, 2013 10:49 am

Yeah. It's a direct connection via fiberoptics.

Well, I would check the connection. It looks like your connection is flapping.
Try to ping the peer for some hours.

jedrek · Fri Mar 29, 2013 10:53 am

Yeah. It's a direct connection via fiberoptics.
Well, I would check the connection. It looks like your connection is flapping.
Try to ping the peer for some hours.

Yeah... that's my thought in the first place. But one thing is interesting... It's always around 21-22 in the evening and around 1-2 in the morning.

//EDIT

Everything is clear now. My ISP calld just few minutes ago, and the problem is on their side of the network

Leo72 · Fri Mar 29, 2013 1:24 pm

caiot5, unfortunately the reset procedure you describe does not work here...

the LCD stops always at "loading kernel", no further message, no way to access the device via winbox

MTik support team, any other idea? is there another procedure for "load factory defaults"? or to access a boot manager and reflash the firmware?

Ticket#2013032566000443

do I have to return the device to our distributor?

Chupaka · Fri Mar 29, 2013 5:44 pm

An example:

add comment="IP LIGA\C7\C3O TN / 5.8" distance=1 dst-address=187.9.30.176/30 \
gateway=172.31.153.171

This line contains accentuation and will return "syntax error".

hm... I added that route, and "/ip route export" exported it normally... =)

raz · Fri Mar 29, 2013 9:58 pm

My CCR is since few Days in production enviroment, im using it as core Router with BGP Fullfeed including Firewalling, like Drop SYN Floods.

Great, the 16 Cores can filter out around 350k pps (!!!) with Conntrack before it goes down. A wonderful extension would be the possibility to Filter Packets by more Flags, like TCP len=0.

jager · Sat Mar 30, 2013 10:39 am

Hi everybody,

Does anybody experience (upgraded to v6.0rc12) usernames and passwords vanishing without reboot or any other issue? This is on CCR1036.
This router is our maing BGP router and was working OK for days after upgrade to the first pre-lease CR12. There is one full BGP route and if no BGP flapping exists, everything is normal.

Now we have some fibre maintenance and the BGP is going on/off sometimes. This completely makes the router crazy and it simply forget all usernames/passwords and it resets to factory defaul admin/no_passwd.
After /system reboot, the router is not accessible until we powercycle it.
Trying to make supout.rif before reboot does not work. It simply fails. Like it is impossible to write do disk.

This is so painfull and I'm really losing my patience. I hate even the idea to do BGP on Cisco, but if this is not going to be fixed soon, I will simply be forced to do so.

Any idea what's wrong???

By the way, the router don't have literally any other task than one BGP route. No firewalling, mangle, etcetc. Just one plain full BGP route and passing traffic to the rest of the network.

yinternetmalaga · Sat Mar 30, 2013 10:56 am

Hello all,

Recently our CCR1036 has been acting strange. Everynight at 1am the CPU usage jumps from 1% to 20%. When looking at the CPU usage, it is showing 8 cores running at 100%. Under "Profile", I have 20% usage on Management.

What features are classified as Management??

Also when this happens, we loose connectivity to any VLAN interface running on the CCR. Very strange!!

Anyone else seen this??

jager · Sat Mar 30, 2013 11:09 am

@yinternetmalaga

Try disabling SNMP

DirectX9 · Sat Mar 30, 2013 1:59 pm

Hello my Dear support.
And How about Switch option (Manual:Switch Chip Features in WIKI) on CCR
Or it is not needed for such device?
I see you had allready implemented MASTER PORT feature in RC12.

Arcticfox · Sun Mar 31, 2013 9:43 am

Dear support, please help me,
I've bought CCR-1036-12G-4S (ROSv6rc12), and getting this 3 types of errors:
1. After making l2tp tunnel, and setting it up, I've found an impossibility to remove that tunnel.
2. Also CCR loses it's PPP profiles and it makes impossible to deactivate tunnel directly (by setting it's status to disable).
Then I go by 3 ways:
3. When I tryed to resetup tunnel profile, I've got a hanging webfig/cli to timeout:
[admin@MikroTik] > ppp profile add name="beeline-l2tp" change-tcp-mss=yes
action timed out - try again, if error continues contact MikroTik support and send a supout file (13)
4. When I tryed to disable l2tp-client, I've got a next situation:
4.a It hangs at: [admin@MikroTik] > interface l2tp-client print
4.b After pressing Ctrl+C it prints:
Flags: X - disabled, R - running
0 R name="l2tp-beeline" max-mtu=1460 max-mru=1500 mrru=disabled
connect-to=195.14.38.42 user="user" password="password"
profile=(unknown) add-default-route=yes dial-on-demand=no allow=chap
4.c After direct trying to disable l2tp client directly:
[admin@MikroTik] > interface l2tp-client disable 0
action timed out - try again, if error continues contact MikroTik support and send a supout file (13)

