MikroTik

jprietove

It's not necessary, but I think it's good to do it: instead of letting the router to choose the Router-ID, choose one yourself and propagate it through your network.

This way, you can always get (to the router that) you want. (read this like the Rolling Stones would do it)

jprietove

Well, sorry if this is off-topic. @anav, my contact details can be found on Trainers page of MikroTik. Also on Consultants.

I've done that configuration before. I don't have a router near to check it, but it looks good.

jprietove

PcComponentes is a general computer store, the other ones are more professional oriented.

You only have to know where to buy and where not.

jprietove

Tested in CHR new install, not coming from an upgrade.

jprietove

Reported with #[SUP-100809]

jprietove

I'm sorry but I can't see any duplicate. The blank entries shows no identity because, probably, they're not MikroTik devices. But other vendor devices, using either CDP or LLDP.

jprietove

Hello, I have been testing 6to4 tunnels and RouterOS reboots with critical kernel failure when packets are forwarded by the tunnel. This has been tested in v7.5, v7.6 and v7.7rc1. Simple scenario: R1 ether1 ----- RX ---- ether1 R2 # R1 /interface 6to4 add !keepalive local-address=192.168.1.2 name=6t...

jprietove

Search in this thread: viewtopic.php?t=116364

jprietove

Try using pppoe-interface as gateway, instead of the IP address.

jprietove

Bridge has 1458 as MTU. It is because eoip tunnels that are members of the same bridge.

Change MTU of EOIP tunnels to 1500 and make sure Bridge actual MTU changes to 1500 also.

jprietove

Check mtu on your configuration. Probably you have some misadjustment.
Post your configuration here if you need help

jprietove

I don't have any BGP instance, or if I understood correctly mark in the OSPF instance the BGP propagation. But in that case it has no effect. Redistribute-connected makes PPPoE network to be considered as external. In the end, if there is another way to make the pppoe not propagate along with the o...

jprietove

I've contacted with support and the answer is:

In v7 configured area is always active (no influence if there is any network added or not).
If an area is not used please disable it.

Yes, the behavior in v6 was different.

So, this behavior is a feature and not a bug

jprietove

Hello, I've been testing OSPF in v7 and, as expected, configuration is different than in v6. Details are provided in https://forum.mikrotik.com/viewtopic.php?t=186087#p934154 but, as I checked the topic as "solved" maybe it won't be read. So, when using RouterOS v7.3beta40, in a very simpl...

jprietove

I've been testing more and I've found a detail... that shocks me. If in IR a new Area is created, the default route doesn't appear!. It doesn't matter if there is no network in the new area. So maybe in this case this is a Bug. I think IR role should be determined by only having networks in one area...

jprietove

In v7 "default-cost" must be configured for the stub area to get the default route originated.

Thank you very much! That was! I wan't aware of this change.

jprietove

I am testing OSPF with new RouterOS v7.3beta40 and I have found that in a STUB Intra-Area Router, the default route is not created. I am not sure if I it is my mistake or it is a bug. I have create a very simple scenario to test it: one router as ASBR with default-originate in backbone area. One ABR...

jprietove

I finally found it was my mistake. R3 and R2 was assigned the same ID. When corrected, everything work as expected.

jprietove

Hello, I've been testing OSPF in v7 and I think I've found a bug with adjacency establishment. I've configured the same scenario in GNS3 using x86 images of RouterOS with v.7.3beta40, v7.2.3 and v6.49.6. Results in v7 are not the expected. Results in v6 looks good. The scenario is this: Selección_12...

jprietove

Post your export here:

export file=anynameyouwant hide-sensitive=yes

jprietove

/ip address add address=83.xxx.xxx.158/30 interface=ether1
/ip route add gateway=83.xxx.xxx.157

jprietove

As RR as mode (default) doesn't use transmit-hash-policy, try using mode=802.3ad or mode=balance-xor.

jprietove

Well, the truth is that I wrote the commands with no router with me, so the syntax error.

About masquerade, I thought you had that rule previously created.

Does it work? Use tool sniffer to check if priority is being used

jprietove

Try this: /interface list add name=wan-p2 /interface list member add list=wan-p2 member=vlan2900-WAN /interface list member add list=wan-p2 member=fibre-pppoe /ip firewall mangle add chain=output out-interface-list=wan-p2 action=set-priority new-priority=2 /ip firewall mangle add chain=forward out-i...

jprietove

VRF makes connected routers to be in a table route, instead of being in the main table.

jprietove

If R1 has two areas, it's then an ABR Area Border Router. It's configuration is wrong.

Put all is networks in the same area.

Same apply to RE.

