MikroTik

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after some problem has appeared on device

What's new in 6.39.3 (2017-Oct-12 11:24):

*) arp - properly update dynamic ARP entries after interface related changes;
*) bonding - fixed 802.3ad mode on RB1100AHx4;
*) bonding - improved reliability on bonding interface removal;
*) console - fixed different command auto complete;
*) crs1xx/2xx - fixed 1 Gbps forced mode for several SFP modules;
*) crs317 - added L2MTU support;
*) crs3xx - improved packet processing in slowpath;
*) dhcp - fixed downgrade from RouterOS v6.41 or higher;
*) dhcpv4-server - fixed lease renew for DHCP clients that sends renewal with "ciaddr = 0.0.0.0";
*) dhcpv6-client - do not run DHCPv6 client when IPv6 package is disabled;
*) dhcpv6-client - fixed IA evaluation order;
*) dhcpv6-client - require pool name to be unique;
*) dhcpv6-server - do not release address of static binding from pool after server removal;
*) discovery - fixed timeouts for LLDP neighbours;
*) ethernet - fixed occasional broken interface order after reset/first boot;
*) ethernet - fixed rare linking problem with forced 10Mbps full-duplex mode;
*) export - fixed export for PoE-OUT related settings;
*) export - fixed wireless "ssid" and "supplicant-identity" compact export;
*) fasttrack - fixed fasttrack over interfaces with dynamic MAC address;
*) firewall - fixed bridge "action=log" rules;
*) firewall - fixed crash on fasttrack dummy rule manual change attempt;
*) firewall - properly remove "address-list" entry after timeout ends;
*) firewall - removed unique address list name limit;
*) hAP ac lite - removed nonexistent "wlan-led";
*) hotspot - improved user statistics collection process;
*) hotspot - require "dns-name" to contain "." symbol under Hotspot Server Profile configuration;
*) ike1 - fixed initiator ID comparison to NAT-OA;
*) interface - improved interface state change handling when multiple interfaces are affected at the same time;
*) ipsec - do not deduct "dst-address" from "sa-dst-address" for "/0" policies;
*) ipv6 - fixed IPv6 address request from pool;
*) metarouter - fixed display of bogus error message on startup;
*) ntp-client - properly start NTP client after reboot if manual server IP is not configured;
*) ovpn - added support for "push-continuation";
*) ovpn - added support for topology subnet for IP mode;
*) ovpn - fixed duplicate default gateway presence when receiving extra routes;
*) ovpn - improved performance when receiving too many options;
*) ping - fixed ping getting stuck (after several thousands of ping attempts);
*) ppp - fixed non-standart PAP or CHAP packet handling;
*) pppoe-client - fixed incorrectly formed PADT packet;
*) pppoe-client - fixed wrong MRU detection over VLAN interfaces;
*) proxy - fixed rare program crash after closing client connection;
*) quickset - fixed incorrect VPN address value on arm and tilera;
*) rb1100ahx4 - fixed HW acceleration fragmented packet decryption when fragment is smaller than 64 bytes;
*) rb1100ahx4 - fixed startup problems (requires additional reboot after upgrade);
*) rb2011 - fixed possible LCD blinking along with ethernet LED;
*) rb3011 - fixed packet passthrough on switch2 while booting;
*) rb922 - restored missing wireless interface on some boards;
*) safe-mode - fixed session handling when Safe Mode is used on multiple sessions at the same time;
*) sfp - fixed invalid temperature readings when ambient temperature is below 0C;
*) sfp - fixed OPTON module DDM information readings;
*) sfp - fixed temperature readings for various SFP modules;
*) sniffer - do not skip L2 packets when "all" interface mode was used;
*) snmp - fixed "/caps-man registration-table" uptime values;
*) snmp - fixed "/system license" parameters for CHR;
*) snmp - fixed "/system resource cpu print oid";
*) snmp - fixed crash on interface table get;
*) ssh - do not execute command if it starts with "-" symbol;
*) supout - fixed IPv6 firewall section;
*) switch - fixed multicast forwarding on CRS326;
*) tile - fixed copying large amount of text over serial console;
*) tile - improved reliability on MPLS package processing;
*) traffic-flow - fixed reboots when IPv6 address has been set as target address without active IPv6 package;
*) trafficgen - fixed "lost-ratio" showing incorrect statistics after multiple sequences;
*) userman - do not send disconnect request for user when "simultaneous session limit reached";
*) userman - fixed "limitation" and "profile-limitation" update;
*) userman - fixed CoA packet processing after changes in "/tool user-manager router" configuration;
*) userman - lookup language files also in "/flash" directory;
*) vlan - do not allow VLAN MTU to be higher than L2MTU;
*) vlan - do not delete existing VLAN interface on "failure: already have such vlan";
*) webfig - allow to unset "rate-limit" for DHCP leases;
*) webfig - fixed wireless "scan-list" parameter not being saved after applying changes;
*) webfig - improved reliability of login process;
*) winbox - added possibility to define "comment" for "/routing bgp network" entries;
*) winbox - added support for certificate CRL list;
*) winbox - do not show LCD menu for devices which does not have it;
*) winbox - fixed ARP table update after entry changes state to incomplete;
*) winbox - hide "level" and "tunnel" parameters for IPSec policy templates;
*) winbox - hide FAN speed if it is 0RPM;
*) winbox - make IPSec policies table an ordered list;
*) winbox - properly show "dhcp-server" warnings;
*) winbox - show "/interface wireless cap print" warnings;
*) winbox - show "/system health" only on boards that have health monitoring;
*) winbox - show "D" flag under "/interface mesh port" menu;
*) wireless - added "etsi1" and "russia3" regulatory domain information;
*) wireless - fixed compatibility with "AR5212" wireless chips;
*) wireless - improved WPA2 key exchange reliability;
*) wireless - updated "china", "norway" and "new-zealand" regulatory domain information;