Trying to reboot CCR causes:
[admin@MikroTik] > sys reboot
Reboot, yes? [y/N]:
y
system will reboot shortly

After 2 minutes: LCD prints "rebooting..."
After more 3 minutes, still "rebooting...".
10 minutes past: still "rebooting..."

I thing something wrong with l2tp module on CCR. Could you debug it?

On ROSv6rc11 I've met next bug:
after deleting NAT rule router fall in "kernel panic!" and reboots.

caiot5 · Mon Apr 01, 2013 2:25 pm

An example:

add comment="IP LIGA\C7\C3O TN / 5.8" distance=1 dst-address=187.9.30.176/30 \
gateway=172.31.153.171

This line contains accentuation and will return "syntax error".
hm... I added that route, and "/ip route export" exported it normally... =)

Thank you so much for the support.
But I can export the routes normally, the problem occurs only when I'm importing it.

lorenzesz · Mon Apr 01, 2013 2:59 pm

Hej! Could someone test if the proxy cache server is capable of using more than one cpu core at once?

Tue Apr 02, 2013 10:10 am

Arcticfox, we cannot reproduce L2TP tunnel problems with v6.0rc12. Please write to support@mikrotik.com and send us supout.rif file for research.

OlegM · Wed Apr 03, 2013 1:23 pm

RC12, which is available at the site, 2 days later started to brake, but after 3 days reboot itself. Rolled back to the version of March 20, RC12. It is stable.

majkel · Wed Apr 03, 2013 2:46 pm

I Think You must send the supout file to the support, becouse on my 1036 first time I have 8 days uptime without problems

OlegM · Wed Apr 03, 2013 3:53 pm

The fact that even the nuclei RC12 work on March 20, significantly more stable than that of March 26. March 20, up 80% on the core and I have not seen addressed in almost all nuclei always. A rising number of 26 for a few seconds up to 100%, not all kernels is used.

Arcticfox · Wed Apr 03, 2013 5:16 pm

Posted to @mail:
Can't make supout.rif because CCR do not want to create it.
Hanging self up and failed... failed... failed...

Leo72 · Wed Apr 03, 2013 11:08 pm

hi, at the moment our CCR1036 doing BGP with RC12 has an uptime of 7 days

the max uptime with previous builds was 9 days

so let's see... fingers crossed

Leo72 · Fri Apr 05, 2013 3:30 am

???

an update about our production CCRs:

CCR1016 RC10 uptime 44 days; no crash until now
CCR1036 RC12 uptime 8 days; no crash until now, with this RC

FiShYmAn · Fri Apr 05, 2013 9:27 am

everyone - do not use backup files to move configuration from one router to another.

use '/export compact' and save to file and then adjust it for router you want to import script into. Backup has a lot of router specific stuff that can cause problems.
Hello
Please tell me about SFP modules (I have some).
All modules (MultiMode or SingleMode) with Gigabit speed are corecctly works with CCR, but SFP with 100Mbit speed is not correctly works - CCR tell that is Gigabit module. What's wrong? Bug in firmware? (CCR1036-12-4 FW3.05 ROS 6rc12 last)

As above I have the same issue with my CCR, I have a fibre connection that needs to be locked to 100mbit full duplex, when i use a 100mbit fibre SFP module the CCR displays this module as being 1Gbps even when i turn off auto negotiate and lock it to 100mbit, of course because it wont lock to 100mbit I cant get my fibre connection working and I have to run it into a media converter which is locked too 100mbit full duplex, then I run ethernet out of this into the CCR, I would ideally like to and cant see any reason why I cant run this direct, but the routeros or the CCR has issues with it.

complete2006 · Fri Apr 05, 2013 12:43 pm

Second call:

Who's in production with actual RC? Who has PPPOE and BGP running?

