MikroTik

!) radius - use MS-CHAPv2 for "login" service authentication;

*) fetch - added "as-value" output format;

/tool fetch mode=https host="mikrotik.com" url="https://mikrotik.com/aboutus" output=user as-value

info fetch: file "aboutus" downloaded

Hardware accelerated IPsec for 3011 is not included in this release. Unfortunately, we could not get it working stable enough in time. It will be available in 6.44.

Interface speeds seem to be set explicitly after upgrading, is this related to the SNMP speed report changelog entry? I haven't tried connecting an interface at other speeds yet, but can I assume that this setting, while a part of /export, will change accordingly?

Hardware accelerated IPsec for 3011 is not included in this release. Unfortunately, we could not get it working stable enough in time. It will be available in 6.44.

*) fetch - added "as-value" output format;

Assuming this is still the same functionality as described at https://wiki.mikrotik.com/wiki/Manual:T ... a_variable , I am surprised to find that when I do this:

Code: Select all

/tool fetch mode=https host="mikrotik.com" url="https://mikrotik.com/aboutus" output=user as-value

I still receive a log line which reads

Code: Select all

info fetch: file "aboutus" downloaded

even though no file appears to have been downloaded (and of course, I don't want it to be). Is this correct?

:put ([ /tool fetch url="https://www.eworm.de/ip/" output=user as-value ]->"data")

:global result;
:set result ([ /tool fetch url="https://www.eworm.de/ip/" output=user as-value ]->"data");
:put $result;

Found a LOG problem with an IPv6 DHCP-CLIENT. The log says there was an error adding the dynamic prefix pool, but it actually is created correctly. Cosmetic problem?

Code: Select all

dhcp,error failed to add ipv6 pool MYPOOL: ok

dhcp,error failed to add ipv6 pool rogers-ipv6: ok

Interface speeds seem to be set explicitly after upgrading, is this related to the SNMP speed report changelog entry? I haven't tried connecting an interface at other speeds yet, but can I assume that this setting, while a part of /export, will change accordingly?

Code: Select all

  /interface ethernet
- set [ find default-name=ether1 ] l2mtu=1582 name=ether1-gateway
- set [ find default-name=ether2 ] comment=node2
- set [ find default-name=ether3 ] comment=node3
- set [ find default-name=ether4 ] comment=node4
- set [ find default-name=ether5 ] comment=node5
+ set [ find default-name=ether1 ] l2mtu=1582 name=ether1-gateway speed=100Mbps
+ set [ find default-name=ether2 ] comment=node2 speed=100Mbps
+ set [ find default-name=ether3 ] comment=node3 speed=100Mbps
+ set [ find default-name=ether4 ] comment=node4 speed=100Mbps
+ set [ find default-name=ether5 ] comment=node5 speed=100Mbps

/interface ethernet print default-config detail

[...] Since the speed setting does not take effect when "auto-negotiation=yes", [...]

This cosmetic issue can be manually fixed by setting new values of "speed" according to v6.43 defaults:

Code: Select all

/interface ethernet print default-config detail

[admin@MikroTik] > /interface ethernet print default-config detail
expected end of command (line 1 column 27)

Upgraded about 7 devices but stopped further upgrading because I can't connect to my hEX any more - user/pass for admin not accepted any more... I can login by ssh-key. I see vptihart also had issues with winbox connectivity.

So be very careful with this upgrade, you may lock yourself out of your device !!

This cosmetic issue can be manually fixed by setting new values of "speed" according to v6.43 defaults:

Code: Select all

/interface ethernet print default-config detail

Code: Select all

[admin@MikroTik] > /interface ethernet print default-config detail
expected end of command (line 1 column 27)

/interface ethernet 
 /interface ethernet>export
# sep/10/2018 17:58:41 by RouterOS 6.42.7
# software id = TX5S-MT3T
#
# model = RouterBOARD 952Ui-5ac2nD
# serial number = XYZWXYZWXYZW
/interface ethernet
set [ find default-name=ether5 ] poe-out=off

 /interface ethernet> set [ find default-name=ether1 ] speed=
1Gbps  10Gbps  10Mbps  100Mbps

