v7.10, 7.10.1 and more [stable] are released!

Thu Jul 13, 2023 3:32 pm

Just like the forum articles on testing and RC versions, I tried to include changes from newer stable sub-versions in the same article. This approach makes it easier to grasp the key issues present in a specific major version, such as 7.10. It might also help when deciding to upgrade from the previous stable branch (7.9.2 to 7.10.2) to realize that there have been a lot of changes and feedback. It doesn't seem very worthwhile to discuss just one or two changes.

frank333 · Thu Jul 13, 2023 4:03 pm

I have updated my RBM11G to ROS 7.10.2 stable.
Unfortunately this feature has not yet been implemented

Schermata del 2023-07-13 14.53.23.jpeg

which is instead present in the 7.10 testing version.

Rox169 · Thu Jul 13, 2023 4:10 pm

Just like the forum articles on testing and RC versions, I tried to include changes from newer stable sub-versions in the same article. This approach makes it easier to grasp the key issues present in a specific major version, such as 7.10. It might also help when deciding to upgrade from the previous stable branch (7.9.2) to (7.10.2) to realize that there have been a lot of changes and feedback. It doesn't seem very worthwhile to discuss just one or two changes.

I agree it is nonsence to discusse only one or two changes. Please keep it as it is.

DarkNate · Fri Jul 14, 2023 1:37 am

wow...this is cool update...we can say 7.10.2 is almost long term release :) I did not know what wifi "stable" ROS to use and now I can use 7.10.2 and 7.11beta4 and I do not know which version to use now :) After few months I can finally use stable version :) Thank you

It seems MikroTik don't understand “stable” any more, at least on ROSv7.

Rox169 · Fri Jul 14, 2023 10:41 am

7.10.2 seems stable to me, what is not working for you?

Jotne · Fri Jul 14, 2023 11:54 am

It seems MikroTik don't understand “stable” any more, at least on ROSv7.

It seems that you did not read the MTs post about stable.

Fri Jul 14, 2023 12:37 pm

I have updated my RBM11G to ROS 7.10.2 stable.
Unfortunately this feature has not yet been implemented
which is instead present in the 7.10 testing version.

The wide view was introduced only in 7.11beta2.

kcarhc · Fri Jul 14, 2023 2:50 pm

please add this fix to 7.10.3 thanks
7.10/7.10.1/7.10.2 dns random crash when DNS entries with specified address-list

*) dns - improved system stability when processing static DNS entries with specified address-list;

frank333 · Fri Jul 14, 2023 5:53 pm

I have updated my RBM11G to ROS 7.10.2 stable.
Unfortunately this feature has not yet been implemented
which is instead present in the 7.10 testing version.
The wide view was introduced only in 7.11beta2.

a pity , it would have been very useful for Webfig users.🥲

DarkNate · Fri Jul 14, 2023 5:57 pm

7.10.2 seems stable to me, what is not working for you?

Are you blind? Read this whole thread again, and deploy large scale networks using Juniper, Arista, Huawei like me and come back to me and say “7.10.2 is stable”.

Currently working with rural WISPs to secure funding to dump MikroTik and switch to Juniper end-to-end. The instability/bugs on MikroTik is costing businesses a lot.

I can't even use BFD on 7.10.1, 7.10.2, 7.10.x.

Rox169 · Fri Jul 14, 2023 9:31 pm

You should firstly learn how to proper answer simple question.... I didn't ask for your shity network but WHAT IS NOT WORKING FOR YOU?

Joe1vm · Fri Jul 14, 2023 9:59 pm

RB5009 as router on stick and Capsman managing 2xAX2 and AX3 connected via cisco switch. All with ROS 7.10.2
I am still getting XXXXXX@Jidelna_5GHz rejected, can't find PMKSA with WPA3 PSK enabled in combination with WPA2 PSK....

Paternot · Fri Jul 14, 2023 11:20 pm

You should firstly learn how to proper answer simple question.... I didn't ask for your shity network but WHAT IS NOT WORKING FOR YOU?

Consider yourself upvoted. I was thinking the same thing here.

DarkNate · Sat Jul 15, 2023 3:42 am

You should firstly learn how to proper answer simple question.... I didn't ask for your shity network but WHAT IS NOT WORKING FOR YOU?

I will say it again, are you blind? Learn to firstly use your eyes. And clearly, you're just some small-time home user, who thinks he/she knows what they are talking about.

viewtopic.php?t=197095#p1011664

viewtopic.php?t=197095#p1012605

viewtopic.php?t=197095#p1012755

Rox169 · Sat Jul 15, 2023 9:08 am

I do not see anything critical...if you are not able to work around you should not be providing any network....

DarkNate · Sat Jul 15, 2023 9:21 am

I do not see anything critical...if you are not able to work around you should not be providing any network....

<edited>? Do you not understand how critical BFD is in production networks? What kind of network engineer are you, to think that BFD is not “critical”?

Do some reading here:
https://en.wikipedia.org/wiki/Bidirecti ... _Detection

We don't have these problems on Juniper/Arista/Huawei.

Rox169 · Sat Jul 15, 2023 9:58 am

It is only you who is complaining about not working BFD...<edited> :)

Sat Jul 15, 2023 10:00 am

Both of you, DarkNate and Rox169.
Stop the name calling before it escalates further.

Facts, yes.
Personal attacks, no.

indy · Sat Jul 15, 2023 10:51 am

Updated a HAP-AX2 from 7.10 to 7.10.2.
A MAP Lite (7.10.1) in station mode sitting right next to the HAP is now reconnecting every couple of minutes.

Jotne · Sat Jul 15, 2023 11:30 am

<edited>? Do you not understand how critical BFD is in production networks? What kind of network engineer are you, to think that BFD is not “critical”?

