posts not strictly related to: v7.4beta [testing]

guipoletto · Tue Jun 07, 2022 5:41 pm

On the spirit of adding controversial IPV6 functionality, can we have DHCPV6 address (/128) delegation? :)

hzdrro · Wed Jun 08, 2022 1:47 pm

Any chance for NDP proxy?

nithinkumar2000 · Wed Jun 08, 2022 9:14 pm

Each and every time when ever a new Upgarde is Posted I use to go and check for one Important New Feature which we all ISP's are waiting from Many Years....

"IPv6 PD accounting Parameter in PPP radius Accounting Packet"

This one feature is stopping all ISP and Major Orgainisation from implementing IPv6 in their Infrastructure.

Happy to see Mikrotik Team is working Really Hard in Devloping and Fixing New Ultimate V7.x OS but my question is Many of us in this forum is already Requesting for this One Little Fix/Feature/Parameter and still now its is not even consided at all.

I Hope Mikrotik Team may Look into this Issue and Give us some Solution to it.

Thanks in Advance Team Mikrotik

Znevna · Wed Jun 08, 2022 9:16 pm

If you don't see it in the changelog, why do you bitch about it in every release topic?
Make a proper feature request.

nithinkumar2000 · Wed Jun 08, 2022 9:22 pm

If you don't see it in the changelog, why do you bitch about it in every release topic?
Make a proper feature request.

FYI Already A Feature Request is made on this... for which we have not received any Reponse from Mikrotik Team

This is a Open Forum and Posting a Issue here (impacting many Mikrotik Users) why it bothers you this much...!

Znevna · Wed Jun 08, 2022 9:31 pm

"Please keep this forum topic strictly related to this particular RouterOS release."
If you don't read what they write, why should they read what you write?

rextended · Wed Jun 08, 2022 10:06 pm

Znevna: +1 Karma

Znevna · Wed Jun 08, 2022 10:09 pm

Please keep this forum topic strictly related to this particular RouterOS release.

nithinkumar2000 · Wed Jun 08, 2022 10:19 pm

If you don't read what they write, why should they read what you write?

Sure I Will Agree on This :D

pe1chl · Wed Jun 08, 2022 10:33 pm

My highest priority request is: achieve feature parity with v6.
I mean: go along every feature of v6, check if it is implemented in v7 and working, if not implement or fix it. Or in cases where that is absolutely impossible, document that it will no longer be available in a "differences between v6 and v7" document.
Only after that job is complete, start working on new features or extending other features that have been added in v7.

rextended · Wed Jun 08, 2022 10:42 pm

If the user read the whole topic to see if someone has already asked or reported the same thing,
instead of making another post virtually identical, there will probably be no errors and everything would be more readable ...

rextended · Wed Jun 08, 2022 11:13 pm

(Thanks @Znevna also for other past reports)

Znevna · Wed Jun 08, 2022 11:15 pm

If only MikroTik team would fix reported bugs as fast as you take action in the forums.

jbl42 · Wed Jun 08, 2022 11:29 pm

If the user read the whole topic to see if someone has already asked or reported the same thing,
instead of making another post virtually identical, there will probably be no errors and everything would be more readable ...

Nope, the user is not exepcted to read the whole topic for a (beta) release quickly growing to more than 100 messages just to be lectored by you based on your personal preference.
The user would be expected to read a list of known and confirmed issues for a release. If such a thing would exist.

rextended · Wed Jun 08, 2022 11:32 pm

¯\_(ツ)_/¯

If the users instead to submit problems to support@mikrotilk.com do a mess on user forum,
do they really expect that in that "slaughterhouse" we will understand something and someone will solve the problem?

pe1chl · Wed Jun 08, 2022 11:42 pm

I think there is some understanding and expectation that mentioning a problem in the release topic (especially shortly after release) will be noticed by developers and put on a list of things to do.
Sometimes there are replies indicating that this was done, but also it often happens that later it is claimed that it was never reported.

jbl42 · Wed Jun 08, 2022 11:46 pm

If the users instead to submit problems to support@mikrotilk.com do a mess on user forum

So reporting the same issue over and over to support is better than reporting the same issue again in the forum?
And why is MT support telling me to report issues with betas in the forum?
And how does it come you feel to be in a position telling poeple testing betas for free on how to report things for free?

Just bacause you obviously have time to hang around in forums the whole day does not mean other poeple do not have some real work to do beside fighting with what MT likes to call beta or stable.
If you really are representing MT (what I hope not considering your rude tone), this explains a lot.

rextended · Wed Jun 08, 2022 11:47 pm

@pe1chl
Really, I hope also that...

@jbl42
Not, I'm only a Moderator, not an Administrator or member of MikroTik Staff
Really very kind, about the rude tone, anyway in a "slaughterhouse" nobody understands anything.

Larsa · Thu Jun 09, 2022 12:06 am

I think there is some understanding and expectation that mentioning a problem in the release topic (especially shortly after release) will be noticed by developers and put on a list of things to do. Sometimes there are replies indicating that this was done, but also it often happens that later it is claimed that it was never reported.

IMHO, forums are far too unstructured to be utilized as a serious bug reporting tool and are only slightly better than email lists.

Come on MT, you can to do better than this! You where able to fix the help site, so why not fix this as well. Btw, why not just use gitbub?

rextended · Thu Jun 09, 2022 12:07 am

gitbub?
https://github.com/GitBub

Larsa · Thu Jun 09, 2022 12:11 am

Allright, github then!

I was thinking of Project planning for developers (aka "github issues")

rextended · Thu Jun 09, 2022 12:16 am

@Larsa, you right...
(ignoring platform)
Something like

example code

RouterOS / Releases / v6  / 6.48.6 Release Notes
                                   Detailed Changes (renamed, added or removed commands, fields, etc.)
                                   Known Bugs
                                   Known Limits
                                   Temporary Walkthroughs
                                   User Reports
                                   Open Tickets
...        ...        ... / 6.49.6 Release Notes
                                   ...
                                   ...
                                   ...
...        ...        v7  / 7.3    Release Notes
                                   ...
                                   ...
...        ...        v7b / 7.4b   Release Notes
                                   ...
                                   ...

Larsa · Thu Jun 09, 2022 12:19 am

Esattamente!

DarkNate · Thu Jun 09, 2022 12:20 am

@nithinkumar2000 some RADIUS/AAA providers have solved that issue and have successfully even found a way to assign persistent PD when using PPPoE. It's commercial in nature, but feel free to email me at: darknate34@gmail.com if you're interested in linking up with the providers.

DarkNate · Thu Jun 09, 2022 12:20 am

Any chance for NDP proxy?

NDP Proxy/NAT66 breaks IPv6 specs to begin with. Your ISP should deploy IPv6 according to BCOP 690.

DarkNate · Thu Jun 09, 2022 12:21 am

On the spirit of adding controversial IPV6 functionality, can we have DHCPV6 address (/128) delegation?

It's not controversial at all. I advocate BCOP 690 and minimum /56s to LAN side of the smallest customer sites. But /128 address assignment (not delegation, delegation is LAN prefix) would be useful for stateful DHCPv6 management of host addressing.

Sob · Thu Jun 09, 2022 12:26 am

So reporting the same issue over and over to support is better than reporting the same issue again in the forum?

I would very much like dedicated forum section for reporting bugs that someone from MikroTik would watch. Or maybe public bug tracker.

Now if ten people find same bug and report it to support, it's not ideal. For support it means handling ten reports, extra work. And not everyone is good with reporting bugs, or maybe the bug is not that clear, so someone may describe some symptoms, but it won't be complete. And everyone can do it in different way. So it's even more work for support to read and understand all that, to even figure out that it's related, and to put the pieces together. If those users would team up, everyone could chip in and they could more easily come up with ways how to reproduce it. Or perhaps find out that it's actually not a bug. And then there's everyone else who could be warned in advance.

Of course the problem is that such section could easily end up full of vague or invalid reports, useless +1s, etc. So maybe not this, but I'm sure that some improvement is possible.

Come on MT, you can to do better than this! You where able to fix the help site, so why not fix this as well.

You don't mean the new docs, do you? Because I don't know if it's just me, but I can't seem to find anything there. I like the old manual, where I can see everything nicely sorted by menu, much better.

Larsa · Thu Jun 09, 2022 1:08 am

Concur that a public bug tracker aka GitHub Issues or similar would be very useful.

Regarding the help docs I agree the old start (index) page is better but MT is able to do the exact same thing with the new help docs using any of the platforms Jira or Confluence. Give them a hint.

I myself is a pure googe kind thus I only make use of the search function whenever I need to lookup something.

pe1chl · Thu Jun 09, 2022 10:46 am

So reporting the same issue over and over to support is better than reporting the same issue again in the forum?
I would very much like dedicated forum section for reporting bugs that someone from MikroTik would watch. Or maybe public bug tracker.

Now if ten people find same bug and report it to support, it's not ideal. For support it means handling ten reports, extra work.

