August 2015 - Public - talk.mikrotik.com.au

Fwd: Cable Modem DHCP Issues
by Jason Hecker (Up & Running Tech) 14 Aug '15

14 Aug '15

How long is the DHCP lease? How long does it take before things go awry?

1 0

Strange OSPF Issue - bit urgent.....
by Paul Julian 13 Aug '15

13 Aug '15

Hi All, just out of the blue tonight the loopback address on both our core switches stopped responding, the switches are still passing data thank god but there is clearly an OSPF issue between these Juniper EX series switches and my Routerboards 1100AHx2's. We run a typical core design with two switches and two routers and additional border gateways in a standard redundant design, but out of the blue tonight all of a sudden core router 1 decided to complain about the switch neighbours going from exStart to 2Way mode, and I am not getting the router from the switch it's complaining about, nor the other switch. I have done some research and it seems that the OSPF error I am seeing is typically related to MTU mismatch, so I did some checking, my L3 MTU is 1500 and L2 MTU is 9192 on core router 2, but on core router 1 it's 1600 and 9116. After thinking to myself that I had found the issue, even though no MTU changes have been made, when I tried to correct the MTU problem I couldn't because I am plugged into switch 1 via ether13, and the maxmtu for some stupid reason on that port is 9116, I can only set the L3 MTU, L2 MTU is stuck on a max of 9116. Now this was working perfectly with nothing touched until about an hour ago, so I am forked if I know what is going on. Both core routers run 5.24 at the moment, I know it's old but it's been really stable so I haven't wanted to upset the apple cart. As these are core routers I can't just drop them and upgrade them or I would have a lot of customers that were pretty upset, so apart from updating the MTU which clearly I can't, does anybody have any pretty quick suggestions on what I could try to fix this issue before business hours kicks in again ? I think I have seen something like this once before and a reboot of said router fixed it, but right now the impact I can see it has is just that I can't manage those switches right now which is not a critical issue, rebooting the core routers though is a whole other story.... Thanks in advance Regards Paul

3 5

ipv6 routes being unreachable
by Bryan Tabb 12 Aug '15

12 Aug '15

Hi Having a problem with a CCR marking all the prefixes it's learning over an ibgp session as the gateway is unreachable. I've got an asr1k and a ccr. Each router has a /128 configured on a loopback (or bridge in mirkotik's case) and a /125 on each interface. /ipv6 address add address=x:x::13/128 advertise=no comment=loopback0 interface=loopback0 We are using ospfv3 for v6 and then building bgp sessions between the loopbacks. i.e. ospf carries the link nets and bgp carries the customer \ transit prefixes The ccr doesn't seem to be installing the loopback address learnt via ospf. However this is where things get a bit strange. For the snippets below ::8 = cisco & ::13 = ccr Looking at ospf routes on the CCR is lists the ::8/128 route [x@mdr-br1] /routing ospf-v3 route> print # DST-ADDRESS STATE COST GATEWAY INTERFACE 1 x:x::7/128 ext-2 20 fe80::72ca:9bff:fe88:5a00 ether1.40 2 x:x::8/128 ext-2 20 fe80::72ca:9bff:fe88:4181 ether1.40 3 x:x::9/128 ext-2 20 fe80::72ca:9bff:fe88:5a00 ether1.40 4 x:x::13/128 intra-area 10 :: ether1.40 I can even ping the cisco loop back from the ccr [xx@mdr-br1] > /ping x:x::8 SEQ HOST SIZE TTL TIME STATUS 0 x:x::8 56 64 8ms echo reply 1 x:x::8 56 64 35ms echo reply 2 x:x::8 56 64 19ms echo reply sent=3 received=3 packet-loss=0% min-rtt=8ms avg-rtt=20ms max-rtt=35ms [xx@mdr-br1] > /ping x:x::8 src-address=x:x::13 SEQ HOST SIZE TTL TIME STATUS 0 2402:7e00::8 56 64 10ms echo reply 1 2402:7e00::8 56 64 7ms echo reply Bgp sessions targeting the cisco loopback using the ccr loopback as the source establish and swap prefixes [xx@mdr-br1] /routing bgp peer> print Flags: X - disabled, E - established # INSTANCE REMOTE-ADDRESS REMOTE-AS 5 E default x:x::8 45280 6 E default x:x::7 45280 So all things being equal I'd say ::13 can reach ::8 and thus should install the v6 routes it is learning from v6. The ccr has v6.27 installed. Reading through the change log I can't see anything there that says we fixed it. Some of the tweaks I've done: * On the asr removed the ipv6 ospf from the loopback interface and add redistribute connected to get the /128 into the ccr * On the ccr added an admin mac onto bridge that I use as the "loopback" - this got the /128 advertised via ospf Has anyone had success get v6 ospf + bgp working with ccrs & ciscos? Cheers Bryan Tabb