BFD was for the 7 train just released in 7.10beta8 just some more than a month ago. What did you use before that?
You are also free to use any product you like, not just MikroTik.

For me all works perfectly.

Here are the v7 BFD changes:

BFD.png

pe1chl · Sat Jul 15, 2023 1:24 pm

<edited>? Do you not understand how critical BFD is in production networks? What kind of network engineer are you, to think that BFD is not “critical”?
BFD was for the 7 train just released in 7.10beta8 just some more than a month ago. What did you use before that?

Well, in my case it was the reason for not upgrading to version 7.x (and not buying new routers that required 7.x) until that was fixed!
(which took waaay too long, IMHO)

Now, I am running a couple of routers on 7.11beta4 and even have replaced the main router at work (keeping the old one available for a hot swap in case of problems).
BFD seems to work OK for me. But I know very well that there always are different scenarios that do not occur in my test case.
(e.g. it seems that BFD does not always work when combined with L3HW offload, but I do not have that enabled)

mducharme · Sat Jul 15, 2023 10:06 pm

I'm glad that BFD got rid of most peoples last issue before upgrading, but we are still stuck not being able to upgrade to version 7 for something that was fine on version 6, and that is MPLS QoS (EXP bits not being set). Reported a year ago, no word yet on a fix. We can't upgrade most of our infrastructure until there is a fix.

kcarhc · Sun Jul 16, 2023 3:41 pm

Surely you already checked the cables ?
Since on my RB5009's, one of them is humming sweetly on 2.5Gb (trunk to AX3), the other 1Gb.
No drops whatsoever that I can see in the logs.

Your link down counter is also something to watch. Not normal.

The device connected to ether1 remains the U6-Enterprise.
Have you considered asking the manufacturer of that device? What firmware version are you using on it? When looking at the forum, quite some of its users are in total despair about the firmware quality, so maybe it has some part of the blame.

Switch back to the USW-Enterprise-8-PoE switch,
as well as the ZyXEL XS1930-12HP switch,
and an unnamed PoE 2.5G 8-port switch.
The devices connected to the PoE ports are all U6-Enterprise.

All three switches can reliably provide power and operate at 2.5G for the PoE ports.
However, the RB5009UPr+S+ 2.5G PoE experiences a decrease in speed after running for a while.
This issue was partially resolved in version 7.9,
but it has become more frequent again in version 7.10.

kcarhc · Sun Jul 16, 2023 3:47 pm

The most frustrating aspect of this issue is that, once it occurs,
neither re-plugging the Ethernet cables nor repeatedly enabling/disabling the PoE functionality can resolve it.
The best solution is to simply restart the RB5009UPr+S+ switch and see if the problem is resolved.

reboot_wiil_fix_RB5009_2.5G_Rate.png

pe1chl · Sun Jul 16, 2023 3:57 pm

I'm glad that BFD got rid of most peoples last issue before upgrading, but we are still stuck not being able to upgrade to version 7 for something that was fine on version 6, and that is MPLS QoS (EXP bits not being set). Reported a year ago, no word yet on a fix. We can't upgrade most of our infrastructure until there is a fix.

Ok... I do not use MPLS. But I think that the priority with v7 should have been to make everything work at least as well as it did in v6.
But it seems they got carried away in implementing new features (probably requested by important customers) before finishing that.

kcarhc · Sun Jul 16, 2023 6:19 pm

please add this fix in 7.10.3
*) dns - improved system stability when processing static DNS entries with specified address-list (introduced in v7.10);

Multiple random kernel failures have been observed in the 7.10.x version.
Most of them have also enabled "dns-to-address-list." The affected devices include the following models:

arm RB450Gx4
arm RB4011
arm64 RB5009
x86 CHR

Please release 7.10.3 to fix this issue and that will confirm whether the kernel failures in the previous version were caused by DNS.
It is known that downgrading to version 7.9 resolves all the issues and prevents them from recurring.

pe1chl · Mon Jul 17, 2023 4:45 pm

please add this fix in 7.10.3
*) dns - improved system stability when processing static DNS entries with specified address-list (introduced in v7.10);

I suggest to install the 7.11beta instead, it appears to be quite stable and solves those problems.

elbantany · Tue Jul 18, 2023 3:25 am

Help me pleas add this fix in link,
Teseted v7.10.1 & 7.10.2
cAP ac
AX2

viewtopic.php?t=197789

sirbryan · Tue Jul 18, 2023 5:40 pm

Ok... I do not use MPLS. But I think that the priority with v7 should have been to make everything work at least as well as it did in v6.
But it seems they got carried away in implementing new features (probably requested by important customers) before finishing that.

I think some of the new features were merely "low-hanging fruit" that could be tackled in a couple of dev cycles, likely by devs who are not working on stuff like BFD and MPLS. If you see who responds on the forums to different topics, its apparent who's baby is who's.

Agreed that there maybe some customers influencing some decisions, but like anything else in product development, if it's easy and cheap to implement something that's 98% of the way done, and adds value to the product, why not do it?

shavenne · Wed Jul 19, 2023 11:38 am

Is it possible that IPv6 addresses on a wireguard interface aren't working anymore? I don't mean IPv6 as an endpoint address but inside the wireguard "net".

I'm using a CHR to give some of my machines fixed external IPv6 addresses. On 7.10 it's not working anymore. I had to downgrade back to 7.9.1. Unfortunately it has to be working so I can't do further investigation at this time :/
IPv4 at least was working fine on that same wireguard interfaces. Just IPv6 have stopped working.

vuk · Wed Jul 19, 2023 2:18 pm

L2TP vpn is more unstable.
Also I can see issues with IPIP Tunnel and IPSec, more unstable, then previous versions, especially in v7.8 it was better.

pe1chl · Wed Jul 19, 2023 3:08 pm

L2TP vpn is more unstable.
Also I can see issues with IPIP Tunnel and IPSec, more unstable, then previous versions, especially in v7.8 it was better.