I agree with that! I am often amazed that they want you to report issues in their bug tracking system, when that system is not public.
A forum is not good for tracking bugs, but at least it offers mutual readability of other people's reports. When we had no reports on the forum, we would never know that some people put their 3011 in bootloop by simply installing a 7.x stable version, until suddenly a 7.x.1 appears with an "improved stability on 3011 when SFP is present" change note!
At least when there is public reporting of bugs in a forum, people can defer updates in such situations. Maybe not what MikroTik likes, but certainly what I like.
(not that I would even CONSIDER to install a "7.x stable" version on my routers, especially in critical use. let them make the .2 or .3 first)

Spirch · Sat Jun 11, 2022 12:56 am

can you provide smaller packages for wifi2, this will increase the number of people that can test it and provide more feedback, my mikrotik does have 256m ram but 16m hd

rextended · Sat Jun 11, 2022 10:04 am

@Spirch, what request is this?
In your opinion what should be removed to reduce the package?
The drivers?
The WPA3?
What do they purposely put useless to increase the size, in your opinion?

Sat Jun 11, 2022 11:22 am

@rextended
It's a simple request to make packages smaller or maybe bringing back modularity as in v6.
Decision of mounting 16M HD in router was a BIG mistake which implies now a lot of problems for users.
It's not our fault that we are now not able to even upgrade quite new devices without some "dances with shamanic drums around the fireplace'

rextended · Sat Jun 11, 2022 11:32 am

@BartoszP, the user do not request the possibility to do not install other packages, but reduce one specific package on size...

Sat Jun 11, 2022 11:42 am

@BartoszP, the user do not request the possibility to do not install other packages, but reduce one specific package on size...

And what .... ? The problem is real no matter what module we talk about as It's impossible to easily upgrade all these tiny in HD space devices.

rextended · Sat Jun 11, 2022 11:49 am

We are talking about two different things, the user is interested in using the wifiwave2 package on a device (unspecified)
probably not supported by the package itself, and ask to reduce in size the package...
Instead you are talking about something, in which I still fully agree, about the limited space,
and it would be better to make the optional packages as before, or at least integrate only those actually needed.
It is also better to have at least 256M of NAND in future products (no Flash ...)

hecatae · Sat Jun 11, 2022 12:52 pm

can you provide smaller packages for wifi2, this will increase the number of people that can test it and provide more feedback, my mikrotik does have 256m ram but 16m hd

There's quite a few Chateau owners who would happily test a wifiwave2 driver bundled with the main .npk instead of the usual WiFi implementation.

Anyone else finding 7.4 perfectly stable compared to 7.3?

sindy · Sat Jun 11, 2022 1:02 pm

the user is interested in using the wifiwave2 package on a device (unspecified)
probably not supported by the package itself, and ask to reduce in size the package...

The thing is that the wifiwave2 package contains drivers for multiple wireless chip families, and if always only the one needed for a particular RouterBoard model was installed, less disk space would be required. But Wave 2 also requires a lot of RAM to model the wireless environment, so RAM size below 128 MB is also disqualifying (as RouterOS itself also needs some RAM). So apart from some "lucky" series of hAP ac² that had 256 MB RAM, I'm not aware of any devices where the flash size alone would prevent Wave 2 from running.

Technetium · Sat Jun 11, 2022 3:23 pm

The thing is that the wifiwave2 package contains drivers for multiple wireless chip families, and if always only the one needed for a particular RouterBoard model was installed, less disk space would be required. But Wave 2 also requires a lot of RAM to model the wireless environment, so RAM size below 128 MB is also disqualifying (as RouterOS itself also needs some RAM). So apart from some "lucky" series of hAP ac² that had 256 MB RAM, I'm not aware of any devices where the flash size alone would prevent Wave 2 from running.

Wifi2 package contains driver for only 2 wifi chip: IPQ4019 and QCA9984.

It requires 14Mb of additional space... further the space required for routeros (12Mb).
It's a pity that year ago, Mikrotik, did not choose to upgrade at least to 32Mb of nand.
I use a Chateau with an external AP (non mikrotik) to have better wifi performance.

I hope in future Routeros will have some trick to load/install driver on a USB storage ! I think this can be made...

pourhosaini · Sun Jun 12, 2022 9:56 am

Hi Dear RouterOS Team

please add ZTE MF79U LTE USB Dongle Support
it is just only available lte dongle in my city
thanks

https://www.alibaba.com/product-detail/ ... 85652.html

Amm0 · Sun Jun 12, 2022 11:32 pm

*) webfig - updated WebFig HTML files with the new MikroTik logo and removed Telnet option from index page;
Maybe the user-manager could use some makeovers too?
Would MT care enough to implement the reseller functionality in the user manager?

A Branding Kit package should let you replace any file, so theoretically this should be possible. Now what file path to use, that I don't dunno.

mikegleasonjr · Mon Jun 13, 2022 6:40 am

@rextended
It's a simple request to make packages smaller or maybe bringing back modularity as in v6.
Decision of mounting 16M HD in router was a BIG mistake which implies now a lot of problems for users.
It's not our fault that we are now not able to even upgrade quite new devices without some "dances with shamanic drums around the fireplace'

Having wifiwave2 is definitely possible on a 16MB memory device. Like you said, they just have to separate each drivers for each chipsets.

I run OpenWRT to have wifiwave2 on 3 devices at home (Cap AC). I get 500 mbit/sec on my MacBook running iperf3. But most importantly I get fast roaming on my phone. It fast roams on the same AP between 2 and 5 ghz or across all 3 Cap ACs when I move. I can run an iperf3 test and move around without the connection ever failing. No need to play anymore with the tx power or having to tweak anything.

Screenshot 2022-06-13 043916.png

mkx · Mon Jun 13, 2022 8:57 am

Did you find anything else that suggests two cores in 3236?

You're nitpicking, aren't you? Linux kernel usually doesn't just "invent" otherwise non-existing CPU cores. So if at some certain point linux kernel in ROS v7 showed 2 CPU cores, this pretty much testifies that SoC includes two CPU cores. Why propaganda materials from different vendors doesn't mention it? Could be that also linux kernel, used by other vendors (many do, you know?), doesn't support multiple cores. Could be that other vendors found out about problems earlier and already implemented workaround (of disabling second core). Could be that other vendors actually enable both cores but their UI doesn't go into trouble of showing that. Could be anything else.
Sadly Marvell seems to hide spec sheets for their SoCs from general public so we can't verify.

Znevna · Mon Jun 13, 2022 8:59 am

So you don't have any proof that suggests two functional cores in that SoC.

rextended · Mon Jun 13, 2022 12:27 pm

A Branding Kit package should let you replace any file

False.

Technetium · Mon Jun 13, 2022 12:58 pm

I run OpenWRT to have wifiwave2 on 3 devices at home (Cap AC). I get 500 mbit/sec on my MacBook running iperf3. But most importantly I get fast roaming on my phone. It fast roams on the same AP between 2 and 5 ghz or across all 3 Cap ACs when I move. I can run an iperf3 test and move around without the connection ever failing. No need to play anymore with the tx power or having to tweak anything.

Isn't fast roaming possible only if you have an Openwrt router as controller ?

mikegleasonjr · Mon Jun 13, 2022 1:29 pm

I run OpenWRT to have wifiwave2 on 3 devices at home (Cap AC). I get 500 mbit/sec on my MacBook running iperf3. But most importantly I get fast roaming on my phone. It fast roams on the same AP between 2 and 5 ghz or across all 3 Cap ACs when I move. I can run an iperf3 test and move around without the connection ever failing. No need to play anymore with the tx power or having to tweak anything.
Isn't fast roaming possible only if you have an Openwrt router as controller ?

No, fast roaming does not require a controller and works across multiple different vendors.

Amm0 · Tue Jun 14, 2022 4:44 pm

A Branding Kit package should let you replace any file
False.

That's perhaps true. :)

There is an "other files" options, but how to use that to replace user mgr graphics, I dunno. But if Branding Kit didn't replace all the logos, that seems like a bug.

rextended · Tue Jun 14, 2022 4:53 pm

Is false... I use branding and do not "let you replace any file".
At least you add your own graphics for webpage, but not for webfig, only a small logo.
And about branding folder is for add script and other files used internally on device,
but you still unable to REPLACE any existing file (or add hidden executable file)...

Amm0 · Tue Jun 14, 2022 8:36 pm

Is false... I use branding and do not "let you replace any file".

I wasn't arguing. It was originally a suggestion that "should be possible" [theoritically]. e.g. "if Branding Kit didn't replace all the logos, some way, that seems like a bug."

The better question is does Mikrotik consider something like this a bug? e.g. should the OP should have just filed a report at help.mikrotik.com and have hope it be fixed? Or does Mikrotik track issues/requests like that from this forum, so filing a bug report duplicative?

rextended · Tue Jun 14, 2022 9:48 pm

Sorry

didisso · Thu Jun 16, 2022 5:18 pm

Hi Team

Could you work on BGP on VRF ?

thanks

regards

pe1chl · Thu Jun 16, 2022 5:30 pm

Hi Team

Could you work on BGP on VRF ?

thanks

Or even better: could you work on BGP? BGP seems to be at a standstill, even though this is the major area of feature incompleteness in v7 relative to v6.

pe1chl · Thu Jun 16, 2022 5:37 pm

Is there some critical problem? upgrade.mikrotik.com returns address 10.0.0.6

Ovic · Thu Jun 16, 2022 6:49 pm

I also get this
>ping upgrade.mikrotik.com

Pinging upgrade.mikrotik.com [10.0.0.6] with 32 bytes of data:
Request timed out.

Ping statistics for 10.0.0.6:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),

buset1974 · Thu Jun 16, 2022 7:51 pm

Hi Team

Could you work on BGP on VRF ?

thanks
Or even better: could you work on BGP? BGP seems to be at a standstill, even though this is the major area of feature incompleteness in v7 relative to v6.

