- Public - talk.mikrotik.com.au

VLAN support with RB750Gr3
by Chris Herrmann 12 Sep '17

12 Sep '17

Hi all, Looking at upgrading from RB2011 to this model to improve IPSEC throughput (don't need wifi on the unit). Sounds like the RB750Gr3 is much faster than the RB2011 for this... but... I've stumbled across some posts with people describing issues using VLANs on the RB750Gr3. The posts in question didn't appear to be resolved... so I figured I'd ask here - can you use vlans safely with this unit and <latest stable software/firmware>? The RB2011 has been working perfectly with this for years now, but we'd like to push far more than the 16Mbps that appears to be the ceiling we get pushing IPSEC packets. Anyone using it for this? Thanks! Chris

4 8

LAN support with RB750Gr3
by Chris Herrmann 11 Sep '17

11 Sep '17

Hi all, thanks for the replies. Mike there's a comment from a Mikrotik staff member on this post: https://forum.mikrotik.com/viewtopic.php?t=113724&start=50 and other similar pages. The exact comment on this from MK specifically is: "RB750Gr3 switch chip does not have full VLAN tagging/untagging support yet, it is planned to implement it in future. Currently, you should use RB750Gr3 switch chip only for basic switching." that was in November 2016, so was hoping that maybe things had changed since then. as for whether I'll go a virtual or hardware switch I'm not sure at this point. In general I'd try and use hardware support for things because dedicated ASICs tend to give you better performance than relying up the main CPU to achieve a feature (this isn't a MK specific comment btw, true of any vendors I've come across). So currently I'm using the switch chip vlan not routerOS virtual interface tagging. If I could continue to use it, that would be my preference... but if not does it change the actual config design a lot? I'm guessing once you have the VLAN interface up then all your other rules are still referring to object(x) which just happens to be a virtual interface instead of a switch chip vlan? Or not...? Thanks! Chris

1 0

Re: [MT-AU Public] m2m network design ideas
by Darren Clissold 08 Sep '17

08 Sep '17

Hi Jeremy, Mostly been using this setup for SNMP and remote management of devices, however as a test I've seend Netflix streamed from the US over a SSTP tunnel without any problems. The biggest limitation will be the 3G, as it's dependant on available bandwidth in the area. Darren. On 7/09/2017 4:35 AM, Jeremy Hall wrote: > Thanks, Darren - very useful! > > Any comments or observations on real-world performance of SSTP tunnels > (TCP over TCP) over 3G/LTE connections? > > Cheers > Jeremy > > On Tue, Sep 5, 2017 at 10:10 PM, Darren Clissold <darren(a)duxtel.com > <mailto:darren@duxtel.com>> wrote: > > Remote router connects to VPN router by SSTP, and route a subnet > down the connection for the LAN. > > Remote router dialing in has the advantage in that you can have > more than one gateway (can have a DHCP on a eth and 3G/4G just > adjust distances) and it will connect on either and still have the > same addressing, no need to worry about the remote sites outside > IP either as you never connect to it directly. > Can use the router secrets table or a Radius server for greater > control (extra routes). > > Darren > > > On 27/08/2017 8:33 AM, Jeremy Hall wrote: > > Hi all, > > I have a small project coming up that involves a m2m network > for remote > monitoring and control of distrubuted equipment, and I am > interested in > hearing about the designs and architectures that folks here > may be using > for this type of application. > > The project will involve multiple remote sites, all with > similar or > identical industrial equipment (PLCs, IP cameras etc) and most > likely > connected to a dedicated 3G/4G service via a Mikrotik gateway. The > equipment on the remote sites will need to be accessible over > the network > by a server (to collect data from equipment), a few > individuals (for > maintenance purposes) and by end customers (who should only be > able to > access devices on their own site/s, and not the whole network). > > I have previously implemented a similar project where these > remote sites > (RB912 or similar) would run a VPN client and establish a PPTP > tunnel back > to a head office router (RB1100AH). The connection was over a > 3G service or > where permitting, would be plugged right in to the customer's > own network > (using NAT and DHCP-client) and get internet access. Per a helpful > suggestion from Mike, each remote network had the same subnet, > which > allowed for much simpler 'copy and paste' site setups, and the > router/tunnel was allocated a single static address > (representing a single > site) on the VPN network. DST-NAT rules on the remote router > were used to > gain access to specific equipment on the remote network using > arbitary > ports. > > This worked well enough, but had a couple of disadvantages; > mainly that the > DST-NAT port forwarding could create issues and confusion, but > also that > the whole lot was dependent on the office router/network being > available, > PPTP could not really be claimed to be 'secure' and customers > could not > access their equipment unless we gave their remote site router > a public IP > address and opened up access that way. > > Facing a similar project now, I'm curious about other > implementations and > approaches, and how other folks might have built out solutions > around > similar requirements. > > For instance, I'm currently dreaming of a solution along the > lines of a VPN > server running on a cloud provider, also running a reverse > proxy (nginx) > open to the internet, such that authenticated (?) customers > can create TCP > connections to a device using a hostname like ' > device.site.customer.mycompany.com > <http://device.site.customer.mycompany.com>' or > 'customer.mycompany.com/device > <http://customer.mycompany.com/device>' (via > proxy_pass and url rewrite directives in nginx). Each remote > site has a > small unique subnet (perhaps a /26) so every device is individualy > addressable. Maintenance staff can connect to the VPN server > from wherever > and have access to the full network. > > If anyone has anything to contribute regarding your own set > up, that would > be most helpful! > > Cheers > - Jeremy > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au <mailto:Public@talk.mikrotik.com.au> > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > <http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au> > > > > --- > This email has been checked for viruses by Avast antivirus software. > https://www.avast.com/antivirus <https://www.avast.com/antivirus> > >

