March 2015 - Public - talk.mikrotik.com.au

BFD + CCR1036
by Alex Samad - Yieldbroker 24 Apr '15

24 Apr '15

Hi I have a few CCR1036-8G-2S+, (6.22) I tried turning on BFD with OSPF. My first hurdle was BFD doesn't work by itself ! I then associated it with a OSPF interface, which had 4 nodes on it. Turned it on all 4 nodes.. worked for a while then up / down flapping ... I ran some tests sending flood pings down the line, no missed packets ! My final test, 2 of these boxes side by side, 1 cross over cable. Turned on OSPF + BFD, started to fail :( I have a nice simple firewall rule 10 ;;; Allow BFD chain=input action=accept protocol=udp dst-port=3784 log=no log-prefix="" I do have a drop invalid before it, but that should affect it and for a period of time BFD does come up. I have it attached to one of my BGP peers on a ROS VM, it seems to work fine. So I'm leaning toward an issue with CCR's So anyone else using BFD with CCR's and OSPF ? Alex

4 14

IPSEC Bugs in V6.27
by Paul Julian 01 Apr '15

01 Apr '15

Hi guys, I just wanted to advise people on this list that I found some serious bugs in 6.27 last night, eventually causing the router to get bricked and lose access altogether when I tried to downgrade it. Initially I reported problems with the lifetime value in the proposal, this will not work when set to 8 hours, and is still a problem. So another issue is that once you work around the problem of the lifetime setting the router still NAT's the outbound IPSEC traffic, even when you add the Accept rule in the NAT rule list the router insists on NATing the traffic for the tunnel. So be careful if you run IPSEC and want to upgrade to 6.27, I have found every other router seemed to run better with this version, but definitely not if you are running IPSEC. Downgrading to v6.10 bricked the router for some reason, downgrading to 6.25 resolved the IPSEC issues instantly, no reconfiguration was required so they were definitely bugs. Regards Paul

1 0

ROS 6.27 IPSEC Bug - Proposal Lifetime
by Paul Julian 31 Mar '15

31 Mar '15

Hi guys, just wondering if anybody has noticed this bug in V6.27 (latest) RouterOS. When configuring the IPSEC proposal if you set the lifetime to 8hours, or 08:00:00 it actually responds to the IPSEC proposal with a lifetime of 0. No matter what else I changed it to it responded with the correct lifetime, except for 8 hours. Unfortunately I have been working on connecting an IPSEC tunnel for a customer for the last couple of hours banging my head against the wall with this one, when I finally noticed this error when it was failing the phase 2 negotiation, it identifies that there is no matching proposal and kills the connection. Just trying to get the US to change their end now, will report it to Mikrotik as a bug I think unless anybody can identify how it can be by design ;-) Regards Paul

1 0

RouterOS rebooting over and over? Possibly BGP + ipipv6 tunnels?
by Damien Gardner Jnr 30 Mar '15

30 Mar '15

Hi Folks, Still waiting for my CCR to come back after dying, so have temporarily cloned one of my RouterOS VM's and am running four of them to accomplish the same as the CCR (and once the CCR comes back the plan is to buy three other 'tik hardware routers, once I figure out exactly what I want/need, based on the resources these VM's are using) Anyway, I seem to be having a weird problem with one of the routers. it's a slightly strange config - I have ipipv6 tunnels between the router and a debian+quagga box in the US. Two tunnels on each of my upstream providers (one for v4, one for v6, as linux does NOT want to run dual-stack over the one tunnel). Since having issues, I've pulled it back to just the two tunnels between the two routers - one for V4, one for V6. I then run BGP over both of those tunnels, and use that to advertise my prefixes in the US. It works well - provided I *don't* advertise my primary /22. My two v6 /48's and my secondary /22 are advertising fine, and work well. However within 2-3 minutes of advertising my primary /22, the router reboots. And immediately reboots. And immediately reboots. And then shuts down. I'm not sure if it's routerOS doing the shutdown, or xenserver detecting the reboot loop and forcing it down. Has anyone seen that before? There's nothing obvious in the logs right before it reboots, and on boot it simply states that the previous shutdown was unexpected. It doesn't generate a supout, so I'm guessing it's not hitting a watchdog or anything? It has me wondering if this is the same reason my CCR1009 died? As I had exactly the same config on the CCR (except it was handling three full v4 + v6 feeds, AND running the three pairs of ipipv6 tunnels plus the three pairs of send-only feeds to the US) Has me rather pulling my hair out.. Wanted to get my 'new' config with everything separate labbed up and running in production before I go and lash out on all new 'tik hardware - but if 'tik isn't going to do one of them, then I lose the awesomeness of winbox, and may as well go back to cisco gear for all of it :-p Thanks, Damien -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder

5 18

DHCPv6 PD Option 18 Etc
by Terry Sweetser 30 Mar '15

30 Mar '15

Hello Mikrotikians! Well, I'm on the learning curve with CCRs and IPv6 -- successfully have ipv6 with DHCPv6 live and handing out PDs. So, firstly, I would prefer to have all of the PDs to be "static". The clients all use option 18 to identify themselves -- bonus points for guessing it is NBN. That leaves me with the task of making the allocations static and linked to the AVC ID in the Option 18 string. How to do? -- http://about.me/terry.sweetser