I also reported possibility memory leak caused by bgp vrf issue, i believe security issue must be fix fast right?

Ovic · Thu Jun 16, 2022 8:27 pm

Latest beta doesn't play nice with wifiwave2 drivers. After update to 7.4beta4 the wifi interfaces don't work anymore on Hap AC3
In winbox it displays an extra option above mode named master interface with unknown status which is unselectable & also the mac-address of the wifi card appears as 00:00:00:00:00:00. Tried to reset the interface but to no avail. Back to 7.3.1 until is fixed

ech1965 · Thu Jun 16, 2022 8:40 pm

Would it be possible to create new topic for each beta ? or AT THE VERY LEAST update the first post to include ALL the changelogs ?
Thanks you very much in advance !

Thu Jun 16, 2022 8:57 pm

Latest beta doesn't play nice with wifiwave2 drivers. After update to 7.4beta4 the wifi interfaces don't work anymore on Hap AC3
In winbox it displays an extra option above mode named master interface with unknown status which is unselectable & also the mac-address of the wifi card appears as 00:00:00:00:00:00. Tried to reset the interface but to no avail. Back to 7.3.1 until is fixed

Not likely.
I've got 2 hAP AC3s running 7.4b4 with ww2, slave interfaces and vlans without a problem.
Also, I don't see the things you mention.

What winbox do you use ? I'm on 3.36 using Win11.

Ovic · Thu Jun 16, 2022 8:59 pm

I'm using also 3.36 and win 11. The issue appeared after upgrading the routerboard firmware to 7.4beta4 not just RouterOS

Thu Jun 16, 2022 9:08 pm

I'm using also 3.36 and win 11. The issue appeared after upgrading the routerboard firmware to 7.4beta4 not just RouterOS

Maybe start separate thread with export of your config so we can have a look.
I'm still inclined to think it is some config thing.

tpedko · Thu Jun 16, 2022 10:49 pm

sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?
what is this error and how to solve it?
Container+pihole on this help help.mikrotik.com/docs/display/ROS/Container

Thu Jun 16, 2022 11:00 pm

set environmental variables as per docs DNSMASQ_USER should be root

bma · Thu Jun 16, 2022 11:24 pm

I also see the "sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?" message in the log when logging=yes is set and I try to edit the configuration on the pihole web services. The configuration edits don't change.
- Using a RB5009 with 95% free in / and 924GB free on /disk1
- Disk1 is a 1TB SSD and used for the env and root dir as the example: https://help.mikrotik.com/docs/display/ROS/Container
- DNSMASQ_USER="root" is set and the error still occurs

See:
viewtopic.php?t=178342&sid=c5f23d5eae04 ... eb#p940168

I tried removing the container and redownloading the image and now it runs out of space after getting the second 50+ MB tar. Both / and /disk1 accept 500MB+ files for upload so it's not clear what's running out of space. Maybe a partition not visible to us?

12:46:54 container,info,debug layer sha256:d71b73c96b9e7bdab370cb1a522c5a1519ea698f2eb205b75d11b197e091706d downloaded
12:46:54 container,info,debug no space to extract layer
12:46:54 container,info,debug was unable to import, container 1306f802-a3d8-4436-ae41-4d991709cef0

rb5009_containers_free_space.PNG

Thu Jun 16, 2022 11:35 pm

@bma and others, regarding container - please use other threads to discuss container in detail

Larsa · Thu Jun 16, 2022 11:39 pm

May I suggest this one: "v7.1rc3 adds Docker (TM) compatible container support"

daaf · Fri Jun 17, 2022 6:45 am

I have tried following the instructions quoted at https://help.mikrotik.com/docs/display/ROS/Container. Download the container and upload to CHR with the command:
amd64
docker pull pihole/pihole:latest@sha256:f56885979dcffeb902d2ca51828c92118199222ffb8f6644505e7881e11eeb85
docker save pihole/pihole > pihole.tar

In the end I get the error in the attached image.

Container.jpg

tpedko · Fri Jun 17, 2022 9:05 am

set environmental variables as per docs DNSMASQ_USER should be root

i set vars
/container envs
add list=pihole_envs name=TZ value=Europe/Moscow
add list=pihole_envs name=ServerIP value=172.17.0.2
add list=pihole_envs name=WEBPASSWORD value=pass
add list=pihole_envs name=DNSMASQ_USER value=root

Znevna · Fri Jun 17, 2022 9:08 am

Please move all container related talk to the dedicated topic: v7.1rc3 adds Docker (TM) compatible container support

pe1chl · Fri Jun 17, 2022 12:35 pm

Well, it looks like it was a complete re-write and it wasn't really tested. That is our job, I guess...
My first thought was "hey you, instead of fiddling with new functionality why don't you just add something to v7 that is still missing, e.g. BFD".
But now, I am not sure anymore that would have been a good idea...

Sat Jun 18, 2022 12:15 am

Support for fast BSS transitions can be enabled with
/interface/wifiwave2/set wifi1,wifi2 security.ft=yes
And a client device will only consider roaming between interfaces if they have the same SSID.

Done but moving from one ap to the other while playing YouTube video I see 4G taking over before it changes ap. I'm sitting literally 2m before the other ap and still it stays with the first one.
Then it gives up, goes to 4G and only then it moves over.
So it does not work ?
Or only with wpa2, not wpa3 ?

Device used is Samsung S20 with 2x hap ac3 as AP.

CTassisF · Sat Jun 18, 2022 1:50 am

moving from one ap to the other

The changelog says "roaming (802.11r) between local AP interfaces", so I guess it only works for interfaces in the same AP (like roaming from 2.4GHz to 5GHz).

Sat Jun 18, 2022 8:03 am

The changelog says "roaming (802.11r) between local AP interfaces", so I guess it only works for interfaces in the same AP (like roaming from 2.4GHz to 5GHz).

I have different SSIDS (and VLANs) for different radios.
But my 2 APs are within the same subnet so by my definition, that's local.
We'll see ...

Znevna · Sat Jun 18, 2022 8:23 am

One elementary requirement for "roaming" is that all your SSIDs have to be identical.
If you have different SSIDs the client will stick to the current SSID as long as it can before switching to another, different SSID, because different SSIDs mean different networks.

Sat Jun 18, 2022 8:26 am

The 2 aps I use, have the same 3 SSids.
2 for 2.4 and 1 for 5ghz.
So within 5ghz, it should roam, I would think ?

It's clear detailed info is needed on how this is supposed to work or what the conditions are to make it so.

Znevna · Sat Jun 18, 2022 9:59 am

Well, they mentioned enough details about the current 802.11r limits here: viewtopic.php?t=186583#p940253
Of course your client has to know about 802.11r too :)
And here's a nice article: https://help.keenetic.com/hc/en-us/arti ... ss-roaming

npeca75 · Sat Jun 18, 2022 10:59 am

It is really nice how finally a RouterOS device that gets its IP via SLAAC will show that IP under IPv6->Addresses, thank you for finally doing this (I realize it was done in 7.3.x and not 7.4.x, but still, it is a new feature that I have been requesting for years now).

However, the default route being received through SLAAC is still not being displayed in the routing table. Are there plans to address this in 7.4.x?

+1 for route show
and to expand this topic
MT is a router, and using VLANs is normal on this device
simple ON/OFF for accept SLAAC is not enough
suppose we have few VLANs, ex: Guest, Lan, VMs, etc, and if there is more than one IPv6 RA, MT wil pickup ALL SLAAC address
please MT, let us choose from which interface we accept SLAAC

pe1chl · Sat Jun 18, 2022 11:05 am

You can do that using a firewall rule, right?

npeca75 · Sat Jun 18, 2022 11:14 am

You can do that using a firewall rule, right?

well, for sake of simplicity, if it is visual, and bound to interface menu ... then you could not miss it

then the position of firewall rule is not important, one rule will not mess with another, etc, etc

using smart switches a lot in my work and there is so simple, you choose interface,check enable RA and this is it.
RA accepted on MGMN Vlan.
Simple
if the low budget tp-link/jetstream switch (example) could do this, why MT could not ?

pe1chl · Sat Jun 18, 2022 11:27 am

It can be done but it is for a small niche case only and it can be done in another way.
Basically what you say is that MikroTik have to provide in their user interface for ALL configurability available from the underlying OS. I sometimes provide similar feature requests and they are usually ignored, or sometimes replied with "nobody ever asks for that".
I don't know if they have some back-pressure against including EVERYTHING and making RouterOS less and less comprehensible, or if it is only a matter of "too much work, not worth it".

npeca75 · Sat Jun 18, 2022 11:58 am

to be honest, MT is popular because of Winbox
most of admins who operate on small or mid sized net love winbox because they don't need to learn CLI on black&white terminals
from this point of view:
IPv6 enable SLAAC is burried in abnormal place in MT
(openwrt: accept RA per interface, linux: accept RA per interface, other brands: accept RA per interface).

In MT world it is in IP Settings, and accept RA on ALL interface ...
so, back to GUI/Winbox...
messing with reversed logic, GUI Accept RA checkbox, (without explanation) then
firewall drop unneeded with firewall rule order importance ...
don't see any logic in this,
it is far from Winbox GUI philosophy
... but, in MT world, half made things are normal :)

pe1chl · Sat Jun 18, 2022 12:44 pm

You have to understand that using SLAAC in a router is not normal. It is only required in certain niche situations with internet providers that have deployed IPv6 but do not yet understand it.
In normal operation within a reasonably managed network you do not need SLAAC on a router.
It would be better to spend your effort on educating your ISP.

mkx · Sat Jun 18, 2022 1:31 pm

In normal operation within a reasonably managed network you do not need SLAAC on a router.

