MikroTik RouterOS MIPSBE Firmware 6.43 RC 56

MAJOR CHANGES IN v6.43:

- api - changed authentication process;
- backup - do not encrypt backup file unless password is provided;
- btest - requires at least v6.43 Bandwidth Test client when connecting to v6.43 or later version server except when authentication is not required;
- cloud - added IPv6 support;
- cloud - added support for licensed CHR instances (including trial);
- cloud - reworked "/ip cloud ddns-enabled" implementation (suggested to disable service and re-enable after installation process);
- mac-telnet - require at least v6.43 MAC Telnet client when connecting to v6.43 or later version server;
- radius - use MS-CHAPv2 for "login" service authentication;
- romon - require at least v6.43 RoMON agent when connecting to v6.43 or later RoMON client device;
- webfig - improved authentication process;
- winbox - improved authentication process excluding man-in-the-middle possibility;
- winbox - minimal required version is v3.15;

Changes in this release:

- bridge - added support for BPDU Guard (CLI only);
- bridge - added support for DHCP Option 82 (disables hardware offloading, CLI only);
- bridge - added support for DHCP Snooping (disables hardware offloading, CLI only);
- bridge - forward LACPDUs when "protocol-mode=none";
- bridge - improved packet handling;
- cloud - added simultaneous IPv4/IPv6 support;
- console - added "dont-require-permissions" parameter for scripts;
- dhcpv4-relay - fixed false invalid flag presence;
- dhcpv6-server - do not allow to run DHCPv6 server on slave interface;
- dhcpv6-server - fixed dynamic simple queue creation for RADIUS bindings;
- dhcpv6-server - properly update interface for dynamic DHCPv6 servers;
- ethernet - fixed possible link flaps after disabling/enabling the interface (introduced in v6.43rc51);
- ethernet - improved large packet handling on ARM devices with wireless;
- ethernet - removed obsolete slave flag from "/interface vlan" menu;
- hotspot - fixed customized HTML file usage (introduced in 6.43rc47);
- ike1 - zero out reserved bytes in NAT-OA payload;
- ike2 - fixed initiator first policy selection;
- ippool - improved used address error message;
- ipsec - added warning messages for incorrect peer configuration;
- ipsec - separate phase1 proposal configuration from peer menu;
- ppp - fixed interface enabling after a while if none of them where active;
- ppp - improved modem mode switching;
- snmp - added "temp-exception" trap;
- switch - fixed possible switch chip hangs after initialization on MediaTek and Atheros8327 switch chips;
- tile - fixed false HW offloading flag for MPLS;
- tr069-client - allow editing of "provisioning-code" attribute (CLI only);
- tr069-client - fixed unresponsive tr069 service when blackhole route is present;
- upgrade - fixed RouterOS upgrade process from RouterOS v5;
- ups - improved UPS serial parsing stability;
- w60g - general stability and performance improvements;
- w60g - stop doing distance measurements after first successful measurement;
- winbox - added "default-route-distance" parameter for "IPv6/DHCP-client" menu;
- winbox - fixed "sfp-connector-type" value presence under "Interface/Ethernet";
- winbox - fixed warning presence for "IP/IPsec/Peers" menu;
- winbox - fixed "write-sect-since-reboot" value presence under "System/Resources";
- winbox - show "System/RouterBOARD/Mode Button" on devices that has such feature;
- wireless - added option to disable PMKID for WPA2 (CLI only);
- wireless - fixed memory leak when performing wireless scan on ARM;
- wireless - updated "united-states" regulatory domain information;

Other changes since v6.42.6:

