March 2018 - Public - talk.mikrotik.com.au

Re: [MT-AU Public] Radar detection Chaos Since 6.40.4
by Mike Everest 31 May '19

31 May '19

Hi Harry, thanks for the comments! (have you tried subscribing to the public list? What happens when you try to add a subscription?) That is only the LIPD class license document but it does not list the relevant standards. The standards list some of the ETSI specifications which according to MT include radar detect operation. From MT perspective, they claim that DFS implies Radar Detect in the relevant standards. I have no doubt that it DOES make that link in the EU specification, but since our AU compliance requirements also refer to some ETSI standard then it is possible that our rules are also affected by the recent updates to relevant ETSI standards simply by association and since ACMA have not explicitly excluded that revision... This is what I am attempting to ascertain ;) So far, I have not been able to find the direct relationships and have been doing the rounds of some compliance folks to try to get to the bottom of it all. It may take some time :-1 Cheers, Mike. ---------------------------------------------------------------------------- -------- Why Choose DuxTel for all your MikroTik needs? 10 good reasons: http://duxtel.com/why_duxtel ---------------------------------------------------------------------------- -------- Follow our tweets for news and updates: http://twitter.com/duxtel > -----Original Message----- > From: Harry Fiotakis [mailto:Harry.Fiotakis@tasmanet.com.au] > Sent: Monday, 23 October 2017 10:39 AM > To: Mike Everest (mike(a)duxtel.com) <mike(a)duxtel.com> > Cc: Philip Loenneker <Philip.Loenneker(a)tasmanet.com.au> > Subject: RE: [MT-AU Public] Radar detection Chaos Since 6.40.4 > > Morning Mike, Phil forwarded me the latest correspondence as I still have not > been approved on the mailing list :( > > https://www.legislation.gov.au/Details/F2015L01438 (Radiocommunications > (Low Interference Potential Devices) Class Licence 2015) > > 5250-5350 Must use DFS > 5470-5600 Must use DFS > 5650-5725 Must use DFS > > No Radar Detect required (it is not implied) > > We will have to seek official clarification on that if Mikrotik require it, but > with it forced on we are downgrading Mikrotik radios or simply not using > them. > > > Regards, > > Harry Fiotakis | TasmaNet > 40-50 Innovation Drive, Tas 7010, Australia > M: 0418 540 806 P: 1300 792 711 > Email: harry.fiotakis(a)tasmanet.com.au > > > -----Original Message----- > From: Philip Loenneker > Sent: Monday, October 23, 2017 10:30 AM > To: Harry Fiotakis <Harry.Fiotakis(a)tasmanet.com.au> > Subject: FW: [MT-AU Public] Radar detection Chaos Since 6.40.4 > > > -----Original Message----- > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of > Mike Everest > Sent: Monday, 23 October 2017 9:50 AM > To: 'MikroTik Australia Public List' <public(a)talk.mikrotik.com.au> > Subject: Re: [MT-AU Public] Radar detection Chaos Since 6.40.4 > > Further update on this issue, > > I've had a bit of correspondence with them, but they are 'fighting' it. Latest > comment from them is that "ETSI standard mentions when you use DFS and > those ranges you need to use the Radar-detect. Radar detect is happening > only for 1 minute." > > The line they are taking is that since our LIPD class license specification says > that DFS must be enabled for the sub 5785 channels, then radar detect must > also be enabled. I've been trying to pore through all the relevant ACMA > documentation so that I can find some definitive paragraph that clarifies the > situation, but so far have drawn a blank. > > I need someone who has some specific familiarity with the relevant rules and > standard that can find something that will convince them to turn it off - any > takers? :-} > > Cheers, Mike. > > > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au

