MikroTik

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

What's new in 6.35.4 (2016-Jun-09 12:02):

*) address-list - make "dynamic=yes" as read-only option;
*) bonding - fixed 802.3ad load balancing mode over tunnels ;
*) bonding - fixed bonding primary slave assignment for ovpn interfaces after startup;
*) bonding - fixed crash on RoMON traffic transmit;
*) dhcpv6 client - fixed ia lifetime validation when it is set by dhcpv6 client;
*) disk - added support for Plextor PX-G128M6e(A) SSD on CCR1072;
*) ethernet - fixed memory leak when setting interface without changing configuration;
*) firewall - do not show disabled=no in export;
*) health - fixed broken factory voltage calibration data for some hAP ac boards;
*) health - fixed incorrect voltage after reboot on RB2011UAS;
*) ipsec - fixed mode-config export;
*) ipsec - fixed route cache overflow when using ipsec with route cache disabled;
*) lte - use only creg result codes as network status indications;
*) ovpn - enable perfect forwarding secrecy support by default;
*) rb3011 - fixed port flapping on ether6-ether10;
*) rb3011 - fixed reset button functionality;
*) rb3011 - improved performance on high cpu usage;

Nice work Mikrotik team.   

One step closer to v7

As far as I know it is not possible to create dynamic rule by static command from console.
Though dynamic address-list entries are displayed after /ip firewall address-list print.

Sorry I just edited my original post.  Sure it is possible.

[dave@MikroTik] /ip firewall address-list> add list=compromised address=1.212.157.221 dynamic=yes timeout=172800
[dave@MikroTik] /ip firewall address-list>

RB2011, RB75, RB951 and Omnitik are behaving stable. Several VPN's, VLAN's etc....no problem.

This "enhancement" broke my scripts too. Mikrotik, as usual, broke compatibility in "current" version without thinking abount own customers.
Mikrotik never rollback "enhancements" like that.
P.S. Last time, if anyone ever asks me whether to buy equipment mikrotik I say - if you want to get the equipment, which fixes bugs in less than a working functional breaks - buy. Thanx, Mikrotik.

Model CCR1016-12S-1S+ (similar results on a  CCR1009)
Queue tree + mangle + some firewall rules, udp 1500 bytes, SEND, on a 10G DAC with max-limit=1000M
Queue disabled = ~1000Mbps
6.34.6 = ~823 Mbps
6.35.4 = ~725 Mbps
6.36rc28 = ~698 Mbps

As far as I know it is not possible to create dynamic rule by static command from console.
Though dynamic address-list entries are displayed after /ip firewall address-list print.

huh? All "load and block current bogus IP addresses on startup" scripts are useless now?? It makes no sense to save them to flash everytime...

As far as I know it is not possible to create dynamic rule by static command from console.
Though dynamic address-list entries are displayed after /ip firewall address-list print.

huh? All "load and block current bogus IP addresses on startup" scripts are useless now?? It makes no sense to save them to flash everytime...

In addition to the flash issue ... I have 27,000 address-list entries (country block, known threats, etc).  If they are imported as dynamic, they are not included in a configuration export.  If I can no longer have these as dynamic entries, my configuration export just grew by 27,000 lines!

I just can't understand the deliberate decision to take a configuration option away.  What is the specific problem this was intended to resolve?

Model CCR1016-12S-1S+ (similar results on a  CCR1009)
Queue tree + mangle + some firewall rules, udp 1500 bytes, SEND, on a 10G DAC with max-limit=1000M
Queue disabled = ~1000Mbps
6.34.6 = ~823 Mbps
6.35.4 = ~725 Mbps
6.36rc28 = ~698 Mbps

Please send your suppout.rif with your configuration to support@mikrotik.com we will test it. 

*) address-list - make "dynamic=yes" as read-only option;

What the f... ?? Why? Are you guys even thinking about impacts with such inappropriate decisions?