I am running 7.11beta4 but I would agree with that. The router is the "server" side for incoming connects from clients. I have seen it happen a couple of times that GRE/IPsec tunnels (configured using the easy method, so active from both sides) were down for some time and that I could revive them by deleting their entry under "active peers" (forcing re-negotiation).
Also, I have seen at least two times that an L2TP/IPsec client connection goes down precisely at the moment that another client connects. But in those cases it re-connected immediately after the failure.

bbs2web · Wed Jul 19, 2023 4:21 pm

RB5009 as router on stick and Capsman managing 2xAX2 and AX3 connected via cisco switch. All with ROS 7.10.2
I am still getting XXXXXX@Jidelna_5GHz rejected, can't find PMKSA with WPA3 PSK enabled in combination with WPA2 PSK....

I also have a RB5009 running as CAPsMAN for 4 x hAP ax^3 CAPs, running 3 SSIDs per 2.4 / 5 GHz radios. One is a simple WPA2/WPA3 PSK whereas the other two are EAP RADIUS and the 3rd is a WPA3-PSK.

Herewith pseudoconfig to configure CAPsMAN to roll out a single SSID for both 2.4 and 5 GHz via CAPsMAN and WiFiWave2:

/interface wifiwave2 channel
add band=2ghz-ax disabled=no frequency=2412,2437,2462 name=ch-2ghz skip-dfs-channels=all width=20mhz
add band=5ghz-ax disabled=no frequency=5180,5260,5500,5580,5660,5745 name=ch-5ghz skip-dfs-channels=all width=20/40/80mhz
/interface wifiwave2 security
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=no disabled=no ft=yes ft-over-ds=yes management-protection=allowed name="Home WiFi" passphrase="N0tS3cur3" wps=disable
/interface wifiwave2 capsman
set ca-certificate=auto enabled=yes interfaces=vlan1
/interface wifiwave2 configuration
add channel=ch-5ghz country=Taiwan datapath="VLAN: Guest - Isolated" disabled=no mode=ap name="wifi1 - 5 GHz" security="Home WiFi" ssid="Home WiFi"
add channel=ch-2ghz country=Taiwan datapath="VLAN: Guest - Isolated" disabled=no mode=ap name="wifi2 - 2.4 GHz" security="Home WiFi" ssid="Home WiFi"
/interface wifiwave2 datapath
add bridge=bridge client-isolation=yes disabled=no name="VLAN: Guest - Isolated" vlan-id=53
/interface wifiwave2 provisioning
add action=create-enabled disabled=no master-configuration="wifi1 - 5 GHz" name-format="5G - %I" supported-bands=5ghz-ax
add action=create-enabled disabled=no master-configuration="wifi2 - 2.4 GHz" name-format="2G - %I" supported-bands=2ghz-ax

NB: This associated wireless clients with VLAN 53 and implements wireless client to wireless client isolation (datapath settings). It also sets the country as Taiwan so you should change that if you don't want to exceed regional restrictions with regards to power output being 1000 mW and instead need to adhere to lower transmit power, commonly only 100 mW.

The above provides fast roaming (LAN based AP to AP handover) but this makes it susceptible to PMKID attacks. If you improve the security posture and disable PMKID you will break fast transition (aka fast roaming).

zember · Wed Jul 19, 2023 5:37 pm

PPPoE in not stable on RB5009UG+S+ on 7.10.2 , last working version is RouterOS 7.7 currently log looks like that:

16:11:42 pppoe,ppp,info pppoe-out1: authenticated
 16:11:42 pppoe,ppp,info pppoe-out1: connected
 16:11:42 interface,info pppoe-out1 detect UNKNOWN
 16:11:44 dhcp,info dhcp-client on VOD got IP address 10.109.85.89
 16:11:48 interface,info pppoe-out1 detect INTERNET
 16:11:49 system,info,account user admin logged in from 192.168.4.4 via winbox
 16:12:25 system,critical,info ntp change time Jul/19/2023 16:11:49 => Jul/19/2023 16:12:25
 16:12:48 interface,info sfp-sfpplus1 link down
 16:12:48 pppoe,ppp,info pppoe-out1: terminating... - disconnected
 16:12:48 pppoe,ppp,info pppoe-out1: disconnected
 16:12:48 pppoe,ppp,info pppoe-out1: initializing...
 16:12:48 pppoe,ppp,info pppoe-out1: connecting...
 16:12:48 pppoe,ppp,info pppoe-out1: terminating...
 16:12:48 pppoe,ppp,info pppoe-out1: disconnected
 16:12:48 pppoe,ppp,info pppoe-out1: initializing...
 16:12:48 pppoe,ppp,info pppoe-out1: connecting...
 16:12:48 interface,info sfp-sfpplus1 link up (speed 1G, full duplex)
 16:12:48 interface,info sfp-sfpplus1 detect LAN
 16:12:48 interface,info net_oran detect UNKNOWN
 16:12:48 interface,info vlan_vod_oran detect LAN
 16:12:48 interface,info vlantv_orang detect LAN
 16:12:49 pppoe,ppp,info pppoe-out1: authenticated
 16:12:49 pppoe,ppp,info pppoe-out1: connected
 16:12:49 interface,info pppoe-out1 detect UNKNOWN
 16:12:55 interface,info pppoe-out1 detect INTERNET
 16:14:36 interface,info sfp-sfpplus1 link down
 16:14:36 pppoe,ppp,info pppoe-out1: terminating... - disconnected
 16:14:36 interface,info sfp-sfpplus1 link up (speed 1G, full duplex)
 16:14:36 pppoe,ppp,info pppoe-out1: disconnected
 16:14:36 pppoe,ppp,info pppoe-out1: initializing...
 16:14:36 pppoe,ppp,info pppoe-out1: connecting...
 16:14:36 interface,info sfp-sfpplus1 detect LAN
 16:14:36 interface,info net_oran detect UNKNOWN
 16:14:36 interface,info vlan_vod_oran detect LAN
 16:14:36 interface,info vlantv_orang detect LAN
 16:14:36 pppoe,ppp,info pppoe-out1: terminating...
 16:14:36 pppoe,ppp,info pppoe-out1: disconnected
 16:14:36 pppoe,ppp,info pppoe-out1: initializing...
 16:14:36 pppoe,ppp,info pppoe-out1: connecting...
 16:14:37 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:14:37 pppoe,ppp,info pppoe-out1: disconnected
 16:14:37 pppoe,ppp,info pppoe-out1: initializing...
 16:14:37 pppoe,ppp,info pppoe-out1: connecting...
 16:14:38 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:14:38 pppoe,ppp,info pppoe-out1: disconnected
 16:14:38 pppoe,ppp,info pppoe-out1: initializing...
 16:14:38 pppoe,ppp,info pppoe-out1: connecting...
 16:14:40 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:14:40 pppoe,ppp,info pppoe-out1: disconnected
 16:14:40 pppoe,ppp,info pppoe-out1: initializing...
 16:14:40 pppoe,ppp,info pppoe-out1: connecting...
 16:14:41 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:14:41 pppoe,ppp,info pppoe-out1: disconnected
 16:14:43 pppoe,ppp,info pppoe-out1: initializing...
 16:14:43 pppoe,ppp,info pppoe-out1: connecting...
 16:14:44 pppoe,ppp,info pppoe-out1: authenticated
 16:14:44 pppoe,ppp,info pppoe-out1: connected
 16:14:44 interface,info pppoe-out1 detect UNKNOWN
 16:14:50 interface,info pppoe-out1 detect INTERNET
 16:14:56 system,info,account user admin logged in from 192.168.4.4 via local
 16:17:26 interface,info sfp-sfpplus1 link down
 16:17:26 pppoe,ppp,info pppoe-out1: terminating... - disconnected
 16:17:26 pppoe,ppp,info pppoe-out1: disconnected
 16:17:26 pppoe,ppp,info pppoe-out1: initializing...
 16:17:26 pppoe,ppp,info pppoe-out1: connecting...
 16:17:26 interface,info sfp-sfpplus1 link up (speed 1G, full duplex)
 16:17:26 interface,info sfp-sfpplus1 detect LAN
 16:17:26 interface,info net_oran detect UNKNOWN
 16:17:26 pppoe,ppp,info pppoe-out1: terminating...
 16:17:26 pppoe,ppp,info pppoe-out1: disconnected
 16:17:26 pppoe,ppp,info pppoe-out1: initializing...
 16:17:26 pppoe,ppp,info pppoe-out1: connecting...
 16:17:26 interface,info vlan_vod_oran detect LAN
 16:17:26 interface,info vlantv_orang detect LAN
 16:17:27 pppoe,ppp,info pppoe-out1: authenticated
 16:17:28 pppoe,ppp,info pppoe-out1: connected
 16:17:28 interface,info pppoe-out1 detect UNKNOWN
 16:17:29 interface,info sfp-sfpplus1 link down
 16:17:29 pppoe,ppp,info pppoe-out1: terminating... - disconnected
 16:17:29 pppoe,ppp,info pppoe-out1: disconnected
 16:17:29 pppoe,ppp,info pppoe-out1: initializing...
 16:17:29 pppoe,ppp,info pppoe-out1: connecting...
 16:17:29 interface,info sfp-sfpplus1 link up (speed 1G, full duplex)
 16:17:29 interface,info sfp-sfpplus1 detect LAN
 16:17:29 interface,info net_oran detect UNKNOWN
 16:17:29 pppoe,ppp,info pppoe-out1: terminating...
 16:17:29 pppoe,ppp,info pppoe-out1: disconnected
 16:17:29 pppoe,ppp,info pppoe-out1: initializing...
 16:17:29 pppoe,ppp,info pppoe-out1: connecting...
 16:17:29 interface,info vlan_vod_oran detect LAN
 16:17:29 interface,info vlantv_orang detect LAN
 16:17:31 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:17:31 pppoe,ppp,info pppoe-out1: disconnected
 16:17:31 pppoe,ppp,info pppoe-out1: initializing...
 16:17:31 pppoe,ppp,info pppoe-out1: connecting...
 16:17:32 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:17:32 pppoe,ppp,info pppoe-out1: disconnected
 16:17:32 pppoe,ppp,info pppoe-out1: initializing...
 16:17:32 pppoe,ppp,info pppoe-out1: connecting...
 16:17:37 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:17:37 pppoe,ppp,info pppoe-out1: disconnected
 16:17:38 pppoe,ppp,info pppoe-out1: initializing...
 16:17:38 pppoe,ppp,info pppoe-out1: connecting...
 16:17:40 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:17:40 pppoe,ppp,info pppoe-out1: disconnected
 16:17:41 pppoe,ppp,info pppoe-out1: initializing...
 16:17:41 pppoe,ppp,info pppoe-out1: connecting...
 16:17:47 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:17:47 pppoe,ppp,info pppoe-out1: disconnected
 16:17:50 pppoe,ppp,info pppoe-out1: initializing...
 16:17:50 pppoe,ppp,info pppoe-out1: connecting...
 16:17:57 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:17:57 pppoe,ppp,info pppoe-out1: disconnected
 16:18:04 pppoe,ppp,info pppoe-out1: initializing...
 16:18:04 pppoe,ppp,info pppoe-out1: connecting...
 16:18:05 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:18:05 pppoe,ppp,info pppoe-out1: disconnected
 16:18:15 pppoe,ppp,info pppoe-out1: initializing...
 16:18:15 pppoe,ppp,info pppoe-out1: connecting...
 16:18:25 pppoe,ppp,info pppoe-out1: terminating... - disconnected
 16:18:25 pppoe,ppp,info pppoe-out1: disconnected
 16:18:35 pppoe,ppp,info pppoe-out1: initializing...
 16:18:35 pppoe,ppp,info pppoe-out1: connecting...
 16:18:36 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:18:36 pppoe,ppp,info pppoe-out1: disconnected
 16:18:46 pppoe,ppp,info pppoe-out1: initializing...
 16:18:46 pppoe,ppp,info pppoe-out1: connecting...
 16:18:47 pppoe,ppp,info pppoe-out1: terminating... - failed to authenticate ourselves to peer
 16:18:47 pppoe,ppp,info pppoe-out1: disconnected

