September 2016 - Public - talk.mikrotik.com.au

ROS 6.37 and DHCPv6 client
by Charlie Garrison 25 Nov '16

25 Nov '16

Good morning, Since upgrading to 6.37, router is having trouble getting IPv6 prefix delegation after reboot. Sometimes the dhcp client will finally renew and bind the PD, after 5 minutes or more. Sometimes it fails. Forcing renewal doesn’t help. But if I disable & reenable the dhcpv6 client on the pppoe interface, then it gets PD immediately. Personal observation says there is a timing issue, with dhcp client trying to get PD before pppoe interface is up (but that’s just a guess). Is this a known/common problem? Or an issue with v6.37? What can I do to resolve it? Thanks, Charlie -- Charlie Garrison <garrison(a)zeta.org.au> github.com/cngarrison metacpan.org/author/CNG

3 5

VDSL modems
by Mike Everest 07 Oct '16

07 Oct '16

Hi Folks, A few months back, I asked for opinions on a good adsl modem to use a bridge for MikroTik PPPoE. With increase in prevalence of VDSL services (especially with #nbwhen ;) does anyone have some opinion of readily available and 'good' (not necessarily cheap ;) vdsl modems? Cheers! Mike.

10 14

RB1100AHx2 PSUs
by Ben Farmer 29 Sep '16

29 Sep '16

Hi guys, We've got a few RB1100AHx2's with failed PSUs we'd like to re-use, however I'm having a hard time finding spare supplies for them. Would anyone know of any supplier with compatible PSUs? Any help would be much appreciated! Regards, Ben Farmer Network Engineer www.myport.com.au Address 86 Brookes St, Fortitude Valley Q 4006 Mobile 0488 034 499 Direct 07 3177 1122 Tel 1300 733 629 Fax 07 3177 1129 Email ben.farmer(a)myport.com.au

4 4

RB3011 - ready for production use?
by Thomas Jackson 21 Sep '16

21 Sep '16

Good afternoon all, I’m doing a design for a new install where (on paper at least) a pair of RB3011s will suit the needs perfectly. An RB2011 isn’t going to have enough grunt to handle the work, but there isn’t the justification (or budget) for a CCR. With the architecture change, I’ve held off moving to the 3011 series for as long as possible. For those that are more brave than me, how are they looking in terms of show-stopping bugs now that they have been out for a while? Cheers, Thomas

3 3

Creative Mikrotik scripting - checking connectivity inside customer networks
by Philip Loenneker 06 Sep '16

06 Sep '16

Hi all, On the back of Terry's creative NBN interface management, I thought I would share an interesting "hack" I came up with last week that might be of value to list members. We provide Managed Private Network services to some customers, where they have multiple sites connected to each other. Our monitoring system does a great job of monitoring if our routers are alive and accessible on our management IP subnets, but we didn't have a way of ensuring that the inter-site links were online. These could be VPNs, EoIP tunnels, VLANs, or routed connections. We also sometimes need to know if there is an issue with their Internet connectivity. A while back, I wrote a script that would loop through a Firewall IP Address List to ping specific hosts and send an email if any were offline. However, this never made it to production for various reasons, and had issues such as producing a lot of emails. Last week I revisited the project, and was looking around to see if I could read the results via SNMP and leverage our existing monitoring platform, which added the advantage of being able to see historical data. But things like Global Variables are not available via SNMP. Enter the Bridge Interface. These interfaces are available via SNMP, and have an MTU value that can go up to 65535. With a bit of tweaking to my previous script, instead of sending an email it changes the value of the Bridge MTU. The MTU can't go below about 80, so I set it up to have an "everything is good" value of 32768, then reduced the number depending on the services offline. A colleague suggested using powers of 2 so that, with a single number, we can identify exactly which services are offline, up to 15 entries. Our monitoring platform doesn't understand bitwise numbering like that, so it requires some manual processing to work out which services are offline, but it is enough to trigger an event so that somebody takes a look. This script gets installed on one single device per customer, obviously choosing one that has high stability and connectivity to all other sites, such as a router installed in our data centre. Any feedback is welcome. My apologies if my code isn't as polished as it could be, it is still being tweaked and improved. This is working well on RouterOS v6.30.4. Regards, Philip # Bridge interface /interface bridge add mtu=32768 name=bridge-MPN-Connectivity-Check # Address list - the first number is the value assigned to the site, and will be used to adjust the MTU of the bridge /ip firewall address-list add address=8.8.8.8 comment=1,Internet list=MPN-Connectivity-Check add address=192.168.250.10 comment=2,Site2 list=MPN-Connectivity-Check add address=192.168.250.18 comment=4,Site3 list=MPN-Connectivity-Check add address=192.168.250.54 comment=8,Site4 list=MPN-Connectivity-Check add address=192.168.250.58 comment=16,Site5 list=MPN-Connectivity-Check #The script that does the work /system script add name=MPN-Connectivity-Check policy=read,write source="# Check MPN paths (VLAN, EoIP, Internet)\r\ \n\r\ \n:local tempIP;\r\ \n:local tempIPcomment;\r\ \n:local tempIParray;\r\ \n:local pingResult;\r\ \n:local errorCount 0;\r\ \n\r\ \n:put (\"Running path assurance script...\");\r\ \n\r\ \n:foreach listEntry in=[/ip firewall address-list find where list=\"MPN-Connectivity-Check\" disabled=no] do={\r\ \n :set tempIP [/ip firewall address-list get \$listEntry address]\r\ \n :set tempIPcomment [/ip firewall address-list get \$listEntry comment]\r\ \n :set tempIParray [:toarray \$tempIPcomment];\r\ \n :set pingResult [/ping \$tempIP count=1]\r\ \n :if (\$pingResult = 0) do={\r\ \n # Ping failed\r\ \n :log warning \"Ping failed to \$tempIP (\$tempIPcomment)\"\r\ \n :put \"Ping failed to \$tempIP (\$tempIPcomment)\"\r\ \n :set errorCount (\$errorCount + \$tempIParray->0)\r\ \n }\r\ \n}\r\ \n\r\ \n# You can't have values below about 80 - but that is enough to cause alarms, so set it to minimum of 80\r\ \n:if (\$errorCount>32688) do={:set errorCount 32688}\r\ \n\r\ \n# Update the MTU value regardless\r\ \n:put \"Setting alert status\";\r\ \n/interface bridge set mtu=(32768-\$errorCount) [find name=bridge-MPN-Connectivity-Check]\r\ \n" #Make it run every minute /system scheduler add interval=1m name=MPN-Connectivity-Check on-event="/system script run 0" policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive start-time=startup To get the OID for SNMP monitoring of the new Bridge interface: /interface print [check the ID of bridge-MPN-Connectivity-Check] print oid [look for entry ID you noted before, capture OID for actual-mtu]