1 0

m2m network design ideas
by Jeremy Hall 27 Aug '17

27 Aug '17

Hi all, I have a small project coming up that involves a m2m network for remote monitoring and control of distrubuted equipment, and I am interested in hearing about the designs and architectures that folks here may be using for this type of application. The project will involve multiple remote sites, all with similar or identical industrial equipment (PLCs, IP cameras etc) and most likely connected to a dedicated 3G/4G service via a Mikrotik gateway. The equipment on the remote sites will need to be accessible over the network by a server (to collect data from equipment), a few individuals (for maintenance purposes) and by end customers (who should only be able to access devices on their own site/s, and not the whole network). I have previously implemented a similar project where these remote sites (RB912 or similar) would run a VPN client and establish a PPTP tunnel back to a head office router (RB1100AH). The connection was over a 3G service or where permitting, would be plugged right in to the customer's own network (using NAT and DHCP-client) and get internet access. Per a helpful suggestion from Mike, each remote network had the same subnet, which allowed for much simpler 'copy and paste' site setups, and the router/tunnel was allocated a single static address (representing a single site) on the VPN network. DST-NAT rules on the remote router were used to gain access to specific equipment on the remote network using arbitary ports. This worked well enough, but had a couple of disadvantages; mainly that the DST-NAT port forwarding could create issues and confusion, but also that the whole lot was dependent on the office router/network being available, PPTP could not really be claimed to be 'secure' and customers could not access their equipment unless we gave their remote site router a public IP address and opened up access that way. Facing a similar project now, I'm curious about other implementations and approaches, and how other folks might have built out solutions around similar requirements. For instance, I'm currently dreaming of a solution along the lines of a VPN server running on a cloud provider, also running a reverse proxy (nginx) open to the internet, such that authenticated (?) customers can create TCP connections to a device using a hostname like ' device.site.customer.mycompany.com' or 'customer.mycompany.com/device' (via proxy_pass and url rewrite directives in nginx). Each remote site has a small unique subnet (perhaps a /26) so every device is individualy addressable. Maintenance staff can connect to the VPN server from wherever and have access to the full network. If anyone has anything to contribute regarding your own set up, that would be most helpful! Cheers - Jeremy