Version 6.39.3 released due to fixes in WPA2 protocol:
viewtopic.php?f=21&t=126695&p=623324#p623324

tile - fixed IPSec hardware acceleration out-of-order packet problem, significantly improved performance

is this fix present in this bugfix version?

tile - fixed IPSec hardware acceleration out-of-order packet problem, significantly improved performance

is this fix present in this bugfix version?

If it was there, you would see it listed above.

tile - fixed IPSec hardware acceleration out-of-order packet problem, significantly improved performance

is this fix present in this bugfix version?

This has been fixed in the initial 6.39 release, so this particular release should be absolutely fine/safe to use on tile with HW-accelerated IPsec.

what do I need to know before i upgrade from 6.37.5 (bugfix) to this one?

is there a place where i can see the whole changelog from 6.37.5 (bugfix) to this one?

Here you can find it.
https://mikrotik.com/download/changelogs

is there a place where i can see the whole changelog from 6.37.5 (bugfix) to this one?

Unfortunately, you will have to read every changelog from the stable channel for 6.38, 6.38.1-6, 6.39, and 6.39.1-2, and then 6.39.3 from the bugfix channel. MIkrotik has been asked before to make changelogs that at the very least are complete from one bugfix to another, e.g. 6.38.7 to 6.39.3, but every time they have given offhand answers (see previous bugfix version topics).

tile - fixed IPSec hardware acceleration out-of-order packet problem, significantly improved performance

is this fix present in this bugfix version?

This has been fixed in the initial 6.39 release, so this particular release should be absolutely fine/safe to use on tile with HW-accelerated IPsec.

thanks
I thought so too, but wanted to be sure about it

Hello, I want to report that bug fix did't work :

*) led - fixed "on" and "off" triggers when multiple LEDs are selected;
*) led - fixed RB711UA ether1 LED (introduced in v6.38rc16);

Hi everybody,

Just to report that I updated some CAPs (1 x wAP, 2 x mAP Lites, 2 x hAP AC Lites, 1 x hAP Lite), a RB2011UiAS-2HnD which mainly operates as L2TP-Client and CAPsMAN and a RB750Gr3, which operates mainly as CAPsMAN, L2TP-Server and Dude Server.

So far everything working as expected.

Hey,

After upgrading to 6.39.3, I was not able to do a /system reset-configuration skip-backup=yes run-after-reset=config.rsc and have the router reload the configuration that is in the config.rsc. I had double checked the .rsc to make sure there are no errors. I can copy and paste the config into terminal and it works just fine.

This had worked before on 6.39.2 and previous ROS's.

Thanks!

Depends on the router model and all kinds of timing details. It has not been reliable for quite some time.
The "workaround" is to put a delay at the top of the rsc file.

Thanks!

I have never ran into this problem before across multiple different models. Adding the delay helped.

Thanks again!