So only R2 is the ABR.

jprietove

You can use Radius for authentication purpouse and enable any of the many 2FA plugins. Check, as an example, FreeRadius with Google Authenticator or Latch (from ElevenPath)

jprietove

Just a few post ago someone was v7 is unfinished and unreliable? Everyone has an opinion, and every use case it's different. If you can, give it a try. If it fits you, ok. If it doesn't, well, you'll be as bad as now. I think that your configuration is simple and probably will work well. But we won...

jprietove

IMHO, try v7 with her offload routing. It should fly!

jprietove

Well, some of us are waiting for docker containers to be ready. This could be another aproach: you have a Server with lots of services (LibreNMS, Radius, IPERF....) and RouterOS directly connected to it. Instead of having things running inside RouterOS, you have your RouterOS side-by-side with them....

jprietove

Instead of using IP as gateway for your routes, you can use the interface itself, as they are Point To Point.

jprietove

In the configuration template, use this values:

Selección_937.png

jprietove

BUGS in Layer 8 are much older than 14 years... and will last forever

jprietove

I download and installed in GNS3 the chr-6.49.2.img and it works, but I also need the same "switch" menu in Winbox I see for my real hap ac2 Switch menu only is shown in devices that support it. CHR has no switch-chip inside, so you can't simulate it... and you won't see the menu option i...

jprietove

He is using CHR image, not SWOS or similar. He is explaining Bridge configuration for CRS3xx but using a CHR image.

From GNS3 you can download CHR image from their repositories

jprietove

Could you try it with -P 4? It may interesting if reverse id different. You can then test with two client at the same time: In the title you have stated 7.1.1.1 and that can be confusing to many. I will try this weekend again. I was testing with only one stream because I was interested in TCP file ...

jprietove

Are you sure ?

Tests uses 2 streams. In wiki you have more information: https://wiki.mikrotik.com/wiki/Manual:T ... mance_test

jprietove

I would expect better performance on wireguard and IPsec... Test results on both 4011 and 1009 ... as far as IPsec is concerned, is about 500 Mbps for both, for 512 bytes of packet... Yes, but published data is in both directions (so 1Gbps link would be 2Gbps bandwidth) And my results are only in o...

jprietove

I have performed some test using RouterOS v7.1.1, all the devices with Connection Tracking disabled. The topology is: PC1 <--> CCR1009 <--> hAP AC3 <--> hAP AC3 <--> RB5009 <--> PC2 Using iperf3, TCP one stream, performing 3 tests of 10 seconds and getting the average value. With pure routing, the b...

jprietove

After reading the title I thought that this thread was about @anav getting more aggressive than usual

jprietove

It could be useful if you provide an export of your configuration:

/export hide-sensitive file=configexport

jprietove

[quote=mozerd post_id=902834 Collaboration is far easier with TailScale …..
[/quote]

So bored about your constant spam... Please, we DO know that it's the best thing, but be polite and don't get dirty every thread of this forum.

Thanks in advance

jprietove

Post your config, please.

jprietove

I use X86 architecture with e1000 network card. This way I can test performance, queues... Also I use CHR with virtio when I don't mind about 1Mbps limit

I use gns3 gui and server locally installed on my laptop: i don't use Gns3 VM

You can get to me using my username at Gmail or DM with Tweeter

jprietove

Well, I use gns3 also, latest version in Ubuntu 20.04LTS
Works good, switch also

jprietove

I sent this case to Mikrotik support.

Well, it works with v.7.1.1

Selección_860.png

jprietove

Why mikrotik change OSPF configuration syntax in so radical way?
Thanks, but no thanks. I will use existing 6.49 or secondhand (refurbished) cisco routers.

Not related with topic. Please, don't disturb

jprietove

Well, it cost me a lot to see that both R1 and R2 has the same Router-ID: 0.0.0.2. And no, there is no need to publish 192.168.10x.0/24 as you have selected 'redistribute connected' in your instance

jprietove

Happy to see that this bug has been solved in v.7.1.1

Now, when enabling R4 it get elected as DR and it's as fast as ffrouting changing R1 from DR to normal router.
And also, R1 status change from "ExStart" to "Full".

Thanks team! Good work!

jprietove

Posting your configuration could be useful.

jprietove

Try using BFD https://wiki.mikrotik.com/wiki/Manual:Routing/BFD

jprietove

You missed the networks you want to publish. In R1:

add area=backbone networks=192.168.101.0/24

And so on...

jprietove

The particular use case is to prevent routes advertised by Neighbor A due to a bug from spreading further to the network

I think you can use two different OSPF Instances in your router, using redistribute-other-ospf. With different OSPF Instances, you can use ospf-filters between them.

jprietove

I would try with /30 instead of /31

jprietove

Tested same scenario but this time with IPv6 and OSPF-v3: again, the router that was DR doesn't like to give the Designation to the new DR and neighboring status keeps in "ExStart"

jprietove

Can you please enable ospf debug logs, trigger exstart state problem, generate supouts and send those files to support?