I'm doing pppoe connection using sfp-sfpplus1 interface, SFP model: HALNy HL-GSFP, and connection is terminated randomly, but sometimes I can trigger instability by running speedtest App above 900Mbits from any machine inside LAN.

mkx · Wed Jul 19, 2023 9:02 pm

From log sequence it's obvious that first SFP looses link and only then pppoe drops. To me this indicates the cause of problems.

And my recomendation: disable "detect internet" feature, it causes problems more often that does any good.

kehrlein · Thu Jul 20, 2023 1:08 am

Updated soft- and firmware to 7.10.2 on these models without any issues:
RB750GL
CRS309-1G-8S+
RBcAPGi-5acD2nD (cAP ac)
RB5009UPr+S+IN
RB760iGS (hEX S)
x86

Info regarding RB760iGS (hEX S): We‘ve had several update issues during the last months with < 10 devices and > 10 different ROS versions, resulting in boot loops. After a lot of debugging, it seems that we’ve identified the root cause: The boot loops occur, if the hES S is powered by PoE only. Since we’ve added an external power supply, all updates went fine. We’ll verify this during the next updates and are going to add this information to the support ticket SUP-68147.

elbantany · Thu Jul 20, 2023 7:25 am

Updated soft- and firmware to 7.10.2 on these models without any issues:
RB750GL
CRS309-1G-8S+
RBcAPGi-5acD2nD (cAP ac)
RB5009UPr+S+IN
RB760iGS (hEX S)
x86

Info regarding RB760iGS (hEX S): We‘ve had several update issues during the last months with < 10 devices and > 10 different ROS versions, resulting in boot loops. After a lot of debugging, it seems that we’ve identified the root cause: The boot loops occur, if the hES S is powered by PoE only. Since we’ve added an external power supply, all updates went fine. We’ll verify this during the next updates and are going to add this information to the support ticket SUP-68147.

Not for me...
I can not connect wifi on RBcAPGi-5acD2nD (cAP ac), after upgrade to v7.
Can you help me please
viewtopic.php?p=1014118#p1014118

ramin110 · Sat Jul 22, 2023 1:25 pm

I have two identical chr mikrotik. one is working , the other doesn't .
weird.

I also reinstalled the chr OS and tried again but same error. the container working on x86 mode.

Mon Jul 24, 2023 11:47 am

Regarding the OVPN service not working with 7.10. We have found the issue and will release 7.11beta with a potential fix soon.

However, the issue is not a bug exactly. If you are running OVPN service with 7.10.2 and it is not working, check if you use OVPN in "IP" mode, but have specified "bridge" under PPP/Profile. The "bridge" can be used only with "Ethernet" mode, not "IP" mode. So the service was connected but was not working. We will return the behavior back to the way it was in v7.9, however, you should be also able to resolve the issue by unsettling PPP/Profile bridge setting on the profile that is used for OVPN service running in "IP" mode.

moep · Mon Jul 24, 2023 5:59 pm

There seems to still be the issue with IPSec/IKEv2 and ECDSA certificates using secp521r1.
When upgrading from 7.9.2 IPSec Tunnels using ECDSA certificates are not established any more.
It does not matter if one side or both sides are on version 7.10.2, every combination involving 7.10.x/7.11 and pre-7.10 does not work.
7.10.x to 7.10.x works and 7.10.x to 7.11betax and 7.11betax to 7.11betax works.
There is a "digital signature verification error" visible in the log on 7.10.x or 7.11betax and "AUTHENTICATION_FAILED" on 7.9.2.
It does not matter, if I change the settings in /ip/ipsec/identities to other ID types for local and/or remote ID.
When I downgrade both sides to 7.9.2 everything works fine again, as it did for every release since v7 came out.

The same bug seems to exist in 7.11beta versions, at least until 7.11beta6 (edit: testet with beta6, problem is still there).

bbs2web · Mon Jul 24, 2023 11:09 pm

DHCP snooping is unstable (works intermittently) or not at all, even after restarting. Confirmed on:

CRS328-24P-4S+
CRS112-8P-4S
CRS354-48P-4S+2Q+
RB5009UG+S+

We have `trusted=yes` configured on the relevant bridge port interface, as well as having `add-dhcp-option82=yes` and `dhcp-snooping=yes` set on the bridge. We typically assign an admin MAC to the bridge, one lower than the lowest MAC of entries in `/int eth print` (we are mindful that some devices have the lowest MAC on the qsf1-1 interface).

intended state:

VLAN                                                            Member Port
 ID   01  02  03  04  05  06  07  08  09  10  11  12  13  14  15  16  17  18  19  20  21  22  23  24  SFP1  SFP2  SFP3  SFP4
  1    U   U   U       U                               U   U   U   U   U   U   U   U   U   U   U   U    U     U     U     U   Default
 12                                                U       T   T                                                              WiFi Link to Site B
 16                        U   U   U   U   U   U           T   T   T                                                          WiFi
 17                U                                       T   T                                                              DMZ
 18                                                        T   T       T                                            T         Accounts
 19                                                        T   T                                                              Reserved

/interface bridge
add add-dhcp-option82=yes admin-mac=48:A9:8A:39:9A:E2 auto-mac=no dhcp-snooping=yes name=bridge priority=0x6000 protocol-mode=mstp region-name=Company vlan-filtering=yes
/interface bridge port
add bpdu-guard=yes bridge=bridge interface=ether1 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether2 restricted-role=yes
add bridge=bridge interface=ether3 restricted-role=yes
add bridge=bridge interface=ether4 pvid=17 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether5 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether6 pvid=16 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether7 pvid=16 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether8 pvid=16 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether9 pvid=16 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether10 pvid=16 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether11 pvid=16 restricted-role=yes
add bridge=bridge interface=ether12 pvid=12 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether13 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether14 restricted-role=yes trusted=yes
add bpdu-guard=yes bridge=bridge interface=ether15 restricted-role=yes trusted=yes
add bridge=bridge interface=ether16 restricted-role=yes
add bridge=bridge interface=ether17 restricted-role=yes
add bridge=bridge interface=ether18 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether19 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether20 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether21 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether22 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether23 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=ether24 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=sfp-sfpplus1 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=sfp-sfpplus2 restricted-role=yes
add bridge=bridge interface=sfp-sfpplus3 restricted-role=yes
add bpdu-guard=yes bridge=bridge interface=sfp-sfpplus4 restricted-role=yes
/interface bridge vlan
add bridge=bridge tagged=bridge,ether14,ether15 vlan-ids=12
add bridge=bridge tagged=bridge,ether14,ether15,ether16 vlan-ids=16
add bridge=bridge tagged=bridge,ether14,ether15 vlan-ids=17
add bridge=bridge tagged=ether14,ether15,ether17,sfp-sfpplus3,bridge vlan-ids=18
add bridge=bridge tagged=bridge,ether14,ether15 vlan-ids=19

szalkerous · Tue Jul 25, 2023 9:37 pm

What's new in 7.10 (2023-Jun-15 08:17):

*) tile - fixed support for microSD card;

Anyone else verify this was actually fixed? Having some real problems on a CCR1009-8G-1S-1S+ with v7.10.2 getting a 32GB SD card to be recognized. I tried wiping it in a separate PC and still no luck.

Just want to see if anyone else can confirm working/not working so I don't waste time.

deanMK · Tue Jul 25, 2023 10:47 pm

After a while, it seems that Wifi is not stable on hAP AX3 on 7.10.2 ! Constant internet drops, or poor wifi quality. On my Old hAP AC2 wifi is muc much stable and better then this on hAP AX3.

Ullinator · Tue Jul 25, 2023 11:22 pm

After a while, it seems that Wifi is not stable on hAP AX3 on 7.10.2 ! Constant internet drops, or poor wifi quality. On my Old hAP AC2 wifi is muc much stable and better then this on hAP AX3.

I can't confirm. My hAP AX3 is absolut stable with 7.10.2 and also with 7.11Beta4.
Testet during Holidays as a WLAN client and WLAN Access point for weeks. (Internet came via WLAN ;-) )
Performance was excelent.
Clients where several cell phones (Pixel), tablets and Notebooks.

K0NCTANT1N · Wed Jul 26, 2023 12:01 am

What's new in 7.10 (2023-Jun-15 08:17):

*) tile - fixed support for microSD card;
Anyone else verify this was actually fixed? Having some real problems on a CCR1009-8G-1S-1S+ with v7.10.2 getting a 32GB SD card to be recognized. I tried wiping it in a separate PC and still no luck.

Just want to see if anyone else can confirm working/not working so I don't waste time.

I confirm.

My microSD is in the 3G Stick Modem. hAP ac^2 does not define microSD since version 7.9.2, 7.10.2. Changed different cards and different manufacturers, different sizes (32GB, 8GB, 4GB)

Ocean · Wed Jul 26, 2023 11:51 am

Regarding the OVPN service not working with 7.10. We have found the issue and will release 7.11beta with a potential fix soon.

However, the issue is not a bug exactly. If you are running OVPN service with 7.10.2 and it is not working, check if you use OVPN in "IP" mode, but have specified "bridge" under PPP/Profile. The "bridge" can be used only with "Ethernet" mode, not "IP" mode. So the service was connected but was not working. We will return the behavior back to the way it was in v7.9, however, you should be also able to resolve the issue by unsettling PPP/Profile bridge setting on the profile that is used for OVPN service running in "IP" mode.

"Bridge" not set in PPP/Profile but tunnel does not work on version 7.10.1, 7.10.2 and 7.11beta7 but works on 7.10.