No, but one might want to accept RA on management interface of an AP (but not the rest of interfaces). Since in MT world proper DHCPv6 doesn't exist ...

And no, it's not possible to educate ISPs (most of them treat customers as ignorant bunch of idiots and don't bother recognising some as exceptions from the rule), I still have faith to move MT ever so slightly in direction of fulfilling some requests from customer base. And yes, I'm aware that this may sound as idealistic ...

npeca75 · Sat Jun 18, 2022 2:14 pm

In normal operation within a reasonably managed network you do not need SLAAC on a router.

No, but one might want to accept RA on management interface of an AP (but not the rest of interfaces). Since in MT world proper DHCPv6 doesn't exist ...

And no, it's not possible to educate ISPs (most of them treat customers as ignorant bunch of idiots and don't bother recognising some as exceptions from the rule), I still have faith to move MT ever so slightly in direction of fulfilling some requests from customer base. And yes, I'm aware that this may sound as idealistic ...

my idea was to MT implement this thing proper way
like rest of winbox, in logic way
not meant to offend anybody
simply, MT is based on Linux. Other vendors is based on Linux. Other vendors could do this proper way, why not MT ?

and, please, it is my decision for what i will like to use (unfortunate) SLAAC.
As @mkx stated, it is very handy for some things, and without proper stateful v6 DHCP, we are doomed to use this
so, if MT don't implement normal DHCP, then, at least, could implement per interface SLAAC

Sat Jun 18, 2022 2:42 pm

Well, they mentioned enough details about the current 802.11r limits here: viewtopic.php?t=186583#p940253

That's the limited info which is not clear enough how it is supposed to work.

Of course your client has to know about 802.11r too :)

All Samsung phones as from Android P support 802.11r

And here's a nice article: https://help.keenetic.com/hc/en-us/arti ... ss-roaming

Interesting article indeed.

Anyhow, on my way to France now so won't be able to test further for 2 weeks.

pe1chl · Sat Jun 18, 2022 2:57 pm

Well, they mentioned enough details about the current 802.11r limits here: viewtopic.php?t=186583#p940253
That's the limited info which is not clear enough how it is supposed to work.

Well, "how it is supposed to work" is described in the 802.11r standard.
There are 3 standards that are relevant here: 802.11k, 802.11r and 802.11v. These are usually mentioned in one sentence (802.11k/r/v).
802.11k allows the distribution of a list of access point MAC addresses and frequencies, so that the client can know where to look for an alternative without having to scan all frequencies.
With 802.11r, a session key is prepared in case a client would want to connect to an alternative AP, and these are sent as a list (AP MAC and key).
This means that the client can roam faster because they do not have to authenticate at the moment of roaming, that has already been done. This mainly helps WPA2-EAP authentication, for WPA2-PSK it makes less of a difference as that always is faster.
But this means the accesspoints have to know of eachothers existence, pointing in the direction of a managed network, like CapsMAN.
It appears that this step has not yet been implemented so now the 802.11r code for now only allows for roaming between interfaces of the same AP (e.g. from 5 to 2 GHz when walking out of range).
That makes it much less useful, but at least it is a first step and we can next hope for 802.11k and then 802.11v. Of course first CapsMAN will have to be made working for wifiwave2.

kev445 · Sat Jun 18, 2022 3:04 pm

*) wifiwave2 - added initial support for roaming (802.11r) between local AP interfaces;

Anything special to be configured for this to function ?
Support for fast BSS transitions can be enabled with
/interface/wifiwave2/set wifi1,wifi2 security.ft=yes
And a client device will only consider roaming between interfaces if they have the same SSID.

Issues as soon as it is turned on
XX:XX:XX:XX:XX:XX@wifi2 rejected, can't find PMKSA

To resolve I disabled WPA3 PSK and removed the management protection config (was set to allowed).
Everything is now working again as expected.

pe1chl · Sat Jun 18, 2022 3:15 pm

Issues as soon as it is turned on
XX:XX:XX:XX:XX:XX@wifi2 rejected, can't find PMKSA

Note that it can take some time for the PMKSA list to be distributed to the clients.
When you turn on 802.11r while clients are present, initially you could see things like this.
Let the clients re-connect and remain connected for a minute or so before testing.

kev445 · Sat Jun 18, 2022 4:05 pm

Issues as soon as it is turned on
XX:XX:XX:XX:XX:XX@wifi2 rejected, can't find PMKSA
Note that it can take some time for the PMKSA list to be distributed to the clients.
When you turn on 802.11r while clients are present, initially you could see things like this.
Let the clients re-connect and remain connected for a minute or so before testing.

The problem was that it wasn't allowing some clients to connect, I think iPhones primarily.
Are you saying that it would have eventually started allowing connections?

pe1chl · Sat Jun 18, 2022 4:27 pm

I think I would disable the wifi interfaces, change the settings, wait some 20 seconds and then enable it again.
(to be sure everyone has disconnected and forgotten about the AP)

sinisa · Sat Jun 18, 2022 4:43 pm

In normal operation within a reasonably managed network you do not need SLAAC on a router.

No, but one might want to accept RA on management interface of an AP (but not the rest of interfaces). Since in MT world proper DHCPv6 doesn't exist ...

And no, it's not possible to educate ISPs (most of them treat customers as ignorant bunch of idiots and don't bother recognizing some as exceptions from the rule), I still have faith to move MT ever so slightly in direction of fulfilling some requests from customer base. And yes, I'm aware that this may sound as idealistic ...

I have to disagree with this (although part in parentheses is very much true). If you show enough knowledge and have arguments (and RFCs) on your side, you can. Just the other day we managed to make a mobile phone operator to change working of their network because calls from latest iphone via VoLTE could not come into Asterisk PBX (not related to Mikrotik, but proof that you can make providers change). And yes, we could make changes on our side, but that would be wrong, because others would come to the same problems sooner or later...

kev445 · Sat Jun 18, 2022 5:13 pm

Note that it can take some time for the PMKSA list to be distributed to the clients.
When you turn on 802.11r while clients are present, initially you could see things like this.
Let the clients re-connect and remain connected for a minute or so before testing.
The problem was that it wasn't allowing some clients to connect, I think iPhones primarily.
Are you saying that it would have eventually started allowing connections?

Getting these in my logs…
XX:XX:XX:XX:XX:XX@wifi3 rejected, FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request

Mikrotik Audience, all have the same SSID

mducharme · Sat Jun 18, 2022 9:53 pm

suppose we have few VLANs, ex: Guest, Lan, VMs, etc, and if there is more than one IPv6 RA, MT wil pickup ALL SLAAC address
please MT, let us choose from which interface we accept SLAAC

Yes, I would also like to see this. Ideally it could be done by selecting an interface list to be used for SLAAC, similar to how neighbor discovery is configured.

Sob · Sat Jun 18, 2022 10:35 pm

Ideally it could be done by selecting an interface list to be used for SLAAC, ...

I'd prefer something similar to DHCP client, which you could add per interface, would have on ovents script, etc. You could do anything with that, so anyone would be happy, no matter how crazy use cases they would have.

npeca75 · Sun Jun 19, 2022 12:10 am

Ideally it could be done by selecting an interface list to be used for SLAAC, ...
I'd prefer something similar to DHCP client, which you could add per interface, would have on ovents script, etc. You could do anything with that, so anyone would be happy, no matter how crazy use cases they would have.

Reality is:
1. we have stateful DHCP Client, but we don't have stateful DHCP server
2. we have stateless RA, but we don't have stateless DHCP client (or similar)

ok, ok, one could argue that blindly assigned SLAAC on MT could be counted as "client", but the truth is, until v7.4 there was no info about SLAAC addresses !
so, basicaly, point 1 & 2 are true, as there is still no default route info

it is sad thing, both stateful && stateless is only 50% done
if MT once finish at least one of them, it will be a reason for celebrating

pe1chl · Sun Jun 19, 2022 11:47 am

Ideally it could be done by selecting an interface list to be used for SLAAC, ...
I'd prefer something similar to DHCP client, which you could add per interface, would have on ovents script, etc. You could do anything with that, so anyone would be happy, no matter how crazy use cases they would have.

Ok but wouldn't that be something that just 3 people really would want to have, and that would just be there to confuse 99% of the other users?
I mean, normally on a ROUTER you want addresses to be obtained by network-sized bites, like DHCPv6 PD does, to assign them to users on networks that you route.
Using SLAAC to assign the router an address on a management network really seems like a niche case. I would use a static address for that.
Having SLAAC would make people think think it is normal to use that to obtain a single address from their provider and then use NAT to route their network, just like they are used to in IPv4.
There seem to be providers that expect this, but they should be educated rather than confirmed (by RouterOS support) that this is the right way to go forward.

mkx · Sun Jun 19, 2022 12:44 pm

I mean, normally on a ROUTER you want addresses to be obtained by network-sized bites, like DHCPv6 PD does, to assign them to users on networks that you route.
Using SLAAC to assign the router an address on a management network really seems like a niche case.

