Hi,
I got the new PoE Switch CSS610-8P-2S+IN and there seem to be a bug in the GUI that prevents me from (re-)enabling the DHCP & PPPoE snooping settings. Let me explain.

1. Reset Configuration; go to system tab DHCP & PPPoE Snooping Trusted Ports are all checked. Everything is fine.
2. System tab: disable and enable Watchdog, just do something to be able to get the "Apply All" Button. Then click the "Apply All" Button. All looks good.
3. Go to any other tab and back to the System tab: In DHCP & PPPoE Snooping all Trusted Ports are unchecked.

And the Switch blocks my DHCP Server on the SFP1 Port.

Also I cannot enable the Trusted Ports. I checked them all, pressed the "Apply All" Button, all looks good, but after switching tabs the Trusted Ports are all unchecked.

A reset configuration re-enables the DHCP Trusted Ports.

Unable to duplicate on any of my three CSS326-24G-2S+RM switches running SwOS 2.13 or with my CRS326-24G-2S+RM that is running SwOS 2.13
What version of SwOS are you running?

The CSS610-8P-2S+IN runs SwOS Lite 2.15
I know it is otherwise unreleased.

Ah.

Thanks for your confirmation that it should normally work.
So it is either a bug, or a hardware defect.

It would be good if an other owner of this box, or somebody from the Mikrotik team, could check if it is software issue or not.

Hello,
We can confirm this DHCP & PPPoE snooping software problem. It is specific to the CSS610-8P-2S+IN model and SwOS Lite 2.15 version.
Please contact MikroTik support via Support Help Desk System (https://mikrotik.com/support) to solve this issue until the new SwOS Lite version is released.

@becs thanks for confirmation. It is great that this problem could be reproduced by you guys and is being worked on.

This seems like a problem only in GUI. As a workaround, I've managed to fix it by inspecting the request in the browser and re-sending it with the correct values.

For trusted ports, look for i13 field in the request and change the value to a hexadecimal bit mask of ports you want to be checked. You can get the correct value by changing temporarily mikrotik discovery protocol and inspecting the value sent (field i08), then just copy it over to the i13. Remember to pad it to full 1, 2 or 4 bytes (2, 4 or 8 chars), otherwise you'll get an unexpected result.

For the add information option, just pass 0x01 in the field i14 to switch it on.

Remember that you have to manually fix the whole request when changing anything on this page that is above those fields (changing password, managing backup or rebooting the device is not affected)

@gwynbleidd thanks for that info. I also wondered, if I could just save/backup the configuration, edit the values as you described, and then load the patched backup file up to the switch.

Note that the switch backup is not exactly overly human readable. It's not binary, but it's not plain text. I have little doubt that with a fair amount of effort, it could be reverse engineered. May or may not be easy.

The backup file doesn't look too bad I can edit it.

Edit:
I didn't contact support yet. And I was kind of surprised by @gwynbleidd detailed information. But I could just modify i13 to create a bitmask for the trusted ports ...

Edit2:
So it is 10 '1's one for each port ....

Edit3:
The bit order seems to be reverse to the GUI, bit0 = ehernet 1 ... bit 10 = sfp2

Edit4:
Well it did what it was supposed to do. It blocked PPPoE and DHCP from those ports.
But what I actually wanted to do is to restrict admin access to the switch to exclude port 1 and 2. As simple as that. I still don't know how to do that.

Hello!

I have the same problem. The SW OS version 2.15p.
Is there solution for it?

Thanks: Péter

Moderator: Why do you quote preceding post? Use Post Replay button instead of Quote one.

Not officially.
I have: "2.15 (built at Thu Mar 10 2022 07:58:58 GMT+0100 (Central European Standard Time))"
Not sure what 2.15p is.
The GUI says: "ERROR: Could not determine latest version, probably no internet connection. Use manual upgrade."
SwOS does not seem to get as many updates as RouterOS .

I have not contacted support yet since this is a low priority thing for me. But I might get impatient soon.

Hi, thanks!
But it's a big problem, the switch blockoed all DHCP request.
I have contacted with Mikrotik Support yesterday, I'm waiting the answer!

Moderator: Why do you quote preceding post? Use Post Replay button instead of Quote one.

Yes that's what DHCP snooping means I suppose.
I just did a reset, and then you can change the other settings, and it is fine, as long as you don't change the things in the system tab.
Please share what you've learned from the support guys. Thanks.

Edit4:
Well it did what it was supposed to do. It blocked PPPoE and DHCP from those ports.
But what I actually wanted to do is to restrict admin access to the switch to exclude port 1 and 2. As simple as that. I still don't know how to do that.

Blocking admin access is done by the "Allow From Ports" option in "General" section. Simply uncheck ports that shouldn't have access to admin interface.

Remember that bug still affects DHCP settings, so you'll have to fix them manually after changing anything on this page.

Blocking admin access is done by the "Allow From Ports" option in "General" section. Simply uncheck ports that shouldn't have access to admin interface.
Remember that bug still affects DHCP settings, so you'll have to fix them manually after changing anything on this page.

Yes. I want to limit the switch getting its ip from Ports 1 and 2 as well. That's why I tried DHCP snooping.

My idea was to use ports 1 & 2 as a "wire" connection, just providing power to both ports,
but preventing admin access to the switch, and getting its IP from those 2 ports.

I don't believe that disallowing admin access to the switch removes the capability to get a DHCP address from that port. One of those things I likely could test if needed... I set mine to static because there are several VLANs on each switch and it could randomly get addresses from any one of several VLANs.

Yes VLANs and static IP are good and valid options. I am not a network engineer by trade, so I don't know what best practices are.