5 26

Fwd: xDSL SFPs
by Jason Hecker (Up & Running Tech) 27 Aug '18

27 Aug '18

That's flat out wrong. Have a look at the PDF on http://www.acma.gov.au/ Industry/Suppliers/Regulatory-arrangements/EMC- Electromagnetic-compatibility/emc-standards-list and see page 5. All IT equipment - no exceptions - must be tested (by an approved tester) to and comply with CISPR-32 and get a C-Tick for use in Australia. Upshot is don't import and use or sell the SPF modules unless the supplier has ensure it's complied. Duxtel know all about this - they supply all their Mikrotik gear (including boring old routers with no Wifi) with pretty little compliance stickers. On 9 August 2017 at 17:05, Paul Julian <paul(a)oxygennetworks.com.au> wrote: > Agreed, the VC-231's are Tick approved, PSU and Bridge, we use a lot of > them when deployed as a NTU for a VDSL2 DSLAM Implementation or as a point > to point VDSL2 link. > > C tick or A tick approval is only required when connecting > telecommunication devices to public communication networks, C tick or A > tick approval is required for radio communications devices, so if it's a > telecommunications device connected to a private wire you don't need > approval, if it's a radio communications device you need approval no matter > what. > > The ACMA make it pretty clear on their website if you aren't sure. > > http://www.acma.gov.au/theACMA/bringing-communications- > equipment-into-australia > > Regards > paul > > -----Original Message----- > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of > Jason Hecker (Up & Running Tech) > Sent: Wednesday, 9 August 2017 4:52 PM > To: MikroTik Australia Public List > Subject: Re: [MT-AU Public] xDSL SFPs > > That's partly true. As it's an active device it still needs C-Tick > approval for electromagnetic compatibility and susceptibility reasons. > There are likely even considerations for electrical isolation as it can > connect two sites on different AC phases and potentials. Considering it's > pumping HF energy into a long wire it's like a radio transmitter anyway so > it definitely needs to comply. > > On 9 August 2017 at 16:45, Paul Julian <paul(a)oxygennetworks.com.au> wrote: > > > If it's a private CAT3 cable there are no approvals required as it's > > just a private link. > > > > We use the Planet VC-231 bridges for that sort of thing, they are > > pretty good and will do 100/100 over a couple of hundred metres with > good cable. > > > > Regards > > Paul > > > > -----Original Message----- > > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of > > Jason Hecker (Up & Running Tech) > > Sent: Wednesday, 9 August 2017 4:41 PM > > To: MikroTik Australia Public List > > Subject: Re: [MT-AU Public] xDSL SFPs > > > > Yes the belt and braces and correct way is to find a version that > > someone has had approved for use in Australia. I don't think anyone > > has done that yet! It'd be nice if the manufacturer did the legwork > > but they only do FCC and CE. > > > > On 9 August 2017 at 16:33, Russell Hurren > > <russell(a)zeropointnetworks.com> > > wrote: > > > > > I've just had a client call me and ask for a WiFi repeater to go in > > > the house next to their motel. There's already CAT3 running between > > > the buildings, so something like that would be a good option for me. > > > I'd be willing to order a pair and give it a try, but I'm not sure > > > about the legality - I presume it'd need an A-Tick approval? > > > > > > I've got a CRS125 in the main building and I could put a hAP ac in > > > the house and it'd be a nice clean option, compared to using > > > something like a Planet VC-231. > > > > > > -----Original Message----- > > > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf > > > Of Jason Hecker (Up & Running Tech) > > > Sent: Wednesday, 26 July 2017 8:37 > > > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > > > Subject: Re: [MT-AU Public] xDSL SFPs > > > > > > That said, the http://www.proscend.com/en-gb/product/sfp/180cr.html > > > looks interesting for linking buildings that have old CAT3 cabling > > > in between. I reckon I could have used that sort of thing in a few > > > places instead of wireless. Has anyone tried these sort of VDSL2 > > bridges? > > > > > > On 26 July 2017 at 10:20, Philip Loenneker <Philip.Loenneker@tasmanet. > > > com.au > > > > wrote: > > > > > > > If anyone would care to donate a unit, I have a service I can test > > > > it > > on. > > > > And as an RSP, we have direct access to the NBN portal to request > > > > reactivation if it gets blocked :) > > > > > > > > -----Original Message----- > > > > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On > > > > Behalf Of Jason Hecker (Up & Running Tech) > > > > Sent: Wednesday, 26 July 2017 10:17 AM > > > > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > > > > Subject: Re: [MT-AU Public] xDSL SFPs > > > > > > > > I think we're all pretty excited about the prospects of those > > > > VDSL2 and G.Fast SFP modules (I am getting FTTC so G.Fast is > > > > probably on the cards one day). I guess you can be the guinea pig > > > > and be the one to risk explaining to your ISP why your port should > be unlocked. > > > > ;) > > > > > > > > On 26 July 2017 at 10:09, Damien Gardner Jnr <rendrag(a)rendrag.net> > > > wrote: > > > > > > > > > If you plug in a modem which does not support G.vector, the port > > > > > will get shut down within ~10 minutes, and requires a support > > > > > request from your > > > > RSP > > > > > to NBNco to have the port re-enabled. They don't specifically > > > > > detect > > > > modem > > > > > model and shut down if they don't know the model though, as far > > > > > as I > > > > know. > > > > > > > > > > IPOE on ADSL is an interesting one, that'd make setup very easy! > > > > > > > > > > On 26 July 2017 at 10:05, Jason Hecker (Up & Running Tech) < > > > > > jason(a)upandrunningtech.com.au> wrote: > > > > > > > > > >> Be careful, I remember reading that modems not tested and > > > > >> authorised for NBN use can cause the port to be locked. Until > > > > >> someone goes to the expense of having them tested and approved > > > > >> for use in Australia (cough .. Mike?) you may not get much joy. > > > > >> They might work on a bog standard ADSL line. > > > > >> > > > > >> Speaking of which, I might be late to the party but I noticed > > > > >> that > > > > Telstra > > > > >> ADSL now supports IPoE as well as PPPoE/A. I reset an old > > > > >> cheapie/dodgy TPLink modem the other day for someone and > > > > >> without doing anything the PC connected did a DHCP request and > > > > >> got a public IP/DNS! When I set the modem up to do IPoE it > > > > >> picked all that up as well but for some reason wouldn't NAT or > > > > >> proxy the DNS. Wrote the modem off and we proceeded to order an > NBN service. > > > > >> > > > > >> On 26 July 2017 at 09:57, Damien Gardner Jnr > > > > >> <rendrag(a)rendrag.net> > > > > wrote: > > > > >> > > > > >> > Anyone else ordered one of the 180-T's yet? innet24.de are > > > > >> > now > > > > selling > > > > >> > them, but are waiting on a firmware update (due out next > > > > >> > week) before they're shipping more units. Looking forward to > > > > >> > getting one and > > > > seeing > > > > >> how > > > > >> > they go on NBN, if I can remove one device from the network > > > > >> > at home, > > > > >> I'll > > > > >> > be very happy! > > > > >> > > > > > >> > On 19 May 2017 at 08:08, Thomas Jackson > > > > >> > <thomas(a)thomax.com.au> > > > wrote: > > > > >> > > > > > >> > > Thanks for the responses everyone > > > > >> > > > > > > >> > > Looks like we're using the double-sided tape again this > > > > >> > > time around > > > > :) > > > > >> > > > > > > >> > > > > > > >> > > > > > > >> > > Sent from mobile > > > > >> > > > > > > >> > > Thomas Jackson > > > > >> > > Managing Director > > > > >> > > +61 2 8378 5555 > > > > >> > > > > > > >> > > > On 18 May 2017, at 12:54 pm, Mike Everest > > > > >> > > > <mike(a)duxtel.com> > > > > wrote: > > > > >> > > > > > > > >> > > > Hi Everyone, > > > > >> > > > > > > > >> > > > I thought I'd chip in some commentary here since there is > > > > obviously > > > > >> > > plenty > > > > >> > > > of interest :-} > > > > >> > > > > > > > >> > > > There are at least two products around that implement > > > > >> > > > some form of > > > > >> vDSL > > > > >> > > in > > > > >> > > > an SFP module, but there are lots of hurdles preventing > > > > >> > > > release to > > > > >> AU > > > > >> > > market > > > > >> > > > which are partly commercial (vendor requests significant > > > > >> > > > - circi > > > > >> > USD100K > > > > >> > > - > > > > >> > > > commitment prior to even proving viable operation on any > > > > >> > > > given > > > > >> network) > > > > >> > > and > > > > >> > > > partly technical (vDSL definition is somewhat 'loose' in > > > > >> implementation > > > > >> > > such > > > > >> > > > that there is no guarantee that something that works well > > > > >> > > > with one > > > > >> > vendor > > > > >> > > > DSLAM will also work with every other) > > > > >> > > > > > > > >> > > > At DuxTel, we've been trying to work out a solution for > > > > >> > > > many > > > > months, > > > > >> > and > > > > >> > > > although we are closing on a potential outcome, there is > > > > >> > > > no firm > > > > >> date > > > > >> > for > > > > >> > > > market readiness. > > > > >> > > > > > > > >> > > > One thing that we know of thus far: > > > > >> > > > - devices are real, and actually exist ;) > > > > >> > > > - devices work with MikroTik RouterOS to the extent that > > > > >> > > > they are > > > > >> > > recognised > > > > >> > > > by SFP drivers and 'inserted module' parameters are > > > > >> > > > reported > > > > >> correctly > > > > >> > > > - MikroTik are 'on board' to develop further support to > > > > >> > > > implement > > > > >> some > > > > >> > > form > > > > >> > > > of configuration interface for routerOS and this type of > > > > >> > > > device > > > > >> > > > > > > > >> > > > Here is what we don't have yet: > > > > >> > > > - commercial agreement with manufacturing vendor/s to > > > > >> > > > support > > > > >> > > development of > > > > >> > > > solution to work with any given vDSL service (read: NBN) > > > > >> > > > - compliance testing documentation to support RCM > > > > >> > > > eligbility for > > > > AU > > > > >> > > > environment > > > > >> > > > > > > > >> > > > What needs to happen before they are made available to > > > > >> > > > the AU > > > > >> market: > > > > >> > > > - compliance testing and certification > > > > >> > > > - testing (and probably some driver/firmware development) > > > > >> > > > to work > > > > >> with > > > > >> > > NBNCo > > > > >> > > > DSLAMs and other DSLAM vendors > > > > >> > > > > > > > >> > > > The big hurdle to the above is in coming to some > > > > >> > > > commercial > > > > >> agreement > > > > >> > > with > > > > >> > > > one or more vendors that satisfies their need to cover > > > > >> > > > costs of > > > > >> final > > > > >> > > stages > > > > >> > > > of development and compliance testing. > > > > >> > > > > > > > >> > > > My assessment of where this is all at is that the > > > > >> > > > manufacturer/s > > > > >> have > > > > >> > > > developed some 'proof of concept' hardware that seems to > > > > implement a > > > > >> > > general > > > > >> > > > form of vDSL (with ADSL fallback) BUT (and that's a big > > > > >> > > > BUT) there > > > > >> is a > > > > >> > > lot > > > > >> > > > of technical work to be done to deliver sufficient > > > > >> > > > confidence that > > > > >> they > > > > >> > > will > > > > >> > > > work reliably over any particular or general vDSL network. > > > > >> > > > That > > > > is > > > > >> not > > > > >> > > even > > > > >> > > > beginning to consider whether they are likely to meet any > > > > particular > > > > >> > > > regulatory compliance requirements for AU or any other > > > > jurisdiction > > > > >> ;) > > > > >> > > > > > > > >> > > > So short story is: they are coming, perhaps, but probably > > > > >> > > > not any > > > > >> time > > > > >> > > soon > > > > >> > > > :-J > > > > >> > > > > > > > >> > > > Questions (on or off list) are welcome! > > > > >> > > > > > > > >> > > > Cheers, Mike. > > > > >> > > > > > > > >> > > > > > > > >> > > > _______________________________________________ > > > > >> > > > Public mailing list > > > > >> > > > Public(a)talk.mikrotik.com.au > > > > >> > > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk. > > > > >> > mikrotik.com.au > > > > >> > > > > > > >> > > _______________________________________________ > > > > >> > > Public mailing list > > > > >> > > Public(a)talk.mikrotik.com.au > > > > >> > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mi > > > > >> > > k > > > > >> rotik.com.au > > > > >> > > > > > > >> > > > > > >> > > > > > >> > > > > > >> > -- > > > > >> > > > > > >> > Damien Gardner Jnr > > > > >> > VK2TDG. Dip EE. GradIEAust > > > > >> > rendrag(a)rendrag.net - http://www.rendrag.net/ > > > > >> > -- > > > > >> > We rode on the winds of the rising storm, We ran to the > > > > >> > sounds of thunder. > > > > >> > We danced among the lightning bolts, and tore the world > > > > >> > asunder _______________________________________________ > > > > >> > Public mailing list > > > > >> > Public(a)talk.mikrotik.com.au > > > > >> > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mik > > > > >> rotik.com.au > > > > >> > > > > > >> > > > > >> > > > > >> > > > > >> -- > > > > >> <https://www.upandrunningtech.com.au> > > > > >> _______________________________________________ > > > > >> Public mailing list > > > > >> Public(a)talk.mikrotik.com.au > > > > >> http://talk.mikrotik.com.au/mailman/listinfo/public_talk. > > > > mikrotik.com.au > > > > >> > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > > > Damien Gardner Jnr > > > > > VK2TDG. Dip EE. GradIEAust > > > > > rendrag(a)rendrag.net - http://www.rendrag.net/ > > > > > -- > > > > > We rode on the winds of the rising storm, We ran to the sounds > > > > > of thunder. > > > > > We danced among the lightning bolts, and tore the world asunder > > > > > > > > > > > > > > > > > > > > > -- > > > > <https://www.upandrunningtech.com.au> > > > > _______________________________________________ > > > > Public mailing list > > > > Public(a)talk.mikrotik.com.au > > > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mik > rotik.com. > > > > au > > > > > > > > > > > > > > > > -- > > > <https://www.upandrunningtech.com.au> > > > _______________________________________________ > > > Public mailing list > > > Public(a)talk.mikrotik.com.au > > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > > > au > > > > > > _______________________________________________ > > > Public mailing list > > > Public(a)talk.mikrotik.com.au > > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > > > au > > > > > > > > > > > -- > > <https://www.upandrunningtech.com.au> > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > > au > > > > > > > -- > <https://www.upandrunningtech.com.au> > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > -- <https://www.upandrunningtech.com.au> -- <https://www.upandrunningtech.com.au>