3 2

Mikrotik Reboots
by Paul Julian 25 Aug '17

25 Aug '17

HI all, has anybody else seen a sharp increase in MT devices just rebooting for no reason of late ? In the past month or so we must have had about 10-15 reboots for no reason. We have seen a mix of OS versions doing it, even ones with the latest bugfix version on them. CCR's, RB1100AHx2's, Grooves, QRT's, Omnitiks, they just seem to be rebooting out of the blue, it's really strange. We run a lot of MT gear and we are seriously seeing a couple a week just reboot for no reason and I am getting a bit concerned about it. They are all rebooting due to watchdog failure, just the default OS one. I'm interested to see if anybody else is experiencing the same. Regards Paul

4 7

Strange PPPOE Problem
by Paul Julian 16 Aug '17

16 Aug '17

Morning all, we have identified a bit of a strange issue and I was hoping that somebody might have come across it before and have some suggestions. We run a number of sites around the place which have a fibre backhaul from our DC to the site, then a router and DSLAM at the site which supplies customers with Ethernet services. Pretty much all sites are configured in an almost identical way. Yesterday we did a new install for a client at a site and noticed that the upload speed was slow compared to what it should be, around 9Mbit/s but fluctuating a bit. When he used the Mikrotik Bandwidth test utility and tested to the local LNS router performance was OK, however when using that app to test to a router in our DC the upload problem appeared still. The CPE was a TPLink VR600 Router running PPPOE, a common unit that we use for these installs and normally a good router. Our tech decided to go to our equipment in the building and test directly plugged into the DSLAM, there was no change when testing to the DC router, when testing to local router it was OK. He then used the router on site which operates as the LNS running PPPOE server and is an RB1100AHx2 and connected directly to one of the spare Ethernet ports on that, configured a PPPOE server on it with the same details as the other server and the problem remained when testing to router at DC, but testing to local router was OK. He then removed the PPPOE component and just connected normally to the Ethernet port on the router with straight IP and bandwidth tests worked fine to the local router and the DC router. There seems to be something going on when coming from a PPPOE connection which terminates on that local router when you try uploading to something past the router, the issue never happens when uploading to the local router only outside of the network. At this particular site we have a couple of other locations which hang off it via wireless backhauls. If we test from the local router at each of these sites back to the DC router we have no issues, so it's definitely PPPOE related. We also have another Mikrotik router at the site which is an out of band router, when testing from this router using the same scenarios we don't have any issues. PPPOE or straight Ethernet works perfectly OK to the local router and DC router, so there is something different between using a MT router as the PPPOE client and other devices. So far we have used a Windows 10 PC, a Macbook and a TPLink router as a CPE, they all experienced the upload problems. We have tried disabling the MRRU setting on the PPPOE server instance, no difference. We have checked firewall rules and everything else on the router and just can't identify anything which could be causing the problem. We have tried disabling Fastpath also just in case. We just can't find anything which seems to indicate a problem. Currently the RB1100 is running ROS 6.37.5, it was upgraded to that bugfix version 107 days ago and we haven't noticed any issues until now. Any suggestions would be appreciated as we have many customers connecting to this router and whilst none have complained it's surely only a matter of time. Thanks Paul

