- Public - talk.mikrotik.com.au

IPv6 with VRRP?
by Damien Gardner Jnr 09 May '19

09 May '19

Hi All, Having a bit of a weird one. Managed to score a couple of RB1100AHx4's cheap on eBay (Oh my lord they are fast!), so am using them for EOIP between sites for my personal colo, as well as BGP redundancy between the sites. v4 BGP is coming along nicely, but v6 is driving me nuts. Ideally I'd have VRRP between the two 1100's on the public VLAN facing my VM's, for the gateway IP, but still have an IP in the subnet on each router for reachability (aka a pretty standard setup..). That works as expected for IPv4. For IPv6, it's a whole other kettle of fish.. Here's a config chunk as example: /interface vlan add interface=bond_bridge mtu=9100 name=vlan39_PUBLIC vlan-id=39 /interface vrrp add interface=vlan39_PUBLIC mtu=9100 name=vlan39_vrrp v3-protocol=ipv6 vrid=39 /ipv6 address add address=2406:c500:fff3::1 advertise=no interface=vlan39_vrrp add address=2406:c500:fff3::2 advertise=no disabled=yes interface=vlan39_PUBLIC /ipv6 route add distance=1 gateway=2400:d400:b97:3c8f::1 add distance=1 gateway=2400:d400:b97:1c8f::1 add check-gateway=ping distance=1 dst-address=2406:c500:fff3:ff00::/56 gateway=2406:c500:fff3::29 Now, while that ::2 IP is disabled, everything works fine. I can ping hosts on the local /64, and on the routed /56. But if I enable the ::2 IP on the parent interface, I can still ping hosts on the local /64, but stop being able to ping hosts on the routed /56, until I remove the IP again: SEQ HOST SIZE TTL TIME STATUS 0 2400:d400:b97:3c8f::2 104 64 2ms hop limit exceeded 1 2400:d400:b97:3c8f::2 104 64 1ms hop limit exceeded 2 2400:d400:b97:3c8f::2 104 64 1ms hop limit exceeded >> disabled ::2 IP 3 2406:c500:fff3:ffe1::2 56 63 1ms echo reply 4 2406:c500:fff3:ffe1::2 56 63 0ms echo reply The v6 routing table for the local LAN with the ::2 IP disabled: 5 ADC dst-address=2406:c500:fff3::/64 gateway=vlan39_vrrp gateway-status=vlan39_vrrp reachable distance=0 scope=10 6 A S dst-address=2406:c500:fff3:ff00::/56 gateway=2406:c500:fff3::29 gateway-status=2406:c500:fff3::29 reachable via vlan39_vrrp check-gateway=ping distance=1 scope=30 target-scope=10 And same with the :2 IP enabled: 5 ADC dst-address=2406:c500:fff3::/64 gateway=vlan39_vrrp,vlan39_PUBLIC gateway-status=vlan39_vrrp reachable,vlan39_PUBLIC reachable distance=0 scope=10 6 S dst-address=2406:c500:fff3:ff00::/56 gateway=2406:c500:fff3::29 gateway-status=2406:c500:fff3::29 unreachable check-gateway=ping distance=1 scope=30 target-scope=10 Is anyone using VRRP on IPv6 successfully, and have any pointers? I 'could' up and down the spare IP in scripts on the VRRP interface, but that seems problematic... And the static route on V6 doesn't let me add %vlan39_PUBLIC or the like in the gateway field to force it out the parent interface.. Thanks, Damien -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder

1 1

Transit provider
by Malcolm Faed 02 May '19

02 May '19

Hi all, We are looking for an internet transit provider for 200+ Mbps in Syd EQ1 Target price is < AU$10 / Mbps. Does anyone have any recommendations based on experience, reliability, ease of setting up and customer service. TIA. *Malcolm Faed*Network Broadcast Engineer malcolm(a)avcomm.com.au Av-Comm Office: +61 2 9939 4377 Mobile+61 424 957 053 Unit 24 / 9 Powells Road, Brookvale, NSW 2100, Australia. avcomm.com.au [image: Twitter] <https://twitter.com/AvCommSatellite>[image: Google Plus] <https://plus.google.com/+AvcommAustralia/>[image: Youtube] <https://www.youtube.com/channel/UCO8ZtcnwoTH7e54LAndE-yw>[image: Linkedin] <https://www.linkedin.com/company-beta/6583589/> This e-mail message may contain confidential or legally privileged information and is intended only for the use of the intended recipient(s). Any unauthorised disclosure, dissemination, distribution, copying or the taking of any action in reliance on the information herein is prohibited. E-mails are not secure and cannot be guaranteed to be error free as they can be intercepted, amended, or contain viruses. Anyone who communicates with us by e-mail is deemed to have accepted these risks. Av-Comm is not responsible for errors or omissions in this message and denies any responsibility for any damage arising from the use of e-mail. Any opinion and other statement contained in this message and any attachment are solely those of the author and do not necessarily represent those of the company.