- backup - added support for new backup file encryption (AES128-CTR) with signatures (SHA256);
- backup - generate proper file name when devices identity is longer than 32 symbols;
- bridge - add dynamic CAP interface to tagged ports if "vlan-mode=use-tag" is enabled;
- bridge - added ingress filtering options to bridge interface;
- bridge - added initial Q-in-Q support;
- bridge - added per-port based "tag-stacking" feature;
- bridge - fixed bridge hw-offloading on MMIPS devices (introduced in v6.43rc10);
- bridge - fixed dynamic VLAN table entries when using ingress filtering;
- bridge - fixed "ingress-filtering", "frame-types" and "tag-stacking" value storing;
- bridge - improved bridge port state changing process;
- bridge - improved packet processing when bridge port changes states;
- bridge - improved performance when bridge VLAN filtering is used without hardware offloading;
- bridge - renamed option "vlan-protocol" to "ether-type";
- capsman - allow to change "radio-name" (CLI only);
- capsman - increase timeout for the CAP to CAPsMAN communication;
- certificate - added "expires-after" parameter;
- certificate - do not allow to perform "undo" on certificate changes;
- check-installation - improved system integrity checking;
- chr - added checksum offload support for Hyper-V installations;
- chr - added large send offload support for Hyper-V installations;
- chr - added multiqueue support on Xen installations;
- chr - added support for multiqueue feature on "virtio-net";
- chr - added virtual Receive Side Scaling support for Hyper-V installations (might require more RAM assigned than in previous versions);
- chr - by default enable link state tracking for virtual drivers with "/interface ethernet disable-running-check=no";
- chr - do not show IRQ entries from removed devices;
- chr - fixed interface name assign process when running CHR on Hyper-V;
- chr - fixed interface name order when "virtio-net is not being used on KVM installations;
- chr - fixed MTU changing process when running CHR on Hyper-V;
- chr - fixed NIC hotplug for "virtio-net";
- chr - improved balooning process;
- chr - improved boot time for Hyper-V installations;
- chr - provide part of network interface GUID at the beginning of "bindstr2" value when running CHR on Hyper-V;
- chr - reduced RAM memory required per interface;
- console - do not show spare parameters on ping command;
- crs317 - fixed Ethernet inteface stuck on 100 Mbps speed;
- crs326/crs328 - fixed broken "new-dst-port" ACL rules (introduced in 6.43rc10);
- crs326/crs328 - fixed untagged packet forwarding through tagged ports when pvid=1;
- crs328 - fixed transmit on sfp-sfpplus1 and sfp-sfpplus2 interfaces;
- crs3xx - added command that forces fan detection on fan-equipped devices;
- crs3xx - added initial Q-in-Q hardware offloading support (CLI only);
- crs3xx - do not report SFP interface as running when interface on opposite side is disabled;
- crs3xx - fixed ACL rate rules (introduced in v6.41rc27);
- crs3xx - fixed flow control;
- crs3xx - fixed packet forwarding on SFP+ interfaces (introduced in v6.43rc11);
- crs3xx - fixed port disable on CRS326 and CRS328 devices;
- crs3xx - fixed tagged packet forwarding in 802.1ad aware bridges (introduced in 6.43rc13);
- crs3xx - fixed VLAN filtering when there is no tagged interface specified;
- defconf - fixed missing bridge ports after configuration reset;
- dhcp - added dynamic IPv4/IPv6 "dual-stack" simple queue support, based on client's MAC address;
- dhcp - reduced resource usage of DHCP services;
- dhcpv4-client - fixed DHCP client that was stuck on invalid state;
- dhcpv4-client - fixed double ACK packet handling;
- dhcpv4-server - added "allow-dual-stack-queue" implementation (CLI only);
- dhcpv4-server - do not allow override lease "always-broadcast" value based on offer type;
- dhcpv4-server - fixed DHCP server functionality (introduced in v6.43rc);
- dhcpv4-server - improved performance when "rate-limit" and/or "address-list" setting is present;
- dhcpv6-client - added missing "Server identifier" parameter in release message;
- dhcpv6-client - allow to set "default-route-distance";
- dhcpv6-client - fixed "add-default-route" parameter;
- dhcpv6-client - fixed option handling;
- dhcpv6 - improved reliability on IPv6 DHCP services;
- dhcpv6-server - added additional RADIUS parameters for Prefix delegation, "rate-limit" and "life-time";
- dhcpv6-server - added "allow-dual-stack-queue" implementation (CLI only);
- dhcpv6-server - added initial dynamic simple queue support;
- dude - fixed client auto upgrade (broken since 6.43rc17);
- ethernet - do not show "combo-state" field if interface is not SFP or copper;
- ethernet - fixed default ethernet advertise values after configuration reset (introduced in v6.43rc33)
- ethernet - improved stability when changing ethernet interface L2MTU on CRS328-24P-4S+ (introduced in v6.43rc11);
- ethernet - properly handle Ethernet interface default configuration;
- export - do not show w60g password on "hide-sensitive" type of export;
- filesystem - fixed NAND memory going into read-only mode (requires "factory-firmware" >= 3.41.1 and "current-firmware" >= 6.43);