2 2

RoMON
by Dave Browning 11 Aug '15

11 Aug '15

Hi All, Has anyone got any tips on getting RoMON working? We’ve tried it here on a few different configurations and it simply does not work. According to the documentation we literally just need to enable it and it should be happy. Cheers, Dave Dave Browning Systems Engineer dave(a)sentrian.com.au P 07 3369 7666 Level 1, 12 Railway Tce, Milton QLD 4064 This email and any files transmitted with it contain confidential information for the exclusive use of the intended recipient. If you received this email in error please notify Sentrian Pty Ltd immediately by return email to the sender and delete the original email. We do not guarantee that this email or any attached files are free of viruses. All recipients should undertake their own virus scanning.

1 0

OSPF issues
by Alex Samad - Yieldbroker 11 Aug '15

11 Aug '15

Hi Need some help debugging some OSPF issue. I have some flapping on the data center network Bascially I have a backbone with 1 asa5520 4 CCR1036 4 RouterOS VM's I am using OSPF to get the routing done. After the issue in the morning I turn on ospf,debug,!raw to my syslog server. To see if I can find out what the issue was This seems to be unusual behaviour (I think), doesn't normally happen, seem to be re inserting known routes but with a different seqnum ? Aug 10 17:47:23 gsrtr1 route,ospf,debug gsrtr1: LSA Update received: Installing and flooding it Aug 10 17:47:23 gsrtr1 route,ospf,debug gsrtr1: header=AS-External LSA id=206.190.96.0 originator=10.43.255.2 seqnum=0x80001814 Aug 10 17:47:23 gsrtr1 route,ospf,debug gsrtr1: Installing an LSA Aug 10 17:47:23 gsrtr1 route,ospf,debug gsrtr1: lsa=AS-External LSA id=206.190.96.0 originator=10.43.255.2 seqnum=0x80001814 Aug 10 17:47:23 gsrtr1 route,ospf,debug gsrtr1: old=AS-External LSA id=206.190.96.0 originator=10.43.255.2 seqnum=0x80001813 Aug 10 17:47:23 gsrtr1 route,ospf,debug gsrtr1: Adding to neighbor's retransmit list Aug 10 17:47:23 gsrtr1 route,ospf,debug gsrtr1: lsa=AS-External LSA id=206.190.96.0 originator=10.43.255.2 seqnum=0x80001814 Aug 10 17:47:23 gsrtr1 route,ospf,debug gsrtr1: neighbor=10.32.255.13 Aug 10 17:47:23 gsrtr1 route,ospf,debug gsrtr1: number of retransmits=1 .... Aug 10 17:47:24 gsrtr1 route,ospf,info gsrtr1: Invalid sequence number Aug 10 17:47:24 gsrtr1 route,ospf,info gsrtr1: mine=587629 Aug 10 17:47:24 gsrtr1 route,ospf,info gsrtr1: received=587628 Aug 10 17:47:24 gsrtr1 route,ospf,info gsrtr1: Discarding packet: MD5 authentication failed Aug 10 17:47:24 gsrtr1 route,ospf,info gsrtr1: source=10.31.19.4 Aug 10 17:47:24 gsrtr1 route,ospf,info gsrtr1: Invalid sequence number Aug 10 17:47:24 gsrtr1 route,ospf,info gsrtr1: mine=581231 Aug 10 17:47:24 gsrtr1 route,ospf,info gsrtr1: received=581230 Aug 10 17:47:24 gsrtr1 route,ospf,info gsrtr1: Discarding packet: MD5 authentication failed Aug 10 17:47:24 gsrtr1 route,ospf,info gsrtr1: source=10.31.17.3 I'm not sure how they get out of sequence. The network is not being overly used ... If somebody can tell me if this is normal behaviour ... "install and flooding". Or its normal for when seq numbers get out.. What might be things that might through a seq out ? Also the network is very static.. so ... I have actually gone in and add static routes with metric 250 for 90% of the routes.. A

