MikroTik

copying community attribute will be fixed in the next beta.

Lease time doesn't do anything to the flash disk. Leases are dynamic and are not stored in the config.

I do not understand how distance is related to attributes being transferred or not, these are completely unrelated things. Also, BGP attributes are forwarded in both cases whether it is iBGP or eBGP. To run BGP best path between BGP routes received within VRF and imported vpnv4 routes, you have to s...

Hit F5 to refresh the window.

https://en.wikipedia.org/wiki/Microsecond

check v7.9beta4

Check v7.9beta4

https://help.mikrotik.com/docs/display/ ... hSelection

Distance problem will be fixed in the next beta version.

HW candidate routes can be only active routes and with the HW flag set.
Filtered routes will never be active.

I believe he means "discard from memory". It is not possible, input-nlri and others are used to discard fast, regexps are not fast so are not available as a method to discard bgp update messages directly.
You can only reject with filters.

There is no bug, a destination must be resolvable in the main table too.

Unfortunately, I cannot guess the IP addresses, the gateway should be the IP address of the host behind which the network is located.

Not exactly sure what do you mean by this: However, the routes that are being announced by the mikrotik is being sent to the correct vrf as well as the main routing table of the ibgp peer. If you mean networks that you announce by adding /routing bgp network entries, then yes these entries are sent ...

I already mentioned what is wrong, you cannot use interfaces as gateways on broadcast networks, set IP address instead of an interface. Such setups didn't work reliably on any version including v6.

Setting the interface as a gateway over broadcast networks is an invalid setup.

Even long before chatgpt, there were scripts with invented commands and syntax that never existed in RouterOS.

routes on PE received from CE and ones imported from vpnv4 are treated as routes from different instances, so bgp best path selection is not applied here. v7 was initially made to work similarly to v6 until a proper solution is developed. This feature is currently being worked on, so you might see i...

OSPF relies on multicast to send HELLO packets, altering those multicast packets in any way (including igmp proxy, nat etc) will cause OSPF not to work properly. and after inquiring if this was expected behaviour I got As mentioned previously, OSPF may not work properly with features enabled that a...

BGP uses BGP attributes to pick best routes:
https://help.mikrotik.com/docs/display/ ... hSelection

print where x.x.x.x in dst-address

Not enough info, send a supout file to support.

https://wiki.mikrotik.com/wiki/Manual:U ... attributes

not enough information. If it is multihop bgp then probably you need to adjust scopes to recursively resolve the gateways of BGP routes.

In ROSv6 BGP Networks are always sent to all instances. You need to use routing filters as pe1chl already mentioned.

by default routes from one instance to another instance is not redistributed unless you have enabled redistribution in the instance config.

I do not know why you cannot see bgp parameters unless those routes are not BGP routes" [admin@dr_05] > /routing/route/print detail Flags: X - disabled, F - filtered, U - unreachable, A - active; c - connect, s - static, r - rip, b - bgp, o - ospf, d - dhcp, v - vpn, m - modem, a - ldp-address,...

You already can see routes received by specific peer before and after filters and all the attributes. See /routing/route menu

That is not entirely true. Cisco by default works similarly. You have to explicitly enable "bgp always-compare-med".

Read more here:
https://www.cisco.com/c/en/us/support/d ... p-med.html

RouterOS currently do not have such options to play with.

That is what I have asked previously where is the magic? If both consoles are using the same source port and the same dst-address with the same dst port, then, when 1.2.3.4:3478 sends packet to 3.4.5.6:12345 what magic should happen for router to guess which one of 192.168.88.x:1234 is the real rec...

The reason is simple. When you have a host that initiates a stun connection request to 1.2.3.4:3478, and the IP of the game console is 192.168.88.10 and the external network IP is 3.4.5.6, then using netmap, it will look like this in the firewall-connection: src-address=192.168.88.10:12345 dst-addr...