8 19

Mikrotik OpenVPN server Windows OpenVPN Server failure OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
by QCS Group - Infrastructure 31 Mar '18

31 Mar '18

Hi All, I have spent a couple of hours on trying to setup an OpenVPN server on my Mirktoik CCR1036 (Hoping to replicate this for end users) I have tried multiple different guides and each time I come back to the same error message. I will forward my config for the OpenVPN server as well as my Windows client config. OpenVPN Setup on Mikrotik: /certificate add name=CA-tpl country="AU" state="QLD" locality="Brisbane" organization="QCSGroup" unit="QCSGroup" common-name="CA" key-size=4096 days-valid=3650 key-usage=crl-sign,key-cert-sign /certificate sign CA-tpl ca-crl-host=127.0.0.1 name="CA" /certificate add name=SERVER-tpl country="AU" state="QLD" locality="Brisbane" organization="QCSGroup" unit="QCSGroup" common-name="core.router.dc.domainname.com.au" key-size=4096 days-valid=1095 key-usage=digital-signature,key-encipherment,tls-server /certificate sign SERVER-tpl ca="CA" name="SERVER" /certificate add name=CLIENT-tpl country="AU" state="QLD" locality="Brisbane" organization="QCSGroup" unit="QCSGroup" common-name="CLIENT" key-size=4096 days-valid=3650 key-usage=tls-client /certificate add name=CLIENT1 copy-from="CLIENT-tpl" common-name="CLIENT1" /certificate sign CLIENT1 ca="CA" name="CLIENT1" /certificate export-certificate CA export-passphrase="" /certificate export-certificate CLIENT1 export-passphrase="123456789" /ip firewall filter add chain=input comment="Allow OpenVPN" dst-port=1194 protocol=tcp add chain=input comment="Allow OpenVPN" dst-port=1194 protocol=udp /ppp secret add name=OpenVPNTest password=OpenVPNTest profile=OpenVPN-profile service=ovpn /ppp profile add change-tcp-mss=yes local-address=172.16.99.254 name=OpenVPN-profile remote-address=OpenVPN-pool use-encryption=yes /ip pool add name=OpenVPN-pool ranges=172.16.99.10-172.16.99.100 /interface ovpn-server server set auth=sha1 certificate=SERVER cipher=aes256 default-profile=OpenVPN-profile enabled=yes require-client-certificate=yes Windows OpenVPN Client: C:\Program Files\OpenVPN\config Directory contains: (I renamed the exported certs/key) ca.crt client1.crt client1.key client1.ovpn secret client1.ovpn file contains: client dev tun proto tcp-client remote core.router.dc.domainname.com.au port 1194 nobind persist-key persist-tun tls-client remote-cert-tls server ca ca.crt cert client1.crt key client1.key verb 4 mute 10 cipher AES-256-CBC auth SHA1 auth-user-pass secret auth-nocache ;redirect-gateway def1 Windows OpenVPN Log: It looks like everything connects, I can see a TCP connection in the Router logs. THis is the client logs. (I have replaced router.ip with our IP address) Wed Mar 28 16:40:08 2018 us=663815 Local Options String: 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_CLIENT,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client' Wed Mar 28 16:40:08 2018 us=663815 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_SERVER,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server' Wed Mar 28 16:40:08 2018 us=663815 Local Options hash (VER=V4): '5cb3f8dc' Wed Mar 28 16:40:08 2018 us=663815 Expected Remote Options hash (VER=V4): '898ae6c6' Wed Mar 28 16:40:08 2018 us=663815 Attempting to establish TCP connection with [AF_INET]router.ip:1194 [nonblock] Wed Mar 28 16:40:08 2018 us=663815 MANAGEMENT: >STATE:1522219208,TCP_CONNECT,,, Wed Mar 28 16:40:09 2018 us=664908 TCP connection established with [AF_INET]routerip:1194 Wed Mar 28 16:40:09 2018 us=664908 TCPv4_CLIENT link local: [undef] Wed Mar 28 16:40:09 2018 us=664908 TCPv4_CLIENT link remote: [AF_INET]router.ip:1194 Wed Mar 28 16:40:09 2018 us=665909 MANAGEMENT: >STATE:1522219209,WAIT,,, Wed Mar 28 16:40:09 2018 us=666913 MANAGEMENT: >STATE:1522219209,AUTH,,, Wed Mar 28 16:40:09 2018 us=666913 TLS: Initial packet from [AF_INET]router.ip:1194, sid=d2631263 4753bbdb Wed Mar 28 16:40:09 2018 us=759771 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure Wed Mar 28 16:40:09 2018 us=759771 TLS_ERROR: BIO read tls_read_plaintext error Wed Mar 28 16:40:09 2018 us=759771 TLS Error: TLS object -> incoming plaintext read error Wed Mar 28 16:40:09 2018 us=760772 TLS Error: TLS handshake failed Wed Mar 28 16:40:09 2018 us=760772 Fatal TLS error (check_tls_errors_co), restarting Wed Mar 28 16:40:09 2018 us=760772 TCP/UDP: Closing socket Wed Mar 28 16:40:09 2018 us=760772 SIGUSR1[soft,tls-error] received, process restarting Wed Mar 28 16:40:09 2018 us=760772 MANAGEMENT: >STATE:1522219209,RECONNECTING,tls-error,, Wed Mar 28 16:40:09 2018 us=760772 Restart pause, 5 second(s) If someone could please point out where my issue is I would be most grateful. I have already spent way too much time on this. Kind Regards, Russell Keavy.

