Love these high quality, short videos! Big fan of Mikrotik here.

Thanks for these MikroTips series, its really useful.

Thank you for this video, because I´ve learned something new I didn´t know before 🙂 One remark: when you put all these commands in the CLI it would be very helpful if you open the corresponding Winbox windows. This would it make more clear and easier to follow 😉

@stevenm45

Жыл бұрын

As a novice but very keen MikroTik user & advocate, I agree with Ulrich that it would be very helpful to simultaneously show the commands appearing in Winbox. I learnt something new too and love these short training videos :)

@olegurvingurigard8373

Жыл бұрын

Probably a good idea, luckily most of the time "IP/address/" is located under IP menu and then under address.. sadly this is not always the case if i recall correctly. and not all functionality has a GUI, can't recall any specific one's just remember there being some.

Explained in great detail! Thank you so much!!

You are an excellent instructor. I will stick with you.

This is the first video I understood in English. Thank you!

@user-wr6hr6ve9n

Жыл бұрын

It's because the girl is Russian :)

@user-bj9hd1bc4j

Жыл бұрын

@@user-wr6hr6ve9n I understood that:)

Thanks for MikroTips, its really useful.

Great video. Thank you

It would be great to see a video about best practice for using VRFs with BGP on RouterOS 7, including leaking routes between tables.

@drumaddict89

Жыл бұрын

also looking forward to that but in the meantime - check out "The Network Berg" he has some pretty impressive videos about BGP and VRF on mikrotik

@BudiSetiawan-id9en

Жыл бұрын

Still have bugs , reported but progress so slow

Thanks a lot for your videos. Very helpful and interesting. It is very unusual when a girl works quickly on the command line

thank you Olga, the vrf is nice feature as shown in the video. but i dont understand why should 2 interfaces have the same ip. and go into vrf setup. is there a specific scenario where this applicable ? the only scenario i think of is an ISP is limited of ip addresses.

@Cenedd

Жыл бұрын

Plenty of cases where this can become a problem. If two companies merge is the most common. Also, if you're providing a WAN service to multiple customers, you'll often find that many of them have a LAN range of 10.0.0.0/24 or 192.168.0.0/24. This allows you to have that configuration that would otherwise conflict. A real-world example for you. A customer was bought by another company. For a while we hosted a couple of their servers that were previously at their main site so that their branch office could continue to access them. Those servers were on 10.0.0.0/24 and would have clashed. We were able to run their hosted servers in a VRF and provide access to their branch office via VPN. It can also be useful if you have conflicting routing requirements. I have IPSEC tunnel interfaces from my home office and routes to IP ranges down those tunnels. I don't want those routes to be used by my guest network. I could prevent access with ACLs but that would mean that the guest network wouldn't be able to access those IP ranges at all when they should be able to access them like any public IP. The tunnels give extra access that shouldn't be public. I should point out that these real-world setups are not on Mikrotik setups but the theory should be the same, I believe.

Great Tutorial :)

Спасибо за видео. Вот сразу появился вопрос, как при такой схеме, "А" может обратится к "B"? Как-то через шлюз или подменить на шлюзе ip через dst-nat?

Thanks a lot! I followed the same steps but with 2 VLANs instead of 2 different ports. It worked. Why did I want a VRF per VLAN? Because I wanted to test the scenario by using the same subnets on each VLAN. Wanted to share it in case somebody needs it.

great stuff, please also show how to extend this to 1:1 map one or both of the networks to another /24

@mikrotik

Жыл бұрын

You can use netmap instead of masquearade rule in firewall, the command like: ip firewall nat add action=netmap chain=srcnat out-interface=ether5 src-address=172.111.0.0/24 to-addresses=192.168.1.0/24 Where 172.111.0.0 network addreses is on "client" router and 192.168.1.0 network addreses is on "main" router WAN interface. Manual wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT

Why interfaces are called cust_a and cust_b, how those routers are used outside?

What about FastTrack/FastPath? Should it be disabled to correct mangle work?

@BattousaiHBr

Жыл бұрын

no need. fasttrack works with conntrack (it's just a faster conntrack). what would not work with this is a firewall no-track rule, which disables conntrack.

@OperKH

Жыл бұрын

I did the same as in this tutorial. When my device in VRF network ping works, it looks like the Internet works, but if I launch speedtest I have a speed around zero. After I turned off "fast path" it started working normally.

@Olga , need more info avout ip/route/add vrf-interface=etherx. Thanks

@mikrotik

Жыл бұрын

Connected routes from the interfaces assigned to the VRF will be installed in the right routing table automatically. If you want to use any services with that IP addresses, please configure vrf for service as well. For example "interface/l2tp-client/set vrf=vrf1..."

@nikolashuminosky6987

Жыл бұрын

@@mikrotik i'm happy with your answer

@nikolashuminosky6987

Жыл бұрын

@@mikrotik one more thing, i got interface into vrf and i want to ssh/telnet, i got them on vrf as well, still can log in via vrf, has that been properly implemented?

where i can get that tshirt :D

@mikrotik

Жыл бұрын

merch.mikrotik.com

Very interesting video, but, I also, like other in comments, agree that need to show in winbox all commands that u put in CLI

why she wrote @main, when added gateway to vrf routing table?