Dir is RIP route, and it cannot cause any actual forwarding problems because this route is inactive.

here is fullcone NAT from cisco and juniper https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/217599-understand-nat-to-enable-peer-to-peer-co.html From that cisco manual: Cisco IOS® routers' NAT implementation when it performs PAT is symmetric by default. Therefore, you ...

We can implement it and maybe call it "tetrahedron nat" to avoid confusion.

But that is what I am trying to say, what you describe does not match the definition of "full cone nat" in RFC 3489. It is something else. Do you know any standard, document/specification, or RFC that describes this type of nat? Or it is just someone's interpretation of what a "full c...

No wonder that rfc 3489 is obsolete and does not mention any cones or other shapes of NAT anywhere else.

You keep mentioning rfc3489 which clearly says what "full cone nat" is supposed to be. "A full cone NAT is one where all requests from the same internal IP address and port are mapped to the same external IP address and port. Furthermore, any external host can send a packet to the int...

Full cone nat is just a fancy name for 1:1 nat or static nat or whatever you want to call it. It is achievable in ROS by adding one srcnat and one dstnat rule, thats it. Or by "full cone support" you mean adding checkbox "enable full cone nat" next to "enable nat" in qu...

That is not a full cone but restricted cone. Restricted Cone: A restricted cone NAT is one where all requests from the same internal IP address and port are mapped to the same external IP address and port. Unlike a full cone NAT, an external host (with IP address X) can send a packet to the internal...

RFC states: Full Cone: A full cone NAT is one where all requests from the same internal IP address and port are mapped to the same external IP address and port. Furthermore, any external host can send a packet to the internal host, by sending a packet to the mapped external address. So full cone con...

Any modern competitive game uses client-server approach, for others mostly uPnp is enough, so it is only some edge cases that would benefit from cone NAT.

Dynamically discovered neighbors were always dynamic, so it is not clear what exactly you are asking.

ROSv7 static route is only when you manually add it by hand. Routes added by VPN protocols are vpn routes.

SNMP has timeout, if you are trying to monitor something that could take a lot of time to process, then it will time out, for example large routing tables.

Right now we are working on changes to get full set of BGP attributes for ip routes in the vrf.

Yes, that is correct, currently BGP is not copying BGP attributes from VPNv4 route to copy route.

v6 does not allow to set interface list in vrf config, v7 does and solves all the problems with dynamic interfaces and vrfs

Adding dynamic items in the static config is not a good idea. v7 solves this problem by using interface lists. how the issue has been solved in v7? As far as i know if the dynamic interface disappear, will also affect in to interface lists. There are different methods to add interfaces to interface...

And still a -1 to the :execute changes here.

:execute change was a mistake for this beta and will be fixed in the next beta.

Set dummy IP on the Windows, routeros default config is to apply config to the router not on windows.

Changing config in the VRF will flap the VRF. Instead I would suggest to add static entries for each l2tp user in /interface l2tp_server and use that for VRF config, instead of adding dynamic entries and then trying to deal with the consequences via scripts.

Adding dynamic items in the static config is not a good idea.
v7 solves this problem by using interface lists.

Try to set some dummy IP in ipv4 settings (instead of dhcp). Windows may not send out broadcast packet if there is no ip config.

It is printed only when you run it manually from the terminal. The point is that you can use it in the scripts.

Another big one is "count-only". You can print count-only, but you cannot "get" it. And when you print count-only you cannot use "as-value". Not sure what do you mean by "get", if you mena to use the value in scripts you can certainly do it [admin@3C22-atombu...

You can definitely run BGP and other services on the same router, bout you must understand the limitations when you are running multihoming setup.

v7 default is reject

NAT is not needed for policy routing. It works exactly as for ipv4, add routing table, mark connection, mark routing and set routes in the routing table.

multiple different local AS numbers and/or multiple different router-ids breaks BGP sessions in multiple instances.