4 11

Re: [MT-AU Public] Huawei E8372
by Andrew Gilbett 29 Mar '18

29 Mar '18

Hi Vaughan, I dont have a setup that I can send a config for handy. But i think i was using 1500. The modem was directly connected to the router. The apn and all 4G services and nat are controlled in the stick nkt the mikrotik as they are a router and basically present an ethernet connection over the usb port. Andrew On Thu, 29 Mar. 2018, 08:44 Vaughan Wickham, <vw(a)zeb.com.au> wrote: > Hello Andrew, > > > > Can you advise what MTU you’re using? > > > > I am using, the default 1500. > > > > Also can I confirm that > > > > 1. You’re not using a powered USB hub, you have your E8372 > connected to your Mikrotik directly? > > 2. Have you been able to set the APN for your 4G ISP within the > Mikrotik? > > > > Thanks > > > > Vaughan > > > > *From:* Andrew Gilbett [mailto:andrew@gilbett.net] > *Sent:* Thursday, 29 March 2018 08:27 > *To:* vw(a)zeb.com.au; MikroTik Australia Public List > *Subject:* Re: [MT-AU Public] Huawei E8372 > > > > That sounds like a mtu or mss issue. > > > > I have used these devices very successfully with mikrotik. Including on a > 10m usb extension cable with built in amplifier. > > On Thu, 29 Mar. 2018, 08:19 Vaughan Wickham, <vw(a)zeb.com.au> wrote: > > Hello, > > > > I've been testing an E8372 USB 4G dongle with an RB951Ui-2HnD router > > > > According to https://wiki.mikrotik.com/wiki/Manual:Peripherals the E8372 > works > > > > My experience has been that it "works" to some degree. > > > > Connecting to some Web sites (e.g. www.smh.com.au ) works consistently, > yet > connecting to other Web sites (e.g. any speedtest site does not work at > all). > > > > In contrast, when the dongle is connected to a USB3 port on a Windows PC, > the performance of the dongle is perfect. Also accessing the Web portal of > the dongle seems quicker when the dongle is attached to the Windows > computer > versus the Mikrotik. > > > > I'm pursuing a couple of avenues regarding troubleshooting > > > > - The Mikrotik has a standard USB2 port and this may not be > supplying the required power for the dongle > > o I have ordered a USB2 hub with an external power adapter which will > supply the power requirements of the E8372 (5V and 750mA). So will test > this > soon. > > - I've not been able to configure the APN for the 4G service > provider in the LTE properties. There is no error, but the APN is not > saved. > I am able to save the APN in the 4G dongle's own firmware/web portal, but > I'm not sure whether this is used when the traffic is traversing the LTE > link of the Mikrotik > > > > > > So the questions that I have are: > > > > 1. Is anyone else using an E8372 with a Mikrotik? > > a. If so, what is your config? > > b. Are you using a powered hub > > c. Did you need to save the APN in the LTE properties? > > > > 2. Is anyone using some other 4G USB hub with a Mikrotik? > > > > Thank you > > > > Regards, > > Vaughan > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > >

4 3

Huawei E8372
by Vaughan Wickham 29 Mar '18

29 Mar '18

Hello, I've made some progress in troubleshooting my issue. Turns out that the performance issue is not the dongle at all. Am yet to fully resolve (and thus understand) the issue but can advise that the issue may be a routing issue or some sort of network configuration issue. The scenario that I have is as follows: User PC's Main router (main link down) 2nd router (use backup link) 4G dongle I need two routers, because the main router doesn't have a USB port, and I want to add a backup link without discarding the existing equipment. What I have just tried is connecting a PC directly to the 2nd router and testing the 4G dongle from there. When I do that the performance is the same as when the dongle is connected to a PC. So the issue has to do with the routing between the Mikrotiks - or something like that anyway. The issue is not the 4G dongle itself. Appreciate the feedback from those who responded. Thanks Regards, Vaughan

1 0

Huawei E8372
by Vaughan Wickham 29 Mar '18

29 Mar '18

Hello, I have performed a ping test using packet size and have determined that the optimal MTU for me is 1500 Ping www.google.com.au -f -l 1472 (ping for various sizes until find size where packet does not need to be fragmented) Regards, Vaughan

1 0

Huawei E8372
by Vaughan Wickham 29 Mar '18

29 Mar '18

Hello, I've been testing an E8372 USB 4G dongle with an RB951Ui-2HnD router According to https://wiki.mikrotik.com/wiki/Manual:Peripherals the E8372 works My experience has been that it "works" to some degree. Connecting to some Web sites (e.g. www.smh.com.au ) works consistently, yet connecting to other Web sites (e.g. any speedtest site does not work at all). In contrast, when the dongle is connected to a USB3 port on a Windows PC, the performance of the dongle is perfect. Also accessing the Web portal of the dongle seems quicker when the dongle is attached to the Windows computer versus the Mikrotik. I'm pursuing a couple of avenues regarding troubleshooting - The Mikrotik has a standard USB2 port and this may not be supplying the required power for the dongle o I have ordered a USB2 hub with an external power adapter which will supply the power requirements of the E8372 (5V and 750mA). So will test this soon. - I've not been able to configure the APN for the 4G service provider in the LTE properties. There is no error, but the APN is not saved. I am able to save the APN in the 4G dongle's own firmware/web portal, but I'm not sure whether this is used when the traffic is traversing the LTE link of the Mikrotik So the questions that I have are: 1. Is anyone else using an E8372 with a Mikrotik? a. If so, what is your config? b. Are you using a powered hub c. Did you need to save the APN in the LTE properties? 2. Is anyone using some other 4G USB hub with a Mikrotik? Thank you Regards, Vaughan

2 1

Telstra Frontier Modem/Router with Failover into MK Router
by Matt Hall 27 Mar '18