/ppp profile
add bridge-learning=no change-tcp-mss=no name=openvpn-far only-one=yes

/interface ovpn-client
add certificate=client_ip.net.crt_0 cipher=aes256-cbc connect-to=xxx.xxx.xxx.xxx mac-address=02:4E:B6:A6:6B:B8 max-mtu=1400 name=ovpn-out1-far \
    port=12333 profile=openvpn-far protocol=udp user=username

pe1chl · Wed Jul 26, 2023 11:58 am

My microSD is in the 3G Stick Modem. hAP ac^2 does not define microSD since version 7.9.2, 7.10.2. Changed different cards and different manufacturers, different sizes (32GB, 8GB, 4GB)

That is completely unrelated to the discussed topic "*) tile - fixed support for microSD card; ".
Your router is not "tile" and the SD card is not in the router. SD card in a USB Modem just shows up as a USB disk.

eworm · Wed Jul 26, 2023 1:23 pm

What's new in 7.10 (2023-Jun-15 08:17):

*) tile - fixed support for microSD card;
Anyone else verify this was actually fixed? Having some real problems on a CCR1009-8G-1S-1S+ with v7.10.2 getting a 32GB SD card to be recognized. I tried wiping it in a separate PC and still no luck.

Just want to see if anyone else can confirm working/not working so I don't waste time.

Yes, works for me. The card is visible in /disk and /file now.

I do not (or no longer) use that now, tmpfs took over functionality for me. So no idea about reliability and speed.

spippan · Wed Jul 26, 2023 11:35 pm

After a while, it seems that Wifi is not stable on hAP AX3 on 7.10.2 ! Constant internet drops, or poor wifi quality. On my Old hAP AC2 wifi is muc much stable and better then this on hAP AX3.

do have "detect internet" active? if so ... disable anything regarding it and reboot the device
hard to say what could be the issue here without any further information about your config

Lupin · Fri Jul 28, 2023 2:18 pm

I upgraded one of our BGP core router : a CCR1072 to 7.10.2 (included firmware) and the situation was problematic.
All CPUs continuously going from 60 to 100% utilization.
Web browsing slowed down dramatically, packet loss and peer go down
I had to roll back to 6.49.8 and everything was back to normal.
Anyone else having the same problems?

pe1chl · Fri Jul 28, 2023 3:28 pm

Impossible to say anything without knowing what your router is actually doing (BGP? Firewall? NAT? IPv4? IPv6? policy routing?).
Even with that, there probably is no easy answer.

sirbryan · Fri Jul 28, 2023 6:52 pm

I upgraded one of our BGP core router : a CCR1072 to 7.10.2 (included firmware) and the situation was problematic.
All CPUs continuously going from 60 to 100% utilization.

Anecdotally, when I loaded down a couple of my 7.10 CCR2116's using a 10Gbps speed test after having just inserted over 300K routes into each of them, one or more of them bogged down pretty bad to where BGP/OSPF appear to have dropped and all customer traffic stopped for 10-20 seconds until everything converged again. I tried it with both L3HW offload enabled and disabled, with the same result. They worked better with only 3000 routes (1 AS away), so I'm betting it was software-related.

My CCR1036 is on 7.10 and is working fine, but it doesn't have more than a handful of BGP-fed routes for internal networks only.

AdHocCZ1 · Sat Jul 29, 2023 4:58 am

What's new in 7.10 (2023-Jun-15 08:17):

*) tile - fixed support for microSD card;
Anyone else verify this was actually fixed? Having some real problems on a CCR1009-8G-1S-1S+ with v7.10.2 getting a 32GB SD card to be recognized. I tried wiping it in a separate PC and still no luck.

Just want to see if anyone else can confirm working/not working so I don't waste time.

.
For CCR1009 in microSD card slot & 7.10.2 (also same for 7.11beta7) -- kind of works, but not happy in compare to microSD in adapter via usb:

After reboot it is shown in Files immediately, but it takes time sometimes to be displayed in Disks.
/disks/ print stuck for a while, but after longer time all appears as below.

[admin@Site23-CCR1009] > /disk/ export  
# 1970-01-04 03:13:59 by RouterOS 7.10.2
# model = CCR1009-7G-1C-1S+
/disk
set sd1 type=hardware

.

[admin@Site23-CCR1009] > /disk/ print 

Flags: B - BLOCK-DEVICE; M, F - FORMATTING
Columns: SLOT, MODEL, SERIAL, INTERFACE, SIZE, FREE, FS
#    SLOT  MODEL          SERIAL      IN            SIZE            FREE  FS   
0 BM sd1   SP32G 02/2021  xxxxxxx  SD  31 914 983 424  31 898 140 672  fat32

.
Problems start when you manipulate with the card the way like you can via USB.
On USB port using adapter for microSD you can eject, detach, reattach, and all works in three or five seconds.
When using slot for microSD I was not able to find deterministic behavior without reboot.
Same card, same problems if formatted as FAT32 or EXT4.
Sometimes it worked, sometimes not. Very long times, sometimes timeout error. Reboot always helped.
So now I use it only as "nonremovable/cold-swappable" local storage in microSD slot of CCR1009.

Tue Aug 01, 2023 8:26 am

Please create a support ticket so we can get additional information on this.

There seems to still be the issue with IPSec/IKEv2 and ECDSA certificates using secp521r1.
When upgrading from 7.9.2 IPSec Tunnels using ECDSA certificates are not established any more.
It does not matter if one side or both sides are on version 7.10.2, every combination involving 7.10.x/7.11 and pre-7.10 does not work.
7.10.x to 7.10.x works and 7.10.x to 7.11betax and 7.11betax to 7.11betax works.
There is a "digital signature verification error" visible in the log on 7.10.x or 7.11betax and "AUTHENTICATION_FAILED" on 7.9.2.
It does not matter, if I change the settings in /ip/ipsec/identities to other ID types for local and/or remote ID.
When I downgrade both sides to 7.9.2 everything works fine again, as it did for every release since v7 came out.

The same bug seems to exist in 7.11beta versions, at least until 7.11beta6 (edit: testet with beta6, problem is still there).