BGP Best path selection works only if sessions are in the same instance, in your config obviously each session is in separate instance.

No, there is nothing wrong in your setup.

AS path can be encoded in two ways, as set and sequence.
Warning indicates that peer received aggregated route where part of the as path is encoded as set and other as sequence, and converts whole as path to as set.

It is already fixed in v7.7 and v7.8betas

You have two different local ASes, which is considered to be two separate BGP instances. You need to run one instace (preferred) or enable output.redistribute=bgp

L2MTU is only on interfaces of MikroTik manufactured devices. Generic drivers do not have L2MTU support.

It is not a bug.

As it is mentioned in the article you cannot disable synchronisation.

we are currently having issues to advertise networks that are not static assigned within the /ip address or static routes from both ends using eBGP.

https://help.mikrotik.com/docs/display/ ... s-Networks

You can find examples on how to do this here: https://help.mikrotik.com/docs/display/ROS/Moving+from+ROSv6+to+v7+with+examples#MovingfromROSv6tov7withexamples-RoutingFilters and here, you can also find how to use new BGP as path matchers: https://help.mikrotik.com/docs/display/ROS/Route+Selection+an...

/routing ospf neighbor print shows the IDs of the DR and BDR.

v7 do not have this problem.

bgp-as-path-slow-legacy has the same syntax as regexps in ROSv6, so the same regexp should work in ROSv7.

what and where exactly is doubled? As far as I can see routing marks are exactly the same number as being added, nothing is doubled.

Not enough context to comment on this. What was tested and what exactly failed?

New "home oriented" devices come with a password from the factory, the password should be on the label.

OSPF can distribute only best route. There is no way that route with distance 2 is also active at the same time when route with distance 1 is active. So OSPF always distributes the first route. When the first route becomes inactive route with distance 2 will become best and will be redistributed and...

Because you are dropping it in input chain. Add rules to accept ICMP and any other protocol to make it work or add rule to accept established connections.

checksum problem is fixed in v7.7rc4

Moved to /routing/bgp/advertisements in the final version.

RouterOS DHCPv6 server can delegate only prefixes, for your setup, you will need to continue to use dnsmasq
https://help.mikrotik.com/docs/display/ ... CPv6Server

You do not need /30

/32 works with /31 on the remote side.
It may not work if your mentioned firewall is not set up properly and blocks the traffic or incorrectly set up a routing table that does not allow route traffic through the router.

We are well aware of theoretical usecases.

What is being asked is use case in the real setup and why the route rules were used instead of other means to achieve the goal.

We would like to know the typical use cases of routing rules and the reason why such an approach is used.

IPv6 DHCP doesn't bind to mac address, but to IAID and DUID

if you are using GCM only then set auth-algorithms=""

When BGP was configured on v7 between this address and the address of the remote (a fixed address in the /24) it would not work without multihop. But now it does.

That was fixed a long time ago.

BGP is advertising only active best route and does not accept advertisements if best route is receiving router. So in triangle setups like illustrated above you will never get a full copy of all the BGP feeds on all the iBGP routers.

multihop is no longer required for ebgp with link-local addresses

Documentation examples have exactly what you have asked in your original post.

== measn "equal" so, no, dst==0.0.0.0/0 will not match everything, because 0.0.0.0/0 is a default route

https://help.mikrotik.com/docs/display/ ... ingFilters

https://help.mikrotik.com/docs/pages/vi ... edfeatures

bgp multipath / add-path is not implemented.

bfd is not implemented at the moment

you can't

Safe mode works only in ineractive mode.

Winbox just like in many other places just takes the info from somewhere else, in this case it just compares the lease mac address with bridge host table entries and shows the port.

You can start by checking this article
https://help.mikrotik.com/docs/display/ ... h+examples

BGP looks for both ipv4 and ipv6 address lists with the same name.