MikroTik support #[SUP-68898]

jprietove

R4 will elect itself as the DR after it looses adjacency with other neighbours. After the link is repaired a new election will happen with 2 DR present and R4 wins because of 'higher' router-id. Yes, thanks. It's not the same as 'cold-boot' I see now... I thought it would be the same as it happens ...

jprietove

More about this. I created the same project with RouterOS v.6.49.1, started all routers from R1 to R4, so R1 gets DR and R2 BDR. After suspending R4 link, wait until timeout and resume the link, R4 gets also elected as DR and ping from nuc-1 to nuc-2 loose 10 packets (10 seconds). And the same proje...

jprietove

In order to test OSPF in RouterOS v7.1 I've created this project in GNS3: project.png BUG: When routers get out of OSPF and after some time they come back, adjacency isn't recovered and DR election seems erratic. The configuration is the same for every router, changing only IP addresses: # R1 config...

jprietove

Very interesting results. Thanks for sharing!

jprietove

Sorry, I didn't... I will give a look and I'll tell you Well, quite a bit late. I am testing OSPF and BGP routing in new v7 and updating my training documents for v7. So I tried this and yes, routes flaps in v6 AND routes still flaps in v7 after DR goes down. [Edited] But, packets are lost in trans...

jprietove

It would be great if you post your configs here.

/export hide-sensitive file=r1

Your screens show IPSec stablished... but we can't see EoIP configuration or state. Please, post your config if you want help

jprietove

Instead of using gre interfaces as gateways, try to add an IP address on each gre interface and use it as your gateway. # Router A ip address add interface=gre-tunnel-sg address=192.168.162.1/30 ip route add dst-address=192.168.62.0/24 gateway=192.168.162.2 # Router B ip address add interface=gre-tu...

jprietove

Try to select ethertype in bridge:

/interface bridge set bridge1 ethertype=0x9100

jprietove

(Edited) For debugging, maybe it can help if you change ESP to AH at IPsec policy.
If the packet lose persist, you can at least use Wireshark to look into the packet.

jprietove

If your Certificate was generated including CA CRL Host, it should be accesible from http://<public_ip>/crl/<cert_id>.crl With <cert_id> equal to an internal ID that I haven't found how to get it. But if the CA Certificate was the first created Certificate, it should be 1. So try with http://your_ip...

jprietove

Why not?
With RouterOS you can use DHCP-Server, inter-VLAN routing, Firewall rules...
With SwOS only L2.

So if you don't need it, it's OK. But it can be very useful in many scenarios.
Same with CLI: if you have CLI, why do you want WinBox?

jprietove

You can create a TAP interface in your Host, attach one of your Guest RouterOS interfaces to that TAP interface. Now, your Host should 'see' your Guest and, if WinBox is installed in Host, you could configure your Guest using WinBox.

jprietove

Yes, you can use both: local and Radius users. If a user is in "secret" local database and in Radius, local database will be used. Only users not in local database will be searched in Radius

jprietove

Try this:

/interface print

instead of

/interface list print

jprietove

I'm using radius and the way u do just will assign to simple queues.

Using Radius Attribute "Mikrotik-Rate-Limit" you can assign a queue dynamically. https://wiki.mikrotik.com/wiki/Manual:R ... Attributes

jprietove

It seems like Bgp doing some work. Maybe updating routes or cache. Is route cache enabled?

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

Would it be the cable? Interface ether goes down and up, so it looks like a L1 problem.
Try changing it

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

43Gbps

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

If you are not using SNMP, disable it.
If you use it, Just change the SNMP community and don't use "public". And use v2 or v3 with authentication.

jprietove

I use pppoe, one server per each Vlan, not bridging them. 600 users at the moment with CCR 1036. No connection tracking. Simple queues in radius profile.
Works like a charm. Less than 10% CPU usage.