After this upgrade, my router will not work anymore.
I have tried through console but he stays hanging.
5 led lights are burning from the Ethernet ports. The display shows Mikrotik, and then the router crashes. The router will freeze.
I have made a screenshot.
Someone who knows if the same thing came true?
Have somebody a solution?

Hi,

I would like to report a OVPN bug with this update. For some reason since the update, the OVPN client on the mikrotik has changed how it handles its dynamic IP assignment. See below.

I have ran into an issue with DHCP.

I have Xclaim Wireless access points and after the upgrade (ROS and Firmware) They will not receive an address. The DHCP server shows it offered the IP but the Xclaim will not accept the IP. Even after rebooting the Xclaim as well, it will not accept the IP address. This has happened on both hEX r2 and RB3011. Have not attempted to upgrade any other systems. Downgraded back to 6.39.2, no problems.

Thanks!

Update: 2017-10-26
Issue is not an issue. The default timeout setting when adding to a list from NAT is to never expire. This can be modified with a simple timeout -- ex., 00:30:00. Working as expected, now.

Original post: 2017-10-25
Still not properly removing entries from address-list after timeout.

I'm getting false errors messages on CPU and Memory clock speeds. At first they scared me but then I read from documentation that they are running at proper speeds. I did decide to 1 return upgraded device to the previous bugfix because of a new installation and didn't want to risk, that was more on the first few days of the current release. I no know it is just a false warning.

here are 2 different devices that have the errors I am talking about:


1) this is an older version of this board before a CPU upgrade on the current model

[---] /system routerboard> print
;;; Warning: cpu not running at default frequency
routerboard: yes
model: 912UAG-5HPnD
serial-number: 4A4602DFB7FB
firmware-type: ar9340
factory-firmware: 3.07
current-firmware: 3.41
upgrade-firmware: 3.41
[----] /system routerboard settings> print
;;; Warning: cpu not running at default frequency
init-delay: 0s
boot-device: nand-if-fail-then-ethernet
cpu-frequency: 400MHz
boot-protocol: bootp
force-backup-booter: no
silent-boot: no
[---] /system routerboard settings> / system resource print
uptime: 2d10h31m12s
version: 6.39.3 (bugfix)
build-time: Oct/12/2017 11:24:56
free-memory: 38.0MiB
total-memory: 64.0MiB
cpu: MIPS 74Kc V4.12
cpu-count: 1
cpu-frequency: 400MHz
cpu-load: 5%
free-hdd-space: 111.0MiB
total-hdd-space: 128.0MiB
write-sect-since-reboot: 8567
write-sect-total: 647224
bad-blocks: 0%
architecture-name: mipsbe
board-name: RB912UAG-5HPnD
platform: MikroTik




------------------------------------------------
2)
[---] > system routerboard settings print
boot-device: nand-if-fail-then-ethernet
cpu-frequency: 880MHz
memory-frequency: 1200DDR
boot-protocol: bootp
force-backup-booter: no
silent-boot: no
protected-routerboot: disabled
[---] > system resource print
uptime: 3m35s
version: 6.39.3 (bugfix)
build-time: Oct/12/2017 11:24:56
factory-software: 6.36.1
free-memory: 226.0MiB
total-memory: 256.0MiB
cpu: MIPS 1004Kc V2.15
cpu-count: 4
cpu-frequency: 880MHz
cpu-load: 0%
free-hdd-space: 7.7MiB
total-hdd-space: 16.0MiB
write-sect-since-reboot: 103
write-sect-total: 1993
bad-blocks: 0%
architecture-name: mmips
board-name: hEX
platform: MikroTik


[--] > export compact
|
| ***omitted part of config***
|
/system routerboard settings
# Warning: memory not running at default frequency
set memory-frequency=1200DDR

When connecting to a RouterOS device running 6.39.3 with Winbox 2.2.18, I am unable to enable/disable BGP peers with the buttons. Device is an OmniTIK U-5HnD. Winbox 3.11 works fine.

Some surprises after upgrading CCR (Tilera) to 6.39.3 bugfix:
- PPPoE server drops connections randomly
- "empty" Interfaces in Winbox, /interface print takes forever, "Unknown" all interfaces in Winbox (e.g. routing/ospf/interfaces) when router has multiple ospf adjacencies



Observed on multiple multi-core CCR-s (1016,1036)

We don't use PPPoE and I haven't seen the unknown interface issue on any of our CCRs, 1036s and 1009s. We have a few with multiple OSPF adjacencies.

