i have the same problem to 3 devices so it is a bug. I hope for a bugfix release soonRouterBOARD 750G r3, Update from v7.1.3 it break routing table, i dont know if bug or not all my routing table is gone, i restore the routing table with backup it seem okay now, still watching for any bugs
same here for a RB4011, update from 7.1.1RouterBOARD 750G r3, Update from v7.1.3 it break routing table
There's a couple of fixes that suggest 7.2 is coming to stable soon, the biggest being:Why is the below fix still not in stable release?
What's new in 7.2rc2 (2022-Jan-28 11:00):
*) arm - fixed "shutdown" command on hAP ac^2;
That's release tree, not stable tree, or stable branch.*) lte - made "RG502QEAAAR11A06M4G" the last OTA firmware version update for Chateau 5G in RouterOS 7.1.x release tree;
But nothing explicit on advertised routes per peer.*) bgp - fixed VPNv4 route sending to remote peer;
*) route - fixed ECMP load balancing in FastPath;
*) route - fixed route addition to VRF from BGP;
*) route - fixed routing configuration export on SMIPS devices;
*) route-filters - renamed "*-set" to "*-list";
Does anybody is already able to get advertised routes per BGP Peer on v7 stable?
A thread on this forum existis since 2021 November about this:
ROSv7 equivalent of /routing/bgp/advertisements print
@emils Is that on your radar?
After they fix the bugs for RB5009 and Chateau owners who can only use RouterOS7 on their hardware.When will Docker be supported again? T_T T_T T_T T_T
Wrong thread. This thread is about 7.1.x updates. They will normal only contain bug fixes.When will Docker be supported again? T_T T_T T_T T_T
[admin@MikroTik] /system/package/update> download
channel: stable
installed-version: 7.1.3
latest-version: 7.1.4
status: ERROR: connection disconnected
The same for me on different devices. Roling back to 7.1.3 without restore backup and all routing tables are backRouterBOARD 750G r3, Update from v7.1.3 it break routing table, i dont know if bug or not all my routing table is gone, i restore the routing table with backup it seem okay now, still watching for any bugs
Thank you :)What's new in 7.1.5 (2022-Mar-22 13:03):
*) route - fixed "table" menu emptying after RouterOS upgrade;
I always liked the "testing" -> "stable" -> "long-term" channel scheme in V6. Is there some reason there isn't an intermediate public "testing" channel before stable in V7?What's new in 7.1.5 (2022-Mar-22 13:03):
*) route - fixed "table" menu emptying after RouterOS upgrade;
what?Mikrotik 6.47.9 (long-term)
<identity> Login:
Rebooting....
installed system-7.1.5
ERROR: not enough space for the upgrade
I'd recommend going to the latest stable before moving to V7 anything. 6.47.9 is 2 long-terms (-0.1) ago.Please see screenshot at
6.47.9 trying to upgrade to 7.1.5
I have 8GB drive with 180Mbytes in use.
Error iswhat?Mikrotik 6.47.9 (long-term)
<identity> Login:
Rebooting....
installed system-7.1.5
ERROR: not enough space for the upgrade
Then i realised... no, this is an OLD x86 Mikrotik that I have had for ages, its the first VM I ever had, its not a CHR, maybe thats why?
Is this upgradable to v7?
wow thats fast :) , i will upgrade in midnight, i will wait other report too, they fix it in half hours that will be a record :)What's new in 7.1.5 (2022-Mar-22 13:03):
*) route - fixed "table" menu emptying after RouterOS upgrade;
Mikrotik released swiftly a new version that also includes keeping the route table and I have updated my 4011 from 7.1.1 to 7.1.5 now. And it works as before...but with new features.@strods
viewtopic.php?t=183548#p917086
"pe1chl, msatter, CTassisF, osc86, IntLDaniel, ivicask - Very sorry for missing routing configuration after an upgrade. We are working on a fix for this."
You broke your promise :p
I always liked the "testing" -> "stable" -> "long-term" channel scheme in V6. Is there some reason there isn't an intermediate public "testing" channel before stable in V7?
Otherthan I guess "testing" is currently v7.2rc4.... but 7.1.4 does NOT seem to be a promotion of testing as it was in V6.
The bug in 7.1.4 (which is also present in 7.2rc4...) affects those that have multiple route tables, e.g. in case of loadbalancing/failover with multiple ISPs, or with an overlay network.I updated from 7.1.4 to 7.1.5. I was just looking at the routing, i.e. /ip/route/print and /ipv6/route/print and it looks the same. I think the "routing table" is something separate, beyond the scope of my knowledge. Hopefully everything is still fine.
No. It is a big missing today.Does anybody is already able to get advertised routes per BGP Peer on v7 stable?
