*) ipsec - fixed "sa-src-address" deduction from "src-address" in tunnel mode;

*) wireless - added option to disable PMKID for WPA2;

When adding (or importing) a new IPsec policy it automatically used src-address to calculate sa-src-address if it was not specified in tunnel mode, which is not correct. E.g.

Code: Select all

/ip ipsec policy add dst-address=192.168.1.0/24 sa-dst-address=10.155.107.5 sa-src-address=0.0.0.0 src-address=10.155.107.6 tunnel=yes

Created:

Code: Select all

 1     src-address=10.155.107.6/32 src-port=any dst-address=192.168.1.0/24 dst-port=any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=10.155.107.6 sa-dst-address=10.155.107.5 proposal=default ph2-count=0

*) wireless - added option to disable PMKID for WPA2;

*) wireless - added option to disable PMKID for WPA2;

upgraded almost 300MK devices today and so far without problem
...

upgraded almost 300MK devices today and so far without problem
...

Wow, you are brave

@MonkeyDan

Code: Select all

*) wireless - added option to disable PMKID for WPA2;
*) wireless - fixed memory leak when performing wireless scan on ARM;
*) wireless - fixed packet processing after removing wireless interface from CAP settings; 
*) wireless - updated "united-states" regulatory domain information;

This wireless problem has been fixed. If your problem is listed there, it should be ok

upgraded almost 300MK devices today and so far without problem
...

Wow, you are brave

upgraded almost 300MK devices today and so far without problem
...

Wow, you are brave

or stupid..

no, really, I have lack of bad experiences...

upgraded almost 300MK devices today and so far without problem

already done on types :
crs 328 poe
crs 317
crs 125
crs 226
ccr 1009
ccr 1016
ccr 1032
metal 52SHPacn
metal 2SHPn
rb 2011
rb 3011
mAP lite

In late night I must also done upgrade on main-rt CCR1072, I supposing no problem also

How did you upgrade 300 devices?
Script / tool? Or manual 1 by 1 ?

How did you upgrade 300 devices?
Script / tool? Or manual 1 by 1 ?

*) crs3xx - fixed tagged packet forwarding without VLAN filtering (introduced in 6.42.6);

After upgrading to 6.42.7, my CRS328-24P-4S+ logs increased CPU temperature from SNMP readouts. The attached graph shows a significant change in CPU temperature after upgrading (at around 23:00). The switch's CPU load (also from SNMP) has not increased.

Were there any changes to the SNMP output for this unit, not mentioned in the changelog? It could look like the temperature of the board was previously listed as CPU temperature.


CRS328-24P-4S+-after-upgrade.png

After upgrading to 6.42.7, my CRS328-24P-4S+ logs increased CPU temperature from SNMP readouts. [...]

Why did 2 fans appear in the last print?

upgraded almost 300MK devices today and so far without problem
...

Wow, you are brave

Hi, I have linux (ubuntu server) with bash script ( which I made myself ) to upgrade all of it.

FYI, my nick name is based on a well known product from Czech Republic

There are some GUI differences for ease of use. It is not v6.42.7 specific.

Is there any indication of the attack surface of "vulnerabilities CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159"?
What kind of installations would be directly at risk and require quick updates?
(e.g. admin service ports open on internet, certain types of VPN service open on internet, any configuration with internet connection, etc)

Anav, welcome back, been a while since I last saw a post from you.

FYI, my nick name is based on a well known product from Czech Republic

Upgraded RB3011. Ipsec tunnels broken
RB750Gr3,. Ipsec tunnels broken ,

I do not see problem to release more information later. Maybe it is about to give people some time to upgrade before releasing details.

I can confirm that the security fixes were added to the notes after the 6.42.7 thread was already posted! Why was this?

Upgraded RB3011. Ipsec tunnels broken
RB750Gr3,. Ipsec tunnels broken ,

Reverted back to 42.6 , all ipsec tunnels back working well ,

Well you guys did want a security blog and more awareness. Now you complain that the issues are not serious enough We will try to find a balance.

Well you guys did want a security blog and more awareness. Now you complain that the issues are not serious enough We will try to find a balance.

Tenable allows vendors to fix issues and release the fixed versions, before they advertise discovered issues.
We could not add non-existing CVE numbers into the changelog.

I can confirm that the security fixes were added to the notes after the 6.42.7 thread was already posted! Why was this?

Webserver Crashed
Telnet service crashed.

Dhcp error still persists as offering lease withour success on CCR1009. After many errors the dhcp stops to answer for a while.

Webserver Crashed
Telnet service crashed.

I confirm this.

In our network we have one RB 3011 that works as a Load Balance and in this routerboard we have one DHCP server on one interface and it stoped working as well after applying 6.42.7. It was installed on top of 6.40.8. Downgraded it to 6.40.8 and then updated it to 6.40.9 and everything is working fine again.

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after some problem has appeared on device

Please follow the steps mentioned in the change log to let MikroTik fix this issue asap:

Well you guys did want a security blog and more awareness. Now you complain that the issues are not serious enough We will try to find a balance.