1 0

UKNOF 43 CVE
by Shane Clay 14 Apr '19

14 Apr '19

For those of you who don't follow AUSNOG... "critical vulnerability" for Mikrotik devices running IPv6 (even firewalled) that you should know about: https://forum.mikrotik.com/viewtopic.php?t=147076 Mikrotik have acknowledged it: https://forum.mikrotik.com/viewtopic.php?f=2&t=147048#p723696 Twitter thread from the person who discovered it: https://twitter.com/maznu/status/1110910688623513601 No current fix. Shane

7 23

Dual Supply for CCR1036
by Andrew Gilbett 08 Apr '19

08 Apr '19

Hi Guys, Do you know if there is any way to present Dual power supplies to a CCR1036-12G-4S? I have not opened one up yet to confirm but from googling it looks like there is a DC jack on the right hand side at the rear but not exposed, which would be cool if you could just plug in 24V there from a external PSU... Has anyone looked in to this in more detail? Andrew

2 1

Fancy Mikrotik Wifi Bridge features
by Jason Hecker (Up & Running Tech) 26 Mar '19

26 Mar '19

This just got pointed out to me. https://wiki.mikrotik.com/wiki/Manual:Wireless_VLAN_Trunk It looks like since 6.41 two Mikrotik devices in AP->Station will keep track of VLANs and probably other non-IP ethernet frames without the need for an EoIP bridge. The Duxlink Duo scripts might be redundant! I have yet to test it but thoughts...? anyone..? anyone..? Bueller?

1 0

Does anyone HAVE a MikroTik CRS305-1G-4S+IN yet??
by Damien Gardner Jnr 19 Mar '19

19 Mar '19

So I'm currently chasing a CRS305-1G-4S+IN - it would be PERFECT for a fileserver upgrade I'm doing for my linux ISO storage server. They look to have been out a couple of years, but had some pretty serious packet forwarding issues up until a month ago, so probably weren't overly popular. Weird thing is, I spent about 3 hours last night hitting up every 'Tik reseller in the world, and they ALL have 0 stock, and expected arrival times between around the 8th and 20th of April. Does anyone actually HAVE one of these mystical beasts? (And interested in parting with it perhaps?) Anyone know why they don't seem to be available? I was otherwise looking at the CRS328's, but at that price point a single cpu core seems stupendously underpowered with the RouterOS changes recently doing away with the switch chip settings and moving everything to bridges... :\ Thanks, DG -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder

3 7

Certification training 'Stand By' list
by Mike Everest 05 Mar '19

05 Mar '19

Hi all! Most of you may know already that there are MikroTik Certification classes running in Sydney later this month, and as we often need to make up some numbers to even up class groups, I'm keen to hear from anyone who is interested to nominate themselves (or someone else) for a 'stand by' seat :) Stand-by places are sometimes needed because practice exercises are completed in groups of 2 for most certification classes, and groups of 4 for routing class. Therefore, when the enrolled numbers do not offer full groups, stand-by list can make up the numbers :) Since there is no guarantee that a stand-by place will be offered, there are some cost savings to be had - so if you are interested, please contact me direct (off-list) sometime over next couple of weeks! Cheers, Mike.

2 2

wAPR-LTE-kit certified for AU use :-D
by Mike Everest 01 Mar '19

01 Mar '19

Apologies in advance if this is too close to 'commercial spruiking' for any - if you think it is, please do feel welcome to tell me about it on or off list :-} But since it is a topic that has come up from time to time, and because we have been working on it for more than 15 months (our case tracking database calls it 492 days and 4 hours ;) I just HAVE to shout it to the world :-D wAPR with built-in MikroTik LTE modem has finally cleared the last certification stage and is now certified fully compliant with all relevant AU regulations :-) Woohoo! :-D Cheers, Mike.