27 Mar '18

Hi Everyone, The new Frontier router/modem (Technicolour DJN2130) from Telstra has 4G failover built in but if you bridge it failover doesn’t work. I’ve tested this by unplugging the WAN port from the accompanying cable modem (Netgear CM450-TLAUS) and also by unscrewing the fibre cable. 4G won’t kick in. If you do the same with the factory settings config, 4G kicks in. I’d like to route and run Wireless from my MK router but am unsure about a few things. Basically I’d like the Frontier to do as little as possible. So far I would do this on the Frontier: Under WAN Services 1. Turn off NAT-PNP 2. Turn of UpnP? 3. Turn off secure mode? (not sure what that is). 4. Turn off Wi-Fi 5. Turn of DHCP Server 6. How should I setup the Firewall? I can’t turn it off completely it seems. Firewall settings are: Low mode, the firewall will allow all outbound connections. It will reject unknown incoming connections but acknowledge the presence of the gateway. Normal mode, the firewall will allow all outbount connections. It will silently drop unknown incoming connections. High mode, the firewall will allow outgoing connections to the following services: HTTP, HTTPS, SMTP, POP3, IMAP, SSH. It will silently drop unknown incoming connections. User mode, you can configure each individual rule of the firewall as well as the default behaviour. User defined options are: Answer Internet ping On/off Outgoing default policy: ACCEPT/DROP/REJECT The outgoing policy defines what is done with packets coming from the LAN devices toward the internet. Setting it to REJECT or DROP will forbid any internet traffic from the LAN unless explicitely allowed by a firewall rule. Incoming default policy: DROP/REJECT The incoming policy defines what is done with packets destined to the gateway. They can be either REJECTED (the gateway will notify the sender they were rejected) or DROPPED (the gateway will silently discard those packets). Then to manually add a new rule options are: 1. Action: ACCEPT/DROP/REJECT 2. Protocol: TCP, UPD, TCP/UDP, UDP Lite, ICMP, ESP, AH, SCTP, all 3. Src IP 4. Src port 5. Dst IP 6. Dst port Then firewall rules for IPv6 follows the same protocol. Thankyou, Matt Hall Sydney

2 1

Re: [MT-AU Public] Mikrotik - Wireless Issue on hAP and hAP ac lite
by Jason Hecker (Up & Running Tech) 08 Mar '18