When connecting to a RouterOS device running 6.39.3 with Winbox 2.2.18, I am unable to enable/disable BGP peers with the buttons. Device is an OmniTIK U-5HnD. Winbox 3.11 works fine.

What's new in 6.39 (2017-Apr-27 10:06):

!) winbox - minimal required version is v3.11;

I have a problem with address lists under the IPv4 firewall since upgrading to 6.39.3. This is on both an RB2011 and a hAP AC.

If I make an entry with a timeout it is deleted much sooner than it should be. Entries seem to last about 7 minutes for every 12 hours of timeout, or 14 minutes for 24 hours, and so on.

Has anyone else reported this?

What's new in 6.39 (2017-Apr-27 10:06):
!) winbox - minimal required version is v3.11;

I guess I missed that. Time to get used to Winbox 3.11 then

There is a bug in EOIP, following the wiki you don't need to set the mtu. It is suppose to default to 1500MTU. It doesn't, its randomly 1408 or 1458, this took a week to fix, as it was randomly breaking ssl sites

There is a bug in EOIP, following the wiki you don't need to set the mtu. It is suppose to default to 1500MTU. It doesn't, its randomly 1408 or 1458, this took a week to fix, as it was randomly breaking ssl sites

This is not a bug but a feature. It's not at all random.

If you don't explicitly set the MTU then it will automatically find out the best MTU by itself as to not cause fragmentation on the packets outside the tunnel.
EoIP adds 42 bytes of overhead. So getting an automatic MTU of 1458 is expected.
On the tunnel you get 1408, I assume it's over some other type of encapsulation (PPP or some other tunnel maybe) that lowers the MTU even further. It may be on the remote side that causes the lower MTU.

You can either force it to 1500 and have fragmentation (outside the tunnel) and subsequently lower performance over the tunnel, or change TCP MSS via mangle rules so that TCP connections take into account the lower MTU and not have the issues you described.
Unless you have a specific requirement to pass full 1500 byte packets over the tunnel I would suggest you go the TCP MSS clamping way as it can increase your performance.

In (not so) recent versions they've also added the 'Clam TCP MSS' option that should automatically do TCP MSS clamping but I haven't used it yet (thus I can't vouch for it) since I've already have had custom mangle rules in place for many years prior to this feature.

One release note: Upgrading older boards (such as 711s) to this release but not immediately updating the board firmware with a second reboot can lead to adverse behavior, such as the boards dropping off wireless connections for short periods for no apparent reason. This happened to us network-wide -- though we have the boards update their own firmware automatically, we don't have them reboot themselves. Usually this has no adverse consequences, but not this time. Updating the firmware and rebooting cures the problem.

scep-client, i belive it's mistake.

v.6.38.7
[igor@ccRBxx] /certificate> add-scep template=test scep-url="http://xx.xxx.xxx.xxx/scep/1"
invalid value for argument server:
invalid value for argument ip
invalid value for argument ip6

[igor@ccRBxx] /certificate> add-scep template=test scep-url="xx.xxx.xxx.xxx/scep/1""
OK!

v.6.39.3
[igor@ccRBxx] /certificate> add-scep template=test scep-url="http://xx.xxx.xxx.xxx/scep/1"
OK!
[igor@ccRBxx] /certificate> add-scep template=test scep-url="xx.xxx.xxx.xxx/scep/1""
Invalid!

on 6.39.3 true winbox it's not possible to enter correct url ( http:// )

Hi,

When adding a IP to an IP>firewall>address list with a timeout (say 4d 00:00:00) and adding a comment in 6.39.3, it drops off within 24hours (and not when the timeout is reached).
Doing the same in v6.38.7 it doesnt drop off and continues to count down till its timeout is reached.

I have tested on an RB1100Dx4_arm and CCR1036-12G-4S_tile, both do this.

anyone else notice this?

Hi,

When adding a IP to an IP>firewall>address list with a timeout (say 4d 00:00:00) and adding a comment in 6.39.3, it drops off within 24hours (and not when the timeout is reached).
Doing the same in v6.38.7 it doesnt drop off and continues to count down till its timeout is reached.

I have tested on an RB1100Dx4_arm and CCR1036-12G-4S_tile, both do this.

anyone else notice this?