Another case, which is a hybrid of the two cases mentioned above, but probably affects waaay more that 3 people: ISP assigning prefixes via DHCPv6 PD but announcing proper upstream gateway via RA. Currently one can either set add-default-route=yes to DHCPv6 client and hope things will just work (which usually do, but sometimes don't and it's plain wrong to do it in IPv6) or one can set accept-router-advertisements=yes in IPv6 settings and risk total IPv6 breakdown if some rogue device in one of LANs starts to anounce itself as super-duper gateway to the universe.
The later could happen from the WAN interface as well, but it's up to upstream provider (ISP) to block such malicious attempts.

For the 95% of users who use QuickSet to set up device it's easy: this setting should accept interface list (among other properties). QuickSet (and most of other sane people) use WAN interface list anyway (default firewall depends on it) and "accept-RAs" would by default accept RAs from interfaces listed in WAN interface list. Nothing too confusing and correct in 99% of cases (I guess that varous modems in bridge mode should not emit RAs with own link-local address).

Znevna · Sun Jun 19, 2022 8:08 pm

Question.
I didn't use any disks attached to RouterOS until now for obvious reasons (because you couldn't do much with them) but now I wanted to play with containers a little.
Attached a pre-partitioned and formatted drive, and I'm seeing constant activity without anything configured in RouterOS that could use the external drive.
I didn't even install the container package yet.
Thoughts?

RouterOS v7.4beta4 - Disk Activity.PNG

Ok, I've transferred a file of about 400MB to it over WinBox and after completion I've deleted the file and reset the counters.
Now it calmed down:

RouterOS v7.4beta4 - Disk Activity - 001.PNG

So it does *something* until you write something to the disk? what does it do I wonder?

npeca75 · Sun Jun 19, 2022 9:07 pm

Ok but wouldn't that be something that just 3 people really would want to have, and that would just be there to confuse 99% of the other users?

Oh, please, don't make assumptions
look in OpenWRT forum
DHCP v6 client is default ON
and it is working !!!
PD,stateful,stateless, 3in1

after few years of activity on OpenWRT forum, i don't remember that someone is "confused" with IPv6 SLAAC client
why? because OWRT have a nice GUI with all information needed, IPv6 Address, IPv6 gateway, etc

and, no, nobody says: it is needed only for 3 people, please don't implement this :)
everyone is happy to have IPv6 working

mducharme · Mon Jun 20, 2022 4:57 am

There seem to be providers that expect this, but they should be educated rather than confirmed (by RouterOS support) that this is the right way to go forward.

This isn't the providers doing something wrong. As I understand it, DHCPv6 does not and cannot provide a default gateway to the client, clients are supposed to use SLAAC to get this as per the applicable RFC's. There was no mechanism added for default gateway to be provided to the client through DHCPv6, it was originally in the spec as I understand it but it was removed from the final version as it was expected that clients would use SLAAC for this. In this case, what MikroTik is doing is adding an "add default route" option to the DHCPv6 client settings that doesn't actually get the correct default gateway but instead seems to make the assumption that the DHCPv6 PD server itself must be the default gateway. In cases where the ISP is doing DHCPv6 relay to a PD server on some remote subnet (which is a perfectly valid configuration), this seems to malfunction and the MikroTik instead tries to create a default route with the gateway as an IP on some other subnet, the actual DHCPv6 server IP being relayed to, and so this fails. If MikroTik could add a little bit more support to SLAAC, they could remove this non-standard "add default route" option from the DHCPv6 client as it would no longer be necessary, and then things would work out of the box with any ISP.

It is clearly not the ISP's fault in this case, and it shouldn't be that you have to "educate" them to avoid a perfectly reasonable configuration that basically every vendor except MikroTik would support. It is instead MikroTik doing something that is non-standard apparently to try to make things easier for end users so they can get the gateway without having to use SLAAC as was intended by the people who wrote the applicable RFC's. In most cases the DHCPv6 PD server is also the gateway, but in some cases it is not, and then this feature will not behave as expected.

Also, as an ISP, we want to move our management networks (often with hundreds of customer radios) to IPv6 only. It is a lot easier to do this now that we can actually see what IP the device has without having to deduce what IP it must have from the link-local. I don't think this feature (seeing the SLAAC-provided route) is one that only three people will care about.

pe1chl · Mon Jun 20, 2022 10:23 am

Also, as an ISP, we want to move our management networks (often with hundreds of customer radios) to IPv6 only. It is a lot easier to do this now that we can actually see what IP the device has without having to deduce what IP it must have from the link-local. I don't think this feature (seeing the SLAAC-provided route) is one that only three people will care about.

But that is not what I considered to be the discussion topic. That was "does MikroTik have to add a per-interface setting of SLAAC client or is it sufficient to have a global setting and can those few users with niche situations use the firewall to disable it on interfaces where they explicitly do not want it".
Of course I agree with you that it is a good thing that the addresses obtained via SLAAC are always displayed in the IPv6 addresses table as "D" items, and the same should be done for routes.

mkx · Mon Jun 20, 2022 11:09 am

But that is not what I considered to be the discussion topic. That was "does MikroTik have to add a per-interface setting of SLAAC client or is it sufficient to have a global setting and can those few users with niche situations use the firewall to disable it on interfaces where they explicitly do not want it".

As soon as some device has more than one interface (for any kind of usage) with IPv6 enabled, it's good to have per-interface setting of SLAAC client. Period.

Since underlying linux kernel supports it, the fuss with firewall blocking RAs on interfaces where user doesn't want it is a complicated workaround which should not be needed.

pe1chl · Mon Jun 20, 2022 12:06 pm

Ok but then I want some other things as well that are available from the underlying Linux platform:
- in a queue tree, allow for direct selection of a member to be active on packet priority, instead of the detour via packet marks
- in the firewall, allow matching on "rpfilter" (the result of the reverse path filter), even when RP filter global setting is OFF
- in a router with more than 16MB of flash, access to the RAM disk
(and I could probably go on for a while)

All things I personally find useful, can use in my niche application, but apparently are not important enough to add to RouterOS even when that should be very easy.

osc86 · Mon Jun 20, 2022 12:56 pm

and proxy_ndp!!

Sob · Mon Jun 20, 2022 3:09 pm

Ok but then I want some other things as well that are available from the underlying Linux platform:

And we all (probably) support that! It's one of things that MikroTik should think about, after they make v7 stable and look for interesting new features they could add. What could be better than just allowing access to something that already exists and they don't have to code it from beginning. Someone could call it cheating, but I wouldn't mind. :)

As for SLAAC, ISPs doing something wrong, etc, I'm afraid that it's lost cause. Even when it's the case, I don't think they will be educated by MikroTik boycotting something, when others don't. But it's not always that, even the right thing (as described above by @mducharme) is currently not handled ideally, and that's not good.

mducharme · Mon Jun 20, 2022 4:35 pm

As soon as some device has more than one interface (for any kind of usage) with IPv6 enabled, it's good to have per-interface setting of SLAAC client. Period.

Since underlying linux kernel supports it, the fuss with firewall blocking RAs on interfaces where user doesn't want it is a complicated workaround which should not be needed.

Yes, I agree completely. With our customer CPE radios we do not want to have to configure a firewall on them for the sole purpose of preventing receiving RA's on interfaces other than our management VLAN - it is certainly an overcomplicated workaround for what should be a basic setting. I don't want a customer to plug something in backwards and start sending RA's to a radio, and then it gets some other global address I don't want.

I'm glad that MikroTik is finally making needed IPv6 improvements, but we (in general, not just MikroTik) have to start treating IPv6 as the *current* protocol, and not just something coming up in the future. Feature parity between IPv4 and IPv6 is no longer something that should be optional, it must be required.

tigro11 · Tue Jun 21, 2022 6:19 pm

From the console /tool Netwatch does not exist
The entered scripts does not work either

Znevna · Tue Jun 21, 2022 7:23 pm

If you read the previous posts..

sirbryan · Wed Jun 22, 2022 8:26 am

You have to understand that using SLAAC in a router is not normal. It is only required in certain niche situations with internet providers that have deployed IPv6 but do not yet understand it.
In normal operation within a reasonably managed network you do not need SLAAC on a router.
It would be better to spend your effort on educating your ISP.

You have to understand that MT doesn't support DHCPv6. As the uneducated ISP (I only have 20 years of experience), I have to resort to RA/SLAAC to get my customers' routers to talk to my MT routers on IPv6. Fortunately, most of their routers are MikroTik routers I have installed. We use RA/SLAAC on the WAN interfaces and DHCPv6 prefix delegation to assign /60's to the routers.

Also, RA/SLAAC are the only things universally supported internally, too. (No Apple support for DHCPv6 at the moment, for example.)

pe1chl · Wed Jun 22, 2022 11:02 am

There is no need to use SLAAC on the WAN interfaces, you can use an address from the pool or use the link-local address. That works just fine.
DHCPv6 PD is the correct way to assign the customer addresses.

mobyfab · Wed Jun 22, 2022 11:26 am

For containers, can we use another subnet than 172.17.0.0/16 or is this hardcoded for now?
This is the default docker subnet so it conflicts with machines already running docker which have this route locally.

Znevna · Wed Jun 22, 2022 11:38 am

Did you try using another subnet and it doesn't work?

WeWiNet · Wed Jun 22, 2022 12:58 pm

*) wifiwave2 - added initial support for roaming (802.11r) between local AP interfaces;

Anything special to be configured for this to function ?
Support for fast BSS transitions can be enabled with
/interface/wifiwave2/set wifi1,wifi2 security.ft=yes
And a client device will only consider roaming between interfaces if they have the same SSID.