It does not work Simple Queues

It does not work Simple Queues

Disable fasttrack

RB750UP + APC UPS + UPS package

In Log, I get "USB UPS AC power off" when I unplug the ups from AC.  When I plug it back in, I get no log.  I used to get "USB UPS AC power on".  Afterward, when I unplug the ups from AC, I get no log.

After I recycle power on the RB750UP, the same thing happens.

Nice release on top of 6.35.  However, dynamic list to read only.. WTF??!

Anyone load 6.35 or the incremental updates on RB1100AHx2 devices?   I have had one online in production for 402 days current uptime....  Wanting to upgrade to latest rOS, but unsure if will break device. Currently on 6.20


 

Nice release on top of 6.35.  However, dynamic list to read only.. WTF??!

Anyone load 6.35 or the incremental updates on RB1100AHx2 devices?   I have had one online in production for 402 days current uptime....  Wanting to upgrade to latest rOS, but unsure if will break device. Currently on 6.20


 

Yesterday I upgraded a CCR1036 from 6.32 directly to 6.35.4 after ~300days uptime.
I had no issues whatsoever but I was very cautious and ready for the worst during the upgrade, so don't try it without taking precautions first (backups, a way to netinstall if it goes completely wrong, etc).

Good to know!  I will just 'buck up' and take the needed steps in precaution and load the update.  I want to take advantage of Fast Track and the ipsec enhancements.  6.20 has issues with SA-lifetimes and such.

@MikroTik team

does 6.35.4 make RB3011 (Arm CPU) completely stable and ready for production environment? I'd like to start using this for customers.

Good to know!  I will just 'buck up' and take the needed steps in precaution and load the update.  I want to take advantage of Fast Track and the ipsec enhancements.  6.20 has issues with SA-lifetimes and such.

@MikroTik team

does 6.35.4 make RB3011 (Arm CPU) completely stable and ready for production environment? I'd like to start using this for customers.

As a General note for equipment in critical PRODUCTION ENVIRNOMENT, I would normally recommend to use the most stable ROS version wich has had most testing wich is the at any time available: "BUGFIX ONLY" ROS version.
Other then that, I find the above advise good! As long as you are prepeard to tackle the consequenses and possible bugs of using the "CURRENT" tree versions of ROS, you should be fine.
And you already did the most important preparation! You asked others for their feedback before you innstalled it! That most often gives you a pointer to wheter or not it is safe to use the mentioned versions. But also always remember, there probably hardly is 2 identical configurations out there, so even if it worked fine on some one elses system, that might still not be true for your system depending on how your configuratin is!
I know this probably sounded a bit pessimistic, but this was not my intention! Only trying to give some advice of best practises regarding upgrades og ROS, Especially over several versions!
Cheers, wish you a wonderful weekend! (PS: Fridays are always a bad day to do ANY big changes in networks like ROS upgrade. If the shit hits the fan, you might get whole weekend ruined! lol Just another little tip most network guys prob have had the "pleasure" of experiencing! hehehe).

@Basdno

Thank you for the insight!  You're absolutely spot on, and no offense taken.  Definitely not planning the upgrade for a Friday!  Thinking I'll apply Monday or Tuesday evening (patch tuesday, bahaha!)
I'll be sure to post back of any issues and or success with the upgrade on our production RB1100ahx2 device.   402 days uptime as we speak...

hi guys
problem is when i reboot RouterOS form winbox all of my routes (which has mark routing ) does not work the same problem as 6.35.1
the solution is shutdown then turn it on again
there is no problem in  6.34.6


in this pic 2 routes which has "nofilter" mark must work  but they dont

My IPSEC policies keep changing to back to SA Src/Dst 0.0.0.0/0 anytime I log off or reboot.

hi guys
problem is when i reboot RouterOS form winbox all of my routes (which has mark routing ) does not work the same problem as 6.35.1
the solution is shutdown then turn it on again
there is no problem in  6.34.6


in this pic 2 routes which has "nofilter" mark must work  but they dont

UP
UP
UP
no one answer?