On v7.1.4 release notes, those are the changes that are almost related to that:But nothing explicit on advertised routes per peer.*) bgp - fixed VPNv4 route sending to remote peer;
*) route - fixed ECMP load balancing in FastPath;
*) route - fixed route addition to VRF from BGP;
*) route - fixed routing configuration export on SMIPS devices;
*) route-filters - renamed "*-set" to "*-list";
A thread on this forum existis since 2021 November about this:
ROSv7 equivalent of /routing/bgp/advertisements print
@emils Is that on your radar?
EDIT: Now all ports are flapping after a few days. This is actually even worse than it was before with just SFP+s flapping.I went from 7.1.3 to 7.1.5 and it appears this might have finally fixed all of my 10G SFP+ interfaces flapping on my CRS328-24P-4S+. I haven't seen a port flap in 1+ hours (used to be every 5 minutes). I'll keep monitoring and report back tomorrow, but this is fairly amazing news, if it remains resolved. I've had this issue on every point release since moving to 7.x until now, with 7.1.5 (I did not try 7.1.4).
There was no configuration change to explain this between the upgrades, I merely performed the RouterOS upgrade, then the RouterBOARD firmware update, and that's it. I re-enabled auto-negotiation and all interfaces negotiated 10G, and there hasn't been a port flap since.
@Mikrotik: what changed that would have fixed this? There's nothing in the changelog that looks related. I just want to make sure whatever fixed this also makes it into 7.2.x when it is released!
[brg3466@LtAP] > /interface/lte/firmware-upgrade lte1 once
installed: R11eL_v05.03.183961
latest: R11eL_v05.04.193841
Yeah I wasn't ask for a "long term", more saying it's kinda random right now. Based on a diff of the release notes from 7.1.5 and 7.2rc4, I show:[...]I always liked the "testing" -> "stable" -> "long-term" channel scheme in V6. Is there some reason there isn't an intermediate public "testing" channel before stable in V7?
Otherthan I guess "testing" is currently v7.2rc4.... but 7.1.4 does NOT seem to be a promotion of testing as it was in V6.
But right now I can imagine developers are in sort of storm trying to get v7 feature set on par with v6, stabilize performance of v7 and add new features every was demanding for the last 10 years. Plus doing some minor maintenance of v6 (in case some nasty bug or vulnerability is discovered). All that at the same time. Not a very pleasant position to be in ...
----------- v7.1.5 ----------- ----------- v7.2rc4 -----------
*) bgp - fixed VPNv4 route sending to remote peer; = *) bgp - fixed VPNv4 route sending to remote peer;
> *) bridge - fixed FastPath when using "frame-types=admit-only
> *) bridge - fixed IP address on untagged bridge interface whe
> *) bridge - fixed PPPoE packet forwarding when using "use-ip-
*) bridge - fixed destination NAT when using "use-ip-firewall = *) bridge - fixed destination NAT when using "use-ip-firewall
> *) bridge - fixed filter and NAT "set-priority" on ARM64 devi
*) bridge - fixed filter rules when using interface lists; = *) bridge - fixed filter rules when using interface lists;
*) bridge - fixed priority tagged frame forwarding when using = *) bridge - fixed priority tagged frame forwarding when using
*) capsman - improved stability when running background scan <
> *) console - fixed terminal repainting on F5 and CTRL+L key p
> *) crs3xx - fixed watchdog timer functionality;
*) crs3xx - improved maximum allowed ACL rule calculation; = *) crs3xx - improved maximum allowed ACL rule calculation;
*) crs3xx - improved system stability when creating many ACL = *) crs3xx - improved system stability when creating many ACL
*) l2tp - improved system stability when processing L2TP cont = *) l2tp - improved system stability when processing L2TP cont
> *) lte - added MAC address and IPv6 LL address persistence af
*) lte - made "no" the default value for "use-network-apn" pa = *) lte - made "no" the default value for "use-network-apn" pa
*) lte - made "RG502QEAAAR11A06M4G" the last OTA firmware ver <
> *) ntp - allow adding duplicate server address if dynamic ent
*) ntp - improved source address usage for reply packets; <
> *) ntp - fixed multicast mode support;
> *) ntp - improved IPv6 address support;
*) ospf - fixed default route origination when "default-origi = *) ospf - fixed default route origination when "default-origi
*) ospf - fixed incorrect LSA types when changing area types; <
> *) ospf - fixed external LSA not updating after prefix netmas
*) ppp - added "comment" option for PPPoE servers; = *) ppp - added "comment" option for PPPoE servers;
> *) ppp - improved stability when handling large amount of con
*) queue - improved system stability when using more than 255 = *) queue - improved system stability when using more than 255
*) route - fixed ECMP load balancing in FastPath; = *) route - fixed ECMP load balancing in FastPath;