Leo72 · Fri Apr 05, 2013 7:38 pm

we have a CCR1036 RC12 in production, with BGP only, no PPP

as I was fearing, today we got the expected crash, just approaching the "9d" uptime mark

the router stopped forwarding

I entered it via winbox, it answered; all interfaces were missing; I was trying to keep calm but was not able to do any useful test

I tried making a supout.inf file, but it did not succeed; customers were starting to call (a TV was broadcasting live), so I had to reboot by power cycling

Ticket#2013040566000701

screenshots sent to MT

Leo72 · Fri Apr 05, 2013 11:09 pm

hi, today evening it crashed again

so we decided to NOT reboot it, instead we connected our lines to the backup router, a RB1100AHX2

so at the moment our "crashed" CCR1036 is on and in "crashed state", so that we or MT can further investigate

I am trying to produce the supout file; started 5 min ago and not yet finished, is that normal?

the CPUs are all 0%, one is 5% on average (probably working on the supout file generation?)

all IP addresses are disappeared

all interfaces are disappeared

(but I am connected to one of them and it actually works)

all BGP entries are disappeared

we can keep it powered on forever until we can find something interesting

MT, we can give you remote desktop access and you can see and investigate by yourselves

morf · Fri Apr 05, 2013 11:32 pm

You done that have caught this bug!
I bought 2 CCR1036, but I'm afraid to put in the real world. So read the forum and wait for a working RC.
I'm on the CCR1036 is not working as it should shaper. Earlier I marked connection then packages and create rules queues. Now in RouterOS 6 this does not work.

complete2006 · Sat Apr 06, 2013 10:43 am

Mikrotik. I think you should remove CCR from routerboard.com for a while or modify the description in that way that people know that system isn't ready for use yet.

raz · Sat Apr 06, 2013 7:09 pm

Hi,

i have the same Problem with freezing CCR, i think its because it rans out of Memory. I have to reboot every 7 Days :/
Im running only BGP, some small Rules, thats all.

lorenzesz · Sun Apr 07, 2013 4:38 pm

Is this hardware working with webcache utilizing all cores?

What features work without crashing the router?

Please answer!

majkel · Mon Apr 08, 2013 8:54 am

Mikrotik. I think you should remove CCR from routerboard.com for a while or modify the description in that way that people know that system isn't ready for use yet.

I think its too late for that

RC12 is stable.. but v6.0 needs a lot for work.. One year ago CCR comes out, and still dont have firewall fastpach supporta, and for 36 cores.. TCP DDOS attacks eat my CCR in 5 seconds.. I Thing MK do very good joob, but for clients what pay for ccr 500-1000$ is to slow.. CCR is outstanding router but his potential somewhere sleeping

complete2006 · Mon Apr 08, 2013 8:57 am

I think they are working hard to remove the bugs as they appear but that is exactly the problem: "as they appear". I made a pre-order in 2012 of 12 pcs CCR 1036 and canceled it after reading first forum posts. From my point of view the CCR is the right way but the step was to big. I would prefer as a first step to have a RB-1xxx with four SFP (or 24 SFP

) that will run stable ...

Chupaka · Mon Apr 08, 2013 10:46 am

TCP DDOS attacks eat my CCR in 5 seconds..

have you checked your own topic? http://forum.mikrotik.com/viewtopic.php ... 33#p362233
you know you have bad firewall rules - and still complains that router cannot process them under heavy DDoS?..

majkel · Mon Apr 08, 2013 10:57 am

I change firewall rules with instructions, with help another peoples.. its better, But still 1Gbit of TCP packets kills router..

I have couple of times situation, that i get TCP SSYN with attack 300-400mbit and router block himself for 2 minutes..

Chupaka · Mon Apr 08, 2013 11:03 am

I change firewall rules with instructions, with help another peoples.. its better, But still 1Gbit of TCP packets kills router..

I can't comment the rules you don't show

complete2006 · Mon Apr 08, 2013 4:05 pm

Hmm. The blocking of the router seem not to bee an CCR issue. I see this here with PC and RB1200 routers. After 2 min they come back. I can log on with winbox . I can ping from the router to the subnet but I can't ping from the subnet to the router.

inasset · Tue Apr 09, 2013 7:49 pm

Mikrotik :

Why don't you release RouterOS 5.24 for the CCR serious, production users, and leave the 6.0rcN series for this who can afford to be your (free) beta testers?