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

An

/export hide-sensitive

could help

jprietove

Queue Tree works on one CPU. If there's heavy traffic, this CPU get 100%. It's better to find a way using Simple Queues, so the workload is balanced over different CPUs.
Please, post your config and what do you want to achieve, maybe someone here can optimize it.

jprietove

https://wiki.mikrotik.com/wiki/MikroTik ... iber_links

Ccr2004 is not compatible. Look the link

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

So the question remains, how do I drop and blacklist any traffic above 6 packets per 8 seconds? What would be the correct expire value for it and why? The answer can be found on https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter : dst-limit (integer[/time],integer,dst-address | dst-port | src...

jprietove

/ppp profile set profile1 only-one=yes

jprietove

No, it shouldn't.

jprietove

If the three pppoe-clients are pppoe-out1, pppoe-out2 and pppoe-out3, you can achieve it this way. First, you need VLAN interfaces on the link to your switch. /interface vlan add interface=ether2 name=e2.10 vlan-id=10 add interface=ether2 name=e2.20 vlan-id=20 add interface=ether2 name=e2.30 vlan-id...

jprietove

Then you have to create as many pppoe servers as Vlan you need, one server in each Vlan. From the client to the server you have to tag your Vlan. I can't understand it any other way. It's true that pppoe server work in a broadcast domain, but every pppoe session is isolated from the others. I can't ...

jprietove

Are you sure you are making your scan from the interface called WAN?

jprietove

I think you should read https://wiki.mikrotik.com/wiki/Manual:S ... our_Router

Specially DNS Caché Section. It explains everything you should consider before exposing your router to Internet.

jprietove

Remove bonding at far-end first. Then remove it at your near end

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

Any Plan for Online Training/Certifications???

We have provided online courses during Spanish lock down, but certification exams should be in person.
So maybe you should contact to your country trainers

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

In general, attending a MUM or any other conference is about knowledge transfer and networking, also for you ?

[ironic]I became a Trainer just for using the coffe-machine in Latvia offices[/ironic]

jprietove

Yes, please! and don't forget to send us the t-shirt and device! I suppose that sending lunch is much more difficult

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

So you mean, I just leave everything as I have it set: thanks, by the way, this is very important. No, what I mean is trying this configuration: Server: /interface l2tp-server server set max-mru=1500 Client: /interface l2tp-client add name=l2tp-client user=l2tp-user password=123 connect-to=10.1.101...

jprietove

You use MRU and set it to 1500. L2TP slices the packets in one side of the tunnel and the slices can be reconstructed at the end of the tunnel.
It's different to fragmentation, because the reconstruction is done in the router and not in destination.

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

Do you have a good tip for a Linux BRAS router?

I didn't read you were using a CRS. You can consider using RB4011 as BRAS. It's affordable and can handle several hundreds of sessions.

jprietove

NTP is not available as an option. For DNS, use the option dns-server in ppp profile:

/ppp profile 
add name="pppoe-profile" local-address=10.1.1.1 remote-address=pppoe-pool dns-server=1.1.1.1

jprietove

Google took me here.
Shameless bump?

cant find a setting for sampling rate.

NetFlow does not have sampling rate.

Sampling rate is for sFlow, mainly used in Switches. At this time, RouterOS does not support sFlow

jprietove

Nothing like dripping sweat over your MT!! ;-) but who cares when the wine is so good, and the tortilla/tapas in the morning and gambas/calamari for lunch. Heck JP, forget the training lets just be degenerate (but only after early morning coffee and a 2 hour bike ride) !! Bike ride? Better a beer r...

jprietove

Why are you using 0.0.0.0 as source address? Disable it or put a valid IP, maybe that's the reason that Netflow is not reaching your server.

jprietove

Have you tried to enable 'EUI-64' in address? Maybe another device is trying to use the same address (prefix obtained with all the other bits 0). If you construct your IP address using the prefix + EUI-64 you shouldn't have this problem

jprietove

Also you can use SNMP https://wiki.mikrotik.com/wiki/Manual:SNMP#Run_Script

jprietove

For sure, use one PPPoE Server per VLAN. Much better than bridge them

jprietove

You can use Routing - BGP - Network. Add your network and un-check 'synchronize'.

jprietove

You should rewrite your config using new Bridge VLAN features for Hardware Offload.

https://wiki.mikrotik.com/wiki/Manual:I ... _Filtering

jprietove

Hello !

Is Router OS vulnerable to the CVE-2020-8597 ?

https://www.kb.cert.org/vuls/id/782301/

In the link you provide, it is stated that mikrotik is not affected

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

Fast forward is no use, its a switch with more than 2 interfaces

Then you should put here complete configuration, not only the one you stated.

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

Well, according to https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Fast_Forward conditions that MUST be met in order for Fast Forward to be active: Bridge Hardware Offloading is disabled So maybe this is the reason I'll try to setup a lab next week to investigate it Enviado desde mi Mi A2 med...

jprietove

It's strange.. I'm sorry but I don't have a Rb2011 unit over here and I can't do any test until Monday. But, could it be..?

interface ethernet switch set switch1 cpu-flow-control=no

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

It could help if you post your bridge configuration in both scenarios: with hw-offload enabled and disabled. Maybe you are missing something.

jprietove

Anyway, mum entrance is free. Just register. But if you can pay the very affordable price, you get much more than you pay: lunch, license, a router, coffee and beer also!