 /interface ethernet> print detail
Flags: X - disabled, R - running, S - slave
 0 R  name="ether1" default-name="ether1" mtu=1500 l2mtu=1598
      mac-address=6C:3B:6B:97:25:6F orig-mac-address=6C:3B:6B:97:25:6F
      arp=enabled arp-timeout=auto loop-protect=default
      loop-protect-status=off loop-protect-send-interval=5s
      loop-protect-disable-time=5m auto-negotiation=yes
      advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
      full-duplex=yes tx-flow-control=off rx-flow-control=off speed=100Mbps
      bandwidth=unlimited/unlimited switch=switch1
      
 /interface ethernet> set [ find default-name=ether1 ] speed=1Gbps
 /interface ethernet> export
# sep/10/2018 18:00:21 by RouterOS 6.42.7
# software id = TX5S-MT3T
#
# model = RouterBOARD 952Ui-5ac2nD
# serial number = XYZWXYZWXYZW
/interface ethernet
set [ find default-name=ether1 ] speed=1Gbps
set [ find default-name=ether5 ] poe-out=off

 /interface ethernet> print detail
Flags: X - disabled, R - running, S - slave
 0 R  name="ether1" default-name="ether1" mtu=1500 l2mtu=1598
      mac-address=6C:3B:6B:97:25:6F orig-mac-address=6C:3B:6B:97:25:6F
      arp=enabled arp-timeout=auto loop-protect=default
      loop-protect-status=off loop-protect-send-interval=5s
      loop-protect-disable-time=5m auto-negotiation=yes
      advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
      full-duplex=yes tx-flow-control=off rx-flow-control=off speed=1Gbps
      bandwidth=unlimited/unlimited switch=switch1

After updating on all my devices I see such a picture.
download/file.php?mode=view&id=33580 download/file.php?mode=view&id=33579

After updating on all my devices I see such a picture.
download/file.php?mode=view&id=33580 download/file.php?mode=view&id=33579

After `6.42.7` -> `6.43` and `/system routerboard upgrade`, login into the box doesn't accept the password anymore. Winbox: `wrong username or password`, ssh: keeps asking for password again and again. Lucky me having a ssh-key there.

It's `RB SXT G-5HPacD`, firmware-type: qca9550, factory-firmware: 3.14, current-firmware: 6.43, upgrade-firmware: 6.43. Using winbox 3.16.

Should anyone want supout.rif, email me.

Edit: Running `/ip ssh set always-allow-password-login=yes` after upgrade to 6.43 restores SSH password login. Winbox password login fails still.

Edit2:
Set the password to the same as before (/user set admin password=password1) -> winbox: `wrong username or password`
Set new password (/user set admin password=password2) -> winbox: login works again
Reset to the original pre-upgrade password (/user set admin password=password1) -> winbox: login still works.

10G on CCR1009 ethernet port? cosmetic issue?

Hardware accelerated IPsec for 3011 is not included in this release. Unfortunately, we could not get it working stable enough in time. It will be available in 6.44.

I don't think you should release that summer intern from the basement until they have it working properly.

10G on CCR1009 ethernet port? cosmetic issue?

Hi, I've found issue in 6.43 when creating/editing new user via web interface.

SXT LTE (1st gen):

1) On device startup it does not populate the route list correctly (does not add the LTE interface subnet in the route list). Have to disable/enable interface after startup so it would work correctly.
2) Passthrough interface option now showing in the LTE APN's section. Does it work now, or 6.43 does not check the device model?

Thank you,

Resnais

Hello,

We just upgrade two CHR on AWS to last version of RouterOS and now we are not able to login.
Winbox: wrong username or password
SSH: Access denied

Any advice?

Regards.

Hello,

We just upgrade two CHR on AWS to last version of RouterOS and now we are not able to login.
Winbox: wrong username or password
SSH: Access denied

Any advice?

*) ssh - disconnect all active connections when device gets rebooted or turned off;

Both of the CCR have other L2TP/Ipsec tunnels to other sites and they dont have that problem..

Hello,

We just upgrade two CHR on AWS to last version of RouterOS and now we are not able to login.
Winbox: wrong username or password
SSH: Access denied

Any advice?

mac telnet a web access works for me

We tried Mac telnet and same issue. Does anyone know if we hard reset device will it clear the backups stored on device?

We tried Mac telnet and same issue. Does anyone know if we hard reset device will it clear the backups stored on device?