Lupin · Tue Aug 01, 2023 4:54 pm

Anecdotally, when I loaded down a couple of my 7.10 CCR2116's using a 10Gbps speed test after having just inserted over 300K routes into each of them, one or more of them bogged down pretty bad to where BGP/OSPF appear to have dropped and all customer traffic stopped for 10-20 seconds until everything converged again. I tried it with both L3HW offload enabled and disabled, with the same result. They worked better with only 3000 routes (1 AS away), so I'm betting it was software-related.

My CCR1036 is on 7.10 and is working fine, but it doesn't have more than a handful of BGP-fed routes for internal networks only.

On these router there are on the 500k routes.
I have waited up to 40 minutes even following an additional reboot.
No luck

The rest of the network I also upgraded it to 7.10.x and did not experience any particular problems except with some 1100AHx2 that make kernel failure and I replaced them.
However on the others I have private bgp with a few thousand routes.
On the 1072 I have a lot of traffic and many more routes

kryztoval · Thu Aug 03, 2023 11:55 am

On this version I am still getting "Association SA Query timed out" after a few days of the device being online (Almost at 5d8h was the time it appeared)

I refuse to restart the device because restarting it is not a viable solution or workaround for this issue, and since I am only using this link to connect 2 ax2 between each other it gave me an opporunity to make some tests.

What worked: Reversing the mode, turning the AP into a station and the station into an AP allows the connection to be made
what didn't work: disabling and re-enabling the interfaces.

I wonder if it will fail again eventually but now in the other direction, and I wonder if it will be fixed if the direction of the connection is changed again. I guess we will see :)

pe1chl · Thu Aug 03, 2023 12:08 pm

Well, the fact that you could reproduce it on a link between two MikroTik devices at least indicates that it is not related to what some obscure other device is doing... that should help in the resolution of the problem.

Thu Aug 03, 2023 12:10 pm

Maybe better to use 7.11 version then (I know, rc1, not yet stable). There have been quite a bit of wifiwave2 related changes there as well.
It could be the issue is already fixed.

kryztoval · Sat Aug 05, 2023 2:29 am

@pe1chl Well, sure, the fact that it happens over 2 mikrotik devices that are the only two connected to that wireless link as it is used as a bridge should help but, sadly, I can't reliably reproduce the error.

@holvoetn Yeah, that could be the case, but this error (at least for me) shows up after a few days. In my experience around 5 days of uptime. Inverting the station/access point settings for the link has kept it running for this time but I can only be certain if it hangs in a few more days.If it comes back again I will consider changing its branch.

Still kind of sad that I have 7 AX2 and I can't use them because of this wireless disconnection.

kryztoval · Sat Aug 05, 2023 9:04 pm

I woke up today to find out that the MPLS/VPLS interface was down, checked the logs and it went down because wifiwave station reported "disconnceted, reason code 3, signal -51) and wifiwave ap reported "disconnected, association SA Query timed out) for about 31 minutes. The link stopped flip-flapping on its own. However, the VPLS connection was lost and it did not recover.

What seemed to fix the VPLS was connecting to wifiwave station and disabling/enabling the vpls interface. No other changes.

I am wondering why the interface did not reconnect once the link recovered and connectivity was restablished.

spippan · Sat Aug 05, 2023 10:50 pm

What seemed to fix the VPLS was connecting to wifiwave station and disabling/enabling the vpls interface. No other changes.

I am wondering why the interface did not reconnect once the link recovered and connectivity was restablished.

had that issue on VPLS links also in the past when the underlying connection went down but came back up again but only a disable/enable re-established VPLS links.
haven't had a fix for that either than netwatch+script

rextended · Sun Aug 06, 2023 6:05 am

⚠️Security Issue: Changing rights / disable / delete the users has no effect on already logged in users. [Tested on 6.48.7 and 7.10.2]
viewtopic.php?t=198410

oe5nip · Sun Aug 06, 2023 11:12 pm

I have an installation with CRS125 + CSS326 + 260 with a lot of vlans.

After installation of this Version a lot of problems with the css326 + 260.

After downgrade to Long Term 6 all is ok.....why ?

kryztoval · Tue Aug 08, 2023 10:07 am

@spippan I have no issues with the VPLS link reconnecting, my issue is that the wireless starts saying "SA Query timed out"

And sure enough, it just happened on the new AP. But it fixed after disabling the wireless card for around 3 minutes.
Sadly this level of inconsistent wireless availability and low realiability makes the wireless unuseable on the ax2 on the 7.10.x release.

I am eager to try it on 7.11 as soon as it is released on stable :)

anav · Tue Aug 08, 2023 9:46 pm

Wow, according to some, caveat - 'opinion with bias', version 7 has been stable for a long time. No definition of long provided --> ?4 inches?

quote ( Bearded Viking Imposter! ):

"Since RouterOS v7 is stable for a long time, there is no use to keep separating discussions. Please use the forum sections according to feature, not version. If a topic you started is behind "locked", sorry, try to continue the discussion in another section. There was no way to lock only new posts, without locking old ones.

As always, please report reproducable bugs to support@mikrotik.com regardless of the version. Forum is for discussions until you are sure it's a bug. When you are sure, report to MikroTik directly, not in the forum. Forum, as it always was, is for user to user discussion and speculation. Not for reporting bugs to MikroTik.

Thank you."

ch36mikrot · Fri Aug 11, 2023 4:00 am

I think we have isuee with Letsencript the multi dns has problem:

progress: [error] could not resolve '01.abc.xyz,'02.abc.xyz,'03.abc.xyz'

Can't resolve the dns when is multiple with single the is no issue

I encountered this problem several days ago.
After I downgraded to 7.92, the function "enable-ssl-certificate dns-name=01.abc.xyz,02.abc.xyz,03.abc.xyz" became normal.

Tue Aug 15, 2023 3:21 pm

RouterOS v7.11 has been released
viewtopic.php?t=198641

Who is online