*) route - fixed route addition to VRF from BGP; = *) route - fixed route addition to VRF from BGP;
*) route - fixed routing configuration export on SMIPS device <
*) route-filters - renamed "*-set" to "*-list"; = *) route-filters - renamed "*-set" to "*-list";
*) sfp - improved SFP module detection on CRS106 and CRS112; <
> *) sms - increased "at-chat" timeout when sending SMS;
*) switch - fixed port-isolation misconfiguration detection w = *) switch - fixed port-isolation misconfiguration detection w
*) traffic-flow - do not handle NAT events when "nat-events" <
> *) switch - improved switch chip initialization process on bo
*) ups - fixed UPS support; = *) ups - fixed UPS support;
*) winbox - added "VPN" tab to "Routing/BGP" menu; <
> *) vxlan - fixed "group" and "interface" setting reset after
*) winbox - added "VRF" parameter for "SSH" and "Telnet" menu <
> *) vxlan - fixed running state after reboot when using "inter
> *) wifiwave2 - added "client-isolation" feature;
> *) winbox - added "host-uniq" parameter to PPPoE client inter
*) winbox - do not show "Antenna Scan" button on devices that = *) winbox - do not show "Antenna Scan" button on devices that
*) wireguard - allow same peer's public key for different int = *) wireguard - allow same peer's public key for different int
> *) wireguard - fixed IPv6 traffic processing with multiple pe
*) wireless - added "3gpp-info" parameter to interworking con = *) wireless - added "3gpp-info" parameter to interworking con
*) wireless - added EAP-AKA to interworking's realm configura = *) wireless - added EAP-AKA to interworking's realm configura
*) wireless - fixed interface initialization on Metal 2SHPn; <
> *) wireless - correctly preserve WMM priority when receiving
> *) wireless - improved nv2 link stability;
I had similar issues on ROS 7.1.3, but usually restarting resolved it.Please check this video
i have delay action ( delete / disable / Enable ) in firewall CCR2116-12G-4s+ .
https://www.youtube.com/watch?v=ZbkLHiIsys0
But after upgrade to 7.1.5
I upgrade to 7.1.5 . I reset the factory. But there is still a problem.I had similar issues on ROS 7.1.3, but usually restarting resolved it.Please check this video
i have delay action ( delete / disable / Enable ) in firewall CCR2116-12G-4s+ .
https://www.youtube.com/watch?v=ZbkLHiIsys0
But after upgrade to 7.1.5
What are the addresses to those Mikrotik servers?The package upgrade feature connects to the MikroTik download servers and checks if there is a new RouterOS version for your device.
I think this menu and the functions under it are orphaned. They are not documented and it surprises me that they still are available in v7.What are the addresses to those Mikrotik servers?
WebFig > System > Auto Upgrade > Mirrors > Add
What info do you have under System->NTP client and what is shown when you click the Peers button?My RB3011 after factory reset and config import with 7.1.3 had a serious problem with system clock - every appox 3.5 hours the time went backwards by about 30 minutes, which kept triggering watchdog and so system reboot.
With 7.1.5 (both RouterOS and firmware) the problem is still there, just now the clock goes backwards "only" 10 minutes.. :-/
What does it say in the first posting in this thread and any release thread?Fortunately I had a backup,
Did you ever start with a fresh netinstall of v7.x and import of a /export (not load of a backup!) on this device?So it looks like the issue of config corruption is still ongoing and any device is at risk of losing parts of config on update... Am really hoping this issue is rectified soon so that we can do our upgrades with peace of mind that we're not "rolling the dice" for potential config loss each time, I mean that is just crazy
Nope, the device was upgraded from v6.48.x -> v7.1.3 -> v7.1.5 (remotely is the key word here - it's not always easy to do a netinstall on every device)Did you ever start with a fresh netinstall of v7.x and import of a /export (not load of a backup!) on this device?
This is why you should (if possible) always test on a equal local device before starting on remote device.Nope, the device was upgraded from v6.48.x -> v7.1.3 -> v7.1.5 remotely is the key word here
Yes, I had the same suspicion and I've checked that. I've tried different NTP public servers, I've also disabled NTP client - it kept doing it regardless of changes I've made.What info do you have under System->NTP client and what is shown when you click the Peers button?My RB3011 after factory reset and config import with 7.1.3 had a serious problem with system clock - every appox 3.5 hours the time went backwards by about 30 minutes, which kept triggering watchdog and so system reboot.
With 7.1.5 (both RouterOS and firmware) the problem is still there, just now the clock goes backwards "only" 10 minutes.. :-/
It looks like you have a falseticker NTP server in there. When you see a server with a large offset, remove it from the configuration.