It could mean that ROS do not see IPv6 hello packets, most likely because Juniper LDP iv6 is by default disabled.
Maybe this helps:
https://www.juniper.net/documentation/u ... v6-support

originate-default generates type5 lsa, which is not flooded to stub areas, this is true for any vendor.

Not sure why you think that link to the backbone and originate-default should relate to STUB area.
When you set ABR for the stub area, you are setting the exit point out of the stub area which means that ABR should inject default route (and summaries if configured to do so) into the stub.

If you mean ip->route list in winbox, then it is a known winbox issue, that it can show other AFI routes not just IPv4

"dst in address-list" means that it will check if destination is in address list (exact match) "dst==10.0.10.0/24 && dst-len>24" - does not make sense, destination cannot be equal to 10.0.10.0/24 and at the same time have netmask larger than 24 last example is the correct...

No it is not related to affinity.
You need to make sure that local as and local router-id are identical on all the bgp sessions.

1. For BGP to redistribute received routes from upstream, both peers must be running the same instance.
2. For "BGP networks" to be advertised there must be corresponding IGP route in the routing table.

and the inability to discard prefixes in incoming filters (instead of just rejecting them which makes them stay around wasting memory) are in the same category of totally unacceptable bugs remaining in production software.. This is not a bug, if you really want to discard then you can do it with in...

because delete returns ids that i has deleted, since you did not delete anything array is empty.

QUERY is not supposed to work that way.
You should use query to get item IDs, and then use those ids to execute delete.

Should be pretty easy, something like this: /routing ospf instance add disabled=no name=i4 add disabled=no name=i6 version=3 /routing ospf area add disabled=no instance=i4 name=bb add disabled=no instance=i6 name=bb3 /routing ospf interface-template add area=bb networks="1.2.3.0/24" add ar...

Yes it should be enough if connection does not have any filter chains set.

See this
https://help.mikrotik.com/docs/display/ ... figuration

Add another instance for ipv6

It's an easter egg

Another useful tool could be /console/inspect.
You can request completion, the list of child menu commands and parameters

In that topic ECMP is not the result of BGP best path selection. You can get ECMP by running bgp on a loopbacks recursively resolved over ECMP, or by running two BGP instances, but then best path selection will not work. As I already mentioned BGP multipath is not implemented and was not implemented...

It is not supposed to work. BGP elects only one best route. BGP multipath is additional feature that is not implemented yet.

FYI IPv6 ECMP in ROSv6 does not exist. RouterOS was able to handle ECMP Ipv6 routes, but actual forwarding can happen only over one gateway.

~ in api is not valid, you cannot use regexps that way.
Any parsing or filtering with regexps must be done on the APP side.

"F" - filtered, means what the name suggests, routes filtered (rejected) by routing filters.

https://help.mikrotik.com/docs/display/ ... ingFilters

Memory limit is unrelated to this OP problem.

Check if for second BGP session local address is picked correctly.

Maybe this is useful? You can get the list by calling:
http://ros_adrese/webfig/list

Received unsupported capability is not the cause of the session not working. Unsupported capabilities are ignored. Most likely there is misconfiguration, typically BFD enabled or non-matching local or remote addresses configured either on ROS or on the remote peer. You can send a supout file and pca...

What exactly you consider as failure? As far as I can see from your output all rules from In_MyISP chain are converted correctly.

And some of your v6 rules doe snot make sense either, why do you set and append communities to empty values for routes that you are discarding anyway?

In case of asymmetric routing make sure that you are not using any of the connection tracking related features.

If you are not using OSPF then delete the instance.

The best path algorithm also compares routes received only by a single BGP instance.

There are two things: 1) SSTP session that sends/receives control packets and encapsulated packets 2) Trafic that should be encapsulated And each can be in its own VRF. * By specifying connect-to ip@vrf you are telling SSTP to establish session from the specifed VRF * by adding SSTP interface in the...

The point is to get the ability to establish the connection from the vrf.