We tried Mac telnet and same issue. Does anyone know if we hard reset device will it clear the backups stored on device?

It depends on the version which was there before and how you have stored the backups. Since 6.? (sorry, I don't know exactly), you have to use a file name starting with flash/ to have that file stored permanently, otherwise it ends up on the ramdisk partition. So if you did so, you can be sure the backup file survives the restoration of default configuration; if you didn't, it still may survive if the upgrade process took into account this approach change but I'm far from sure here.

After upgrade from 6.42.7 to 6.43, the L2TP/IPSec VPN between ROS and Draytek Vigor 2920 broken.
It showed failed to get valid proposal and failed to pre-process ph1 packet(side:1, status 1)
Downgrade to 6.42.7 and it worked as usual.

After upgrade from 6.42.7 to 6.43, the L2TP/IPSec VPN between ROS and Draytek Vigor 2920 broken.
It showed failed to get valid proposal and failed to pre-process ph1 packet(side:1, status 1)
Downgrade to 6.42.7 and it worked as usual.

We have a huge memory leak on the new 6.43 code running on our CRS317's. Some devices seem to be more affected than others, but within 10hrs the device reboots due to low memory.

We have a huge memory leak on the new 6.43 code running on our CRS317's. Some devices seem to be more affected than others, but within 10hrs the device reboots due to low memory.

I encountered the same problem on a CCR while it was still rc. MT Support was unable to reproduce / fix it.
Only a netinstall solved it for me. I could restore the old config without further problems, though.

I'm pleasantly surprised to see that we were unaffected by the authentication changes. We use centralised RADIUS authentication to Active Directory and associate AD security group membership to RouterOS user group permissions. Winbox, SSH and local authentication continues to work...

We have a huge memory leak on the new 6.43 code running on our CRS317's. Some devices seem to be more affected than others, but within 10hrs the device reboots due to low memory.

I have now noticed that my CRS125-24G-1S-2HnD is running out of memory, with 6.43.7 it ran around 95MB of free memory, with 6.43 it was down to 34MB free, over night it is now down to 31MB free. Good thing it don't have too much traffic going though this as multiple people are reporting reboots. Attached is a graph showing it slowly increase usage of memory.

Windows AD should be ok since MS-CHAPv2 is a Microsoft invention - and being that, not really secure. The reasons for breaking compatibility with non-MS 2FA products are not clear to me, in any case PAP/CHAP requests can still be tunneled via IPSEC etc to ensure security ...

Found a LOG problem with an IPv6 DHCP-CLIENT. The log says there was an error adding the dynamic prefix pool, but it actually is created correctly. Cosmetic problem?

Code: Select all

dhcp,error failed to add ipv6 pool MYPOOL: ok

.....
.......
Yes, I have a similar issue:with the current release 6.43

Code: Select all

dhcp,error failed to add ipv6 pool rogers-ipv6: ok

but it actually is created correctly.

I sent 3 support output files 90%, 98% and then after the reboot 5%... at 98% the system was trying to swap as the SPI process ran at 100% on 1 CPU. I have a change at 3am to downgrade the switches back to 6.42.7 and hope the VLANs work with some of our providers.

Found a LOG problem with an IPv6 DHCP-CLIENT. The log says there was an error adding the dynamic prefix pool, but it actually is created correctly. Cosmetic problem?

Code: Select all

dhcp,error failed to add ipv6 pool MYPOOL: ok

.....
.......
Yes, I have a similar issue:with the current release 6.43

Code: Select all

dhcp,error failed to add ipv6 pool rogers-ipv6: ok

but it actually is created correctly.

Same here!

DHCPv6 error log message is a cosmetic issue which also will be fixed soon. This error actually tells that there is no error.

admin password after upgrade EMPTY.

*) bridge - improved performance when bridge VLAN filtering is used without hardware offloading;

So bad you cannot use switch chip together with bridges anymore

*) winbox - fixed "sfp-connector-type" value presence under "Interface/Ethernet";

L2TP/IPsec works properly for me on 6.42.7 and 6.43, must be something specific to your configuration or network. Have you sent a supout.rif file to support@mikrotik.com?

After updating CCR1009 to 6.43 there is a problem with port stability! Has anyone else encountered such a problem?