- filesystem - improved software crash handling on devices with FLASH type memory;
- health - fixed voltage measurements for RB493G devices;
- health - improved speed of health measurement readings;
- hotspot - allow to properly configure Hotspot directory on external disk for devices that have flash type storage;
- hotspot - fixed RADIUS CoA & PoD by allowing to accept "NAS-Port-Id";
- ike1 - added unsafe configuration warning for main mode with pre-shared-key authentication;
- ike1 - purge both SAs when timer expires;
- ike2 - fixed rekeyed child deletion during another exchange;
- ike2 - improved basic exchange logging readability;
- ike2 - use "/32" netmask by default on initiator if not provided by responder;
- interface - improved interface "last-link-down-time" and "last-link-up-time" values;
- interface - improved reliability on dynamic interface handling;
- ipsec - added "responder" parameter for "mode-config" to allow multiple initiator configurations;
- ipsec - added "src-address-list" parameter for "mode-config" that generates dynamic "src-nat" rule (CLI only);
- ipsec - do not allow removal of "proposal" and "mode-config" entries that are in use;
- ipsec - fixed AES-CTR and AES-GCM key size proposing as initiator;
- ipsec - fixed "sa-src-address" deduction from "src-address" in tunnel mode;
- ipsec - fixed "static-dns" value storing (CLI only);
- ipsec - improved invalid policy handling when a valid policy is uninstalled;
- ipsec - improved reliability on generated policy addition when IKEv1 or IKEv2 used;
- ipsec - install all DNS server addresses provided by "mode-config" server;
- ipsec - use monotonic timer for SA lifetime check;
- kidcontrol - allow to edit discovered devices;
- ldp - properly load LDP configuration;
- led - fixed default LED configuration for RBLHGG-5acD-XL devices;
- led - improved w60g alignment trigger;
- log - fixed false log warnings about system status after power on for CRS328-4C-20S-4S+;
- log - show interface name on OSPF "different MTU" info log messages;
- lte - added additional D-Link PIDs;
- lte - added additional ID support for SIM7600 modem;
- lte - added additional low endpoint SIM7600 PIDs;
- lte - added eNB ID to info command;
- lte - added extended LTE signal info for SIM7600 modules;
- lte - added extended signal information for Quectel LTE EC25 and EP06 modem;
- lte - added ICCID reading for info command R11e-LTE and R11e-LTE-US (CLI only);
- lte - added "registration-status" parameter under "/interface lte info" command;
- lte - added roaming status reading for info command (CLI only);
- lte - added signal readings under "/interface lte scan" for 3G and GSM modes;
- lte - added support for alternative SIM7600 PID;
- lte - added support for Novatel USB730LN modem with new ID;
- lte - added support for Quanta 1k6e modem;
- lte - allow to execute concurrent internal AT commands;
- lte - allow to use multiple PLS modems at the same time;
- lte - do not allow to remove default APN profile;
- lte - do not allow to send "at-chat" commands for configless modems;
- lte - expose GPS channel for PLS modems;
- lte - fixed memory leak on USB disconnect;
- lte - fixed SIM7600 registration info;
- lte - fixed SMS send feature when not in LTE network;
- lte - ignore empty MAC addresses during Passthrough discovery phase;
- lte - improved modem event processing;
- lte - improved r11e-LTE and r11e-LTE-US dialling process;
- lte - improved r11e-LTE configuration exchange process;
- lte - improved reading of SMS message after entering running state;
- lte - improved readings of info command results for the SXT LTE;
- lte - improved stability of USB LTE interface detection process;
- lte - properly detect interface state when running for IPv6 only connection for R11e-LTE modem;
- lte - renamed LTE scan tool field "scan-code" to "mcc-mnc" (CLI only);
- lte - show UICC in correct format for SXT LTE devices;
- lte - use "/32" address for the Passthrough feature when R11e-LTE module is used;
- lte - use alphanumeric operator format in info command;
- multicast - allow to add more than one RP per IP address for PIM;
- ntp - allow to specify link-local address for NTP server;
- ospf - improved link-local LSA flooding;
- package - do not allow to install out of bundle package if it already exists within bundle;
- package - renamed "current-version" to "installed-version" under "/system package install";
- ppp - added support for additional ID for E3531 modem;
- ppp - show comments from "/ppp secrets" menu within "/ppp active" menu when client is connected;
- quickset - recognize 160 MHz channel as HomeAP mode;
- rb1100ahx4 - added DES and 3DES hardware acceleration support;
- romon - fixed RoMON services becoming unavailable after disabled once during active scanning process;
- romon - properly classify RoMON sessions in log and active users list;
- routerboard - allow to fill up to half of the RAM memory with files on devices with FLASH storage;
- routerboard - fixed "protected-routerboot" feature (introduced in v6.42);
- routerboard - fixed wrongly reported RAM size on ARM devices;