What exactly is broken ?Hi MT,
HotSpot functionality with external AP is severely broken on all v7.x MT was able to reproduce the issue but no ETA for the fix. Please give this a priority boost somehow because this is one of the selling features of the device, we can reproduce this on number of device including RB5009 which don't have a workaround because we can't downgrade this to v6
https://help.mikrotik.com/servicedesk/s ... /SUP-74435
Yes and no.This is why you should (if possible) always test on a equal local device before starting on remote device.Nope, the device was upgraded from v6.48.x -> v7.1.3 -> v7.1.5 remotely is the key word here
yes still broken in 7.2rc4 and if ever it works there we are not going to use this as well because dot1x is also broken with 7.2rcxWhat exactly is broken ?Hi MT,
HotSpot functionality with external AP is severely broken on all v7.x MT was able to reproduce the issue but no ETA for the fix. Please give this a priority boost somehow because this is one of the selling features of the device, we can reproduce this on number of device including RB5009 which don't have a workaround because we can't downgrade this to v6
https://help.mikrotik.com/servicedesk/s ... /SUP-74435
Already tried 7.2rc4 ?
There was a hotspot fix in there.
Haven't had the time yet to test myself (but will have to do it shortly for the part I need it for).
But from other users I read their issue was solved using that version.
/routing id add disabled=no id=172.22.99.254 name=id-slava select-dynamic-id=""
/routing ospf instance add name=rt-slava out-filter-chain=ospf-out redistribute=connected router-id=id-slava
my hap ac3 update run smooth...This version make my hap ac3 bootloop
OSPF stopped working after upgrading from 7.1.3 to 7.1.5
By analyzing the text configuration, it was found that one line was "lost" on update. Like this.
Therefore, the required parameter (router-id) was missing in this configuration. After the fix, everything worked.Code: Select all/routing id add disabled=no id=172.22.99.254 name=id-slava select-dynamic-id=""
Code: Select all/routing ospf instance add name=rt-slava out-filter-chain=ospf-out redistribute=connected router-id=id-slava
Try to upgrade device firmware first. My R11e-LTE6 disappeared after upgrading to 7.1.5, and showed up again after upgrading RBM33g's firmware. And I did a remote upgrade from 7.1.3 to 7.1.5... :(LtAP mini LTE US kit
Still cannot upgrade the modem firmware[brg3466@LtAP] > /interface/lte/firmware-upgrade lte1 once
installed: R11eL_v05.03.183961
latest: R11eL_v05.04.193841
But once you want to upgrade, it gets stuck because LTE interface disconnected.
I wonder if anyone who successfully upgraded the modem firmware ? I have been trying since 7.1 beta 4, always fail !
EDIT: Now all ports are flapping after a few days. This is actually even worse than it was before with just SFP+s flapping.Update on the link flapping: I still see it every once in a while at 10G with the SFP+s on my CCR2004 and CRS328, but it’s significantly less frequent.
Hey, guys,BootLoop
No Netinstall access via ETH1 port (+-20sec pressing reset)
I have been seeing this for a long time: I can download from a machine natted to the router very fast. I think it is due to this:Upgraded a hEX RB750gv3 to 7.1.5 everything seems to went fine except when I look at System->Package
In check for Updates it only show ERROR: connection timed out when I look for new version.
Same for long term, stable, testing and development.
I can ping mikrotik.com from terminal, so internet connection is ok.
[boss@MT] > :ping download.mikrotik.com
SEQ HOST SIZE TTL TIME STATUS
0 159.148.172.226 timeout
1 159.148.172.226 timeout
2 159.148.172.226 timeout
3 159.148.172.226 timeout
sent=4 received=0 packet-loss=100%
[boss@MT] > :ping download.mikrotik.com
SEQ HOST SIZE TTL TIME STATUS
0 159.148.147.204 56 47 75ms458us
1 159.148.147.204 56 47 75ms275us
sent=2 received=2 packet-loss=0% min-rtt=75ms275us avg-rtt=75ms366us max-rtt=75ms458us
I found the problem.Something that has changed about OSPF in 7.2RC4/7.2RC5/7.1.5, when loaded onto one of my CCR2004's (lab connection to production network), sends an announcement via OSPF to all the other routers, causing one of the cores to redirect traffic to itself.
add chain=ospf-out disabled=no rule="if (dst in 100.64.0.0/10 && dst-len in 24-32) { accept; }"
add chain=ospf-out disabled=no rule="if (dst in 0.0.0.0/0 && dst-len in 0-32) { reject; }"
Which version of Winbox are you using ?Our Metal 52c access point kicks me out of Winbox after a 3 seconds, winbox keeps reconnecting and being kicked out. This is ever since 7.1.4 was put on it. I can no longer access the device, because I switched off its web-UI server. I used to be able to connect after having power-cycled, but now this workaround no longer works.