2 7

Fwd: CAPSMAN WAPAC WIFI Failure
by Jason Hecker (Up & Running Tech) 10 Aug '17

10 Aug '17

OK I really don't want to but I'll turn off local forwarding and client-client and try tunnelling. Are your CAPSMAN tunnels on the local broadcast domain or using an IP address? If the former it'd seem to me that tunnel frames could get dropped or lost if the CAPSMAN controller got overwhelmed. What device are you using for the controller? I am using an RB2011 which is fine just for managing the radio interfaces. On 10 August 2017 at 14:05, Andrew Thrift <andrew(a)networklabs.co.nz> wrote: > We have an install with around 230 wAP AC's on a single CAPSMAN, all > SSID's use tuneled datapath. > > The issues we have had are: > > - ARP replies disappearing when using a tunneled datapath (Clients get > a DHCP lease but are unreachable) This one still happens on 6.40.x > > - Irregular performance. Two laptops connected to the same AP on the > same SSID, one will only be able to do 4mbit, the other will do a few > hundred. Both have Intel 802.11ac wireless cards. > > - Prior to 6.40rc2 we had issues with mainly Apple iPhones and Samsung > Galaxy J5's where they would be connected but would be unreachable. > Dropping them off from Capsman, or restarting wireless fixed them. > This seems to be fixed.. > > I am hoping Mikrotik can fix the ARP issue, and I am looking forward > to the promised band-steering features :) > > > > > On Thu, Aug 10, 2017 at 2:03 PM, Jason Hecker (Up & Running Tech) > <jason(a)upandrunningtech.com.au> wrote: > > Dave and Andrew, > > > > What issues have you had with WAPACs? > > > > Jason > > > > On 10 August 2017 at 08:39, Dave Browning <dave(a)sentrian.com.au> wrote: > > > >> I've had random issues with wAPAC's that rolling back to bug fix > resolved. > >> Can't name all the issues and not all issues resolved. But life is a bit > >> happier on bugfix. > >> > >> > On 9 Aug 2017, at 9:19 pm, Jason Hecker (Up & Running Tech) < > >> jason(a)upandrunningtech.com.au> wrote: > >> > > >> > Hi > >> > > >> > I am getting similar issues with 6.40 and 6.39.2. I wish Mikrotik > would > >> > mention such major changes in the change log. > >> > > >> > No (R)STP on any bridges, long guard interval, 1 hour group key > timeout > >> > don't seem to help any. > >> > > >> > Another school with Apple devices and a similar setup isn't having the > >> same > >> > issue but their devices tend to stay in the rooms. > >> > > >> > I'll try 6.40.1 tomorrow and turn off local forwarding and client to > >> client. > >> > > >> >> On 9 August 2017 at 19:58, Andrew Thrift <andrew(a)networklabs.co.nz> > >> wrote: > >> >> > >> >> Hi Jason, > >> >> > >> >> I have not seen that specific issue, but Mikrotik replaced the driver > >> >> for the wAP AC and hAP AC in RouterOS 6.40. It fixed a few issues we > >> >> were having on them. > >> >> > >> >> > >> >> It might be worth giving that a try.. > >> >> > >> >> > >> >> Regards, > >> >> > >> >> > >> >> > >> >> Andrew > >> >> > >> >> On Wed, Aug 9, 2017 at 8:14 PM, Jason Hecker (Up & Running Tech) > >> >> <jason(a)upandrunningtech.com.au> wrote: > >> >>> I have a school site with CAPSMAN on an RB2011 controlling 7 WAPACS. > >> >>> > >> >>> Local forwarding and client to client comms are used and the 5GHz > band > >> is > >> >>> pre-eminent as most of the devices are iPads and Macbook Airs. > >> >>> > >> >>> When the class of students with their iPads move from one WAPAC to > >> >> another > >> >>> Wifi connectivity seems to collapse on the adjacent WAPACS - no > devices > >> >> can > >> >>> communicate. Registration table shows they join but data doesn't > flow > >> >> very > >> >>> well if at all so DHCP fails etc. After 15-30 mins or a power > cycle it > >> >> all > >> >>> seems to settle down and things work again until the next > migration... > >> >>> > >> >>> When the WAPACS aren't working well on Wifi I can still connect in > from > >> >> the > >> >>> network side with Winbox and have no issues there. > >> >>> > >> >>> I've tried all sorts of things and am running out of options. > >> >>> > >> >>> Has anyone else seen this sort of thing? > >> >>> -- > >> >>> <https://www.upandrunningtech.com.au> > >> >>> _______________________________________________ > >> >>> Public mailing list > >> >>> Public(a)talk.mikrotik.com.au > >> >>> http://talk.mikrotik.com.au/mailman/listinfo/public_talk. > >> mikrotik.com.au > >> >> > >> > > >> > > >> > > >> > -- > >> > <https://www.upandrunningtech.com.au> > >> > _______________________________________________ > >> > Public mailing list > >> > Public(a)talk.mikrotik.com.au > >> > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mik > rotik.com.au > >> > >> _______________________________________________ > >> Public mailing list > >> Public(a)talk.mikrotik.com.au > >> http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mik > rotik.com.au > >> > > > > > > > > -- > > <https://www.upandrunningtech.com.au> > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > -- <https://www.upandrunningtech.com.au> -- <https://www.upandrunningtech.com.au>