I updated my hAP ac^2 from 6.42.7 and upgraded firmware
after update my cpu usage rise from 2% to 30% and dhcp stopped working. export also hang out after /interface wireless. reboots doesn't helps. Downgraded to 6.42.7 now is working fine again.
I updated it again with same result.

So bad you cannot use switch chip together with bridges anymore

You can definitely use VLANs in "hybrid" mode ... do the VLAN filtering on switch chip (/interface ethernet switch) and "new bridge" (without using bridge vlan functionality) with individual ports as members.

Regarding low speed: I suspect your configuration is not optimal. I conducted some tests using VLANs on bridge (SW implementation) and I could achieve wire speed for port-to-port transfers (without any filtering) while CPU utilization was around 30% of a single core (8% overall CPU utilization).

After updating CCR1009 to 6.43 there is a problem with port stability! Has anyone else encountered such a problem?

"DHCPv6 PD Pool (PPP Profile) not work anymore."
i'v got this problem too.
When connection established, dinamic DHCPv6 server creating, but client not get address from pool.

You can definitely use VLANs in "hybrid" mode ... do the VLAN filtering on switch chip (/interface ethernet switch) and "new bridge" (without using bridge vlan functionality) with individual ports as members.

Not sure if I understand you correctly - using bridge with hw offloading, then bridging vlan interfaces of 'switch bridge' to new plain bridges? I am using this config on my rb2011, but I thought it is blacklisted by Mikrotik?!?

Regarding low speed: I suspect your configuration is not optimal. I conducted some tests using VLANs on bridge (SW implementation) and I could achieve wire speed for port-to-port transfers (without any filtering) while CPU utilization was around 30% of a single core (8% overall CPU utilization).

Not sure if we are talking about the same here - I am doing real world tests with tcp and smb reaching 114MB/s when switching or bridging, but I need the filtering. So at the moment you turn on IP filtering with some rules present, performance breaks down to ~50% while cpu on hap ac2 is maxed out. Using VLAN aware bridges is even worse.

WinPC <-- access port with PVID=42 --> RBD52G <-- trunk port --> RB951G <-- access port with PVID=42 --> LinPC

bridge - add dynamic CAP interface to tagged ports if "vlan-mode=use-tag" is enabled;

Great work MT team!

I was wondering if you could elaborate on the dynamic vlan function? I can see that the Caps interfaces are included in the bridge and that the active interfaces are tagged in the dynamic vlan entry for PVID 1. I would expect that the dynamic caps interfaces are dynamically added to all the bridge vlan entries. I have also tried to add the Capsman interfaces in their own interface list. However the newly created interface list woith all the dynamic caps interfaces can not be selected in the bridge vlan entry.

Below the config for my test setup on 6.43

Code: Select all

/interface bridge
add fast-forward=no name=Lo0 protocol-mode=none
add fast-forward=no name=bridge protocol-mode=none vlan-filtering=yes
/interface bridge port
add bridge=bridge interface=ether1
add bridge=bridge interface=ether2 pvid=666
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
/interface bridge settings
set allow-fast-path=no
/interface bridge vlan
add bridge=bridge tagged=bridge,ether1 untagged=ether2 vlan-ids=666
add bridge=bridge tagged=bridge,ether1 vlan-ids=200
add bridge=bridge tagged=bridge,ether4,ether5 vlan-ids=10,20,30,667

/caps-man datapath
add bridge=bridge client-to-client-forwarding=yes local-forwarding=no name=vl10-data vlan-id=10 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes local-forwarding=no name=vl20-data vlan-id=20 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes local-forwarding=no name=vl30-data vlan-id=30 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes local-forwarding=no name=radius-data vlan-mode=use-tag
/caps-man security
add authentication-types=wpa2-eap disable-pmkid=yes eap-methods=passthrough encryption=aes-ccm group-encryption=aes-ccm group-key-update=1h name=Radius-Sec
/caps-man configuration
add country=netherlands datapath=radius-data distance=indoors hide-ssid=no mode=ap name=DynVlan security=Radius-Sec ssid=AllVlan
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes package-path=/upgrade upgrade-policy=require-same-version
/caps-man manager interface
set [ find default=yes ] forbid=yes
add disabled=no interface=vl667
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=ac master-configuration=DynVlan name-format=prefix-identity name-prefix=5Ghz-
add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=DynVlan name-format=prefix-identity name-prefix=2.4Ghz-

I updated my hAP ac^2 from 6.42.7 and upgraded firmware
after update my cpu usage rise from 2% to 30% and dhcp stopped working. export also hang out after /interface wireless. reboots doesn't helps. Downgraded to 6.42.7 now is working fine again.
I updated it again with same result.