I would have to physically reset the device manually, or is there another way?
I'm not seeing that ?still memory leak on my hap ac3 after few days and rebooting itself
For what it's worth, I'm connected to the ISP ONU with DHCP, MTU=1500, and I see the same timeouts and slow download.It can point to some MTU problem further upstream. E.g. you have the MikroTik behind an ISP router that has a PPPoE link with MTU 1492 or so, but on the LAN side the MTU is 1500 and that is also what the MikroTik sees.
The whole thing is relying on PMTUD then, which is broken for the MikroTik download servers.
But in this case there often are other random sites that are slow or don't work at all.
[admin@MikroTik] > ping download.mikrotik.com
SEQ HOST SIZE TTL TIME STATUS
0 159.148.172.226 timeout
1 159.148.172.226 timeout
2 159.148.172.226 timeout
3 159.148.172.226 timeout
sent=4 received=0 packet-loss=100%
[admin@MikroTik] > ping download.mikrotik.com
SEQ HOST SIZE TTL TIME STATUS
0 159.148.147.204 56 51 264ms937us
1 159.148.147.204 56 51 266ms147us
2 159.148.147.204 56 51 269ms439us
3 159.148.147.204 56 51 264ms230us
sent=4 received=4 packet-loss=0% min-rtt=264ms230us avg-rtt=266ms188us max-rtt=269ms439us
It is the latest (.35). I got in using ssh, luckily I left that one open/running. That way I did a factory reset without having to climb the tower here.. Still, my config was nothing out of the ordinary, and it's a little worrying that even "long-term" versions aren't truly stable. I'm wondering to what RoS and bootfw version I should downgrade this device.Which version of Winbox are you using ?Our Metal 52c access point kicks me out of Winbox after a 3 seconds, winbox keeps reconnecting and being kicked out. This is ever since 7.1.4 was put on it. I can no longer access the device, because I switched off its web-UI server. I used to be able to connect after having power-cycled, but now this workaround no longer works.
I would have to physically reset the device manually, or is there another way?
Try the latest.
It's done this in V7 a lot, it creates DHCP network 0.0.0.0/0. It will then create the right one for the subnet if you hit the apply again, e.g. "twice". BUT still want to make sure DHCP Server is still check, since sometimes the "first apply" seemingly doesn't apply the DHCP Server setting. The 0.0.0.0 is never cleaned up, even if you re-apply.NetInstall to 7.1.5 the LHGR, done OK.
System Reset configuration to get a Default Configuration, done OK.
Unit was setup by QuickSet - The DHCP Server was ON !!.
Unit disconnect, DHCP not give IP, connection can be done by Mac-Address only.
WinBox Magic of session keep windows open and show uptime status in corner with open log-s too.
Disconnetion of unit is so fast then I not have time to click and correct anything.
I see the DHCP Server is OFF ? Range is missing !. When I try press the DHCP Server ON then I see strange IP RANGE who is show in logs too.
Unit was reset to default by pressing button, and configure manually WITHOUT QUICKSET who probably have got some new BUG as always - Quick Set - this is like always beta feature.
/ip dhcp-server
add address-pool=dhcp interface=bridge name=dhcp1
/ip dhcp-server network
add address=0.0.0.0/24 gateway=0.0.0.0 netmask=24
/system/default-configuration/quick-set/print
I have noticed this as well, OSPF fails, cycling from Full state down to Init - caused by redistributed routes that should have been rejected by the output filter. Another thing I have noticed is that although output filters are ignored, applying the same rule to the input filter (on the opposite end) seems to work ok.I found the problem.Something that has changed about OSPF in 7.2RC4/7.2RC5/7.1.5, when loaded onto one of my CCR2004's (lab connection to production network), sends an announcement via OSPF to all the other routers, causing one of the cores to redirect traffic to itself.
If I load anything above 7.1.3 (7.2rc4/5, 7.1.5) on my CCR2004-1G-12S+2XS, my OSPF out filters are ignored, specifically the reject statements meant to keep all but a couple of subnets from leaving the router. Routes learned from other routers were further propagated, causing some of the core routers to circularly reference each other.
Turns out that router and another CCR2004 running 6.47.10 each have a second OSPF instance sharing only each other's routes. I changed that instance's area to a different area ID, then changed it to a stub. It stopped the circular references but it didn't stop the private routes from leaking. That's how I noticed the reject rules weren't working.