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

You can use tool netwatch without any script, just the ip address and the timing

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

vpls one side is up and other end is down help please, i have checked LDP and MTU on both routers but still its the same and i m stuck

Check IP address (/32) of both ends appears on routing table

jprietove

It really works. It's my configuration at home

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

No change. Did you test it?

Sorry, I didn't... I will give a look and I'll tell you

jprietove

Use LOOPBACK ip Address as Router-ID:

* R1, /routing ospf instance set [ find default=yes ] router-id=192.168.2.1
* The same in all others Routrers

This will solve all your problems

jprietove

Please provide export of the routers

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

Maybe I'm not understanding well but, are you asking about "export" command?

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

I don't know exactly what are you trying to do. If you want to execute a script in a MikroTik router you can follow this link https://wiki.mikrotik.com/wiki/Manual:SNMP#Run_Script Using the OID and with write permissions in SNMP when PRTG gets the data though SNMP using this OID, the script is execu...

jprietove

Even if it's not perfect, we'd love to start testing BGP/MPLS on ARM/Tilera!

And CHR also, please!!

jprietove

Just use Movistar ont as a Bridge. Ir is the usual way for ftth. Imho

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

I think he is talking about gpon. Have a look in this thread:

viewtopic.php?f=3&t=116364&hilit=Gpon

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

Exactly

https://wiki.mikrotik.com/wiki/Manual%3 ... #Interface

Well, not exactly because this is not OSPF-v3... it is (sorry for the mistake):

/routing ospf interface add interface=all passive=yes

jprietove

Not as easy when you have a few hundred vlans. Not bad to script but would be nice to have a simple checkbox to automatically have all interfaces as passive and then add the ones you want.

/routing ospf interfaces add interface=all area=backbone passive=yes

jprietove

Take a look at https://code.google.com/archive/p/flowd/

You have a python example code and it works nice!

jprietove

Any of you are using Ethernet port for something different of managing?

If it's used for routing, firewalling or anything it can hang the router

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

Cat 5 cable is not suitable for 1Gbps. Use cat 5e or, much better, cat 6

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

In my opinion you should consider migrate to BGP with ospf. With good planning it's not painful and it's not necessary to get clients without service.

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

It depends on the ccr1009 model. Not all shares the same block diagram

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

Acording to https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Bridge_Hardware_Offloading only CRS3xxx series supports bonding with hardware offload. It means that other devices do bonding with CPU. CCR1009-7G-1C-1S+PC has 9 cores so it can take 1 Gbps from each G port and bond them in total of ...

jprietove

Try using ether 5 and 6, for example. ether 1 to 4 are connected to switch chip and this chip is connected to cpu by 1gbps line. This may be a problem in performance. Check block diagram here: https://i.mt.lv/cdn/rb_files/CCR1009-8G-1S-1Splus-160128140835.png Enviado desde mi Mi A2 mediante Tapatalk

jprietove

I'm afraid that bonding is hardware offload only in crs3xx series. In CCR series bonding is done on software. But I've reached 2gbps with bonding on ccr1009 in a transit router. I mean, different IP addresses for source and destination. So there should be a problem in your setup. Enviado desde mi Mi...

jprietove

Follow the examples in https://wiki.mikrotik.com/wiki/Manual:C ... s_switches with ether type 0x8100 in bridge

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

I suggest this video from recent MUM Europe 2019 in VIenna:
Understanding throughput: https://youtu.be/zsrdgo0Npc8

jprietove

A feature I would like to see in Winbox is a new selection to close all winbox windows Example - many many windows open in winbox , click close-all and presto they all close and you still have your connected winbox session North Idaho Tom Jones Or I'm not understanding you... or for sure it is the ...

jprietove

Sure a lot of people will be interested. You can also look here for someone near you:

https://mikrotik.com/consultants

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

A feature I would like to see in Winbox is a new selection to close all winbox windows
Example - many many windows open in winbox , click close-all and presto they all close and you still have your connected winbox session

North Idaho Tom Jones

Isn't it the existing Session -> Close Windows?

jprietove

In ipv6 usual prefix is /64. So a local attack will not be filtered by the rules proposed and the number of possible hosts is 2^64 because ipv6 addresses are 128 bit numbers.