3 2

Virtual AP now also implements virtual client
by Mike Everest 06 Sep '16

06 Sep '16

I found this little gem in the wiki docs this morning while reviewing some training materials: "It is also possible to create virtual clients and have both an AP and a Client on the same physical interface. This allows to make a repeater setup with only using one hardware card." http://wiki.mikrotik.com/wiki/Manual:Interface/Wireless#Virtual_interfaces Only since v6.35 - I'm sure it was mentioned in release notes, but OK I don't always read the release notes eh? ;-) Cheers!

3 4

The NBN Questions again ...
by Terry Sweetser (SkyMesh) 06 Sep '16

06 Sep '16

Hello MK People, I have now several CCR 36core deployed routers, with Q-in-Q interfaces numbering in 4,000 range. They're in a single bridge group and DHCP broadcasts and ipv6 multicasts have become a major issue. A single DHCP reply generates an ipv4 broadcast to 4000 interfaces in the bridge group. The group members are all on the same split horizon, so no port to port traffic occurs. When ipv6 ND fires up some discoveries, again N*4000+ packets go out. Given these are 600 bytes, and N*4000 PPS, N being number of open requests or discoveries, there's multiples of 10Mbps of traffic going out. I'm loath to redo the bridge concept, it would mean burning up a /30 per site for "their own subnet" space. PPPoE, as an answer to urgent support cases has been used, but for 10,000 sites this is just not possible. Currently, I have a bridge rate limit in place to "slow down" (a la tar pit) floods of DHCP requests. Where to from here? Is there some new or interesting Cisco-like "unnumbered" scheme possible? Can I try to move IPv6 to the individual interfaces, and drop IPv6 across the bridge? Can I filter out all bridge DHCP and attach 4000 DHCP servers to the interfaces? (No joke.) -- http://about.me/terry.sweetser

6 14

Re: [MT-AU Public] The NBN Questions again ...
by Andrew Thrift 05 Sep '16

05 Sep '16

Hi Terry, Do you have "always-broadcast" on the DHCP server set to yes ? If so changing to no should alleviate the issues with IPv4 clients. Regards, Andrew On 29/08/2016 18:11, "Karl Auer" <kauer(a)nullarbor.com.au> wrote: -----Original Message----- > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf > Of Terry Sweetser (SkyMesh) > A single DHCP reply generates an ipv4 broadcast to 4000 interfaces in > the bridge group. Not wanting to be mean, but why did you put 4000 hosts into a single broadcast domain? That's really your root problem. That said, a DHCP reply should not be broadcast under normal circumstances, it should be unicast to the discoverer. Only the initial discover from a client should be broadcast. On some systems this is a setting however; maybe your DHCP server has been set to broadcast responses. As far as IPv6 goes, DHCP works very differently. As long as your switches support MLD snooping and don't just flood all multicast packets out all ports, you should see massively reduced "broadcast" traffic compared to IPv4. > When ipv6 ND fires up some discoveries, again N*4000+ packets go out. About the only stuff that goes to all hosts should be RA packets from routers. What other packets are you seeing to all hosts? There should be nothing except packets to ff02::1. I'm starting to wonder if your hardware supports MLD; it sounds as if multicast is being flooded out all ports. > Can I try to move IPv6 to the individual interfaces, and drop IPv6 > across the bridge? What "interfaces" are we talking here? Router interfaces? If this is a routed network, you should certainly not be seeing floods of DHCP traffic... neither IPv6 multicast nor IPv4 broadcast should make it across a subnet boundary. I clearly don't have a good enough handle on your topology. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 6D59 8AE6 810D 44E3 7626 7040 4DD6 F89F 3053 4774 Old fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au

2 1

Webfig access error
by Steve Hille 03 Sep '16

03 Sep '16

Hi folks, I am getting the following error on a Mikrotik switch and an AP Error 406: Not Acceptable I have tried in Chrome, Firefox and IE and I get the same flavour of each message regardless of which browser I choose. I am able to log in via Winbox. I recently upgraded them to the latest OS but still no good. I also noticed that the link from the switch to the AP is continually going up and down, I tried to hard set it to 100 full which slowed it down a little but it's still continually going up and down, does anyone have any suggestions? Cheers, Steve

2 1