How many SSID groups can be created? I do have the master interfaces I want to roam accross (they have same SSID), and also the virtual interfaces that do exist (same SSID among them). Like main and guest wifi network. If I do export it does not show to which roaming group the interface belongs to:

/interface wifiwave2
set [ find default-name=wifi1 ] configuration=Home configuration.mode=ap disabled=no security.ft=yes
set [ find default-name=wifi2 ] configuration=Home configuration.mode=ap disabled=no security.ft=yes
set [ find default-name=wifi3 ] configuration=Home configuration.mode=ap disabled=no security.ft=yes

Is roaming defined by "SSID" ? Is there any limitation of number of SSID, master i/f and virtual i/f one can use ?

My audience has the 3 master interfaces and 12 virtual ones, using 6 SSID among them.
Does the ROS 7.4 support such scenario ?

mkx · Wed Jun 22, 2022 2:39 pm

There is no need to use SLAAC on the WAN interfaces, you can use an address from the pool or use the link-local address. That works just fine.

As I already wrote (and you didn't explain where I was wrong): RA (SLAAC) is the only proper way of receiving upstream gateway address. So router does have to listen to RAs on its upstream (WAN) interface(s). At the same time it has to ignore RS (Router Solicitation) queries on the very same interface(s), answering to RS on WAN interface(s) can cause havoc. I'm not sure if ROS having WAN interface set with "an address from pool" (yes, some people do that) ignores RS queries, I fear it doesn't just like it doesn't on other (LAN) interfaces.

didisso · Wed Jun 22, 2022 3:38 pm

Hello Everybody

Any new regarding BGP inside a VRF ?

Regards

WeWiNet · Wed Jun 22, 2022 3:43 pm

Support for fast BSS transitions can be enabled with
/interface/wifiwave2/set wifi1,wifi2 security.ft=yes
And a client device will only consider roaming between interfaces if they have the same SSID.
Issues as soon as it is turned on
XX:XX:XX:XX:XX:XX@wifi2 rejected, can't find PMKSA

To resolve I disabled WPA3 PSK and removed the management protection config (was set to allowed).
Everything is now working again as expected.

Using ipad with iOS 12.5.5 you can not authenticate/connect to Wifi when 802.11r is enabled.
Tried to disable WPA3, management config disabled (is already) and few other things.

Only help is remove security.ft from the interface.
Is there a special logging command to see what is going on under the hood of Wifiwave2?

pe1chl · Wed Jun 22, 2022 4:15 pm

There is no need to use SLAAC on the WAN interfaces, you can use an address from the pool or use the link-local address. That works just fine.
As I already wrote (and you didn't explain where I was wrong): RA (SLAAC) is the only proper way of receiving upstream gateway address.

Ok fortunately I have never encountered a situation where it will not work. Most providers here use PPPoE and it provides a local address, and the router can set a default route (no gateway address required, just an interface connected route). Others use a static address on the link and you get the address and gateway address on a letter at the start of your subscription (not a very user friendly method, but on the other hand it does not rely on anything).
The use of SLAAC on the link to the provider is not in use anywhere here, I think. Even the providers that use DHCP for IPv4 do not use it.

sirbryan · Wed Jun 22, 2022 5:20 pm

As I already wrote (and you didn't explain where I was wrong): RA (SLAAC) is the only proper way of receiving upstream gateway address.
Ok fortunately I have never encountered a situation where it will not work. Most providers here use PPPoE and it provides a local address, and the router can set a default route (no gateway address required, just an interface connected route). Others use a static address on the link and you get the address and gateway address on a letter at the start of your subscription (not a very user friendly method, but on the other hand it does not rely on anything).
The use of SLAAC on the link to the provider is not in use anywhere here, I think. Even the providers that use DHCP for IPv4 do not use it.

On all the ISP networks I have managed over the last 20 years (in the US), we used PPPoE on DSL and DHCP on everything else (fixed wireless, fiber, cable). Presently, I do DHCP on fixed wireless, as does a neighboring WISP, the local cable company, and Starlink. The telco (DSL & fiber) does PPPoE. Both are standard enough; ISPs across the country pick one or the other depending on the experience and preference of the network's administration team.

As a provider, I choose DHCP due to its convenience in turning customers up quickly and troubleshooting when routers go awry (one less thing to support in third-party routers).

IPv6 is barely held together by tin cans and strings when it comes to vendor support; fortunately SLAAC on the WAN and DHCPv6-PD for the LAN "mostly works" on both the MT routers I deploy and the third-party routers customers bring along.

blingblouw · Wed Jun 22, 2022 6:09 pm

Issues as soon as it is turned on
XX:XX:XX:XX:XX:XX@wifi2 rejected, can't find PMKSA

To resolve I disabled WPA3 PSK and removed the management protection config (was set to allowed).
Everything is now working again as expected.

wifes iphone had exactly the same issue, mine on 15.5 connects fine

Using ipad with iOS 12.5.5 you can not authenticate/connect to Wifi when 802.11r is enabled.
Tried to disable WPA3, management config disabled (is already) and few other things.

Only help is remove security.ft from the interface.
Is there a special logging command to see what is going on under the hood of Wifiwave2?

mobyfab · Wed Jun 22, 2022 6:14 pm

Did you try using another subnet and it doesn't work?

It didn't work the first time because of a bug with veth interfaces: updating IPs has no effect, interface must be re-created.

Sob · Wed Jun 22, 2022 7:18 pm

RA (SLAAC) is the only proper way of receiving upstream gateway address.

A bit of nitpicking, SLAAC (Stateless Address Autoconfiguration) is the part where device configures address from prefix received in RA, if it has autonomous flag. But if you get own prefix from DHCPv6 server, you don't need SLAAC (= another address), you need only to accept RA and get gateway from there (if ISP configures it like this, for use with DHCPv6, there's no reason for autonomous flag anyway, so there won't be any address configured by device).

This is how it's supposed to work, so it should definitely be supported, including per-interface config, without requiring any tricks with firewall. And also mentioned in manual. Currently it's not, so if someone new to this reads RouterOS DHCPv6 manual, they don't get even a single hint about how it should be done properly.

SLAAC (= automatic address) is something that normally shouldn't be required on router, but the world is not ideal and sometimes it may come in handy.

Panbambaryla · Wed Jun 22, 2022 11:02 pm

Guys,

could you, please, move your discussion regarding IPv6 SLAAC into another thread? This is one big RouterOS topic dominated now by something not strictly related...

Znevna · Wed Jun 22, 2022 11:22 pm

+1 minimum 3 characters

doneware · Thu Jun 23, 2022 8:18 pm

dup post about netwatch not available in CLI. removed. note to myself: read first, then post.

doneware · Thu Jun 23, 2022 8:22 pm

also something strange. I wanted to beef up the 4019's single-chain wifi with ww2 package on a cube60 pro ac, so i installed ww2 on it - and i lost access to w60 interfaces.
presumably this is expected so, as installing/enabling ww2 disables the 'default' wireless package, which also has the drivers for the WiGig part... hopefully this will be a bit enhanced.

Znevna · Thu Jun 23, 2022 8:45 pm

Reading the description of cube60 pro ac, the 5GHz part is used as automatic backup, so they are somewhat tied to one another, I doubt that your request has any standing point.

pe1chl · Thu Jun 23, 2022 8:56 pm

Well, having the possibility for wireless and wireless2 to co-exist would be welcome on my 4011 too!

WeWiNet · Fri Jun 24, 2022 11:50 am

Wifiwave2:
Using 802.11.r on a pair of 2G and 5G interface with same SSID on audience (set security.ft=yes),
I know see huge amount of "interface flapping" of clients being at the edge of good 5G and better 2G connection.
Before they worked well and did roam from time to time from 5G to 2.4G and back, but really not often and it would not be noticed.
Now its like 4-5 times per minutes and constant reconnects of high layer apps making it impossible to work with them.
Removing 11r, (security.ft=non) and things get stable again...

Anyhow experiencing something like this?

WeWiNet · Fri Jun 24, 2022 11:53 am

Well, having the possibility for wireless and wireless2 to co-exist would be welcome on my 4011 too!

Or the option to replace the old 11n 2.4G PCIe card which is in RB4011 by a wifiwave2 compatible one.
I just checked yesterday MIkrotik web page. there is none.
Really a pitty as without that for me, the RB4011 with Wifi is a piece of useless HW ready for the bin...

Znevna · Fri Jun 24, 2022 11:55 am

You can always use it without WiFi.

pe1chl · Fri Jun 24, 2022 12:37 pm

What I do not understand is why the addition of a new WiFi driver (which even has a new configuration command tree) means that the old driver has to be disabled.
I think RouterOS should at boot first enable wifiwave2 and have it probe for its supported hardware, and after that is finished it should enable the old wireless driver and have it find the remainder of the hardware that wifiwave2 has not picked up.
So at least I can have wifi wave2 on 5 GHz while having legacy wifi on 2 GHz (which I use only for some esp8266 gadgets so performance is not important).

hecatae · Fri Jun 24, 2022 3:40 pm

also something strange. I wanted to beef up the 4019's single-chain wifi with ww2 package on a cube60 pro ac, so i installed ww2 on it - and i lost access to w60 interfaces.
presumably this is expected so, as installing/enabling ww2 disables the 'default' wireless package, which also has the drivers for the WiGig part... hopefully this will be a bit enhanced.