2 4

friday arvo food-for-thought...
by Mike Everest 07 Aug '15

07 Aug '15

I just realised (duh - probably should have noticed aged ago) that CCR Tilera models have 9 cores, 16 cores, 36 cores... All square numbers. Which I suppose has something to do with the way the buses are hooked up.... So assuming 72 core version is just 2 36 core CPUs,... Why don't we have a 25 core CCR? Cheers! Mike.

4 8

Bizarre thing with PPTP. Urgent (for me :-))
by Karl Auer 05 Aug '15

05 Aug '15

I'm trying to get a very basic PPTP connection into my Mikrotik RB951-2HnD. This device does PPPoE over an ADSL modem in bridge mode. - input firewall allows TCP/1723 - input firewall allows GRE - have enabled pptp-server server - have a separate PPP secret for a test user - have a separate ppp profile for the PPTP connection - no NAT rules beyond an existing "masquerade everything outbound" rule. Here's the bizarre thing. When I enable the PPTP server, my pppoe interface to the Internet goes down. If I disable the PPTP server then disable/enable the PPPoE interface, the Internet connection comes up again. Completely repeatably. What the....? Any ideas? This is semi-urgent; someone (not me) factory reset a RB750 that was happily doing PPTP, and now we are trying to recreate it from scratch and having very little luck. I'm trying to get it working on my home router and the above mystery is a bit of a showstopper. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB Old fingerprint: 231A B066 CF91 1216 4F0F F2AC CE25 B8AA 46DC CC4F

3 2

POE Interface and Disable command
by Paul Julian 04 Aug '15

04 Aug '15

Stupid question perhaps....but, I have access into a CPE via the wireless link, and in good Mikrotik fashion the router I have on the other side of the CPE, also a MT, has auto negotiated at 10M FULL, so I need to disable the interface and re-enable it from the CPE side, but, the CPE is powered using POE on that same interface. Sooo, if I disable the Ethernet interface will it lose power or is the POE totally separate from the data side of the interface, I am pretty sure it is but before dropping this interface I Want to be 100% sure as it's a long drive to re-enable it J Thanks Paul

2 3

How to set the pptp client default route distance for IPv6??
by Damien Gardner Jnr 04 Aug '15