When I paid for the CCR router I thought I was buying a stable production Router, as indicated in your videos, technical and marketing documentation. I was definitely NOT buying a 'someday-will-be' production router.

R

Tue Apr 09, 2013 8:29 pm

Mikrotik :

Why don't you release RouterOS 5.24 for the CCR serious, production users, and leave the 6.0rcN series for this who can afford to be your (free) beta testers?

When I paid for the CCR router I thought I was buying a stable production Router, as indicated in your videos, technical and marketing documentation. I was definitely NOT buying a 'someday-will-be' production router.

R

Then blame your distributor - in all official announcements MT informed that this is "pre-production batch for those who wanna try it before full production"
You can't have RouterOS v5 , cause this is completely new CPU architecture that didn't exist before v6

inasset · Tue Apr 09, 2013 8:46 pm

Then blame your distributor - in all official announcements MT informed that this is "pre-production batch for those who wanna try it before full production"
You can't have RouterOS v5 , cause this is completely new CPU architecture that didn't exist before v6

Taken from : http://routerboard.com/CCR1036-12G-4S

"CCR1036-12G-4S is an carrier grade router with a cutting edge 36 core Tilera CPU! Over 20 times faster than our previous top model."

Now, it seems your concept of 'Carrier Grade' is a bit different from mine.

And, if you have the source code for v5.24, why can't you compile it for Tile64?

R

biomesh · Tue Apr 09, 2013 8:51 pm

Then blame your distributor - in all official announcements MT informed that this is "pre-production batch for those who wanna try it before full production"
You can't have RouterOS v5 , cause this is completely new CPU architecture that didn't exist before v6
Taken from : http://routerboard.com/CCR1036-12G-4S

"CCR1036-12G-4S is an carrier grade router with a cutting edge 36 core Tilera CPU! Over 20 times faster than our previous top model."

Now, it seems your concept of 'Carrier Grade' is a bit different from mine.

And, if you have the source code for v5.24, why can't you compile it for Tile64?

R

You need to read everything on the page (i.e. at the bottom)

"Pre-production samples for evaluation purposes will be available from Distributors, starting December 2012. Place your order for test units with your Distributor now!"

inasset · Tue Apr 09, 2013 8:56 pm

You need to read everything on the page (i.e. at the bottom)

"Pre-production samples for evaluation purposes will be available from Distributors, starting December 2012. Place your order for test units with your Distributor now!"

Yes, I read it. This confirms it is not a Carrier Grade router. It may be, someday.

R

rower · Mon Apr 15, 2013 3:08 pm

You need to read everything on the page (i.e. at the bottom)

"Pre-production samples for evaluation purposes will be available from Distributors, starting December 2012. Place your order for test units with your Distributor now!"
Yes, I read it. This confirms it is not a Carrier Grade router. It may be, someday.

R

the router is. the software is not. and there is almost no information on that by any reseller.

raz · Mon Apr 15, 2013 11:47 pm

Hi,

how long it takes to get an Reply of: [Ticket#2013041366000268] ?

btw

hping3 --rand-source –S –L 0 –M 0 –p 179 MIKROTIK IP --flood will kill the CCR <3 Seconds. ONLY Basic Setup, no Conntrack ONLY ip firewal drop TCP to Port 179 @ IP.

janisk · Wed Apr 17, 2013 10:59 am

We are working on the issue.

coombes69 · Wed Apr 17, 2013 12:28 pm

We now have a CCR-1036 in production, all has been working well for a week now on 6.rc13

I decided to add a few queues which worked fine for around an hour (queue tree, 6 child queues matching packets for priority with queue type ethernet-default.)

The whole queue service appears to have crashed whilst everything else works perfectly.

I cant reboot router during the day, is there a way to restart the service?

raz · Wed Apr 17, 2013 1:30 pm

We are working on the issue.

Great to hear, dont got a Feedback

if you need more Infos send me a Mail.

otgooneo · Wed Apr 17, 2013 1:41 pm

We now have a CCR-1036 in production, all has been working well for a week now on 6.rc13

I decided to add a few queues which worked fine for around an hour (queue tree, 6 child queues matching packets for priority with queue type ethernet-default.)

