- Public - talk.mikrotik.com.au

last 2 (hopefully) vrf questions
by Alex Samad - Yieldbroker 08 Feb '17

08 Feb '17

Hi My last 2 issue with VRF's So ICMP's that a generated on the box for net unreachable and similar iCMPs have the src address of the main table So my main table is basically 192.168.0.0/24 ether1 0.0.0.0/0 via 192.168.0.2 prc-src 192.168.0.1 VRF's Management Internet Private I have /ip route vrf set up for each And I have mangles rules to mark and remark packets So what happens on any of the vrf interfaces if the ccr generates a ICMP it has a source address of 192.168.0.1 I have a snat rules to snat to each interfaces actual address, but that doesn't seem to work for these icmp's But does work if I do something like this /ping 8.8.8.8 the source gets set to my Public ip address I use mange to route 8.8.8.8 from local machine via the Public VRF. I have sent support an email, but as yet no response. I do believe that somebody said they had fixed this on the list ? My last problem for now is my main table DGW is reliant upon ether1 being up :( if its not then local packet generation stops working . My thought was to generate a bridge and attach ether1 and apply the ip to the bridge ... the bridge should always be up and thus the dgw should always be up. How are other people handling this ? I did try a dgw with gateway against another bridge interface, but that interface was in Private and it overwrote my mangle rule . Alex

1 0

CPU pegged at 100%
by Andrew Gilbett 08 Feb '17

08 Feb '17

Hi All, How can you do a "TOP" to find out what is pegging a cpu core on a CCR? I suspect it is BGP but not sure how to check. Thanks Andrew

4 5

Hardware Recommendation
by Ben Jackson - eLogik 08 Feb '17

08 Feb '17

Hi, I'm needing advice on Mikrotik (or other) hardware to use in station mode to which I can connect a 2.4 / 5 Ghz (Omni) antenna and also swap out the 802.11 cards depending upon the site, i.e. some customers have 2.4Ghz g/n access points, where others may have 5Ghz n/ac access points so I want a platform that I can vary the 802.11 card to suit. The range to the access point from the station will be variable, but no more than about 100m. Line of sight may not be feasible. I have been pointed in the direction of the RB411 with an enclosure and suitable 8dbi antenna - any other takers? It also needs a Gig Ethernet port ;). Cheers, Ben Jackson eLogik m:0404 924745 e: ben(a)elogik.net w: www.elogik.com.au [image: http://www.elogik.com.au] <http://www.elogik.com.au>

5 12

just posted this to the forums - bgp issue ?
by Alex Samad - Yieldbroker 07 Feb '17

07 Feb '17

Hi Interface Internet ip address on interface 10.10.10.67/24 20.20.20.67/24 bgp peer remote address 10.10.10.68, update-source=Internet whilst doing a tcp dump on 10.10.10.68, I could see BGP packets coming from 10.10.10.67 and from 20.20.20.67 it seemed to alternate and it stopped the BGP peer connecting. the auto route create is 10.10.10.0/24 Internet prf-src 10.10.10.67 so why is the bgp peer sending from 20.20.20.67 http://forum.mikrotik.com/viewtopic.php?f=14&t=117929 A Alex Samad | Network And System Manager | Yieldbroker * +61 2 9994 2893 | ( +61 438 838 143 | * alex.samad(a)yieldbroker.com<mailto:alex.samad@yieldbroker.com> This email is confidential and intended for the addressee only. If you may have received this email in error please delete it and notify the sender immediately. Recipients should not forward, disclose, distribute or copy this e-mail or any attachments in whole or part without the express permission of the sender. Views expressed in this message are those of the individual sender, except where they are specifically stated to be those of Yieldbroker. Yieldbroker accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Yieldbroker can not guarantee the integrity of this communication and shall not be liable for e-mail which may be intercepted, corrupted, lost, spoofed, delayed, incomplete, or virus infected.

2 2

scripting
by Alex Samad - Yieldbroker 07 Feb '17

07 Feb '17

Hi I have this I a test.rsc file which I scp over and then I do /import test.rsc But it doesn't print anything for the variable # set local hostname :global hostname [/system identity get name] :if ( $hostname = "artr1" ) \ do={ :global LocalIP 192.168.0.1 :global ManagementIP 1.3.8.72 :global PublicIP 2.7.3.67 :global PrivateIP 1.3.200.10 :global RouterID 1.3.255.10 } :if ( $hostname = "artr2" ) \ do={ :global LocalIP 192.168.0.2 :global ManagementIP 1.3.8.73 :global PublicIP 2.7.3.68 :global PrivateIP 1.3.200.11 :global RouterID 1.3.255.11 } :if ( $hostname = "bextrtr1" ) \ do={ :global LocalIP 192.168.0.1 :global ManagementIP 1.3.8.70 :global PublicIP 2.7.3.69 :global PrivateIP 1.3.200.12 :global RouterID 1.3.255.12 } :if ( $hostname = "bextrtr2" ) \ do={ :global LocalIP 192.168.0.2 :global ManagementIP 1.3.8.71 :global PublicIP 2.7.3.70 :global PrivateIP 1.3.200.13 :global RouterID 1.3.255.13 } # vrrp dgw :global PublicVRRPIP 2.7.3.71 # # Validate variables # :put "Hostname: $hostname" :put "Local IP: $LocalIP" :put "Management IP: $ManagementIP" :put "Public IP: $PublicIP" :put "Private IP: $PrivateIP" :put "Routerid: $RouterID"