04 Aug '15

Hi Folks, Not sure if I've found a bug in the PPTP client in RouterOS, or if I'm just missing something. Our ADSL at home is pretty horrendous, so I run ADSL + LTE, PPTP over the top of both back to SY3, and then OSPF over the those (only for connected routes, not default routes - default comes from the PPTP interfaces). Home nat's out of the the DC, unless the DC is offline, then it falls back to ADSL, an then to 4G. We do a lot of traffic on our LTE connection, but I've noticed that occasionally we have long streams of outbound traffic, but it's usually overnight, so I haven't been able to torch it. Turns out, it's IPv6! I didn't realise I even had IPv6 running over the PPTP tunnels, I figured it was just local to the house only, and going to the 'net over our DSL. But no, we have V6 on the PPTP tunnels, which was unexpected. The issue turns out to be, that the default routes being created when the PPTP sessions come up, aren't using the 'Default Route Distance' setting on the PPTP interface. Our V4 default routes look like this: [admin@MikroTik] > /ip route print detail where dst-address=0.0.0.0/0 Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit 0 A S dst-address=0.0.0.0/0 gateway=203.45.254.1 gateway-status=203.45.254.1 reachable via pppoe-tid distance=1 scope=30 target-scope=10 routing-mark=out-force-tid ^ Manual default route for servers in the DMZ 1 A S dst-address=0.0.0.0/0 gateway=192.168.8.1 gateway-status=192.168.8.1 reachable via lte1 distance=50 scope=30 target-scope=10 routing-mark=out-force-lte ^ Manual default route for traffic destined to m.telstra.com 2 ADS dst-address=0.0.0.0/0 gateway=192.168.13.2 gateway-status=192.168.13.2 reachable via pptp-out-syd3-adsl distance=10 scope=30 target-scope=10 ^ Default route over PPTP-ADSL. Lowest distance, as preferred 3 DS dst-address=0.0.0.0/0 gateway=192.168.13.3 gateway-status=192.168.13.3 reachable via pptp-out-syd3-lte distance=20 scope=30 target-scope=10 ^ Default route over PPTP-LTE. Second-lowest distance, keeps NAT sessions running, but we firewall off a few things to keep bandwidth down 4 DS dst-address=0.0.0.0/0 gateway=203.45.254.1 gateway-status=203.45.254.1 reachable via pppoe-tid distance=40 scope=30 target-scope=10 ^ Default route if both PPTP are down - out ADSL 5 DS dst-address=0.0.0.0/0 gateway=192.168.8.1 gateway-status=192.168.8.1 reachable via lte1 distance=50 scope=30 target-scope=10 vrf-interface=lte1 ^ Deafult route of last resort, natting out behind LTE However our V6 routes look like this: [admin@MikroTik] > /ipv6 route print detail where dst-address=::/0 Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, o - ospf, b - bgp, U - unreachable 0 ADS dst-address=::/0 gateway=pppoe-tid gateway-status=pppoe-tid reachable distance=1 scope=30 target-scope=10 1 DS dst-address=::/0 gateway=fe80::2a94:fff:fef1:5900%pppoe-tid gateway-status=fe80::2a94:fff:fef1:5900%pppoe-tid reachable distance=1 scope=30 target-scope=10 2 DS dst-address=::/0 gateway=pptp-out-syd3-adsl gateway-status=pptp-out-syd3-adsl reachable distance=1 scope=30 target-scope=10 3 DS dst-address=::/0 gateway=pptp-out-syd3-lte gateway-status=pptp-out-syd3-lte reachable distance=1 scope=30 target-scope=10 Yep, the distances are ALL 1. So it's ignoring the default distance in use on the PPTP and PPPOE interfaces entirely. Am I missing something? I guess I could remove the 'Add Default Route' tickbox on each session, and manually enter default routes? But surely the Default Route Distance should be applying to V6 as well? At the worst, can I just turn OFF V6 on the PPTP-LTE session? V6 won't work with ADSL down, since it's using TID-assigned V6 space at the moment. This is a CRS-109-8G-1S-2HnD on 6.30.2. Thanks, Damien -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder

2 5

Working with 3/4G.
by Daniel Hoffman 01 Aug '15

01 Aug '15

I have just had to put a hap lite in to be a client to a Vodafone 4g wifi modem and bring that connection back into my network via Ethernet. All works really well but wondering if anyone has any experience with firewall rulesets and or application filtering to block big data use such as MS/Apple updates, apple iCloud backups etc etc. I've been thinking about just some big IP range drops for the big companies such as Apple and MS and AWS but thought maybe there is a better way. Anyone.

3 2