The whole queue service appears to have crashed whilst everything else works perfectly.

I cant reboot router during the day, is there a way to restart the service?

Unfortunately, No. You can not restart service or process. All you can is disable/enable queues or restart router itself.

aTan · Wed Apr 17, 2013 1:48 pm

Does Master port feature works? I have RC13 and for me it doesn't. I can set Master port, but it doesn't work, and after restart setting vanishes.

Wed Apr 17, 2013 3:30 pm

Does Master port feature works? I have RC13 and for me it doesn't. I can set Master port, but it doesn't work, and after restart setting vanishes.

Master-port setting will not take effect because CCR1036-12G-4S and CCR1016-12G do not have switch-chips.

n3c8 · Wed Apr 17, 2013 5:13 pm

I'm just wondering. Are there any estimates about when we can expect the CCR to be production standard. Also I've previously mentioned a lack of MTU, any movement on that? One final question, are there any indications that the actually hardware spec will change in production models making our current purchase purely a prototype/pre-production model.

DirectX9 · Wed Apr 17, 2013 5:29 pm

CCR does not have swtich chips, so master port setting is not working as there are nothing to work on.

Are you recommend to use BRIDGE instead of?

rogeriodj · Thu Apr 18, 2013 2:34 am

Is to get my money back?
My CCR-1036 sucks!
Because neither the gbic own mikrotik does not work, the link is ok, most do not have any traffic, longer connect a rb in other works!
Now in rb2011 works perfect.
What the fuck is that CCR does not work?

janisk · Thu Apr 18, 2013 9:42 am

Are you recommend to use BRIDGE instead of?

as ccr does not have switch option use of bridge is only way on how to extend the Ethernet network if you have to.

infused · Thu Apr 18, 2013 11:55 am

Is to get my money back?
My CCR-1036 sucks!
Because neither the gbic own mikrotik does not work, the link is ok, most do not have any traffic, longer connect a rb in other works!
Now in rb2011 works perfect.
What the f**k is that CCR does not work?

So what you are saying is you should have read that this was a pre-production release?

SwissWISP · Thu Apr 18, 2013 12:45 pm

Our CCR acts like it got infected by a Virus.
It began to create scripting jobs by itself, changed the position of firewall rules (I was looking at the rules while it was doing it) and deleted my whole BGP config after a reboot.

Am I the only one with this problem or did someone else see this too?

- Mat

janisk · Thu Apr 18, 2013 1:22 pm

check if you are running latest release of 6.0rc or you have secured the router

SwissWISP · Thu Apr 18, 2013 2:08 pm

It runs on RC14 and there are firewall rules to limit access to this router and of course username and password are not default.

janisk · Thu Apr 18, 2013 2:14 pm

please generate supout rif when in one state and afterwards generate another one in altered state. we have not seen anything like that.

SwissWISP · Thu Apr 18, 2013 3:27 pm

please generate supout rif when in one state and afterwards generate another one in altered state. we have not seen anything like that.

I just saw why these Jobs are created. It's because a autosupout.rif got created in the background (and partly fails). The stuff that happens to the BGP config is a bug and can be reproduced (at least on my device). The only thing that I can not explain is why the firewall rules changed.

Well, I opened a new ticket because I also found some other bugs.

- Mat

JbBoin · Thu Apr 18, 2013 4:18 pm

Two days ago i tried the RC14 i found on the forum on my CCR, one of the CPU got stuck ~100% after few seconds while getting a BGP full routing table so i couldnt do a /routing bgp * print which would never end up (but it could be cancelled with control+c).

Back to RC13 and everything is working fine.

janisk · Thu Apr 18, 2013 5:20 pm

SwissWISP, check if you have not sected different firewall rule ordering. That could explain rules changing order.

SwissWISP · Thu Apr 18, 2013 5:27 pm

SwissWISP, check if you have not sected different firewall rule ordering. That could explain rules changing order.