3 3

Looking for experiences running 10Gbps BIDI on CCRs
by Bryan Tabb 23 Mar '15

23 Mar '15

Hi all Just wondering if anyone has played with 10 Gb BIDI SFPs in the CCRs and what your experiences are like. I'm thinking things like - Which brand worked or probably more important didn't work - Any gotcha's \ roadblocks you came across Looking at using a couple CCRs at each end of a single fibre and using l2vpns to extend network. Kind of a poor man's CWDM. Just wondering if I'm going to hit CPU limits. If im not mistaken if you bridge ports that hits the CPU? Config would look something like below Thanks Bryan /interface vpls add cisco-style=yes cisco-style-id=100 disabled=no l2mtu=1500 name=eompls-xconnect-FFF remote-peer=192.168.1.1 use-control-word=yes /interface bridge add name=bdi-xconnect-pwid-100 /interface bridge port add bridge=bdi-xconnect-pwid-100 interface=sfp1 add bridge=bdi-xconnect-pwid-100 interface=eompls-xconnect-100

1 0

Internode and weird IPV6 dynamic DNS on 750g
by James Hodgkinson 22 Mar '15

22 Mar '15

So, I’ve had a 750G since the MUM in Brisbane and it’s been great, never had a chance to set any IPV6 up on it until after I got Internode about 12 months ago. It all works pretty well, except for one niggle. Going into the DNS screen on the web interface just locks it up hard (Chrome, IE, Safari all tested), and I tend to have to kill the process for the tab and restart my session. I hadn’t checked using SSH before because DNS seemed to work OK and there weren’t any other issues, but I did tonight and what I found was … curious. I have statically set a pair of servers, my internal and GoogDNS as the external… but it seems to have picked up a few IPV6 ones dynamically? Anyone know how to stop this? I guess it’s the use-peer-dns setting on the dhcp-client that’s buggy in some way? [user@router] /ip dns> print servers: 10.0.0.2,8.8.8.8 dynamic-servers: 192.231.203.132,192.231.203.3, 2001:44b8:1::1,2001:44b8:2::2, 192.231.203.132,192.231.203.3, 2001:44b8:1::1,2001:44b8:2::2, 192.231.203.132,192.231.203.3, 2001:44b8:1::1,2001:44b8:2::2, (repeat this 158 times: 2001:44b8:1::1,2001:44b8:2::2, ) allow-remote-requests: no max-udp-packet-size: 4096 query-server-timeout: 2s query-total-timeout: 10s cache-size: 2048KiB cache-max-ttl: 1w cache-used: 79KiB Yeah, I really did count the 158 repetitions, just because. After realising the weird config I tried manually setting the IPV6 resolvers, then disabling use-peer-dns under the /ipv6 dhcp-client, then disabled/re-enabled the client and it showed a much shorter list of dynamic servers… still repeated the previous ones as above a couple of ti (without the epic repeats). Did it on the /ip dhcp-client and all the dynamics are gone as one would expect. Is this happening because of a known problem when I enabled use-peer-dns on both the IPV6 and IPV4 dhcp-clients, or is it a bug? James

2 1

Full/Half duplex on Omnitik routers
by Paul Julian 19 Mar '15

19 Mar '15

Hi guys, I have posted before to this email list about an issue we have at customer site where direct Ethernet connections between wireless routers (1 x CPE and 1 x AP back to back) all of a sudden drop from full duplex to half duplex mode, even though they are hard set to 100M full. Previously I have considered POE injectors, cables, etc, but I have just had it happen on the weekend and again this morning at a different site. The common components between these sites are the Gigibit POE injector which comes with the Omnitik radios and the Omnitik radios themselves, at one site I have RB411's plugging into the back of the Omnitik and at the newer site I have SXT's plugging into the back of the Omnitik. So I have tried replacing POE injectors, cables, and also tried leaving the interfaces as auto-negotiate and hard setting them to 100M Full, but the original site still fails from time to time, the link goes to half duplex then at some random time after that just goes back to full duplex by itself. I can play around with the interfaces and get it back up and running normally but clearly I don't want to do that and aren't just able to jump onto the radio and do it at any time. Has anybody else experienced this problem with Omnitiks and if so is there a solution ? I am running ROS 6.19 on the latest problem unit and firmware 3.17. Any suggestions would be appreciated. Thanks Paul

4 16

LTE/4G USB Modem
by Alen Orsolic 10 Mar '15

10 Mar '15

Hi All, Due to a number of recent enquiries I am seeking feedback as to known working 4G USB modems, in particular Telstra network supported devices. As we don't stock or use any ourselves any comments and or suggestions would be greatly appreciated. I have canvassed the MikroTik hardware support Wiki, but would appreciate any positive working and in production solution. A number of customers are looking at implementing a failover based product but, current 4G USB modems purchased from Telstra have yielded unsatisfactory results. Regards, Alen

4 11

MikroTik LNS config
by Nick Pratley 09 Mar '15

09 Mar '15

Hey all, Having a few issues getting an LNS session working! Any one got this working with a Cisco LAC? Provider removed the tunnel password from when I was running a Cisco as the LNS - but for the life of me I can not get it to authenticate the sessions. Torching the interface, I can see from the providers LAC the l2tp requests coming in to me when I start the session. I've read all forum posts on the 7 pages that a Google search returns - but everyone has confirmed they are able to complete the task without posting any configs. So far, I have L2TP Server Binding PPP Secret with user(a)domain.com and password L2TP profile with local & remote address >From what I have read - that's all that is needed - but it's not working. Unfortunately there is nothing in the logs either. Hoping someone who has set this up can spare 10 minutes and give me a hand :-) Cheers Nick

7 20