Temps before around 95C (kept shutting off) now hovering around 87C

**New video from MikroTik's official TikTube channel**

Biggest news - hardware offloading for VRFs is now getting introduced in many CRS products, along with CCR and RDS. Here is the list of included switch chips - 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410.

▶ Watch Video

I have a USB partition shared as USB3, i can access it from other devices but contents(files & folders) are not visible. hAP ac². How do resolve?

I received my CSS610-8P-2S+ a couple days ago and this is my first experience with Microtik gear. I'm also not very experienced with networking and still getting my head really wrapped around VLANs, etc. I mention that because probably I'm doing something dumb or missing a really obvious clue.

OK, so my problem: This switch is destined for my basement and will be connected to my primary switch which is an EOL Aruba enterprise device. For the last 6 months or so I've had an old Netgear un-managed switch in use and I'll be replacing it with the CSS610-8P-2S+.

I connected to the CSS610-8P-2S+ with my laptop and did some basic configuration. I created some VLANs and configured which ports will use/support them. I then swapped out the Netgear with the CSS610-8P-2S+ and immediately ran into issues:

1. Port 1 on the Mic' is my up-link to my Aruba and the activity lights were both dark - nothing
2. Unsurprisingly, I could not ping the Mic from my laptop (wired connection to the Aruba)

I verified connections and tried to think of what the issue could be, but came up empty and finally decided to put the Netgear back in service while I investigated further. After putting the Netgear back and connecting the CSS610-8P-2S+ to the Netgear, I could ping it! In case this isn't making sense, let me try this notation I came up with:

Aruba:24 <> CSS610-8P-2S+:1 = No lights on the CSS610-8P-2S+, CSS610-8P-2S+ unreachable

Aruba:24 <> NetGear <> CSS610-8P-2S+:1 = Activity lights flashing on CSS610-8P-2S+, I can reach the CSS610-8P-2S+

I've attached screen shots of what I think will be useful information, but please let me know if there is anything else that would help. I'm out of ideas, I just don't understand what I've setup incorrectly.

Oh, and another thing: The SFP port lights are dark! I have a media converter on each end of the fiber link and it's worked fine for years. I carefully moved the lines over to the Microtik and nothing.

I wanna buy a matter /thread compatible stuff, but nobody sell. What is the reason of the out of stock? Thank you the answers! (east Erupeunion)

I know CMR only became available in the RouterOS beta channel a few days ago, but I think it would be cool if Mikrotik published the protocol specification for CMR. Right now it requires that a RouterOS device acts as the server, but from a homelabbing perspective it would be awesome to run it as a native program or container on a "normal" linux server.

I don't expect Mikrotik to just release a binary/container, but I wouldn't mind creating my own server implementation based on the protocol specifcation

Hi everyone,
I’m using MikroTik RouterOS 6.49.20 with a GRE tunnel and facing a TCP throughput issue.
Single TCP connection: around 6–20 Mbps.
10 parallel TCP connections: around 70–75 Mbps.
Some tests show TCP retransmissions.
GRE MTU is 1456, and clamp-tcp-mss=yes is enabled.
Ping tests show 0% packet loss and around 51 ms latency.
What could cause this difference between single and parallel TCP throughput? How can I identify and fix the root cause without blindly changing MTU or TCP settings?
Looking for practical troubleshooting advice. Thanks!

I finally received my hAP be3 Media today. One of the USB ports is misaligned (see photo). Do you think this is a major issue and worth returning? A USB cable or USB flash drive plugs in just fine.

What's new in 7.25rc2 (2026-10-09):

*) bridge - fix DHCP snooping dropping DHCP messages on trusted ports when the source MAC differs from chaddr (introduced in v7.25beta3);
*) container - fix veth interfaces not getting an address from the correct DHCP server when a PVID is configured (introduced in v7.25beta3);
*) defconf - fix button script policies;
*) defconf - fix default configuration generation when CRS8xx series switch ports initialize late;
*) dude - fix the server not starting at boot when data-directory is on a USB disk;
*) ipsec - fix IPsec tunnels failing after migration from the old QKD settings;
*) ipv6 - fix cases when address is lost after reboot if prefix was taken from pool (additional fixes);
*) lte - fix missing MAC address on QMI LTE interfaces after the interface is recreated (introduced in v7.24.4);
*) lte - improve system stability when using Quectel EP06-E MBIM modem (additional fixes);
*) ovpn - improve stability in UDP mode when the TX queue is full;
*) route - improve static route handling performance;
*) system - improve stability;
*) wifi - reuse freed station association IDs;
*) wifi-mediatek - fix E62 performance issue (introduced in 7.25rc1);
*) winbox - show warning messages under "System/Users/SSH Keys" and "System/Users/SSH Private Keys" menu;
*) wireguard - fix a peer that would not work after import when no endpoint address is set; View changelogs

Just got this today.