This has worked all the way up to 7.1.3. It doesn't work on 7.2rc4+ or 7.1.5.Code: Select alladd chain=ospf-out disabled=no rule="if (dst in 100.64.0.0/10 && dst-len in 24-32) { accept; }" add chain=ospf-out disabled=no rule="if (dst in 0.0.0.0/0 && dst-len in 0-32) { reject; }"
On another note, an upgrade from 7.1.3 to 7.1.5 on an RB5009 failed. It shows up in its neighbors' entries as having 7.1.5, but it's not responding on its IP's and I can't mac-telnet to it from any neighboring device. (It's out in the shop and it's 4:00 AM. I'll go out and look at it later...)
I think in general v7 is less agressive at refreshing window contents in winbox. You can press F5 to refresh it at any time. In v6 when something changes in the router it would also change in the winbox window, but in v7 that generally does not happen. This may mean there is less network traffic for an open winbox and also probably less load on the router.Since Ros 7.x.x I see this bug with file deletion and what is displayed in Winbox.
This is totally true. I never even knew when winbox had a refresh before V7, it just updated. This is especially in IP>Routes with stuff like recursive routes, where you have both the actual delay in recalculating the route table AND winbox getting that calculation. If you don't hit F5, you might think some recent route configuration was misconfigured – instead it may be just winbox has updated IP>Routes with the new state.I think in general v7 is less agressive at refreshing window contents in winbox. You can press F5 to refresh it at any time. In v6 when something changes in the router it would also change in the winbox window, but in v7 that generally does not happen.Since Ros 7.x.x I see this bug with file deletion and what is displayed in Winbox.
*) lte - made "RG502QEAAAR11A06M4G" the last OTA firmware version update for Chateau 5G in RouterOS 7.1.x release tree;
working as intended.On Chateau 5G after update 7.1.5
For checking only the message could be just you have the latest versionworking as intended.On Chateau 5G after update 7.1.5
failure: L3 HW Offload not supported
Beware that only single bridge can offload to switch chip. If you have more than one bridge (some people like it that way), then you can force ROS to offload a particular bridge ... with some trickery.... when I enabled hw offloading in bridge (while using vlan filtering) the hw offload status still greyed out in each port.
I don't disagree, I'm using 7.2rc5 on my chateau.For checking only the message could be just you have the latest version
working as intended.
Thanks for confirming this. Support seemed to think I have it set up wrong. I quoted the current documentation for RouterOS 7 regarding output filters, and I got this back:I have noticed this as well, OSPF fails, cycling from Full state down to Init - caused by redistributed routes that should have been rejected by the output filter. Another thing I have noticed is that although output filters are ignored, applying the same rule to the input filter (on the opposite end) seems to work ok.
I found the problem.
If I load anything above 7.1.3 (7.2rc4/5, 7.1.5) on my CCR2004-1G-12S+2XS, my OSPF out filters are ignored, specifically the reject statements meant to keep all but a couple of subnets from leaving the router. Routes learned from other routers were further propagated, causing some of the core routers to circularly reference each other.
This has worked all the way up to 7.1.3. It doesn't work on 7.2rc4+ or 7.1.5.Code: Select alladd chain=ospf-out disabled=no rule="if (dst in 100.64.0.0/10 && dst-len in 24-32) { accept; }" add chain=ospf-out disabled=no rule="if (dst in 0.0.0.0/0 && dst-len in 0-32) { reject; }"
My setup is a basic one, with a RB4011 and a couple of hAP ac2's in a broadcast network with a single backbone area. I imagine for more complex setups there might be more problems...