Thank you for confirming that the current ww2 package does not contain w60 drivers.

Znevna · Fri Jun 24, 2022 11:40 pm

Container comments don't get saved.

Mon Jun 27, 2022 5:19 pm

Group Management Protocol(GMP)

Are you trying to avoid saying the "C" word? Is this CGMP by another name?

daaf · Mon Jun 27, 2022 5:50 pm

I have used:

 0 key="TZ" name="pihole_envs" value="Europe/Riga" 
 1 key="WEBPASSWORD" name="pihole_envs" value="mysecurepassword" 
 2 key="DNSMASQ_USER" name="pihole_envs" value="root"

Some of those changes are present in the previous beta too, what gives?
*) container - added support for running Docker (TM) containers on ARM, ARM64 and x86;
*) netwatch - added support for more advanced probing;
*) wifiwave2 - added initial support for roaming (802.11r) between local AP interfaces;

Or they contain fixes over the previous implementation?
LE: ok, netwatch script on-down is fixed, the rest of the reported issues are still present (regarding netwatch).
LE2: I don't know if containers existed in WinBox but it exists now.
This no longer works since "list" became "key" and of course the settings were not migrated to the new syntax, I had to readd them with "key"
Code: Select all
/container/envs/add list=pihole_envs name=TZ value="Europe/Riga"
/container/envs/add list=pihole_envs name=WEBPASSWORD value="mysecurepassword"
/container/envs/add list=pihole_envs name=DNSMASQ_USER value="root"
Code: Select all
/container/envs/print 
 0 name="TZ" key="pihole_envs" value="Europe/Riga" 
 1 name="WEBPASSWORD" key="pihole_envs" value="mysecurepassword" 
 2 name="DNSMASQ_USER" key="pihole_envs" value="root" 
And using this
Code: Select all
/container/add file=zdisk/pihole_dev_armv7.tar root-dir=zdisk/containers/pihole_dev envlist=pihole_envs hostname=pihole logging=yes interface=veth1
Makes the added container to ignore the envlist, since it starts with a random password and dnsmasq runs as "pihole" instead of root.
Meh. How was this tested, again?... >.>
Adding comments seem to be fixed.... too bad about the envlist, this is kind of unusable, again.
Veth interfaces still can't be edited, any change to address or gateway require a reboot, or removing the interface and recreating it....

Znevna · Mon Jun 27, 2022 5:51 pm

Yes, but it doesn't work, container ignores envlist.
LE: wrong, see my previous edited comment about this.

Ovic · Mon Jun 27, 2022 6:07 pm

*) wifiwave2 - fixed WPA3-PSK authentication incompatibility with certain vendor and model devices;
This fix is not included in the latest beta, as my Samsung A52s 5G doesn't connect anymore on the network after upgrade. It only works with 7.3.1

buset1974 · Tue Jun 28, 2022 4:24 am

What's new in 7.4beta5 (2022-Jun-27 10:39):

*) container - added support for running Docker (TM) containers on ARM, ARM64 and x86;
*) dhcpv4-server - disallowed overriding message type option;
*) dhcpv4-server - log message when user option updates existing option;
*) dhcpv4-server - placed option 53 as the first one in the packet;
*) health - fixed requesting data from sensor when issuing "get" command;
*) health - fixed voltage reporting on some RBmAP-2nD devices;
*) lte - validate LTE attached IP type in MBIM mode;
*) netwatch - added support for more advanced probing;
*) poe - hide "poe-voltage" parameter on devices that do not support it;
*) route - expose all valid routes to route select filter from OSPF and RIP;
*) route-filter - fixed route select filter rules;
*) upgrade - ignore same version packages during upgrade procedure;
*) wifiwave2 - added initial support for roaming (802.11r) between local AP interfaces;
*) winbox - added "name" parameter under "Routing/BGP/Session" menu;
*) winbox - added "to-address" and "to-ports" parameters under "IPv6/Firewall/NAT" menu;
*) winbox - added support for "Routing/GMP" menu;
*) winbox - added support for "veth" interface types;
*) winbox - fixed "inactive" flag naming under "MPLS/Local Mapping" menu;
*) winbox - fixed minor typo under "Interface" stats;
*) winbox - fixed units for "reachable-time" parameter under "IPv6/ND" menu;
*) winbox - removed "TLS Host" parameter from "IP/Firewall/NAT" menu;
*) winbox - removed duplicate signal strength column under "Wireless/Registration Table" menu;

No improvement on BGP that already reported? Amazing

DeviceLocksmith · Tue Jun 28, 2022 5:55 am

Container support is broken for me on arm64 after upgrade from beta4 to beta5. Mount configuration disappeared, as well as maximum ram. Cannot set maximum ram anymore, the value is not displayed in the config. Container fails to start with no error message. It was working fine in beta4.

Znevna · Tue Jun 28, 2022 6:37 am

Read previous comments.

DeviceLocksmith · Tue Jun 28, 2022 7:35 am

I am not using envs. It must be broken in multiple ways

Znevna · Tue Jun 28, 2022 7:38 am

Works fine here.

daaf · Tue Jun 28, 2022 8:48 am

The same thing happened to me on a hAP ac3, delete the containers, environments and mounts and start again, it works for me.

Container support is broken for me on arm64 after upgrade from beta4 to beta5. Mount configuration disappeared, as well as maximum ram. Cannot set maximum ram anymore, the value is not displayed in the config. Container fails to start with no error message. It was working fine in beta4.

Znevna · Tue Jun 28, 2022 8:57 am

Probably they changed too many stuff under the hood. Since the memory limit is gone, envlist changed syntax, they did something to the mounts to fix sudo (probably got rid of nosuid?) But this doesn't qualify as "broken in multiple ways", since it works just fine if you redo everything.
LE: nevermind, read below :D

daaf · Tue Jun 28, 2022 9:07 am

Yes, they have made many changes, it has not disappeared, it just does not save the configuration or show it by the terminal.

Containers.png

Probably they changed too many stuff under the hood. Since the memory limit is gone, envlist changed syntax, they did something to the mounts to fix sudo (probably got rid of nosuid?) But this doesn't qualify as "broken in multiple ways", since it works just fine if you redo everything.

Znevna · Tue Jun 28, 2022 9:12 am

Wait, did they silently fix pulling in the internal storage too? it gets pulled in whatever you specify as tmp-dir now?

daaf · Tue Jun 28, 2022 9:16 am

Yes, I already tried it and it worked.

Wait, did they silently fix pulling in the internal storage too? it gets pulled in whatever you specify as tmp-dir now?

owireless · Tue Jun 28, 2022 11:29 am

Hi, haven't followed updates for a while. Are there any plans to backport wwave2 features to currently unsupported AC devices?

anthonws · Tue Jun 28, 2022 1:27 pm

Mikrotik is the new Nintendo :D Masters in "Even More Stability" changelog!!!

Thanks Znevna for the detailed container fixes/changes list! Awesome work!

daaf · Tue Jun 28, 2022 2:56 pm

I share some scripts for the rapid deployment of a container, "container-module" must be run previously to load the global function to register the containers; the other scripts such as "container-pihole" contain the parameters to create the container, use them by the terminal to display the output.

https://github.com/dalejos/Mikrotik-Scr ... /container

Thanks! most of them, if not all, are findings by @daaf (thanks, again!), I can't take all the credits ^^. I've only put them in a list.

benlg · Tue Jun 28, 2022 3:42 pm

/interface/ethernet/switch/rule add switch=switch1 ports=ether8 new-vlan-priority=6
failure: new-vlan-priority not supported for this switch

Please support this on RB5009 (SUP-70924 opened accordingly, jan 2022).
Many thanks MikroTik dev team !

Tue Jun 28, 2022 4:26 pm

Mikrotik is the new Nintendo Masters in "Even More Stability" changelog!!!

Thanks Znevna for the detailed container fixes/changes list! Awesome work!

I hope you are kidding. A few years ago we had 3-4 lines in changelogs. This is more than ever.

dmfr · Tue Jun 28, 2022 4:49 pm

Code: Select all
/interface/ethernet/switch/rule add switch=switch1 ports=ether8 new-vlan-priority=6
failure: new-vlan-priority not supported for this switch
Please support this on RB5009 (SUP-70924 opened accordingly, jan 2022).
Many thanks MikroTik dev team !

Recently opened SUP-85256 to request the same.

Besides while Mikrotik is reading, there's a switch rule feature entirely missing compared to (any) other manufacturer,
It applies to all switch chip devices ie CRS3xx/5xxx, CCRs
While it is possible (if implemented) to set the COS (new-vlan-priority) when matching an ACL, there should be an option to change ip/ip6 dscp value (new-dscp ?) using hardware ACL rules as well.

Currently on routers, only option is /ip(v6)/firewall/mangle rules, breaking fasttrack.
There was on CCR1xx/2xx a dscp remapping section in qos, but it doesn't exists on CCR3xx/5xx and there is no substitute option.

I can agree that DSCP on public internet is mainly irrelevant, and that's why DSCP remapping is needed (ie. reset to dscp=0),
because we've seen on several carriers weird traffic behavior when pushing traffic dscp <> 0, especially dscp = 0x20.
And even on LAN scopes, there's a history of bugs/problems (vmware, openssh, legacy wireless appliances with WMM) related to DSCP..

pe1chl · Tue Jun 28, 2022 5:01 pm

I can agree that DSCP on public internet is mainly irrelevant, and that's why DSCP remapping is needed (ie. reset to dscp=0),
because we've seen on several carriers weird traffic behavior when pushing traffic dscp <> 0, especially dscp = 0x20.