@bulkaans

Жыл бұрын

It means that the gateway will be resolved in the main table

@mikrotik

Жыл бұрын

For clarity. It is not mandatory to add @main in case of main vrf, but it is mandatory in case you use other vrfs.

multiple vrf tickets opened, bugs acknowledged but not solved.

where to get those t-shirts? 😱👌

@mikrotik

Жыл бұрын

sooooooon!

@drumaddict89

Жыл бұрын

@@mikrotik yassss ;)

what is "public interface"? why not just "eth#"??

@nikiforossarantoglou5917

24 күн бұрын

Because that way you know it's the interface on WAN side. Another reason is that in many cases it's not a wan interface but rather a WAN interface list (eg 2 ISP used for failover).

With this method, Mikrotik's IP will no longer play the role of DNS server. Clients will no longer receive any response from Mikrotik router dns service. unless we change the dns server address to one of the public dns for clients.

Слышно что не носитель языка! 😉 Но именно из за этого (не спешная речь) всё разборчиво и понятно! 👍

@maxpla1035

Жыл бұрын

@Vinsent Levitzky Я в курсе, но я чего то решил что девушка русскоговорящая.. ☺️ В любом случае - молодец! 👍

@overgrow601

Жыл бұрын

@Vinsent Levitzky вог первых по акценту, а во вторых ну имя ольга ну явно из снг

@user-wr6hr6ve9n

Жыл бұрын

@@maxpla1035 К таком невероятно сложному выводу по методу Холмса Вас привело имя Ольга :)))

Nice, but It still doesn't work with RB3011 in V7.6(beta), it still have issues with hardware offloading routes

@Andrew_Thrift

Жыл бұрын

The RB3011 is a software based router. It has no ability to route in hardware. For that you will need a CRS3xx, CRS5xx or a CCR2116 or CCR2216

@andreaguerrini9495

Жыл бұрын

@@Andrew_Thrift I don't want HWO, V7 tries to applies and it doesn't work.

i love my Vurfs

Gostei muito do vídeo mas seria bom ter também em português.

@TechLabs94

Жыл бұрын

muito bom mesmo, eu irei replicar o laboratório no EVE-NG, executar os testes e trazer o material aqui pro canal, siga-nos para mais novidades. obrigado

@GarudaTelecom

Жыл бұрын

Tem legenda em PT-BR

The biggest problem you have is delivery backlog. I can no longer get Mikrotiks in Europe, everything is only on pre-order basis where I can wait 1 year. But the biggest cheek are KZreadrs who are supposed to advertise the products, they are delivered directly by you. So why are you releasing products you can't supply? It frustrated me because I wanted to upgrade my home system and I can't

@mikrotik

Жыл бұрын

All of these products are available, but the quantities are not as high as they could be. The devices sell out quite fast. When we do release new products, I would suggest to immediately place an order / reservation with the nearest distributor.

@markarca6360

Жыл бұрын

@@mikrotik Is it in connection with the chip shortage? That is why I see your products selling for higher prices here in the Philippines.

@TheMockTv

Жыл бұрын

@@mikrotik I don't even want to know how long I should wait for a replacement device if there is a technical problem like with the current Mikrotik RB5009UPr with poe, which gets stuck in the bootloop due to a cold solder point and only boots when it's over 40 °C. You need to finally fix your supply chain and not always reassure users because it's no use to anyone

@stephanszarafinski9001

Жыл бұрын

@@seantellsit1431 rb4011 breaks after 13 months on shelve doing nothing and 2 months at customer??? What did you do to it to break it so fast!

@jefftee448

Жыл бұрын

@@markarca6360 yes, it absolutely is the chip shortage.....and that goes for any electronics.

Great video but… when would this be useful? Why use this instead of different IP ranges?

@michaelklehr7509

Жыл бұрын

for provider. no matter what subnets the clients use.

@SirHackaL0t.

Жыл бұрын

@@michaelklehr7509 Hmmm. Ok… Surely as a provider you give your clients an ip address range for their network to use as the gateway. Doing incoming traffic will be impossible as how will it know which interface to send the traffic to when they are both identical?

@michaelklehr7509

Жыл бұрын

@@SirHackaL0t. you don't give your clients an subnet. they have there subnets already and you provide service. if all your clients can have the same subnet, no problem.

@SirHackaL0t.

Жыл бұрын

@@michaelklehr7509 Well, not sure how it works where you are but my ISP gives me an IP address on their network and my network connects through that using NAT. Problem solved without the need of this. It just seems to be a solution looking for a problem to fix.

@drumaddict89

Жыл бұрын

@Clive Flint the clients have LOCAL NETS too and these networks mostly are established with some yet set up ranges you for instance play ISP then and need to handle different clients and need to route (e.g. because of IPsec tunnels from sites of your customers) traffic which would overlap on layer 3 with VRFs you could seperate that and also ad RDs to your VRFs!! think of a VRF like a VLAN ... but the VRF operates at layer3 instead like VLAN on layer2! if you don't know what VRF is and what it can do for you - you do not need it

create videos for people who use winbox not cli ... this is useless

its better to use native english speakers as Mikrotik is an internationally known company

@mikrotik

5 ай бұрын

MikroTik is a Latvian company and we don’t have native English speakers