That's a good hint. Maybe I have accidentely clicked on that tab. I will keep an eye on that. If it never happens again, it was just my fault.

raz · Fri Apr 19, 2013 12:41 am

Sorry for asking a lot, but any News at Ticket#2013041366000268 ?

morf · Fri Apr 19, 2013 9:04 am

Hello!
Strange CPU with two cores. The CCR1036 has no firewall rules, queues, nothing. But for some reason the load on the two cores of about 5-6%.
I do not want to say that this is a problem, but it can be any source of the problem?

onnoossendrijver · Fri Apr 19, 2013 2:09 pm

5 - 7 percent cpu utilization on 2 of the 36 cores corresponds to about 0.4% overall cpu utilization. I don't see any strange things here.

morf · Fri Apr 19, 2013 4:40 pm

5 - 7 percent cpu utilization on 2 of the 36 cores corresponds to about 0.4% overall cpu utilization. I don't see any strange things here.

Maybe so. I found it strange that in the "pure" ССR1036 is any load on the CPU.

morf · Fri Apr 19, 2013 5:55 pm

how CCR works with BGP, and how to cope with the routing of about 1 Gbps of traffic? Please write, those who used ССR with 2 or more BGP uplinks.

SwissWISP · Fri Apr 19, 2013 8:21 pm

how CCR works with BGP, and how to cope with the routing of about 1 Gbps of traffic? Please write, those who used ССR with 2 or more BGP uplinks.

I wouldn't use the CCR for BGP routing at the moment. There is a problem with stuck routes: http://forum.mikrotik.com/viewtopic.php?f=14&t=57781.
I was told by support that they are working on a solution.

- Mat

infused · Sun Apr 21, 2013 10:57 pm

Does anyone get long pauses on the CCR? Almost like it's timing out?

We've noticed we get this outage for about 5 seconds. If you are trying to login to the router at that time, the login hangs as well. Had this on all versions so far.

friction · Mon Apr 22, 2013 12:06 am

Does anyone get long pauses on the CCR? Almost like it's timing out?

We've noticed we get this outage for about 5 seconds. If you are trying to login to the router at that time, the login hangs as well. Had this on all versions so far.

I've got no CCR to compare this and I think I haven't got this issue on any other MT rboards yet, but on a linux machine, it usually occurs when it performs a reverse lookup on your IP address... Have you set any dns servers, e.g google dns (8.8.8.8, 8.8.4.4)? This may in fact be a totally different issue, ofc, just trying to help.

infused · Mon Apr 22, 2013 1:46 am

Does anyone get long pauses on the CCR? Almost like it's timing out?

We've noticed we get this outage for about 5 seconds. If you are trying to login to the router at that time, the login hangs as well. Had this on all versions so far.
I've got no CCR to compare this and I think I haven't got this issue on any other MT rboards yet, but on a linux machine, it usually occurs when it performs a reverse lookup on your IP address... Have you set any dns servers, e.g google dns (8.8.8.8, 8.8.4.4)? This may in fact be a totally different issue, ofc, just trying to help.

Interesting, you may be right. We had googles one set for some reason... will change and update.

nick3dos · Mon Apr 22, 2013 12:13 pm

Hello

I just get my new CCR1016-12G.
I have installed 6.0rc13 version.

I made my hotspot just like i had it before with RB1100AH v.5.24.
Everything works fine but in ip -> hotspot -> active, i can't see any traffic on Tx Rate collum

Anybody knows why is this happening???

louisg · Wed Apr 24, 2013 3:19 am

We're running our core infrastructure with a CCR1016-12G.

Certainly recommend this to anyone that is looking at replacing or upgrading core devices.

Mikrotik get a +1 for this.

athlonxp78 · Wed Apr 24, 2013 7:03 pm

We're running our core infrastructure with a CCR1016-12G.

Certainly recommend this to anyone that is looking at replacing or upgrading core devices.

Mikrotik get a +1 for this.

What versión of RouterOS you are using? 100% Stable?

coombes69 · Wed Apr 24, 2013 11:04 pm

We are now using a CCR-1036 as our firewall/internet gateway and we are very impressed

We have 2000 users with 5-600 concurrent on a 100mb WAN and 250 firewall rules, 20 NAT rules, 20 mangle rules, OSPF, PBR to caching box and PPTP VPN

10 PCQ Queues

I have to say that for the money this device is amazing obviously the feature set is great as all mikrotik devices carry the same features but with 500 concurrent users and hundreds of PCQ connections the highest CPU load i have seen is 3%

I know this is probably overkill for our setup but its still substantially cheaper than other firewalls on the market.

This has been running RC13 for 2 weeks now with only a slight glitch with queueing that was down to config and a reboot resolved it.