Enviado desde mi Mi A2 mediante Tapatalk

jprietove

Yes, you can use the same pool for all the profiles

jprietove

I have done several tests with GNS3 using CHR 6.44.2 (stable) and as long as the router has enough memory, it doesn't crash. In my tests, the attack 'steals' around 180 MiB. Using a CHR with 256 MB, system resources shows a total memory of 224 MiB and free-memory of 197 MiB before attack. During the...

jprietove

I use GNS3 that is more than a diagram tool and you can also try https://draw.io

jprietove

I've used that configuration lots of time. No problem at all. Look your cables, connectors, etc. It should be almost 'plug and play'

jprietove

I have just tested this beta and I confirm that with 300 Mb RAM the router's memory doesn't fill. A CHR with 300 Mb of RAM with OSPF-v3 has 237 Mb of free-memory and during the attack it keeps on around 200 Mb.

Hopefully this fix will be in long-term and current branches soon.

jprietove

Version 6.45beta23 has been released. What's new in 6.45beta23 (2019-Apr-01 05:51): !) ipv6 - fixed soft lockup when forwarding IPv6 packets; !) ipv6 - fixed soft lockup when processing large IPv6 Neighbor table; ---------------------- Congratulations! I have tested this beta and I confirm that wit...

jprietove

This sounds almost exactly the same as what MikroTik will be fixing on Monday.

What would be characters 9, 10, 11, 12 of the md5sum?

Sorry @maznu but I don't get the same md5sum you expected. Maybe mine is a different but correlated attack

jprietove

I've done my own investigation and I think I can reproduce the problem. First it is important to note that the target of the attack needs not to be the Mikrotik itself: if it is forwarding traffic from an attack, its memory can exhaust and eventually it will reboot. So my lab is similar to this: an ...

jprietove

Export your config and tell us exactly what you want to achieve

jprietove

It is not strange, it is called hexadecimal: In the address 2001:db8::33/126 I will look into the last '33'. As it is HEX, in Binary it is 001100 11 The last two bits are not belonging to the prefix, so the prefix is 001100 00 If I write it in HEX again it is 30, os the prefix is 2001:db8::30/126 Th...

jprietove

Pool 10 11 2 has not a next pool

Enviado desde mi Redmi 3 mediante Tapatalk

jprietove

I posted this on my previous answer. Clearly you didn't read it

Enviado desde mi Redmi 3 mediante Tapatalk

jprietove

[admin@R2] > interface bridge vlan add bridge=bridge1 vlan-ids=30 tagged=ether4,ether5 untagged=ether5
failure: interface cannot be in tagged and untagged at the same time

Enviado desde mi Redmi 3 mediante Tapatalk

jprietove

I think you should mark this as solved and forget about it. You asked a question, the answer is simply "no, you can't" and I really don't know why are we still feeding the yroll

Enviado desde mi Redmi 3 mediante Tapatalk

jprietove

I don't know exactly what are you asking in this post. One port can be 'tagged' and 'untagged' at the same time for different VLAN-id. Hybrid port is the name. BUT not for the SAME VLAN-ID A hybrid port can be useful in a construction where you have several nodes connected in a dumb switch (not vlan...

jprietove

Use tool torch

Enviado desde mi Redmi 3 mediante Tapatalk

jprietove

No, I haven't missed it: look at the title I have choosen.

jprietove

There seems to be an issue that allows bypass firewall and nat if winbox is exposed.
Please read this carefully

https://medium.com/tenable-techblog/mik ... d46398bf24

Enviado desde mi Redmi 3 mediante Tapatalk

jprietove

Not analogous but best is: reading, understanding, learning, practicing and a lot of Wireshark

jprietove

Chain should be output. Try this:

/ip firewall mangle
add action=set-priority chain=output new-priority=5 out-interface=vlan2

jprietove

Please, export your config

jprietove

Are any of you using port ether1 or just sfp-plus ports? If you are, remember that "The new Cloud Router Switch 317-1G-16S+RM is a rack-mountable manageable switch with Layer3 features, it has 16 SFP+ ports for high performance 10GbE connectivity and a 1GbE copper port for management. "

jprietove

I've been using CCR1016 with bonding in balance_rr with 1.7 Gbps traffic for more than one year, software based (not hardware) and CPU hardly goes more than 5-6%. It would be usefull to know if you are using RouterOS or SwitchOS, which RouterOS/SwitchOS version are you using, an export of your confi...

jprietove

What is happening Your router are doing bonding and bridging by software, thats the reason your CPU goes so high. As your traffic is going from only one point to other, the MAC-addresses of all traffic will be the same so if you use layer2 hash, only one path will be choosen. Improving a little Bet...

jprietove

Maybe it's a typo? Look here: /routing bgp peer add address-families=ip,vpnv4 in-filter=casino-in name=up-gcp_casino out-filter=casinio-out remote-address=169.254.0.2 remote-as=65502 ttl=default ^^^^^^^ You wrote casinio-out instead of casino-out

jprietove

Test mtu with ping and no fragment option. VLAN has additional bytes in header so instead of 1480 maybe it's 4 bytes less.