I hope you understand that when you post a new version AND update the bugfix version at the same time, mentioning 4 security issues that have no description, the users get a bit nervous and assume that an update is urgently required.
I asked for the attack surface, you could have replied "issues in the webserver exploitable by authenticated users" and I would have known that it is not urgent for me to update, and I could have waited until more details became known.
But as the issue was completely unknown and it could well have been in ISAKMP, SSTP, PPP or whatever, I decided to work overtime to update everything.

So indeed it would be welcome when it was a little more clear what is going on.

Well you guys did want a security blog and more awareness. Now you complain that the issues are not serious enough We will try to find a balance.

@rushlife: Thank you for the scripts!

It looks like the default routerboot boot mode has changed from "nand if fail then ethernet" to "try-ethernet-once-then-nand".
This wasn't mentioned in the release note. However, I think it is a good idea, I already set difficult-to-access devices that way.
Advantage: you can netinstall a device by powercycling it while connected to a computer with running netinstall, without having to fiddle with the button.
(which can be very tricky when the device is mounted on a tower)

RouterOS version 6.42.7 has been released in public "current" channel!

Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 6.42.7 (2018-Aug-17 09:48):

MAJOR CHANGES IN v6.42.7:
----------------------
!) security - fixed vulnerabilities CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159;
----------------------

*) bridge - improved bridge port state changing process;
*) crs326/crs328 - fixed untagged packet forwarding through tagged ports when pvid=1;
*) crs3xx - added command that forces fan detection on fan-equipped devices;
*) crs3xx - fixed port disable on CRS326 and CRS328 devices;
*) crs3xx - fixed tagged packet forwarding without VLAN filtering (introduced in 6.42.6);
*) crs3xx - fixed VLAN filtering when there is no tagged interface specified;
*) dhcpv4-relay - fixed false invalid flag presence;
*) dhcpv6-client - allow to set "default-route-distance";
*) dhcpv6 - improved reliability on IPv6 DHCP services;
*) dhcpv6-server - properly update interface for dynamic DHCPv6 servers;
*) ethernet - improved large packet handling on ARM devices with wireless;
*) ethernet - removed obsolete slave flag from "/interface vlan" menu;
*) ipsec - fixed "sa-src-address" deduction from "src-address" in tunnel mode;
*) ipsec - improved invalid policy handling when a valid policy is uninstalled;
*) ldp - properly load LDP configuration;
*) led - fixed default LED configuration for RBLHGG-5acD-XL devices;
*) lte - added signal readings under "/interface lte scan" for 3G and GSM modes;
*) lte - fixed memory leak on USB disconnect;
*) lte - fixed SMS send feature when not in LTE network;
*) package - do not allow to install out of bundle package if it already exists within bundle;
*) ppp - fixed interface enabling after a while if none of them where active;
*) sfp - hide "sfp-wavelength" parameter for RJ45 transceivers;
*) tr069-client - fixed unresponsive tr069 service when blackhole route is present;
*) upgrade - fixed RouterOS upgrade process from RouterOS v5;
*) userman - fixed compatibility with PayPal TLS 1.2;
*) vrrp - fixed VRRP packet processing on VirtualBox and VMWare hypervisors;
*) w60g - added distance measurement feature;
*) w60g - fixed random disconnects;
*) w60g - general stability and performance improvements;
*) w60g - improved MCS rate detection process;
*) w60g - improved MTU change handling;
*) w60g - properly close connection with station on disconnect;
*) w60g - stop doing distance measurements after first successful measurement;
*) winbox - added "secondary-channel" setting to wireless interface if 80 MHz mode is selected;
*) winbox - fixed "sfp-connector-type" value presence under "Interface/Ethernet";
*) winbox - fixed warning presence for "IP/IPsec/Peers" menu;
*) winbox - properly display all flags for bridge host entries;
*) winbox - show "System/RouterBOARD/Mode Button" on devices that has such feature;
*) wireless - added option to disable PMKID for WPA2;
*) wireless - fixed memory leak when performing wireless scan on ARM;
*) wireless - fixed packet processing after removing wireless interface from CAP settings;
*) wireless - updated "united-states" regulatory domain information;

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after some problem has appeared on device

Please keep this forum topic strictly related to this concrete RouterOS release.

If you router has a storage issue (not enough space due to RouterOS, not by other files stored on the device), use package from this link:
https://www.mikrotik.com/download/share/fix_space.npk
- upload package to your router;
- run /system reboot

Other affected installations will be fixed automatically, if there is enough space left for an upgrade by this fix:
"package - free up used storage space consumed by old RouterOS upgrades"

how fix this please help me !

Hello,

I have a big problem for me. I wanted to update RouterOS to v 6.42.7 but without success. Now I have disable Wireless module and my AP's are broken because my CAPsMAN is off.
If I want to enable a Wireless module nothing will hapend after restart

Can you help me?