- routerboot - removed RAM test from TILE devices (routerboot upgrade required);
- sfp - fixed DDM data with SFP+ modules on CRS328-4C-20S-4S+ (introduced in v6.43rc10);
- sfp - fixed default advertised link speeds;
- sfp - hide "sfp-wavelength" parameter for RJ45 transceivers;
- smb - fixed valid request handling when additional options are used;
- sms - converted "keep-max-sms" feature to "auto-erase";
- sms - do not require "port" and "interface" parameters when sending SMS if already present in configuration;
- sms - improved reliability on SMS reader;
- snmp - added CAPsMAN "remote-cap" table;
- snmp - added "phy-rate" reading for "station-bridge" mode;
- snmp - fixed "remote-cap" peer MAC address format;
- ssh - disconnect all active connections when device gets rebooted or turned off;
- ssh - strengthen strong-crypto (add aes-128-ctr and disallow hmac sha1 and groups with sha1);
- supout - added "w60g" section to supout file;
- switch - added support for port isolation by switch chip;
- swos - implemented "/system swos" menu that allows to upgrade, reset, save or load configuration and change address for dual-boot CRS devices (CLI only);
- tile - added DES and 3DES hardware acceleration support;
- tr069-client - fixed setting of "DeviceInfo.ProvisioningCode" parameter;
- usb - fixed modem initialisation on LtAP mini;
- usb - fixed power-reset for hAP ac^2 devices;
- user - all passwords are now hashed and encrypted, plaintext passwords are kept for downgrade (will be removed in later upgrades);
- userman - fixed compatibility with PayPal TLS 1.2;
- vrrp - fixed VRRP packet processing on VirtualBox and VMWare hypervisors;
- vrrp - improved reliability on VRRP interface configured as a bridge port when "use-ip-firewall" is enabled;
- w60g - added distance measurement feature;
- w60g - fixed random disconnects;
- w60g - improved MCS rate detection process;
- w60g - improved MTU change handling;
- w60g - properly close connection with station on disconnect;
- watchdog - added "ping-timeout" setting;
- webfig - properly display time interval within Kid Control menu;
- webfig - properly show NTP clients "last-adjustment" value;
- winbox - added bridge Fast Forward statistics counters;
- winbox - added "poe-fault" LED trigger;
- winbox - added "secondary-channel" setting to wireless interface if 80 MHz mode is selected;
- winbox - fixed arrow key handling within table filter fields;
- winbox - fixed bridge port MAC learning parameter values;
- winbox - properly close session when uploading multiple files to the device at the same time;
- winbox - properly display all flags for bridge host entries;
- winbox - removed duplicate "20/40/80MHz" value from "channel-width" setting options;
- winbox - show HT MCS tab when "5ghz-n/ac" band is used;
- winbox - show "Switch" menu on hAP ac^2 devices;
- wireless - added option for RADIUS "called-station-id" format selection;
- wireless - do not disconnect clients when WDS master connects with MAC address "00:00:00:00:00:00";
- wireless - fixed "/interface wireless sniffer packet print follow" output;
- wireless - fixed packet processing after removing wireless interface from CAP settings;
- wireless - fixed wireless interface lockup after period of inactivity;
- wireless - improved Nv2 reliability on ARM devices;
- wireless - improved Nv2 stability for 802.11n interfaces on RB953, hAP ac and wAP ac devices;
- wireless - updated "germany 5.8 ap" and "germany 5.8 fixed p-p" regulatory domain information;
- x86 - improved Ethernet driver for Davicom DM9x0x;

About Router Firmware:

Before you consider downloading this firmware, go to the system information page of the router and make sure that the currently installed version isn't either newer or matching this release.

Due to the large variety of router models and different methods for upgrading the device, it is highly recommended that you read and, above all, understand the installation steps before you apply the new firmware, even if you are a power user.

In theory, these steps shouldn't be much of a hassle for anyone, because manufacturers try to make them as easy as possible, even if they don't always succeed. Basically, you must upload the new firmware to the router through its administration page and allow it to upgrade.

If you install a new version, you can expect increased security levels, different vulnerability issues to be resolved, improved overall performance and transfer speeds, enhanced compatibility with other devices, added support for newly developed technologies, as well as several other changes.

If you're looking for certain safety measures, remember that it would be best if you perform the upload using an Ethernet cable rather than a wireless connection, which can be interrupted easily. Also, make sure you don't power off the router or use its buttons during the installation, if you wish avoid any malfunctions.

If this firmware meets your current needs, get the desired version and apply it to your router unit; if not, check with our website as often as possible so that you don't miss the update that will improve your device.