3 7

B28 LTE modem success
by Jason Hecker (Up & Running Tech) 26 Feb '19

26 Feb '19

I have banged on a bit in the past concerning Telit miniPCIe LTE modules which work on Band 28 in a Mikrotik. A few months ago I bought a Telit LE910C1-AP from Glyn in Sydney to see if it came up in LTE mode on the Mikrotik seeing as a lot of work has been done to improve LTE in ROS. Alas, no joy so I left it. I recently saw mention of support for a Telit module in 6.44.rc1 so I decided to revisit the whole thing. It works! The Telit MiniPCI module is: Telit LE910C1-AP https://www.telit.com/wp-content/uploads/2017/11/Telit_LE910C1_Hardware_Use… It supports: LTE FDD bands 1, 3, 5, 8, 28 and HSPA+ bands 1, 5, 8 CAT1 speeds 10Mbit down / 5Mbit Up. With speedtest.net I got 9.62/4.86 (ping 29ms) Antenna: SRFL026 (single antenna - no diversity) https://antenova.com/wp-content/uploads/2016/05/Mitis-SRFL026-PS-1.1.pdf Price: $128 inc GST, shipping and patch antenna above as a kit from Glyn's webstore. Talk to these guys if you want to order one. http://www.glynstore.com/pages/Contact-Us.html Dean and Leo are always very nice and helpful with sales and support. A company I used to work for bought a lot of Telit 2G modules from Glyn. Mikrotik Board: RB411 ROS: 6.34rc2 Carrier: Telstra (Two B28 towers within 2kms of me) The board interface comes up as 'usb' in ROS which has 7 channels. I tested all the channels with a telnet client and the remote access setting in ROS using RFC2217. Eventually I discovered channels 4 and 5 respond as a serial interface and it responds to AT commands. For example ----- at&v DTE SPEED : 115200 DTE FORMAT : 8N1 GSM DATA MODE : Not Transparent AUTOBAUD : +IPRxxx00=NO COMMAND ECHO : E1=YES RESULT MESSAGES : Q0=YES VERBOSE MESSAGES : V1=YES EXTENDED MESSAGES : X1=YES LINE SPEED : F0=autodetect CONSTANT DTE SPEED : YES FLOW CONTROL OPTIONS : &K3=HW bidirect. ERROR CORRECTION MODE : RLP CTS (C106) OPTIONS : &B2=OFF while disc. DSR (C107) OPTIONS : &S3=PHONE ready->ON DTR (C108) OPTIONS : &D0=ignored DCD (C109) OPTIONS : &C1=follows carrier RI (C125) OPTIONS : \R1=OFF dur. off-hk C108/1 OPERATION : &D4=NO POWER SAVING ON DTR : +CFUN:1=NO DEFAULT PROFILE : &Y0=user profile 1 OK ----- Great! Obviously the mode of operation for this unit was going to be PPP. This is all you need to get it working in ROS: /interface ppp-client add apn=telstra.internet data-channel=4 dial-command=ATD disabled=no \ info-channel=5 name=ppp-out1 phone=*99# port=usb2 profile=Telstra The beauty of this you get to use the assigned carrier grade NAT IP address from Telstra (for example 10.98.250.114) instead of the double NATed address that comes off a lot of dongles. The RB411 has a sloooow 300MHz CPU so it takes a few minutes for the built in serial port and usb2 to come up in the System->Ports menu. Concerning also is when making changes to or enabling the PPP interface would sometimes fail with: "couldn't change interface <ppp-out1> - object doesn't exist (4)" which is baloney of course. A second attempt always seems to work. The next step is to try it out in a RBwAPR. There are faster CAT11 (more expensive) and slower Cat-M1 modules available too but I have yet to try these out. The LE910C1-AP seems good for those that need B28 at decent speeds for OOBE access or 4G failover in Mikrotik now that Sierra is a distant memory. The new Gen2 NBN routers from Telstra fail over to 6/1Mbit speeds so 10/5 seems OK to me for an industrial rated LTE modem. The module also supports and has connectors for a GPS and a 4G diversity antenna but I have yet to test them out. Jason Hecker

2 5

Web Managed PDU's
by Paul Julian 11 Feb '19

11 Feb '19

Hi all, I am looking at some options for web managed PDU's, preferably 4 port. As we know, occasionally something locks up on a remote site or needs a reboot because an interface has locked up or something, we are looking to implement some remote controlled PDU's for our remote sites as an additional component of our out-of-band solution, has anybody had any good or bad experience with these and/or can recommend some that a reasonably priced and reliable ? Thanks Paul

1 0