- Public - talk.mikrotik.com.au

VLANing on a CCR1009
by Christopher Hawker 02 Dec '21

02 Dec '21

Hey folks, I’m currently working with a CCR1009 and a Cisco switching stack. We have 4 VLANs on the network, and if a device is configured on a VLAN it can ping its gateway, however cannot access the internet if a source NAT rule is configured using a specific public IP. If it is configured as a masquerade, it works using the primary IP for outbound NAT. What could I be missing? Thanks, CH Sent from my iPhone

4 3

ether2 not enabled as bridge port
by Karl Auer 01 Dec '21

01 Dec '21

We found that ether2 on a newly installed RB4011 was "not working". Investigation revealed it was not delivering an IP address via DHCP. Further investigation revealed that unlike every other port 3-10 in the bridge, ether2 was disabled. Since the DHCP server is on the bridge interface, devices connected to ether2 are not getting served. /interface bridge port add bridge=bridge1 disabled=yes interface=ether2 add bridge=bridge1 interface=ether3 [etc] I didn't configure this unit. I'm a bit mystified as to why it would have been configured like that. My question is whether I can safely just enable it. I can't see why not, but as it is now in production I thought I would ask the brains trust... Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 9FB6 C08F 91CB 5093 30EF 3E2F 8C94 EEBD 117C 4A10 Old fingerprint: CF68 0C56 EEE4 CC19 28D4 03B3 BCE0 E800 E31F 7254

5 8

PS180-T / RB4011
by Denis Hancock 30 Nov '21

30 Nov '21

Hi All Has anyone been able to get an vDSL SFP PS180 to work with Exetel on an RB4011 ? We're using VLAN8 (8/35 LLC) (we hope) so SFP has a VLAN8 hanging off it PPPoE client interface set to VLAN8 thanks for any advice -- *Denis Hancock* Chief Technical Officer / Director Helpdesk 1300 139 593 <1300139593> Mobile 0407 687 621 <0407687621> Unit 15, 5 Enterprise Drive, Rowville 3178 <https://goo.gl/maps/HGmhhNncEF12> <https://www.facebook.com/samuraiconsulting.melbourne> <https://au.linkedin.com/in/denishancock> Australian Information Security Association (AISA) Member This email is intended only for the addressed and is subject to copyright. If you have received this email in error, please notify me immediately.

5 8

Fiber splicing and testing gear - available
by Mike Everest 24 Nov '21

24 Nov '21

Hello, As a favour to a deceased estate liquidator, if there is anyone interested to consider purchse of some fiber splicing and testing gear to please contact me off-list. Apologies to those who might consider such a post 'inappropriate' here (those folks are welcome to let me know off-list also ;) but finding a buyer will be very helpful to the young family :-} Thanks! Mike.

1 0

RB4011 and Yealink W60B
by Karl Auer 22 Nov '21

22 Nov '21

Just installed an RB4011 in a client site. They had an existing Yealink W60B phone there, powered by a plug-pack. The specs on the plug pack say 600mA output. Tried plugging the phone in to the poE port (10) on the RB4011, with no success. The W60B showed no evidence of seeing power. Tried setting poe-out on the port to "forced-on", no change. The Yealink doco says it requires "IEEE 802.3af, Class 1" PoE. I can't find any such spec for the RB4011, just lots of statements that it is passive PoE. Is there a trick or should I give up? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 9FB6 C08F 91CB 5093 30EF 3E2F 8C94 EEBD 117C 4A10 Old fingerprint: CF68 0C56 EEE4 CC19 28D4 03B3 BCE0 E800 E31F 7254

9 10

ROS v7 - Production Ready?
by Thomas Jackson 05 Oct '21

05 Oct '21

Hi all, Last week I picked up a CCR2004-16G-2S+ for a new build (it ticked basically every box for what we need, dual PSU, >8 ports, appealing price point, etc), and powered it up today to realise it is running ROSv7 out of the box, and doesn't have a downgrade path to v6 (my mistake for not reading the description closely enough!). On one side, the Mikrotik website still lists v7 as beta which makes me uncomfortable pushing this into a prod environment, but on the other side it looks like all of the new models are coming out v7 only so presumably it is considered production ready? Before I make the trip down to the DC to rack it up, how are others finding v7 stability? Or should I order a CCR1036 (our usual model for this type of work) and chuck the CCR2004 in the cupboard until v7 is a bit further along? Any input appreciated!