+1 to mikrotik.

regardtv · Wed Apr 24, 2013 11:36 pm

Unfortunately, No. You can not restart service or process. All you can is disable/enable queues or restart router itself.

A couple of times a day I wish I had the 'devel' login to be able to kick some services in the balls and just restart them. SNMP is one I specifically wish I could restart - but alas

donny · Fri Apr 26, 2013 7:05 am

I am using CCR1016-12G OS version 6.0rc13,
Sometime list in simple queue and queue tree are disappeared. And at the same time SNMP error too.
After reboot, everything back to normal, but after few hour, its happen again.

inSaNo · Fri Apr 26, 2013 11:21 pm

Today I've ordered a CCR1016-12G (via my local reseller) for one of my customers.
I can't wait to get my hands on it.. I'll be implementing it at a new colocation site.

etorla · Mon Apr 29, 2013 4:46 pm

The SNMP is not found properly. I need reboot the Cloud Core every days.

I have ccr1016-12G with V6.0rc13

Thanks

hero12 · Thu May 02, 2013 5:37 pm

[16:32:00] spinka8: I was using CCR36 about 3 days -firewall/queue/pppoe+dynamic queue/radius/linux+mysql+ssh-->mikrotik and it worked perfect. 3% CPU 200/200 Mbps. One problem appearded with the queues which disappeared when I activated them for the first time. Good job Mikrotik

GhostWorks · Thu May 02, 2013 8:39 pm

We are now using a CCR-1036 as our firewall/internet gateway and we are very impressed

We have 2000 users with 5-600 concurrent on a 100mb WAN and 250 firewall rules, 20 NAT rules, 20 mangle rules, OSPF, PBR to caching box and PPTP VPN

10 PCQ Queues

I have to say that for the money this device is amazing obviously the feature set is great as all mikrotik devices carry the same features but with 500 concurrent users and hundreds of PCQ connections the highest CPU load i have seen is 3%

I know this is probably overkill for our setup but its still substantially cheaper than other firewalls on the market.

This has been running RC13 for 2 weeks now with only a slight glitch with queueing that was down to config and a reboot resolved it.

+1 to mikrotik.

Thanks for your info it does look very impressive , I'm considering it for my network , it's not a huge network but my current draytek vigor3900 is at 67% CPU load and have had several issues , looking at this forum which it's progress in resolving issues and RC every 2-4 weeks looks very promising ...

Over kill yes , but we all like our over kill , or fast cars wouldn't exist

acemesh · Thu May 02, 2013 10:01 pm

Hi,

For a wireless ISP ( with radius backend ) , how many concurrent sessions might 1016-12G and 1036-12G support?
If I get 2, will it be easier to load balance them ?

Thanks,

otgooneo · Fri May 03, 2013 9:34 am

Hi,

For a wireless ISP ( with radius backend ) , how many concurrent sessions might 1016-12G and 1036-12G support?
If I get 2, will it be easier to load balance them ?

Thanks,

We have 3 CCR1036 but not load balancing, just 3 separate networks. As I know one is CPU is max=3%, when 270 active users, 12 firewall filter rules, 32 NAT rules, 5 mangle rules, 4 static simple queues. Uses FreeRadius for AAA and PPPoE clients don`t have MPPE encoding. I believe if u use encoding, it will eat much more CPU. It works without any critical issue. Sometimes console freezes (crashes). Console become alive after do supout command or wait some hours.

The load balancing is simple, just start start exactly same hardware with exactly same ROS and configuration. It should do load balancing. I heard it from this forum. But don`t remember links.

SwissWISP · Mon May 06, 2013 12:18 pm

Are there any plans to make the BGP process multi processor capable?

jriera · Tue May 07, 2013 3:32 pm

Are there any plans to make the BGP process multi processor capable?

+1!! Any news about it?

paoloaga · Thu May 09, 2013 3:05 pm

Are there any plans to make the BGP process multi processor capable?
+1!! Any news about it?

I am using a CCR-1036 with 3 peers with a full view and as a route-reflector for ~50 RR clients. One core is constantly at 100% CPU and BGP updates are very slow. Hope it can be parallelized.

nick3dos · Fri May 10, 2013 11:15 am

Even with the new update, i can't yet see any traffic in Hotspot's Tx Rate collum

Anyone else the same problem?
Any ideas???