1 0

CAPSMAN WAPAC WIFI Failure
by Jason Hecker (Up & Running Tech) 10 Aug '17

10 Aug '17

I have a school site with CAPSMAN on an RB2011 controlling 7 WAPACS. Local forwarding and client to client comms are used and the 5GHz band is pre-eminent as most of the devices are iPads and Macbook Airs. When the class of students with their iPads move from one WAPAC to another Wifi connectivity seems to collapse on the adjacent WAPACS - no devices can communicate. Registration table shows they join but data doesn't flow very well if at all so DHCP fails etc. After 15-30 mins or a power cycle it all seems to settle down and things work again until the next migration... When the WAPACS aren't working well on Wifi I can still connect in from the network side with Winbox and have no issues there. I've tried all sorts of things and am running out of options. Has anyone else seen this sort of thing? -- <https://www.upandrunningtech.com.au>

4 9

xDSL SFPs
by Thomas Jackson 09 Aug '17

09 Aug '17

Good afternoon all, I remember some discussion earlier in the year about xDSL SFPs in AU. Did anyone manage to find one that worked? We've got a few sites coming up for refresh in the next month or so and it would be nice to move away from our standard deployment of an RB with a TPLink double-sided-taped together. All sites currently have ADSL2+ connections - and all are allegedly getting NBN FTTN or FTTdp in the next 12-18 months so it would be great to have something supporting both (although given that the office I'm sitting in at the moment had NBN fiber pulled in a couple of months ago which is still not ready for service, I'll believe that last part when I see it...). Thanks!

8 24

802.11af/at switch
by Jason Hecker (Up & Running Tech) 26 Jul '17

26 Jul '17

I bought some Netgear GS105PE 802.3af/at in/out switches to power a existing WAPACs and hook nearby AppleTVs into ethernet from a HP V1910 (JE008A) switch way back at the rack. No good, in spite of firmware upgrades to the HP and Netgear switches the WAPAC would not be powered but has no issue being powered from the HP directly - same problems as per below where the Netgear didn't negotiate 802.3at: https://community.netgear.com/t5/Smart-Plus-Click-Switches/GS105PE-PoE-not-… I still don't actually know if the Netgear and WAPAC are compatible at all, the Netgear LED flicked on and off indicating PoE passthough wasn't working to the WAPAC. Apart from the HEX POE (overkill a bit) are there any other compact switches anyone can recommend that can be fed by 802.3at and pass on the power as well? I did find a hint below for the V1920 and I'll try it tomorrow on the V1910 if it's possible. http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=mmr_kc-0133889 Someone else made some changes to their V1910 and 802.3at connected but power would not pass through. https://community.netgear.com/t5/Smart-Plus-Click-Switches/Netgear-GS105PE-… I wasted enough time this evening trying to get it working. I say Mike, if the HEX POE Just Works and the new hopefully cheaper switches coming from Mikrotik (when?) Just Work you could be onto a winner! -- <https://www.upandrunningtech.com.au>

2 2