08 Mar '18

As an aside, have you seen your non-Apple clients maxing out at 54Mbit TX rate on 2.4GHz as per this thread? https://forum.mikrotik.com/viewtopic.php?f=7&t=102908 At my place Apple devices are fine but anything Android - including out late model Samsung phones refuse to go above 54Mbit TX. I am surprised this isn't resolved and seems to be in the Too Hard basket for Mikrotik! This is a problem anywhere you put in loads of Mikrotik devices. Any thoughts, Mike or anyone else who has deployed public CAPSMAN systems? On 7 March 2018 at 08:09, Ben Farmer <ben.farmer(a)gigafy.co> wrote: > Hi Jason, > > I've applied the changes you've suggested and so far haven't heard back. > Although this issue is a bit weird, sometimes it'll happen immediately, > other times it'll take two to three weeks to be a problem. > > Mikrotik has also loaded one of their test packages on the device to get > more debugging info, so hopefully we have something soon. > > Ben > > -----Original Message----- > From: Public <public-bounces(a)talk.mikrotik.com.au> On Behalf Of Jason > Hecker (Up & Running Tech) > Sent: Tuesday, 6 March 2018 10:55 > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Subject: Re: [MT-AU Public] Mikrotik - Wireless Issue on hAP and hAP ac > lite > > Hi Ben > > What happened in the end? > > Jason > > On 27 February 2018 at 09:50, Ben Farmer <ben.farmer(a)myport.com.au> wrote: > > > Hi Jason, > > > > Thanks for the suggestions, most of those we've got, but will give it > > a shot with only-N, WMM enabled and multicast helper as well. > > > > Greg, they are not able to roam, the SSID is restricted down to one > > device only. > > > > The error message so far has appeared on both iOS/OSX devices and > > Windows laptops. Haven't heard anything about Android devices, but > > then again they don't seem to be as common these days. > > > > Regards, > > Ben Farmer > > > > Network Engineer > > > > > > www.myport.com.au > > > > Address 86 Brookes St, Fortitude Valley Q 4006 Mobile 0488 034 499 > > Direct 07 3177 1122 Tel 1300 733 629 Fax 07 3177 1129 Email > > ben.farmer(a)myport.com.au > > > > -----Original Message----- > > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of > > Jason Hecker (Up & Running Tech) > > Sent: Tuesday, 27 February 2018 7:58 > > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > > Subject: Re: [MT-AU Public] Mikrotik - Wireless Issue on hAP and hAP > > ac lite > > > > Hi Ben, > > > > I generally set the following on 2.4GHz: > > > > - Use only channels 1, 6, 11 > > - Set 20Mhz bandwidth > > - Unless you have old gear set 2GHz-only-N. When devices like Sonos > and > > old printers crop up you have to go back to B/G/N. > > - 802.11 > > - Distance indoors > > - Adaptive noise immunity client and ap > > - Preamble mode to both > > - Any guard interval > > - All chains enabled > > - Full multicast helper > > - WMM enabled > > - Only use WPA2-PSK and only AES > > > > More than 1 AP now I use CAPSMAN, sometimes with local forwarding > > sometimes not. It's just a lot easier in the long run. > > > > Try it out. > > > > Jason > > > > > > > > > > On 27 February 2018 at 08:27, Ben Farmer <ben.farmer(a)myport.com.au> > wrote: > > > > > Hi guys, > > > > > > Hoping any of you can help. We're seeing weird issues with our > > > Mikrotik client routers in deployment, specifically with the 2.4GHz > > > wireless on the hAP and hAP ac lites. > > > > > > This issue we're seeing seems to affect the 2.4GHz wireless card > > > (Atheros > > > AR9300 in both models) but does not affect the 5GHz card in the ac > lite. > > > > > > Customers are reporting to us the inability to connect to wireless > > > at times, such as invalid security key or failure to connect > > > messages (depending on the customer device). > > > > > > The wireless interface itself will show as running, but with no > > > clients connected. No error messages are indicated in the log about > > > exchange key timeouts or anything similar, like you'd expect. > > > > > > Doing anything that performs a soft-reset like operation on the > > > wireless interface will allow the customer to connect again for a > > > period > > of time. > > > This can include: > > > - Doing a wireless scan. > > > - Doing a frequency usage scan. > > > - Changing channel. > > > - Changing SSID. > > > > > > Basically any option you can change will fix it, even rebooting the > > router. > > > > > > We've tried all different types of software from 6.39 through 6.41, > > > even the latest rc (6.42rc35). We've seen this issue for at least > > > three months now, if not longer. It's not isolated to a particular > > > site either, as we receive reports daily from other customer > > > locations > > with the same issue. > > > > > > Initially we thought it was interference, but even then we have > > > customers with very low utilisation and still seeing this issue. > > > > > > We have reported a case with Mikrotik, but their most recent > > > suggestion was to post in the forums to see if anyone else was > > > experiencing this issue (which surprised me, generally they direct > > > you to support if you write this sort of stuff in the forums). > > > > > > Below I've included a brief output from the router showing the way > > > this interface is currently set up. > > > > > > Have any of you seen this type of issue on either this wireless card > > > or others? > > > > > > /interface wireless security-profiles add > > > authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys > > > name=wlan1 supplicant-identity=room-403 > > > > > > /interface wireless > > > set [ find default-name=wlan1 ] > > > adaptive-noise-immunity=ap-and-client-mode > > > band=2ghz-b/g/n country=australia disabled=no distance=indoors > > > frequency=2462 mode=ap-bridge security-profile=wlan1 ssid="Room 403" > > > wireless-protocol=802.11 > > > > > > Regards, > > > Ben > > > > > > _______________________________________________ > > > Public mailing list > > > Public(a)talk.mikrotik.com.au > > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > > > au > > > > > > > > > > > -- > > <https://www.upandrunningtech.com.au> > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > > au > > > > > > -- > <https://www.upandrunningtech.com.au> > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > -- <https://www.upandrunningtech.com.au>

2 2

Mikrotik - Wireless Issue on hAP and hAP ac lite
by Ben Farmer 06 Mar '18

06 Mar '18

Hi guys, Hoping any of you can help. We're seeing weird issues with our Mikrotik client routers in deployment, specifically with the 2.4GHz wireless on the hAP and hAP ac lites. This issue we're seeing seems to affect the 2.4GHz wireless card (Atheros AR9300 in both models) but does not affect the 5GHz card in the ac lite. Customers are reporting to us the inability to connect to wireless at times, such as invalid security key or failure to connect messages (depending on the customer device). The wireless interface itself will show as running, but with no clients connected. No error messages are indicated in the log about exchange key timeouts or anything similar, like you'd expect. Doing anything that performs a soft-reset like operation on the wireless interface will allow the customer to connect again for a period of time. This can include: - Doing a wireless scan. - Doing a frequency usage scan. - Changing channel. - Changing SSID. Basically any option you can change will fix it, even rebooting the router. We've tried all different types of software from 6.39 through 6.41, even the latest rc (6.42rc35). We've seen this issue for at least three months now, if not longer. It's not isolated to a particular site either, as we receive reports daily from other customer locations with the same issue. Initially we thought it was interference, but even then we have customers with very low utilisation and still seeing this issue. We have reported a case with Mikrotik, but their most recent suggestion was to post in the forums to see if anyone else was experiencing this issue (which surprised me, generally they direct you to support if you write this sort of stuff in the forums). Below I've included a brief output from the router showing the way this interface is currently set up. Have any of you seen this type of issue on either this wireless card or others? /interface wireless security-profiles add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=wlan1 supplicant-identity=room-403 /interface wireless set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode band=2ghz-b/g/n country=australia disabled=no distance=indoors frequency=2462 mode=ap-bridge security-profile=wlan1 ssid="Room 403" wireless-protocol=802.11 Regards, Ben

3 5