5 6

issues with VRF
by Alex Samad - Yieldbroker 06 Feb '17

06 Feb '17

Hi So been doing some testing around the routing and separation of the VRF's. So I have VRF Management - ether port Private - this is a point to point with clients Public - Isp I have added the relevant interfaces to the relevant Vrf in the /ip route vrf section I have tried testing with ping to 8.8.8.8 So test machine on the Private vlan setup static route 8.8.8.8/32 via 10.10.10.10 (my new router) I do a /ip route print detail where routing-marl=private 8.8.8.8 in dst-address It only shows me the default gateway... But /tool quick snif quick ip-address=8.8.8.8 shows the icmp coming in on Private and out Public ????????? This might just be icmp packets ! Did another test from my mgmt. box setup static route Ip r a 8.8.8.8/32 via 10.20.10.10 Ping and I can see packets heading out Public But telnet 8.8.8.8 and it doesn't go anywhere In fact the reply icmp comes from the main table, looking at the ICMP .... Alex

2 2

wifi
by Alex Samad - Yieldbroker 03 Feb '17

03 Feb '17

Hi Does mikrotek have something like this The UniFi AP AC HD (UAP-AC-HD<https://unifi-hd.ubnt.com/>) is now available. Comes in at a higher price point, aimed at high density deployments. * 802.11ac Wave 2 * MU-MIMO * 2.4 GHz: 800 Mbps (4x4) * 5 GHz: 1733 Mbps (4x4) * dual gigabit ethernet, supporting link aggregation * power: 802.3at (PoE+) * datasheet: https://dl.ubnt.com/datasheets/unifi/UniFi_UAP-AC-HD_DS.pdf

2 5

Configuration Management Solutions
by Andrew Gilbett 02 Feb '17

02 Feb '17

Hi All, What is everyone using for configuration management, backup and change control? I am looking for something that is automated and provides version control... I found https://github.com/shift8nix/mtrcbackup which looks good has anyone used it or are there better tools out there? Andrew

4 3

Re: [MT-AU Public] Configuration Management Solutions
by Jeremy Hall 02 Feb '17

02 Feb '17

In addition to Rancid, you could also check out Oxidized (a modern Rancid replacement): https://github.com/ytti/oxidized It integrates with LibreNMS (also an Observium replacement!) > ---------- Forwarded message ---------- > From: Damien Gardner Jnr <rendrag(a)rendrag.net> > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Cc: > Date: Wed, 1 Feb 2017 21:17:53 +1100 > Subject: Re: [MT-AU Public] Configuration Management Solutions > I don't know about others, but I just use rancid, as then all of my > switch/router configs are in the one place. And it integrates into > Observium nicely :) > > On 1 February 2017 at 21:16, Andrew Gilbett <andrew(a)gilbett.net> wrote: > > > Hi All, > > > > What is everyone using for configuration management, backup and change > > control? > > > > I am looking for something that is automated and provides version > > control... > > > > I found https://github.com/shift8nix/mtrcbackup which looks good has > > anyone > > used it or are there better tools out there? > > > > Andrew > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > > > > -- > > Damien Gardner Jnr > VK2TDG. Dip EE. GradIEAust > rendrag(a)rendrag.net - http://www.rendrag.net/ > -- > We rode on the winds of the rising storm, > We ran to the sounds of thunder. > We danced among the lightning bolts, > and tore the world asunder > > > > ---------- Forwarded message ---------- > From: Andrew Cox <andrew.cox(a)brightwifi.com> > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Cc: > Date: Wed, 1 Feb 2017 07:58:50 -0600 > Subject: Re: [MT-AU Public] Configuration Management Solutions > I've been getting ready to move over to Unimus now which is an "every > network device" backup system written by Tomas of the Brothers WISP group. > > - Andrew > > On 1 Feb. 2017 4:18 am, "Damien Gardner Jnr" <rendrag(a)rendrag.net> wrote: > > > I don't know about others, but I just use rancid, as then all of my > > switch/router configs are in the one place. And it integrates into > > Observium nicely :) > > > > On 1 February 2017 at 21:16, Andrew Gilbett <andrew(a)gilbett.net> wrote: > > > > > Hi All, > > > > > > What is everyone using for configuration management, backup and change > > > control? > > > > > > I am looking for something that is automated and provides version > > > control... > > > > > > I found https://github.com/shift8nix/mtrcbackup which looks good has > > > anyone > > > used it or are there better tools out there? > > > > > > Andrew > > > _______________________________________________ > > > Public mailing list > > > Public(a)talk.mikrotik.com.au > > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk. > mikrotik.com.au > > > > > > > > > > > -- > > > > Damien Gardner Jnr > > VK2TDG. Dip EE. GradIEAust > > rendrag(a)rendrag.net - http://www.rendrag.net/ > > -- > > We rode on the winds of the rising storm, > > We ran to the sounds of thunder. > > We danced among the lightning bolts, > > and tore the world asunder > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > >

1 0

VRF and BGP
by Alex Samad - Yieldbroker 01 Feb '17

01 Feb '17

Hi Next step. I want to setup a iBGP peer and I want all the bgp routes learn and distributed to be linked to the VRF internet Seems like I have to choices /routing bgp instance I can add an instance and use routing-table. Or I can add a /routing bgp instance vrf entry after add one to /routing bgp instance but leaving routing-table as main So I want all the BGP routes received and sent to be only from vrf internet. So which one do I use ! Pro's cons. The wiki page is not that informative Alex

2 5