Hello,

It seems that /logs entry are UTC whatever the Time Zone is:

I suppose it was solved in 6.35.2
Is it the newly expected behavior or a real bug?

Regards

hi guys
problem is when i reboot RouterOS form winbox all of my routes (which has mark routing ) does not work the same problem as 6.35.1
the solution is shutdown then turn it on again
there is no problem in  6.34.6


in this pic 2 routes which has "nofilter" mark must work  but they dont

Please send your suppout.rif with your configuration and more detailed description  to support@mikrotik.com we will test it. 

In 6.35.4 (and 6.35.2) the oid for temperature and cpu temperature are not working as monitored by the Dude.

I have a CCR1009-8G-1S-1S+   (with the heatsink type of cooling)  monted in a fan cooled L-Com box outdoors.
It keeps crashing and the only thing I can suspect right now is temperature.
6 minutes after the last crash the temperature of the router was 52 and the cpu was 66.  Not really sure if that is high enough to cause problems.

To help diagnose this, I need the Temperature oids to work properly.
Does anyone have any evidence they they work at all?

RB750UP + APC UPS + UPS package

In Log, I get "USB UPS AC power off" when I unplug the ups from AC.  When I plug it back in, I get no log.  I used to get "USB UPS AC power on".  Afterward, when I unplug the ups from AC, I get no log.

After I recycle power on the RB750UP, the same thing happens.

I rolled back to version 6.35.2, same issue.

There is an issue with GRE links in 6.35.4. Pings went crazy, the IP connection didn't work with the primary IP on the router, I had to use the secondary, bandwidth was unreliable, fast at one moment, slow at another.

Downgraded both sides to 6.34.6 and everything is working like a champ, just as it was before upgrading to 6.35.4. Pretty sure 6.35.2 worked fine. Whatever version I was running before the upgrade worked fine.

Hello,

After upgrading the router with OS v6.35.4,  i'm facing the issue with Radius.
I configured my router for hotspot and then i configured USERMAN.
When i created users in Mikrotik hotspot, it is working.
But the users are created in userman, for it showing me the erroe of radius is not responding. I don't know what's wrong it's any bug in new version.
Because i did the configuration 7-8 times but same error i'm getting..
Please advice...

Hello!
Excuse me for my English.
I'm using CCR1009-8G-1S-1S+. It is configured CAPsMAN v2. Connected 129 points hap ac lite. Recently updated CCR1009-8G-1S-1S+ to v6.35.4, after that there was a problem point, occasionally, of crystals becoming inactive, then the work was restored. I did downgrade to 6.35.2 - began to work normally. 

Updated RB750UP from 6.35.2 to 6.35.4 this night. Got some white hairs...
This device itself has rebooted fine... but not all PoE-powered by it.
Thus, Ubiquiti NanoBridge M2 and NanoStation M2 "auto on" PoE-ed OK.
But -- Mikrotik RB2011UAS-2HnD-IN was dead (the same current ROS version, updated some days before). Ethernet port was not connected, PoE status was "short circuit".
Blinking interface did not help, as Disable/Enable, Power Cycle (5s), etc. Only setting PoE Out to "forced on" made powered RB2011 live again. Why does not work "auto on" option now?
_{P.S. Firmware all the last version too.}

Updated RB750UP from 6.35.2 to 6.35.4 this night. Got some white hairs...
This device itself has rebooted fine... but not all PoE-powered by it.
Thus, Ubiquiti NanoBridge M2 and NanoStation M2 "auto on" PoE-ed OK.
But -- Mikrotik RB2011UAS-2HnD-IN was dead (the same current ROS version, updated some days before). Ethernet port was not connected, PoE status was "short circuit".
Blinking interface did not help, as Disable/Enable, Power Cycle (5s), etc. Only setting PoE Out to "forced on" made powered RB2011 live again. Why does not work "auto on" option now?
_{P.S. Firmware all the last version too.}

Attached to my RB750UP are RB250GS, RBwAP2nD, and RB411AH.  I have to "force on" my RBwAP2nD since it draws little current, around 7 mA at rest.  When I measure the power usage with and without the RBwAP2nD, the different is over 1 watt.  I think there is a bug.