5 8

Mikrotik seller in Port Moresby
by Malcolm Faed 24 Sep '21

24 Sep '21

Hi all, Does anyone know of a Mikrotik seller in Port Moresby at all. It could save me sending one up. Cheers, *Malcolm Faed.* Head of Engineering *Av-Comm* avcomm.com.au malcolm(a)avcomm.com.au 24/9 Powells Road, Brookvale, NSW 2100, Australia P: +61 (2) 9939 4377 M: +61 409 601 747 [image: Twitter] <https://twitter.com/AvCommSatellite> <https://plus.google.com/+AvcommAustralia/>[image: Youtube] <https://www.youtube.com/channel/UCO8ZtcnwoTH7e54LAndE-yw>[image: Linkedin] <https://www.linkedin.com/company-beta/6583589/> This e-mail message may contain confidential or legally privileged information and is intended only for the use of the intended recipient(s). Any unauthorised disclosure, dissemination, distribution, copying or the taking of any action in reliance on the information herein is prohibited. E-mails are not secure and cannot be guaranteed to be error free as they can be intercepted, amended, or contain viruses. Anyone who communicates with us by e-mail is deemed to have accepted these risks. Av-Comm is not responsible for errors or omissions in this message and denies any responsibility for any damage arising from the use of e-mail. Any opinion and other statement contained in this message and any attachment are solely those of the author and do not necessarily represent those of the company.

1 0

Merai/Meris attack via MikroTiks?
by Karl Auer 10 Sep '21

10 Sep '21

Have just read this and am a bit confused. https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/ I can't figure out whether the attackers are abusing Mikrotik features that the owner has nor disabled or blocked, or whether this is an actual vulnerability - i.e., something exploitable even if the owner of the device has followed best practice. Does anyone have more information about this issue? Is it even an issue at all? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 9FB6 C08F 91CB 5093 30EF 3E2F 8C94 EEBD 117C 4A10 Old fingerprint: CF68 0C56 EEE4 CC19 28D4 03B3 BCE0 E800 E31F 7254

2 1

EoIP Tunnel that doesn't want to tunnel
by Christopher Hawker 06 Sep '21

06 Sep '21

Hi Everyone, I for some reason, have two MT devices (A-side is a CCR1009-8G-1S-1S+ and the Z-side is a CHR) and they don't seem to want to tunnel together. The tunnel comes up, two ICMP packets get through, and the link goes down. There is no firewalling in place (or has been disabled altogether for testing purposes) however the issue still manifests. The only thing is on the A side the public IP address is received by DHCP, however a reservation has been set by the carrier so the address will not change. *** A Side *** /interface eoip add allow-fast-path=no disabled=yes ipsec-secret="fakepass" local-address=192.0.2.10 mac-address=12:34:56:78:90:12 name=tun1 remote-address=203.0.113.10 tunnel-id=1 /ip address add address=172.21.254.2/30 interface=tun1 network=172.21.254.0 *** Z Side *** /interface eoip add allow-fast-path=no disabled=yes ipsec-secret="fakepass" local-address=203.0.113.10 mac-address=21:09:87:65:43:21 name=tun1 remote-address=192.0.2.10 tunnel-id=1 /ip address add address=203.0.113.10/29 interface=ether1 network=27.32.52.8 add address=172.21.254.1/30 interface=tun1 network=172.21.254.0 If anyone would be able to point out any issues or have any ideas, it'd be much appreciated! Thanks, Christopher Hawker

4 7

State of 3G/4G fallback on MikroTik?
by Karl Auer 01 Sep '21

01 Sep '21

We need to quote to a client for two routers capable of running a VPN between two sites - easy, that's a MikroTik. But they want a fallback to 3G/4G so that the site that falls back keeps Internet access AND so that the VPN keeps running. What's the state of MikroTik 3G/4G fallback? Last I looked it seemed very roll-your-own, and supported only a few very specific dongles... Ideally it would work like the (vastly more expensive) Merakis and just fail everything over to the secondary link if the primary fails, where "fail" would be either a ping test or interface down. That said, I'm OK with a solution that needs more work, as long as once done it is set-and-forget. Any pointers? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 887A DA07 4DCC EE76 B413 27D4 C638 4189 6CF0 D556 Old fingerprint: 8454 EE43 6215 B6DD 1B4D 9D8D 984D 7BA1 7378 A38D

7 12