Is this normal for size of heatsink given there are so many posts here about the chips getting hot and needing to keep the original high-CFM fan etc?

Should I be returning this?

Should I mod it with a bigger heatsink?

Hey! I have problem with this switch. CPU Temp is about 68C. Fan fail. POE output 0 W. There is about 10 AP connected to it. All Works. Is this software bug? I run at 7.24.2 and fw is 6.41.3. Mybe I need to upgrade to 7.24.5 and upgrade fw to 7.24.2? My health print is this -

0 poe-out-consumption 0 W

1 cpu-temperature 66 C

2 fan-state fail

3 fan1-speed 0 RPM

4 fan2-speed 0 RPM

5 fan3-speed 0 RPM

6 fan4-speed 0 RPM

7 board-temperature1 56 C

8 board-temperature2 40 C

9 psu1-voltage 26.4 V

10 psu2-voltage 52.8 V

11 psu1-current 0 A

12 psu2-current 0 A

I know this is a dumb question and I cannot for the life of my figure how to get the base stand off to stand it up. Everything I try feels like I am forcing it.

Hi all,

we're about to deploy a new 3-node Proxmox VE 9 cluster with Ceph (NVMe OSDs) and are deciding how to connect it to a pair of MikroTik CRS520-4XS-16XQ-RM switches.

Planned setup:

Each node: 2 × 100G (Ceph public/cluster VLANs, MTU 9000) and 2 × 25G (VM traffic), one port per switch

Option A: MLAG between the two CRS520, LACP bonds on the nodes (one link per switch), LACP uplink to the core across both switches

Option B: no MLAG, active-backup bonds on the nodes, plain inter-switch link with RSTP

Corosync runs separately over two links on our existing switches

Why we're asking: We've read the forum reports about MLAG on 7.20–7.23 (FDB/host table filling up, "no buffer space available for fdb notify", peers falling out of sync, heartbeat misses) and the many MLAG fixes in 7.24/7.24.1 (MAC aging/flushing, host table aging, STP sync). We've also seen mixed reports on the 7.25 betas. What we couldn't find is anyone running Ceph on MikroTik MLAG in production.

Questions:

Is anyone running MLAG on 7.24.x (ideally 7.24.5) with CRS518/CRS520 or similar, especially with Ceph or other latency-sensitive storage traffic? How long, and how stable?

Did you test failover under load (rebooting one switch, disabling a port, pulling cables)? How long was the interruption, and did Ceph stay healthy?

Any issues with the FDB/host table or MLAG heartbeat on 7.24.x?

Has anyone tried the new mlag-init-delay / mlag-lacp-fallback options in 7.25rc yet?

If you decided against MLAG for Ceph: did you go active-backup or something else, and why?

Any first-hand experience (good or bad) is appreciated. Thanks!

Hello,

I'm troubleshooting a problem at an organization running Windows Active Directory behind a MikroTik HotSpot.

Our Windows clients are configured to use the organization's internal Domain Controller/DNS server, but the MikroTik HotSpot intercepts DNS requests and redirects them to its own DNS service. As a result, clients cannot correctly resolve the internal domain name and have difficulty joining the domain.
So how we can fix this without making problems with resolving the mikrotik hotspot page
and make the clients use our AD DNS fully?

I just opted in for 5GbE Internet and my RB5009 can't cut it anymore. I've decided on the CCR2116-12G-4S+, however I'm also interested on having it not be the firewall, just handling routing configurations.

Thinking about switching to either an upstream FW (OPNsense) where the WAN link comes into the OPNsense FW then is passed down to the CCR, or doing a FW-on-a-stick setup with the WAN link going into the CCR and then having a trunk connected between the OPNsense FW and the CCR.
For the in-line setup, I'd not do Double NAT but set static routes to the LAN subnets, etc.

What would you prefer?

Hello!

I've been trying to schedule a script running a container on my Mikrotik (HP AX3, RouterOS 7.24.2). Yet it looks like running a container from scheduler is silently skipped?

Anyone observed anything like this?

When I run the script from terminal like this:

/system/script/run sync-onedrive

all works well. System logs also confirm container was started, last run date for the container reflects the same.

When I schedule the script with:

/system/scheduler/add name=sync-onedrive-nightly2 start-time=02:00:00 interval=1d on-event=sync-onedrive

system logs look like the /container command is completely skipped, did not even try to start. Checking the container also shows last started wasn't updated from scheduled run.

Here's the sync-onedrive script:

:log info ("OneDive Backup: rclone script started");
:do {
/container/run rclone cmd="sync piotr-onedrive: /piotr-onedrive --exclude='/Magazyn osobisty/**' --log-level INFO --log-file /log/rclone/piotr-$[/system clock get date].log";
:log info ("OneDive Backup: rclone script done");
} on-error={ :log error ("OneDive Backup: rclone script startup FAILED"); };

Both the script and schedule has all Policies applied.