I still have an open ticket for such an issue, and not yet found the time and courage to research it to the bottom.
What I found is that it probably is not "due to the carrier" but it is a bug somewhere in the ARM implementation of RouterOS or something in the switch chip config of the RB4011.
I need to reset DSCP to 0 on my outgoing traffic on my RB4011 (arm) or else some traffic gets dropped, however:
- when I copy the exact same config to my old RB2011 (mipsbe) it suddenly works fine!
- the first packet comes through OK, it is only the second and further packets that get dropped (hinting towards a connection tracking issue)

It is difficult for me to trace and debug the issue because there is always a lot of background traffic on my router, and also because I really want to trace the traffic coming out of the switchport, not some internal trace that may be leading me to the wrong path.

dmfr · Tue Jun 28, 2022 5:34 pm

It is difficult for me to trace and debug the issue because there is always a lot of background traffic on my router, and also because I really want to trace the traffic coming out of the switchport, not some internal trace that may be leading me to the wrong path.

Right it could be anything from the LAN to the upstream carrier.
We have/had a dozen RB4011 on various network positions (core/edge/access) and learned :

dscp != 0 do trigger slow traffic / packet drop / etc on several carriers
mangle rules (for setting dscp=0) is effective as long as connection is not fast-tracked
should you want to have both mangle dscp & fasttrack (for ipv4), you need to restrict fasttrack to connections > 20 kB + no-mark, examine the first 20kB (connection-bytes) through a first mangle rule to mark dscp!=0 conns not to be fasttracked

Back to the topic, RB4011 is unfortunately a dead-end because RTL8367 is very basic and never supports hardware rules.
However 88E6393X, and mainly CRS/CCR2x16's 98DXes could greatly benefit hardware new-dscp rule to "clean" forwarded traffic from upstream dscp side effects.

anav · Tue Jun 28, 2022 5:50 pm

I share some scripts for the rapid deployment of a container, "container-module" must be run previously to load the global function to register the containers; the other scripts such as "container-pihole" contain the parameters to create the container, use them by the terminal to display the output.

https://github.com/dalejos/Mikrotik-Scr ... /container
Thanks! most of them, if not all, are findings by @daaf (thanks, again!), I can't take all the credits ^^. I've only put them in a list.

Where is the docker container script for moviestar espana............ Nice work by the way. ( viewtopic.php?p=942346#p942346 )

@normis/strods ........ Will "TILE" receive containers or is that just an incompatible architecture altogether?

daaf · Tue Jun 28, 2022 7:00 pm

Do you have the link to download the container?

I share some scripts for the rapid deployment of a container, "container-module" must be run previously to load the global function to register the containers; the other scripts such as "container-pihole" contain the parameters to create the container, use them by the terminal to display the output.

https://github.com/dalejos/Mikrotik-Scr ... /container

Where is the docker container script for moviestar espana............ Nice work by the way. ( viewtopic.php?p=942346#p942346 )

@normis/strods ........ Will "TILE" receive containers or is that just an incompatible architecture altogether?

Znevna · Tue Jun 28, 2022 7:09 pm

@normis/strods ........ Will "TILE" receive containers or is that just an incompatible architecture altogether?

Let me spare you the trouble of using google.
Linux dropped TILE support in 4.17, because reasons.
Nobody builds dockers for TILE because docker doesn't support such a thing.
After you fix these two above you can ask MikroTik about it.
Oh yeah, and we have a similar topic right here on the forum viewtopic.php?t=179162
You didn't have to pollute the release topic with .. offtopic.
Cheers!

pe1chl · Tue Jun 28, 2022 7:15 pm

We have/had a dozen RB4011 on various network positions (core/edge/access) and learned :

dscp != 0 do trigger slow traffic / packet drop / etc on several carriers

Yes, I think it is a RB4011 problem. Hopefully I can one time pinpoint it enough for MikroTik to take actual action.
I always disable fasttrack as I use lots of advanced features of the router and do not want to waste my time with finding tricky fasttrack rules that work for me.
But unfortunately that made me switch from RB2011 to RB4011 to get more raw performance, and now (like you) I experience that DSCP issue, which disappears when plugging the old RB2011 back in (with the same config).
So it likely is not the carriers, it is the device itself.

owireless · Tue Jun 28, 2022 8:14 pm

Hi, haven't followed updates for a while. Are there any plans to backport wwave2 features to currently unsupported AC devices?
I think they should start by fixing wwave2 on supported products before porting it elsewhere.

Didn't know it was in such a sorry state. Non of my AC devices have enough storage to load the ww2 package so I can't even test. Why they ever started downgrading to those small storage I'll never know.

akw28888 · Wed Jun 29, 2022 1:39 am

The thing is that the wifiwave2 package contains drivers for multiple wireless chip families, and if always only the one needed for a particular RouterBoard model was installed, less disk space would be required. But Wave 2 also requires a lot of RAM to model the wireless environment, so RAM size below 128 MB is also disqualifying (as RouterOS itself also needs some RAM). So apart from some "lucky" series of hAP ac² that had 256 MB RAM, I'm not aware of any devices where the flash size alone would prevent Wave 2 from running.
Wifi2 package contains driver for only 2 wifi chip: IPQ4019 and QCA9984.

It requires 14Mb of additional space... further the space required for routeros (12Mb).
It's a pity that year ago, Mikrotik, did not choose to upgrade at least to 32Mb of nand.
I use a Chateau with an external AP (non mikrotik) to have better wifi performance.

I hope in future Routeros will have some trick to load/install driver on a USB storage ! I think this can be made...

螢幕擷取畫面 2022-06-29 061539.png

The wifiwave2 package contains Qualcomm's proprietary drivers from QSDK, and many firmwares lib.
But the package contains many unused firmware files.
They are not using IPQ5018, IPQ6018, IPQ8074, IPQ8074v2, all of them are WiFi6 SoCs.
Currently they don't have any WiFi 6 products, if removed them, it can save ~7.26MB.
For driver binaries, they can remove support for unused chipsets to reduce size.

Many other vendor's routers with IPQ4019 chipset only have 128MB RAM, but all of them are using QSDK drivers, I don't think 128MB RAM will have issue.
So I think it's possible to get wifiwave2 support on 16MB ROM / 128MB RAM devices.

But MikroTik prefers provide only one package for all devices...

Wed Jun 29, 2022 9:11 am

Container can run only containers that work on the CPU of this device. There are no containers that support TILE CPU, as far as I know.

pe1chl · Wed Jun 29, 2022 11:42 am

The wifiwave2 package contains Qualcomm's proprietary drivers from QSDK, and many firmwares lib.
But the package contains many unused firmware files.
They are not using IPQ5018, IPQ6018, IPQ8074, IPQ8074v2, all of them are WiFi6 SoCs.
Currently they don't have any WiFi 6 products, if removed them, it can save ~7.26MB.
For driver binaries, they can remove support for unused chipsets to reduce size.

Many other vendor's routers with IPQ4019 chipset only have 128MB RAM, but all of them are using QSDK drivers, I don't think 128MB RAM will have issue.
So I think it's possible to get wifiwave2 support on 16MB ROM / 128MB RAM devices.

On a hAP ac2 (a device like you specify) there is only 1.5MB of free space with a bare v7.4beta install. So no way there would be enough space for even a trimmed down wifiwave2 package, unless:
- significant space can be gained by omitting other things, like the standard wireless package, routing packages, and maybe other things home users do not use (which would require modularizing v7 again much like it was with v6)
- some way is found to store part of the install on a USB stick (preferably "data" related to the drivers, don't know if that is large, or at least things that are being read into RAM entirely and not demand-paged like executable code)

Maybe a specialized v7 build could be made for "use of hAP ac2 and similar devices with wave2 wifi and limited RouterOS functionality".

anav · Wed Jun 29, 2022 3:59 pm

Container can run only containers that work on the CPU of this device. There are no containers that support TILE CPU, as far as I know.

Thanks Normis! No worries, no expectations, just asking and understand nothing to do with RoS. :-)

Larsa · Wed Jun 29, 2022 4:04 pm

For strods, emils and normis:

Please on beta6, or any new version, start another topic.

Good suggestion!

Or possible even better (IMO) Github GitHub Issue Tracker, JIRA Public Bug Tracker or similar "public issue tracker"..

pe1chl · Wed Jun 29, 2022 4:11 pm

+1 (I hate the use of that, but in this case I think it is legitimate)
BTW: good news! An issue I reported back in 2021 and which on Oct 28, 2021 was marked as "Yes, a fix will be included in the next v6 testing release version", now finally has been marked with "your issue has been fixed. This means that in the upcoming days, we plan to release a RouterOS update with this fix". Hooray!
Now my fear is that this in the meantime will be a v7 testing release, and on the router where I had that issue I really cannot run v7 due to lack of BFD.
Oh well... at least I will test it on my home router.

infabo · Wed Jun 29, 2022 6:34 pm

As Mikrotik does not want to run an all public issue tracker, they should at least keep track of known issues and solutions (if any) on a dedicated forum topic or on their confluence (https://help.mikrotik.com/docs/).

Manjaro Linux does something similar, see https://forum.manjaro.org/t/stable-upda ... n/114857/2