Hello All,

I upgraded CRS112-8G-4S-IN to 6.53.4 but i could not install dude server npk. Why? Could anyone help me?

I upgraded CRS112-8G-4S-IN to 6.53.4 but i could not install dude server npk. Why?

Because the Dude server is not supported on MIPSBE platforms.

I upgraded CRS112-8G-4S-IN to 6.53.4 but i could not install dude server npk. Why?

Because the Dude server is not supported on MIPSBE platforms.

Thank you for your help! Could you help me Which type of switches are supported? I could not find that!

Could you help me Which type of switches are supported?

None. The Dude server is only supported on TILE (CCR series), ARM (RB3011) and x86. It's all clearly indicated on the download page.

This "enhancement" broke my scripts too. Mikrotik, as usual, broke compatibility in "current" version without thinking abount own customers.
Mikrotik never rollback "enhancements" like that.
P.S. Last time, if anyone ever asks me whether to buy equipment mikrotik I say - if you want to get the equipment, which fixes bugs in less than a working functional breaks - buy. Thanx, Mikrotik.

dito for the removed possibility to change a dynamic simple queue all in a sudden. 
This killed Mikrotik as PPPoE Concentrators for me for a range of customers.

It does not work Simple Queues

Disable fasttrack

I found the cause for this:
Winbox sometimes automatically added the Target-Device a second time, in my case the bridge-internal.
This did not work. Removing the second occurance of "bridge-internal" brought back simple queues.
@Mikrotik: Please correct Winbox here!!

Hello,

with 6.35.4 user reported bad wifi.. I saw high latency, ICMP losses, low throughput myself.
Within the log I found (too)many: "disconnected, max key exchange retries" setup is with CAPSMAN + wireless-rep + traffic forwarding@ CAPSMAN + WAP AC

I went back to 6.35.2: Connections are normal: low latency, good throughput, no ICMP losses.

Btw, CAPSMAN really needs a working downgrade option. I had to downgrade each access point step by step...

Having a consistent issue with RB450G running this version where routes that are using routing marks will become inactive, and the only way to make the route active again is to reboot router.

Downgrading to v34.6 fixes this issue so it appears to be related to this specific version.

Does 6.35.4 fix the issue on RB2011 devices? There was a bug noted on version 6.34.6 with the 2nd switch group.

Is that fixed in this release?

Hello,
I wrote to Normis.

On another forum you wrote.

"IGMP snooping development will not be sped up if one person will register many forum accounts and post the same request over and over again"
"IGMP snooping is currently not in development and we have no plans to make it in near future.
Your voices have been heard, no need to make more topics about it. If such feature will be considered, it will be for RouterOS 7 not sooner"


This is not true!!
Many millions of people are waiting for IGMP.
And no one who writes in many places.
 
I am a TV operator in Poland wait many years of hope and nothing.
You close discussions silencing people who request it.
All my comments on a forum about IGMP you deleted.
Very many operators asking for Igmp not the only one !!
One of the most important things for mikrotik IGMP and PIM new

You delete forum posts,
You close the discussions,
You laugh with these requests.
Why??

Hello,
I wrote to Normis.

On another forum you wrote.

"IGMP snooping development will not be sped up if one person will register many forum accounts and post the same request over and over again"
"IGMP snooping is currently not in development and we have no plans to make it in near future.
Your voices have been heard, no need to make more topics about it. If such feature will be considered, it will be for RouterOS 7 not sooner"


This is not true!!
Many millions of people are waiting for IGMP.
And no one who writes in many places.
 