Enviado desde mi Redmi 3 mediante Tapatalk

jprietove

Anyone has experience in Bequant's tcp optimizer? http://www.bequant.com/bta.html Probably the same can be done by a Mikrotik CCR although they claim some patented technologies. And if someone can make same, send me a pm and give me a price for a 500Mbp backbone connection. Hello wireless Rudy, I h...

jprietove

Try this:

/ip address add interface=ether1 address=99.88.9.17 network=99.88.7.180
/ip route add dst-address=0.0.0.0/0 gateway=99.88.7.180

jprietove

I think you have been very well answered in the other forum viewtopic.php?p=706857#p706857

Enviado desde mi Redmi 3 mediante Tapatalk

jprietove

In AWS you can select Mikrotik CHR at VM creation time. No need to install Linux or anything else... Just choose Mikrotik CHR instead of Windows, Ubuntu or any other thing

Enviado desde mi Redmi 3 mediante Tapatalk

jprietove

I just checked all my routers. All of the ip, network (same being /32), and router IDs are unique to each router. Try also to change interface network-type. Instead of broadcast, it seems your configuration could be PTMP because it (appears to) has a central Router. This way, the routers will not l...

jprietove

Check if there are several routers with same Id. Check also that router up address in loopback interface is correct, with /32 and network equal to address. Sometimes if configuration is copied from one router and pasted in another, and then the loopback IP is changed, the network remains. For exampl...

jprietove

Why could you not use the automatic update that ArchilMindiashvili describe above? You can do > System>Packages>> Check For Updates >> Download and install >> Reboot system is updated I can't speak for OP, but there's a legitimate case: when a router doesn't have internet access (for any particular...

jprietove

Try to see what is in ip, ARP. Maybe you have a static assignment for your Mac address and IP address

Enviado desde mi Redmi 3 mediante Tapatalk

jprietove

It is not recommended to restore a backup from a MikroTik into another one. But it can work, maybe it will not be fully functional, but I'm pretty sure that after restoring it into a same model router, you will be able to export the configuration you need. After that, reset configuration and build i...

jprietove

That's it: it should work ok, as it was an unique 5Gbps interface

Enviado desde mi Redmi 3 mediante Tapatalk

jprietove

and i think you have mistake i have up to 5gbps :D you told i am able use up to 5Mbps :D anyway thank you. You are right. 5 Gbps... :D :D and alst question my friend is what will happen if one my slave port bandwidth will be full ? are the other packets drop ? or they will transmit from other slave...

jprietove

Hello, in balance rr i think i will get retransmitting segments for tcp/ip If you use same cables (good quality Cat6), same length, it should be OK : no retransmission errors, no jitter and no problems. so its better use layer2-layer3 transmit hash, so when layer2-layer3 transmit hash in enabled i ...

jprietove

in addition to my last posts please http://prntscr.com/kyh2a1 1. when i have set layter2-layer3 transmit hash i see outgoing traffic balanced over active LAG ports, but sometimes i see one of the ports outgoing traffic is around 180mb and its not balance, when i check flow i see its from one src ip...

jprietove

1. as i understand your explaination because i have a switch behind my routers and my computers are connected to switches i should choose layer2-layer3 transmit poliocy so in this case outgoing traffic will go towards all ports right? so i can have 5gbps throughput for outgoing traffic ? but if i c...

jprietove

so my questions are : 1. right now can i have 5gb throughput from my brocade switch to mikrotik ccr 1016 ? You have configured your bonding mode=802.3ad. This means that "LACP balances outgoing traffic across the active ports based on hashed protocol header information and accepts incoming tra...

jprietove

Well, it was a very long time ago when this question was post in this forum. Maybe this is useful for somebody: IPSec can't transfer multicast traffic, so it is not possible to configure IPSec policy for it. Instead, you can use GRE6 tunnel between your routers and add this GRE interfaces to OSPF-v3...

jprietove

Look here: https://wiki.mikrotik.com/wiki/Main_Page

jprietove

I think, you got your subnet masks wrong. VRRP-Interfaces always should be configured with /32 No, it is not necessary. The objective of VRRP is to have two or more devices for failover. If the main fails, the backup actives the IP that is shared in both routers (that is, configured the SAME IP add...

jprietove

It is OK: as soon as Master is not reachable, Backup VRRP will put their IPs on valid state.