# mar/23/2022 10:52:33 by RouterOS 7.1.4
# software id = ****
#
# model = RouterBOARD 3011UiAS
# serial number = 7****
/interface bridge
add admin-mac=6*********E auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] speed=100Mbps
set [ find default-name=ether2 ] name=ether2-master speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps
set [ find default-name=ether6 ] name=ether6-master speed=100Mbps
set [ find default-name=ether7 ] speed=100Mbps
set [ find default-name=ether8 ] speed=100Mbps
set [ find default-name=ether9 ] speed=100Mbps
set [ find default-name=ether10 ] speed=100Mbps
set [ find default-name=sfp1 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/interface list
add exclude=dynamic name=discover
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
add dns-name=hot.spot hotspot-address=192.168.88.1 name=hsprof2
/ip hotspot user profile
set [ find default=yes ] shared-users=10
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add add-arp=yes address-pool=default-dhcp interface=bridge name=defconf
/ip hotspot
add address-pool=default-dhcp addresses-per-mac=unlimited disabled=no \
interface=bridge name=server1 profile=hsprof2
/ip hotspot user profile
add address-pool=default-dhcp name=4m rate-limit=4m/4m shared-users=100
add address-pool=default-dhcp name=10m rate-limit=10m/10m shared-users=100
add address-pool=default-dhcp name=3m rate-limit=3m/3m shared-users=100
/port
set 0 name=serial0
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
sword,web,sniff,sensitive,api,romon,dude,tikapp,rest-api"
/zerotier
set zt1 comment="ZeroTier Central controller - https://my.zerotier.com/" \
disabled=yes disabled=yes name=zt1 port=9993
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf interface=ether6-master
add bridge=bridge comment=defconf hw=no interface=sfp1
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=ether7
add bridge=bridge interface=ether8
add bridge=bridge interface=ether9
add bridge=bridge interface=ether10
/ip neighbor discovery-settings
set discover-interface-list=discover
/ipv6 settings
set disable-ipv6=yes
/interface detect-internet
set detect-interface-list=all
/interface list member
add interface=ether2-master list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=sfp1 list=discover
add interface=ether6-master list=discover
add interface=ether7 list=discover
add interface=ether8 list=discover
add interface=ether9 list=discover
add interface=ether10 list=discover
add interface=bridge list=discover
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client interface=ether1
/ip dhcp-server lease
add address=192.168.88.254 client-id=1:14:*************** mac-address=14:************ server=\
defconf
add address=192.168.88.244 client-id=1:14:*************** mac-address=14:***************** server=\
defconf
add address=192.168.88.248 client-id=1:**************78 mac-address=\
B4:**************8 server=defconf
add address=192.168.88.237 client-id=1:****************d comment=cctv \
mac-address=***************:8D server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=192.168.88.1
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment=\
"place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment="defconf: masquerade" \
out-interface=ether1
add action=masquerade chain=srcnat comment="masquerade hotspot network" \
src-address=192.168.88.0/24
/ip hotspot user
add name=s6421 server=server1
That's what support told me was going on and to disable all redistribution checkboxes. But even after doing that I still ran into problems. I probably should test it again at 2:00 a.m. one of these days.Regarding the OSPF Output filter problem for redistributed connected routes, I discovered a fix / workaround.
If you uncheck the redistributed connected routes checkbox, but leave the OSPF output filter selected - it will work correctly. I think the checkbox overrides the filter and redistributes all connected routes no matter what.
Before 7.1.5 it worked correctly, I had both the checkbox selected and the proper output filter rules.
Maybe this will help fix some other issues with OSPF.
If i remember correctly, on ARM devices only way to upgrade is from bundled systemI did upgrade a hEX S and no problems. I tried a CRS326 and no matter what I did I got not enough space for upgrade.
Depends on what you need and what has proven already to work.(I would not recommend upgrading a remote system to v7 anyway at this time)
Sure. That's why I wrote "I would not recommend upgrading" ... which is not the same as "I would advise against upgrading" or "I discourage upgrading". For a random user coming by v7 doesn't offer much that v6 doesn't (notable exception are wifiwave2 drivers on select devices and wireguard).Depends on what you need and what has proven already to work.(I would not recommend upgrading a remote system to v7 anyway at this time)
...
Obviously it was a calculated decision. Not this weekend but the weekend after I'm there myself :wink:
/ip firewall filter add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 protocol=udp
/ip firewall filter add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
/ip firewall filter add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
/ip firewall filter add action=accept chain=input comment="allow IPSec AH" protocol=ipsec-ah
/ip firewall filter add action=accept chain=input comment="allow IPSec ESP" protocol=ipsec-esp
/ipv6 firewall filter add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
/ipv6 firewall filter add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
Thanks for the insight. I want to avoid Netinstall as I have several remote locations and the onsite persons doesn't have technical skills to do this remotely. I am looking for Mikrotik to provide a solution around the unbundled installation. And agreed with the bogus space error, I saw that before in v6 that I think (if I remember well) I sorted it out by going unbundledThe error messages are telling you that you most probably have unbundled installation of 6.49.5 on your hAP ac ... and this kind of installation can not be upgraded to monolithic v7. The last error (insufficient space) is bogus actually. You have to netinstall the device.
7.2rc6 has some fixes for redistribution of OSPF & RIP into OSPF via route filters.is the ospf / instances / redistribute option supposed to work in 7.1.5? For me it's not working, even when nothing is checked, at least all connected routes are redistributed.
I solved it with route filters for now.
yes, my issue is fixed with 7.2rc77.2rc6 has some fixes for redistribution of OSPF & RIP into OSPF via route filters.
I just want to filter out unreachable routes, it's absolutely unrelated to blackhole property, as blackhole is another type of route.You can now only use "blackhole" for a similar function.