Can confirm this, tested 2 ips with and without comment, they did disappear after around 2 hours even if the limit was 4d,
6.39.3

Hi,

When adding a IP to an IP>firewall>address list with a timeout (say 4d 00:00:00) and adding a comment in 6.39.3, it drops off within 24hours (and not when the timeout is reached).
Doing the same in v6.38.7 it doesnt drop off and continues to count down till its timeout is reached.

I have tested on an RB1100Dx4_arm and CCR1036-12G-4S_tile, both do this.

anyone else notice this?

Scroll up for my post from October 27th.

Bug on Layer 7 v6.40.4 on RB951G



as you can see on the screenshot its showing unknown on layer 7 tab which is supposed to be named "Files" but instead its showing "Streaming"
on previous version its working fine and now with the new update its unstable.
Hope theres a solution I am sorry for my bad english.

Thanks

Regards,
Winston

I have ran into an issue with DHCP.
I have Xclaim Wireless access points and after the upgrade (ROS and Firmware) They will not receive an address. The DHCP server shows it offered the IP but the Xclaim will not accept the IP. Even after rebooting the Xclaim as well, it will not accept the IP address. This has happened on both hEX r2 and RB3011. Have not attempted to upgrade any other systems. Downgraded back to 6.39.2, no problems.

I have same trouble after upgrade on "routeros-mipsbe-6.39.3.npk" - my old (unupgradable) tablet device with Android 4.0 can't get IP via dhcp4 mikrotik server. All ok after im downgrade on "routeros-mipsbe-6.38.7.npk".

I have a problem with address lists under the IPv4 firewall since upgrading to 6.39.3. This is on both an RB2011 and a hAP AC.

If I make an entry with a timeout it is deleted much sooner than it should be. Entries seem to last about 7 minutes for every 12 hours of timeout, or 14 minutes for 24 hours, and so on.

Has anyone else reported this?

I experience the same behaviour on a hEX (750G r3), that is: for entries I add manually through the webinterface. It seems that entries added by a firewall rule (e.g. action=add-src-to-address-list address-list-timeout=1d) timeout as expected.

Another nuisance in this release is in the DHCP-client script: $"gateway-address" remains empty. It works as expected in 6.40.5, but it would be nice if it could be fixed in the bugfix branch as well.

I have ran into an issue with DHCP.

I have Xclaim Wireless access points and after the upgrade (ROS and Firmware) They will not receive an address. The DHCP server shows it offered the IP but the Xclaim will not accept the IP.

DHCP is broken for me also. iOS, Android and Windows all report no DHCP server. Couldn't downgrade back to 6.38.7 so I went up to 6.40.5 and DHCP worked again.

I think there is a problem when exporting IPSec policies: SA src/dst address is not exported when tunnel = no

Is that normal?

Thanks.

In transport mode SA src/dst addresses are the same as src/dst, so SA addresses are not shown/exported

Good day,

is there any news on a bugfix version for the DHCP server issues reports for wireless devices,
and the Firewall Address list items not living out their time period?

In this release address list entry timeout option is broken! Entry is removed from address list randomly, but much more faster than specified amount of time

In this release address list entry timeout option is broken! Entry is removed from address list randomly, but much more faster than specified amount of time

many have raised this bug but no answer yet, perhaps it will be fixed in the next bugfix

In this release address list entry timeout option is broken! Entry is removed from address list randomly, but much more faster than specified amount of time

many have raised this bug but no answer yet, perhaps it will be fixed in the next bugfix

As of most comments on the forum have any one filed a ticket to support about it?

It is a known problem that already has been fixed in 6.40.5
I think it is more likely that 6.40.5 will become bugfix soon, than that there will be another 6.39 release.

I've come across a bug in the ssh rendering code for 6.39.3. This bug is happening in other areas of the terminal as well, but this is the first chance I've had to document it. As such, this particular area is /caps-man registration-table pr stats:

I've come across a bug in the ssh rendering code for 6.39.3.

So, what's the exact "bug"? Could you point it on the picture?

Hi
Upgraded rb2011 and a rb3011 from 6.36.4, so far so good. The quite frequent problems with igmp-proxy are remaining though. (Problems mean glitches and quite some iptv pictures / sound errors; I mean every one two or three minutes, not all the time, but my wife thinks it's very bad .
Are others seeing that too? (I tried changing my config, so only one ether IF is using the igmp-proxy instead of having it in a bridge, but seems sames)

Is there any other way/package/config I can use if I do not want to use igmp-proxy?

thanks

Version 6.40.6 has been released in bugfix channel:
viewtopic.php?f=21&t=131129