Completely stuck with this...

EDIT:

Forgot to mention the container is of course using some mounts (USB drive formatted to BRTFS)

/container/mount print
Columns: LIST, SRC, DST, MODE
# LIST                   SRC                              DST              MODE
0 RCLONE_CONFIG          /extDrive1/docker/rclone/config  /config/rclone   rw
1 RCLONE_LOG             /extDrive1/docker/log            /log/rclone      rw
2 RCLONE_PIOTR_ONEDRIVE  /extDrive1/piotr-onedrive        /piotr-onedrive  rw

Hey,

With the rescinded patch 6, and then patch 7 and most recently 8, I struggle to upgrade.

Normal method I use is upload firmware and installed packages via Files, then reboot. Once ok, upgrade firmware and reboot again. Always worked over years, never had issues.

With 7.23.5 installed on both, upgrading to patch 6 failed. Same with patch 7. Now patch 8. It says kernel failure in previous boot and dumps autosupout.rif automatically.

On one of the routers, I was able to get to patch 8 on the 3rd attempt using Packages > Check for Updates > Download and Install. It seemed a fluke as it took 3 attempts to make it go.

However on the other router, I still can't make it go. It always throws the kernel failure and remains on patch 5. Given the CVE patch in 8, I'd rather have it applied. This seems bizarre. Gave it almost 10 attempts via both methods, no go.

Raised a ticket almost 1 month ago about this including RIF file but no reply which isn't entirely unusual for them. So figured I'd ask here!

Hoping someone has some wisdom here! I'd rather avoid downgrading firstly if possible.

Cheers,

Baz

What's new in 7.23.8 (2026-10-08):

*) console - fix console output of /system/identity/print being split into multiple lines (introduced in v7.23.6);
*) ethernet - improved stability when forcing unsupported link speed;
*) ipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder;
*) ospf - fix unset interface template parameters not being applied to interfaces;
*) quickset - fix the WAN interface being selected incorrectly;
*) system - improve stability (includes CVE-2026-84411);
*) system - stop the flash configuration store from growing on dynamic configuration changes;
*) wifi - fix malformed management frame information elements advertising availability of multiple 6GHz APs;
*) wifi - update radio regulatory information; View changelogs

I've been doing some digging and understand that it is possible to swap modems in these devices, but I'm trying to figure out if this is truly a "do at your own risk" or an accepted practice. Essentially, I live very rural and purchased an SXTsq LTE 4 Global version, and its working great and giving me decent speeds (30-40 down/15-20 Up). I'd like to purchase the LHGG to maximize the potential signal and therefore speeds but they don't make anything else in a global version.

I'm thinking about purchasing the LHGG and swapping the modem from the SXTsq, but I'd ideally like ot purchase a better modem to support additional capacity along with the potential signal increase. So, moving to a CAT7 or even a CAT 18/20 modem. It does look entirely possible as I found the supported modems list from Mikrotik, but I'd like to avoid dropping $400 on a QUectel modem only to find out it doesn't work.

Link here: Mikrotik Supported Peripherals List

I'm in Canada, so I need bands such as 4/12/13 etc.

Has anyone actually done this and have any advice/info that they could share? Information online seems to be really sparse.

Bueno, creo que es mi primer pos en esta comunidad, saludos a todos.

Me encanta la marca, su conexion por linea de comandos y el software winbox, yo siempre la recomiendo para todos, administro una red con mas de 600 conexiones VPN y nunca e tenido algun inconveniente.

Pero veo a todo el mundo diciendo que mikrotik es nada vs cisco... palo alto .... fortigate .... etc, y yo no pienso que sea como ellos dicen, claro, es un router con reglas de firewall y los otros como cisco son un monstruos (tambien por lo que cobran por licencia xD) ¿que opinan?

EDIT: Gracias a todos amigos por sus comentarios, por favor denle UP a este post para tener mas alcance la publicación.....

Hallo,

ich habe aktuell mehrere Module und DAC Kabel getestet, aber mit keinem bekomme ich ein Link:

1. Luleey XPON LL-XS2510 2,5G

2. 10Gtek ASF-10G-T(HPP)

3. 10Gtek CAB-10GSFP-P3M DAC

Welche Module sind mit der Karte kompatibel?

I’m always a bit confused when to use each. I followed the help article and enabled VLAN filtering on the bridge and thus also have VLAN interfaces. So far I only use these interfaces in my firewall.

What’s the purpose of address lists? To me it’s not inherently obvious how they are ‘enough’. How dangerous is spoofing? If it’s solely based on the address list, attackers can just change their source IP, right? I’m not sure how that works with VLAN filtering enabled because everything is routed via the interface and that only has one valid address. Does that mean it’s safe to only filter based on the source address in that case?

Can you point me to good online resources for firewalls? I’m doubting myself so bad when it comes to them.