/ip route print. I don't want to create anything, just to filter out unreachable routes in PRINT command.You can create a bridge "unreachable" without ports and addresses, then route the traffic there. Now create a firewall rule to match packets to that interface and reject.
check-gateway is unrelated to unreachable as it's a method to check reachability, not a result of checking.Maybe you can work around it by using: where check-gateway and inactive
Maybe you can work around it by using: where check-gateway and inactive
ROS V6 has a wonderful command that just tell you the "route resolution" incheck-gateway is unrelated to unreachable as it's a method to check reachability, not a result of checking.
will try to use "/ip route print where inactive and !disabled"... still not sure this will cover all possible states and is equivalent to "unreachable"
/ip route check 8.8.8.8
. status: ok
. interface: bridge
. nexthop: X.X.X.X
:global rtcheck [/ip route check 8.8.8.8 as-value once]
Please explain you actual use case then. Your example is a route that is unreachable because it does check-gateway and the check is failing.check-gateway is unrelated to unreachable as it's a method to check reachability, not a result of checking.Maybe you can work around it by using: where check-gateway and inactive
will try to use "/ip route print where inactive and !disabled"... still not sure this will cover all possible states and is equivalent to "unreachable"
See 16 posts up (#170).After 5 Days I had drops in the internet connection. First I tough it's a other problem, but now after rebooting my RB750Gr3 it's stable again. Do we have a memory leak???
It is unlikely to be the device, it more likely is some configuration. To solve this you would really need to make a supout file and create a ticket on help.mikrotik.com/servicedesk.See 16 posts up (#170).After 5 Days I had drops in the internet connection. First I tough it's a other problem, but now after rebooting my RB750Gr3 it's stable again. Do we have a memory leak???
Jotne already noticed and provided indications it is happening on some devices.
Cause of that is often the incorrect configuration following an often copied advice. When both PPPoE and DHCPv6 are used and both have "add default route" checkmark enabled, IPv6 does not work on v7 while it did work on v6. You need to remove "add default route" checkmark in DHCPv6 in that case, and only leave it in the PPPoE client.Upgrade went OK. IPV4 is ok. IPV6 network stopped working. I suspect that one of the fixes has impacted my firewall rules.
but it is not sure if that would also prevent adding duplicate dynamic prefix when another dynamic prefix already exists.*) ipv6 - do not add duplicate dynamic prefix when static already exists;
https://twitter.com/mikrotik_build/stat ... 5669407749Version 7.1.5 really moved to long term or is it a bug?
I remember that we buy to biggest customer new CCR who works only at new RouterOS v6.. he start journey very badly and we have stable 6.4 and next one was 6.19 and all laters. So many problems this hardware and software generate then currently with ros7 I track, read all and not buy until the STABLE will be real STABLE and not feal like experiment on my customers.I guess that is a preparation for 7.2 in stable...
Let's wait what next week brings. 😜
I use this to report one of links used for failover is down. This is useful if you have more than one upstream link to provider(s).Please explain you actual use case then. Your example is a route that is unreachable because it does check-gateway and the check is failing.check-gateway is unrelated to unreachable as it's a method to check reachability, not a result of checking.
will try to use "/ip route print where inactive and !disabled"... still not sure this will cover all possible states and is equivalent to "unreachable"
What other cases do you know that lead to an "unreachable" route in v7?
Thank you for your reply. Unfortunately in this case. I am not using PPPoE and my border router with DHCPv6 and IPv6 is working fine. It is the internal router and the trunk link to the border router where the problem appears to be.Cause of that is often the incorrect configuration following an often copied advice. When both PPPoE and DHCPv6 are used and both have "add default route" checkmark enabled, IPv6 does not work on v7 while it did work on v6. You need to remove "add default route" checkmark in DHCPv6 in that case, and only leave it in the PPPoE client.Upgrade went OK. IPV4 is ok. IPV6 network stopped working. I suspect that one of the fixes has impacted my firewall rules.
It may be that it has been fixed in 7.2rc5:but it is not sure if that would also prevent adding duplicate dynamic prefix when another dynamic prefix already exists.*) ipv6 - do not add duplicate dynamic prefix when static already exists;
I've reported the problem with regular reboots on RB3011 over a week ago, and they even didn't bother to reply. I doubt they any longer care about that router (since RB4011 is out) :/Excessive CPU usage on the RB3011 is still not fixed.
Does anyone know if Mikrotik has at least recognized the problem at some point?
Columns: DEVICE, VENDOR, NAME, SPEED
# DEVICE VENDOR NAME SPEED
0 1-0 Linux 5.6.3 ehci_hcd RB400 EHCI 480
1 1-1 VIA Labs, Inc. USB2.0 Hub 480
2 1-1.4 Realtek USB 10/100/1000 LAN 480
Huh... "/routing/route/print where unreachable"?Hello,
in 6.x.x ROS there was "unreachable" property for every route in /ip route
It's gone in 7.x.x? Why? And what should I use instead of it in scripts?