It does not show the whole picture, is the added sstp client part of the vrf too? If not then it is the expected behavior because sstp interface is in the main table.

/routing/bgp/advertisements/print now shows a detailed list, where on rc1 it showed only a summary. There was a "show" command that showed the full list. So now I tried /routing/bgp/advertisements/print count-only to see if it maybe shows a summary only. It showed: 704 no such item (4) Fr...

ipip support did not make into 7.6 release. The OVPN client, which you initially asked for, works.

https://help.mikrotik.com/docs/pages/vi ... edfeatures

At this point, IP Accounting is ancient history and will not be added back.

ROS v7 DO share eBGP routes by default, so most likely it is a misconfiguration. For example, all BGP sessions are not part of the same instance, setting different router-ids for each session makes it run as separate instances.

That is not a problem on your side, you should contact the remote peer maintainer to resolve the issue.

I assume that remote peer is also MT?

BGP redistributes routes received from other bgp sessions from the same instance without needing any redistribute settings enabled. Either sessions are not from the same instance or you have set routing filters to block something. Advertisements can be seen if you install v7.6rc and go to /routing/s...

Currently as-override and some other AS Hacks are not fully implemented.

Currently there is a bug, that resend,refresh is stopping the session. Will be fixed in the future.

Returned type is an array of a single element, get command does not accept an array, either use pick command to pick the 0 element of an array or if you are sure that there is only one element then convert array to string with :tostr command

Dumb question, is area1 or area 2 set as a backbone area?

It can be done by running a script on a dhcp client. You can get the received gateway from there and add the route or change the existing route.

Not really sure how it is supposed to work, route requires the gateway with @vrf you are just specifying in which table to resolve the gateways IP.

No, during failover you will need to nat those public IPs to other public IPs from the second ISP.

If you want real failover for clients with public IPs, then you must have to get your own public network and then advertise it to your ISPs with BGP.

Filters support completion, you can press <tab> to get available options

if (bgp-large-communities equal 200001:200001:10) { <add actions here> }"

Please wait for the next beta where this particular problem should be fixed

However when I apply this filter /routing filter community-large-list add communities=1016:65102:4 list=bgp-community-large-1016-65102-4 routing/filter/rule/ routing/filter/rule/set rule="if ( bgp-large-communities equal-list bgp-community-large-1016-65102-4 ) { delete bgp-large-communities al...

command delete bgp-communities all doe snot exist
if you want to delete everything from bgp-communities then use

delete bgp-communities wk,other;

you adjust nexthops with gs and gw-interface parameters

Currently, also the output is a large string blob, not really easily usable for filtering let's say by prefixes and communities like in your example.
That is why we are asking for as much feedback as possible to know in which direction to move.

the main reason why it is not in the BGP submenu, is because the adverts will be able to show advertisements also from other publishers, not just a BGP peers.

It appears that prefixes sharing common attributes are grouped together with the attributes at the bottom. It would be nice to get this output in a format like routing/route with headers and have the output aligned in rows/columns. Since it is a direct output of the data that is sent to the remote ...

New /routing/stats/adverts menu, feedback, and suggestions are welcome. The stats should be made available as part of /routing/bgp/session instead of as a separate menu. So it can be displayed as a column in the sessions window and on the stats tab of the detail window of a session. not really sure...

Need adverts prefix send peer bgp

what do you mean exactly?

New /routing/stats/adverts menu, feedback, and suggestions are welcome.

delete bgp-*-communities

If you want to stick to v6, then increasing OSPF dead-interval and BGP hold-time may help. Also, make sure that timers are at least set to default values or higher.

This particular problem is solved in ROSv7 by running OSPF and BGP in separate processes.