Thank's

Update.png

*) package - do not allow to install out of bundle package if it already exists within bundle;

Yes, I tried it as first. But after restart is still Wireless package on it

I am trying to reset a 532a router board back to factory so I can access it. They recomended using netinstall so I am. However every time I try I am getting an error. bind tftp general failed: Please advise what I can do to resolve this error

Yes, I tried it as first. But after restart is still Wireless package on it

Looks like netinstall is the only solution:
viewtopic.php?f=1&t=133352&p=655190

I noticed that interface "last link up/down times" are in the future.

Webserver Crashed
Telnet service crashed.

I confirm this.

I can confirm this also.

We have found out that sometimes the R11e-LTE modems fail to get an IP address in 3G mode using RouterOS v6.42.7 - we will fix this problem in the next RC and then push that change to the Current release.

We have found out that sometimes the R11e-LTE modems fail to get an IP address in 3G mode using RouterOS v6.42.7 - we will fix this problem in the next RC and then push that change to the Current release.

Thanks Uldis I wait because we find the same problem when I've upgraded from 6.42.3 to 6.42.7,

[time=1535139686 user_id=118648]
how fix this please help me !

1. Please don't put questions not related to a specific release into the release topic, make new topic!
2. You are killing your router by Sector Writes, maybe logging on disc? Check your config, stop it!

We have found out that sometimes the R11e-LTE modems fail to get an IP address in 3G mode using RouterOS v6.42.7 - we will fix this problem in the next RC and then push that change to the Current release.

6.42.7 BGP problem

we have 6.42.7 updated this morning.
I'm noticing that our BGP blackhole peer with our upstream is not sending withdrawal from the network list like it used to.

anyone else have issues with this?

We are aware of a specific IPsec issue caused by the new improved policy handling in 6.42.7. A fix is already available in the latest release candidate version and will be included in the next current version as well. Very sorry for inconvenience.

Have you tried to use WinBox with MAC connection?

Just type in again the password, don't use the saves password.

Upgrade v6.40.x to v6.42.7 and can't login into system (via ssh, winbox). But CHR work done. Why unmanaged?

Hello,

The same thing happens to Kayu. Since I upgraded to v6.42.7 I can not access the routers, it indicates an incorrect username or password ...

I think the problem is for the admin user ... in some routers I only had this user configured and now I can not enter

Mikrotik any solution?

Thanks in advance

I have updated the wimbox to the latest version and it still fails

Thanks

He's got problems even to log in using ssh so it doesn't seem to be a Winbox-related issue.

@kayu, @XeviMB, it takes time for the ssh to generate a new key on the very first login attempt, and maybe a new one is generated after upgrade, so if you have tried to log in using ssh only once, try again now after some time has elapsed. But it is just a wild guess.

I have port flapping issues on hap ac². Anyone else?

I´ve tried remote upgrade into controlled environment (via package menu) on Ccr1009-8g-1s-1s+ from V6.28 to V6.42.7 and lost connectivity so something went bad.
The screen upgrade showed image dowloaded and it was rebooting after that something more.
I´ll going to check on-site. Please any ideas?

I´ve tried remote upgrade into controlled environment (via package menu) on Ccr1009-8g-1s-1s+ from V6.28 to V6.42.7 and lost connectivity so something went bad.
The screen upgrade showed image dowloaded and it was rebooting after that something more.
I´ll going to check on-site. Please any ideas?

You have made a too-big version upgrade, you should have installed some intermediate versions.

By now the only thing you likely can do is netinstall and reconfigure.
You COULD have repartitioned the device into 2 partitions and copy the old version so you could revert back
But that is too late now.

Netconfig is limitted due it´s mandatory Windows PC and we use only Macbooks so another issue here.

Netconfig is limitted due it´s mandatory Windows PC and we use only Macbooks so another issue here.

If it's any help, I have succeeded doing a couple of netinstalls using Windows running in a virtual machine on a Mac.
So basically you could take a trial of VMware, install W10 in it as a trial, recover your router and then get rid of the hypervisor and windows without spending a dime.

Many others vendors roll-back automatically to previous version and at least give a console warning message please upgrade to x before that. It´s basic!

Many others vendors roll-back automatically to previous version and at least give a console warning message please upgrade to x before that. It´s basic!

As I already wrote, you could have had that! But on MikroTik it is a user-decision to yield half of the fash capacity to have version rollback.
See this: https://wiki.mikrotik.com/wiki/Manual:Partitions

In short: click on partition, select repartition, set number of partitions to 2.
The router will reboot and now instead of 128MB you will have 64MB of flash.
Go back to partition, select a partition and then "copy to", select the other partition.
Now you do your upgrade. When the router fails to boot, it will try boot from the other partition and you are back
in your old version, which you can copy again to try something else.

Apparently most users do not know that, and it is becoming less interesting as all new low-end routers do not have enough flash space to do this.
However, for your CCR it still was and is an option. I use it on the two CCRs I manage and it already has saved me.

@rjj

If you does not like it the way MikroTik do it, you can always go for another vendor like Cisco.
But it would be at a much higher cost.