I seen the issue with dhcp stop working. check in dhcp server if you have dhcp server configured with unknown interface, if you have remove that and upgrade to 6.43. When you have dhcp-server configured with unkwnon interface and upgrade to 6.43 will cause dhcp to stop working

Changing the identity on hAp ac² crashes the router with an error: "kernel failure in previous boot".

/system identity set name="some other name"

Changing the identity on hAp ac² crashes the router with an error: "kernel failure in previous boot".

You mean changing identity name as in

Code: Select all

/system identity set name="some other name"

The above command doesn't crash my hAP ac² ... running ROS 6..43.

Changing the identity on hAp ac² crashes the router with an error: "kernel failure in previous boot".

I can not reproduce this issue on my hAP ac^2 with ROS 6.43 (both CLI and WinBox).

Hi,

on 6.43 current.

dhcp server bindings not working

ip pool used prefix shows pppoe's ipv6

but on dhcp server bindings don't received ipv6 pppoe

somebody with this problem?

Hello , i am having difficuties about ccr1036-12g-4s when get udp attack with 0 length .

Using RouterOS 6.4 and here is the tcp dump of attack :

21:10:26.299021 IP 132.155.220.60.39812 > x.x.x.x.44710: UDP, length 0
21:10:26.299034 IP 180.19.33.203.lxi-evntsvc > x.x.x.x.2342: UDP, length 0
21:10:26.299035 IP 56.24.15.219.6200 > x.x.x.x.1234: UDP, length 0
21:10:26.299036 IP 11.90.77.183.23051 > x.x.x.x.44710: UDP, length 0
21:10:26.299057 IP 28.110.53.197.28188 > x.x.x.x.44710: UDP, length 0
21:10:26.299062 IP 215.92.148.235.23767 > x.x.x.x.3453: UDP, length 0
21:10:26.299064 IP 0.19.41.141.4864 > x.x.x.x.80: UDP, length 0
21:10:26.299065 IP 137.132.25.40.33929 > x.x.x.x.44710: UDP, length 0
21:10:26.299065 IP 49.38.104.169.9777 > x.x.x.x.110: UDP, length 0
21:10:26.299067 IP 203.183.15.186.47051 > x.x.x.x.44710: UDP, length 0
21:10:26.299185 IP 51.163.222.160.41779 > x.x.x.x.44710: UDP, length 0
21:10:26.299191 IP 0.33.48.114.8448 > x.x.x.x.4432: UDP, length 0
21:10:26.299193 IP 143.96.62.38.24719 > x.x.x.x.447: UDP, length 0

I have added many rule like :

0 chain=forward action=drop connection-state=invalid protocol=udp log=yes
log-prefix="log-paket"

1 chain=forward action=drop protocol=udp connection-bytes=0-10 log=yes
log-prefix="udp-attack"


It makes routerboard freeze and unaccesible, please help me to solve that.

No logs.

How does on obtain the default settings for menu items?

The '/system default-configuration print' command details the default initialisation script and does not show default values.

How does on obtain the default settings for menu items?

The '/system default-configuration print' command details the default initialisation script and does not show default values.

1. Backup or export current config.
2. Disconnect router from internet and reset config without applying default configuration.
3. Connect to router via MAC.
3. /export verbose file=all_defaults, save this file for future reference
4. Restore backup or import config from step 1.

I cannot upgrade to 6.43. I think something messed up with packets installed

1. uninstall the extra wireless package, the lower one on your screenshot.
2. install separate packages - get ZIP file from download section of mikrotik pages. Upload all needed packages except wireless. After reboot CCR will be running ROS 6.37. I guess you don't need wireless package at all, but if you feel like installing it, install it after ROS is already running upgraded.
3. netinstall CCR

We have a huge memory leak on the new 6.43 code running on our CRS326's. We use vlan. Within 12hrs the device reboots due to low memory.

CCR1009, just found out all the "last link up time" is the current time in winbox (except those have link down will be in future), anyone have the same issue?