jprietove

In a WISP covering a very extensive area with 30 PPPoE servers, more than 300 PtMP and more than 2000 CPE we had problem with MPLS: sometimes MPLS forwarding table doesn't follow OSPF. We decided to split the very big OSPF domain into several little ones using iBGP. Routing tables have diminished fr...

jprietove

You can do it using a static route before disabling BGP Peer:

/ip route add gateway=[ip_default_gateway]

jprietove

TL/TR: Hello, I'm trying to configure an scenario with certificates and I've found a bug and a possible one. [*]Trying to sign a certificate via SCEP only works on CLI. Winbox gets an error "Error in SCEP URL - double field expected" [*]Trying to add Registration Authorities I get an erro...

jprietove

Hello, try yourself different antenna combinatios with MikroTik Wireless Calculator: https://mikrotik.com/calculator

jprietove

What version of wine are you using ? I'm using Wine 1.6.2 with Ubuntu 16.04.4 LTS, Netinstall for RouterOS v.6.40.1. I've just downloaded Netinstall v.6.42.1 and works OK. Tried with your IP addresses, everything works fine. Please, check: All your computer interfaces are disabled, except your wire...

jprietove

Hello, I can confirm than NetInstall runs properly on Ubuntu 16.04 using Wine. Instructions for using NetInstall can be found at https://wiki.mikrotik.com/wiki/Manual:Netinstall Be sure to run it as sudo. In my computer I launch it using: gksu wine /media/Compartida/Red/netinstall.exe Press reset bu...

jprietove

Hello, after digging I've found a mistake in my rsyslog configuration that led to this problem. Mikrotik remote log is reporting logs with its current time, so I think it is fine.

jprietove

Hello. I am having this problem too. CHR version 6.42.1. I'm reporting this as a bug

jprietove

When using GNS3 I prefer to build my own qcow2 image starting from .ISO file. I use this commands: qemu-img create -f qcow2 routeros-6.40.7.qcow2 256M qemu-system-i386 -net none -cdrom mikrotik-6.40.7.iso -m 256M routeros-6.40.7.qcow2 Look the option -net none : this tells QEMU to create the image w...

jprietove

Be sure that your instance has: redistribute-connected: no redistribute-ospf: no redistribute-other-bgp: no redistribute-rip: no redistribute-static: no client-to-client-reflection: no And you will have no need to use any filter. If this doesn' work, please export here your BGP configuration for bot...

jprietove

First of all, I would check all the cables and verify they are Cat6 or at least Cat5e and they are firmly and well crimped

jprietove

IMO, your problem may be caused because 1 public IP address is not enough. I have at home 60 TCP connections with not very much usage of Internet. It goes to near 200 when several devices are used. If you have only 1 IP address for 2000 customers, considering that TCP port is a 16-bit number so ther...

jprietove

Let's say the providers R2 and R3 has AS numbers 65002 and 65003, respectively. If R2 provides a Blackhole community, usually 65002:666, the peer with R1 has an IN-FILTER like this: [admin@MikroTik] > routing filter print Flags: X - disabled 0 chain=bgp-in bgp-communities=65002:666 invert-match=no a...

jprietove

Similar as you write: /ip firewall nat print where chain=srcnat && action=masquerade && out-interface="bridge-local" If you need it on a script, syntax changes but essentially it is the same: :if ([:len [/ip firewall nat find chain=srcnat && action=masquerade &&...

jprietove

It seems that you don't have VPLS interface passive in OSPF.
In OSPF interfaces add all as passive and then, add only the interfaces that has to be active to OSPF, i.e., ether1, ether2...

jprietove

Hello: you need R1 to know how to get to 10.10.11.0/24. And R2 needs to know how to get there too. Try the following

Code: Select all

R1

/ip route add dst-address=10.10.11.0/24 gateway=192.168.60.2



R2

/ip route add dst-address=10.10.11.0/24 gateway=192.168.60.6

jprietove

Have you considered using 'check-gateway=ping'? From the wiki (https://wiki.mikrotik.com/wiki/Manual:IP/Route) "Periodically (every 10 seconds) check gateway by sending either ICMP echo request (ping) or ARP request (arp). If no response from gateway is received for 10 seconds, request times ou...

jprietove

Hello. I don't really understand what do you mean when you say "R2, R3 and R4 did not know about each other's existence, but only about R1". You can use different totally-stub areas for R2, R3 and R4. This way, R2, R3 and R4 will have a default gateway that will be R1. BUT they can send pa...

jprietove

This issue has been fixed in version 6.39.2. I've tested it and seems it is working fine.

Thank you very much!

jprietove

Thank you very much for your opinions. Anybody knows how to report this bug? Or maybe Mikrotik read this forum and will solve it?

Thank you again!

Search found 201 matches