I would prefer to have 1 port as dedicated management port, for admin access and IP ...
So if I isolate one port, put it on a separate VLAN, and use this one as a trusted port, it should work ...

But I am still waiting for a SwOS update. My version is from March ...
I seems like RouterOS gets more frequent updates.

Yes, RouterOS gets far more attention than SwitchOS. I have five permanently installed Mikrotik switches at my house. All are on 2.13 except one old RB260 that can't take the 2.x firmware. All are carrying multiple VLANs and the static IP is on a dedicated management VLAN. Admin access is limited to the port used for a VLAN trunk on each switch and on a couple of them, also a dedicated port on the management VLAN. Other than VLANs, I'm not doing anything fancy. The only real issue I have had with any of them was a bug that was fixed several years ago that resulted in the switch dropping all except small packets (standard pings would work, but normal traffic packets would not).

I contacted support and I got a reply:

Hello,

Thank you for contacting MikroTik Support.
The problem is already fixed in the newer SwOS lite version. It is not publicly available yet, but the version will be installed on newer CSS610-8P-2S+ devices.

<I removed the private download link>

Let us know if the issue is solved.
Best regards,

I upgraded my box. The SwOS Lite version is 2.16 dated 18. July. 2022.
So there was a beta version all the time. I wonder why MT is so hesitant to make it available.

At first glance the problem is fixed. I will do more testing over the weekend, or beginning of next week.

If you have the same issue, then do contact support to get the beta version.

I did a few quick tests.

My setup:

• CSS610 Port 1 Modem with PoE
• CSS610 Port 2 RB5009UG with PoE IN (1st 1Gb Port)
• CSS610 Port 6 Client
• CSS610 SFP+ 1 connected to RB5009 SFP+

Settings:

• Port 1 and 2 are Connected, but isolated from the rest via port isolation
• Port 1 and 2 are marked as "not allowed", and Mirotik discovery is disabled on port 1 and 2
• CSS610 gets it's IP via the SFP+ 1 port from RB5009

Test 1 DHCP snooping all port are trusted. Client gets IP, as expected.

Test 2 DHCP snooping: Port 6 marked as untrusted.
This test did not work before hand. I guess, it was because all ports were marked as untrusted.
Now with 2.16 the client gets its IP address as expected. I also confirmed it using wireshark.

Test 3 DHCP snooping: Only SFP+ 1 port is trusted.
This blocks the PPPoE from my modem on Port 1, as expected. I just wanted to try out if blocking works as well.

Test 4 DHCP snooping SFP+ 1 and Port 1 are trusted.
The RB5009 can connect to my ISP using PPPoE, as expected. And the client still works as well.

So for my use case this problem is fixed.
Well done!

Hi,
Please provide fixed firmware link ?
Same issue here on a production site...
Thank you !

This is pretty crazy - how is this thing on sale for so long with a completely broken firmware?

If someone can share the firmware quicker than support can would really appreciate it, I rewired everything form the old switch and now this. I'm super annoyed, serve me right to not test everything is working before wiring....

In the meantime as above just save a backup, modify field i13 to 0x3ff (everything trusted) and the UI should update itself.

I have also just discovered this problem today after weeks of faffing around.

@oskarsk - Is the 2.17rc1 firmware that you have post a link to the fix for this issue?

I have just installed the new version and it appears to fix the bug. I will need to run this firmware for a while to ensure that there are no new bugs.

Please Mikrotik test the software more thoroughly, these sorts of issues cause engineers to lose faith in your product and damage your brand.

Many thanks @oskarsk, works as expected !

Many thanks to all who suffered before me and to @oskarsk for providing the link to 2.17rc. After beating my head for a number of hours trying to figure out what I was doing wrong on this device versus my css610-8G-2S+IN, I was relieved to see it wasn’t me at all. Now I can finally put this thing into service.

Thanks for providing the updated version. Will this also run on the CS610G?
This as I'd like to keep my versions in alignment (home use not for critical systems)

Don't believe it will run on your other device. There is very specific SWOS versions for each of the CSS610 devices. What I would REALLY like to see however is a final version for the CSS610-8P rather than a beta version. I'm still a bit salty that I bought a device that was non-functional right out of the box. Mikrotik needs to invest the time/effort to get us a stable version.

Hello,
I've bought this switch based on online reviews. I've equipped it with a mikrotik coper 10GbE interface. I believe I've hit similar issues with flaky to distorted DHCP. Are there any solutions? I'm also amazed that my firmware is one version ahead of shown online in the downloads.

You have 2.17rc1 attached a few post above.

https://box.mikrotik.com/f/695ea9fc171e44cc99d3/?dl=1

Hi oskarsk, any news on a stable version of this?

I just bought one of these and this thread really helped me out, thanks to all.

Hoping soon for a final non RC firmware.

Greetings,

I have 2.14 SWoS Lite and CSS610-8G-2S+IN I had connection drops on SFP+ (or maybe a reboot? I don't know, I see no logs anywhere!)
Above mentioned 2.17rc1 is for P version, not G version. Could anyone share 2.17 or newer for G version?

Above mentioned 2.17rc1 is for P version, not G version. Could anyone share 2.17 or newer for G version?

I would like to have a newer firmware for the G (non-PoE) model as well. In another thread

viewtopic.php?hilit=CSS610%208G%202S&p= ... 2d#p978458

a user mentions that his CSS610-8G-2S+IN was shipped with SwitchOS Lite 2.16. Yet the latest firmware that can be downloaded is 2.14 from 2021. How can I get at least SwitchOS Lite 2.16?

https://box.mikrotik.com/f/695ea9fc171e44cc99d3/?dl=1

Anyone got a link? Are they ever going to fix the firmware?