I am a TV operator in Poland wait many years of hope and nothing.
You close discussions silencing people who request it.
All my comments on a forum about IGMP you deleted.
Very many operators asking for Igmp not the only one !!
One of the most important things for mikrotik IGMP and PIM new

You delete forum posts,
You close the discussions,
You laugh with these requests.
Why??

I seem to remember a similar description about a TV operator in Poland. Although the account name was different strange indeed. Also I cannot locate Normis' Post?

I think some 30% of the posts on these IGMP snooping threads are the same person. The admins can clearly see it. So sad. 
I did say repeatedly that spam on the forum will not speed up anything. Developers will not type any faster. 

Hi,
after update to 6.35.4 from 6.32 my two ccr1036, don't work script in netwatch, I have problem with disable/enable firewall rules.
Someone has a similar problem?
thx

Does 6.35.4 fix the issue on RB2011 devices? There was a bug noted on version 6.34.6 with the 2nd switch group.
Is that fixed in this release?

fixed in in RC brunch (starting v6.36rc39) only

Hello,
I wrote to Normis.

On another forum you wrote.

"IGMP snooping development will not be sped up if one person will register many forum accounts and post the same request over and over again"
"IGMP snooping is currently not in development and we have no plans to make it in near future.
Your voices have been heard, no need to make more topics about it. If such feature will be considered, it will be for RouterOS 7 not sooner"


This is not true!!
Many millions of people are waiting for IGMP.
And no one who writes in many places.
 
I am a TV operator in Poland wait many years of hope and nothing.
You close discussions silencing people who request it.
All my comments on a forum about IGMP you deleted.
Very many operators asking for Igmp not the only one !!
One of the most important things for mikrotik IGMP and PIM new

You delete forum posts,
You close the discussions,
You laugh with these requests.
Why??

I seem to remember a similar description about a TV operator in Poland. Although the account name was different strange indeed. Also I cannot locate Normis' Post?

Hello Genkun,
This is Normis Post: http://forum.mikrotik.com/viewtopic.php ... mp#p544800

We run v6.35.1 in a virtual environment (CH) and it only has usermanager running (this virtual CH).
Would there already be any differences between v6.35.4 and v6.35.1? 
In the changelog I don't see any changes that have anything to do with usermanager?

I think some 30% of the posts on these IGMP snooping threads are the same person. The admins can clearly see it. So sad. 
I did say repeatedly that spam on the forum will not speed up anything. Developers will not type any faster. 

Hey I should be verified different person, and I could really use IGMP snooping in routerOS. My ISP is bombarding my 951-2n with multicast traffic and causing me a lot of issues. I've used a mAP in between the switch and my router to just filter out the multicast traffic, but if I could just just put a routerboard in that had IGMP snooping, I could have much more control over my network.
On the topic though, I've also had issues with frequent wireless disconnects where clients will not be able to connect to the AP until the wireless interface is turned off and on again. Downgrading to 6.34.6 has resolved the issue. 

Why, please explain us why is the dynamic addres-list option read-only now? All scripts broken. Need to rollback. And no workaround nor alternatives, how should it be done in order to keep big address lists dynamic without flash writing?

Why, please explain us why is the dynamic addres-list option read-only now? All scripts broken. Need to rollback. And no workaround nor alternatives, how should it be done in order to keep big address lists dynamic without flash writing?

Ya, I fought this for a while since it broke all my scripts, too.  You can omit "dynamic=yes" (the command isn't even available anymore) and just include "timeout=xxxx" and it will work just fine.  The address-list entries will continue to be dynamic.

I had an exchange with support over this.  My take is that some users were using "dynamic=yes" and not specifying a timeout.  I never tried to see if this would even take.

I think this was handled very poorly by MT.  To just eliminate an existing command with no explanation was not in anybody's best interest.  Why not just have a check where if dynamic=yes was entered, it had to be followed by timeout=xxxxx, if it wasn't there then command string would be rejected.  Much better solution than breaking people's stuff.

Version 6.36 [current] has been released:
http://forum.mikrotik.com/viewtopic.php ... 88#p548188