BGP attributes must be set in the routing filters. Setting BGP attributes for non-BGP routes did not make much sense. It was only good for testing, aka an easy and fast method to generate fake BGP routes.

https://help.mikrotik.com/docs/display/ ... -Queryword

add /20 blackhole route

"Wrong checksum" problem will be fixed in the next beta

You cannot use TE tunnel directly, you have to set up something that can use TE as a transport, like VPLS then add IP address to the VPLS.

ROSv6 had hacks to guess what ipv6 nexthop to set automatically. In case of eBGP on a shared network it is easy and we can get and use link-local address, which we will add as a feature in the future. But in other cases you would still need to adjust nexthop with routing filters according to your ne...

You can define the source address of the session by setting local.address And what exactly is the bug in v7? DIbH 4700:1100::/29 ::ffff:10.230.0.111 ? This route is not a bug, that is what you get when ipv6 prefix is sent over the ipv4 session, gateway is ipv4 mapped address. Exactly the same gatewa...

There is no linux support for address lists for route rules. If you want to use more advanced matching then use mangle.

Make sure you have correct local.address set.

ptmp-broadcast in v7 operate the same as ptmp in v6, both are using multicast to discover neighbours.

Probably something like:
65530[min-max]?[min-max]?$

where [min-max] is the range of ASNs you want to match.

Also, you can still use old string matching with the "bgp-as-path-slow-legacy" parameter.

I see another problem. I went to ppp and changed the name of the vpn connection. In ip/route the name was not automatically changed making all the static routes through this vpn invalid. See? this is why the previous behavior was far better. This is completely false. Interfaces are referenced by ID...

but you will be surprised how many users are setting dynamic interfaces in static configs.

if address is not correct, then it is a socket error, most likely there were logs entries saying something about not able to open socket.

Typical problems why BGP session is not established:
* missing correct local address
* enabled BFD on one of the sides.

Very similar examples already exist in the documentation.
Your example would be:

/routing filter rule add chain=xxx rule="if (dst in 192.168.0.0/16) {reject} else {accept}"

VRF lite is cisco terminology for VRF setups without MPLS.

yes it should fix various reported ping issues

no there isn't,

write in the terminal "get 0" and press tab to see all the valid parameter names.

From which menu? Are you sure that this parameter even exist in the menu you are trying to get it from?

routing->rules

Set show columns to show "routing table"

Same as in v6. Is the redistribute=ospf not working?

It's not like you have thousands of VPN tunnels that you need static routes for so typing a name for few routes should not be a problem, or write a script that does that for you automatically when VPN connects. By not allowing to pick interfaces it prevents from making a lot of bad configs.

And most likely wont be. In typical configs where interfaces were set configuration was invalid.

You can try two OSPF instances and redistribute routes from one instance to another.

It is better to disable feature that is generating opaque LSAs. Especially if Ubiquity is generating corrupt body. Run a packet sniffer to see if the arriving messages are actually corrupted.

You can filter only external LSAs. What device is generating those opaque LSAs with corrupt body?

m? if you disable connection none of the helpers will work, because they depend on connection tracking.

by disabling connection tracking.

There is no documentation about variable referencing because RouterOS scripting does not have referencing concept. Set should perform deep copy which it apparently did not in ROSv6.

Works for me on v7 too.

Depends on how you are trying to run that code, if you paste it in the terminal then whole code must be in {} braces otherwise local varaible expires in next line.

I believe it was answered several times. It is a known reported problem, but this message does not affect the operation of the OSPF. You can ignore it until the problem is fixed.

https://help.mikrotik.com/docs/pages/vi ... edfeatures

ip route menu does not have protocol specific parameters. It should be used only for static route configuration and probably quick route view.

Use routing/route menu

https://help.mikrotik.com/docs/display/ ... CMP)routes

This is unrelated to v7.4rc release, ask specific scripting questions here:
viewforum.php?f=9

count-only will also show zero if there is no session.

If there is no session then there will be no counter. It won't help in case of md5 mismatch because connection is dropped before BGP can see it.

Search found 6870 matches