MikroTik RouterOS ARM Firmware 6.45 RC 34

MAJOR CHANGES IN v6.45:

- dot1x - added support for IEEE 802.1X Port-Based Network Access Control (CLI only);

Changes in this release:

- dot1x - added support for IEEE 802.1X Port-Based Network Access Control (CLI only);
- dhcp - create dual stack queue based on limitations specified on DHCPv4 server lease configuration;
- dhcp - do not require lease and binding to have the same configuration for dual-stack queues;
- dhcp - show warning in log if lease and binding dual-stack related parameters do not match and create separate queues;
- dhcpv4-server - replaced "busy" lease status with "conflict" and "declined";
- dhcpv6-client - fixed status update when leaving "bound" state;
- dhcpv6-server - override prefix pool and/or DNS server settings by values received from RADIUS;
- e-mail - include "message-id" identification field in e-mail header;
- ike1 - fixed rekeying process when NAT is detected (introduced in v6.45beta16);
- ospf - added support for link scope opaque LSAs (Type 9) for OSPFv2;
- ospf - improved "unknown" LSA handling in OSPFv3;
- supout - changed IPv6 pool section to output detailed print;
- tr069-client - added LTE CQI and IMSI parameter support;
- tr069-client - fixed potential memory corruption;
- winbox - fixed crash when opening CAPsMAN menu (introduced in v6.45beta27);
- wireless - fixed "country-info" printing (introduced in v6.45beta27);

Other changes since v6.44.2:

- bridge - fixed log message when hardware offloading is being enabled;
- certificate - added "key-type" field (CLI only);
- certificate - added support for ECDSA certificates (prime256v1, secp384r1, secp521r1) (CLI only);
- certificate - fixed SAN being duplicated on status change (introduced in v6.44);
- certificate - made RAM the default CRL storage location;
- certificate - removed DSA (D) flag;
- conntrack - fixed "loose-tcp-tracking" parameter not taken in action (introduced in v6.44);
- crs3xx - correctly display auto-negotiation information for SFP/SFP+ interfaces in 1Gbps rate;
- crs3xx - fixed auto negotiation when 2-pair twisted cable is used (downshift feature);
- dhcp - create dual stack queue based on limitations specified on DHCPv4 server lease configuration;
- dhcp - do not require lease and binding to have the same configuration for dual-stack queues;
- dhcp - show warning in log if lease and binding dual-stack related parameters do not match and create separate queues;
- dhcpv4-server - added "client-mac-limit" parameter (CLI only);
- dhcpv4-server - added "vendor-class-id" matcher (CLI only);
- dhcpv4-server - fixed commenting option for alerts;
- dhcpv4-server - improved stability when performing "check-status" command;
- dhcpv6-server - added "address-list" support for bindings (CLI only);
- dhcpv6-server - added "insert-queue-before" and "parent-queue" parameters (CLI only);
- dhcpv6-server - added RADIUS accounting support;
- dhcpv6-server - added "route-distance" parameter (CLI only);
- dhcpv6-server - fixed binding setting update from RADIUS;
- discovery - improved neighbour's MAC address detection;
- discovery - limit max neighbour count per interface based on total RAM memory;
- ethernet - added support for 25Gbps and 40Gbps rates;
- export - fixed SMS "allowed-number" compact export (introduced in v6.45beta);
- fetch - added SFTP support;
- fetch - improved user policy lookup;
- ike1 - adjusted debug packet logging topics;
- ike1 - improved stability for transport mode policies on initiator side;
- ike2 - added support for ECDSA certificate authentication (rfc4754);
- ike2 - do not send "User-Name" attribute to RADIUS server if not provided;
- ike2 - improved XAuth identity conversion on upgrade;
- ike2 - prefer SAN instead of DN from certificate for ID payload;
- ipsec - added dynamic comment field for "active-peers" menu inherited from identity (CLI only);
- ipsec - added "ph2-total" counter to "active-peers" menu (CLI only);
- ipsec - added support for RADIUS accounting for "eap-radius" and "pre-shared-key-xauth" authentication methods (CLI only);
- ipsec - added traffic statistics to "active-peers" menu (CLI only);
- ipsec - do not allow adding identity to a dynamic peer;
- ipsec - fixed freshly created identity not taken in action;
- ipsec - fixed policies becoming invalid after changing priority;
- ipsec - fixed possible configuration corruption after import;
- ipsec - general improvements in policy handling;
- ipsec - properly drop already established tunnel when address change detected;
- ipsec - renamed "remote-peers" to "active-peers" (CLI only);
- ipsec - renamed "rsa-signature" authentication method to "digital-signature";
- ipsec - replaced policy SA address parameters with peer setting;
- ipsec - use tunnel name for dynamic IPsec peer name;
- ipv6 - adjusted IPv6 route cache max size;
- ipv6 - improved IPv6 neighbor table updating process;
- lte - added passthrough interface subnet selection;
- lte - added support for manual operator selection;
- lte - allow to specify URL for firmware upgrade "firmware-file" parameter;
- lte - do not show error message for info commands that are not supported;
- lte - fixed session reactivation on R11e-LTE in UMTS mode;
- lte - improved "info" command query;
- lte - improved R11e-4G modem operation;
- lte - renamed firmware upgrade "path" command to "firmware-file" (CLI only);
- lte - reset LTE modem only when SIM slot is changed on dual SIM slot devices;
- lte - show alphanumeric value for operator info;
- lte - show correct firmware revision after firmware upgrade;
- lte - use default APN name "internet" when not provided;
- lte - use secondary DNS for DNS server configuration;
- ppp - added initial support for Quectel BG96;
- proxy - increased minimal free RAM that can not be used for proxy services;
- rb2011 - removed "sfp-led" from "System/LEDs" menu;
- rb4011 - fixed SFP linking (introduced in v6.45beta6);
- sfp - fixed S-35LC20D transceiver DDMI readouts after reboot;
- smb - fixed possible buffer overflow;
- sms - added USSD message functionality under "/tool sms" (CLI only);
- sms - allow specifying multiple "allowed-number" values;
- sms - fixed long message parsing (introduced in v6.45beta19);
- sms - improved delivery report logging;
- snmp - added "dot1dStpPortTable" OID;
- snmp - added OID for neighbor "interface";
- snmp - added "radio-name" (mtxrWlRtabRadioName) OID support;
- snmp - added "write-access" column to community print;
- snmp - allow setting interface "adminStatus";
- snmp - properly return multicast and broadcast packet counters for IF-MIB OIDs;
- ssh - added "both", "local" and "remote" options for "forwarding-enabled" parameter;
- ssh - added new "ssh-exec" command for non-interactive command execution;
- ssh - do not generate host key on configuration export;
- ssh - fixed multiline non-interactive command execution;
- ssh - improved session rekeying process on exchanged data size threshold;
- ssh - use correct user when "output-to-file" parameter is used;
- supout - added "kid-control devices" section to supout file;
- switch - fixed possible crash when interface state changes and DHCP Snooping is enabled;
- switch - properly reapply settings after switch chip reset;
- tile - improved link fault detection on SFP+ ports;
- tunnel - removed "local-address" requirement when "ipsec-secret" is used;
- userman - added support for "Delegated-IPv6-Pool" and "DNS-Server-IPv6-Address" (CLI only);
- userman - updated authorize.net gateway DNS name;
- w60g - prefer AP with strongest signal when multiple APs with same SSID present;
- wireless - added support for US FCC UNII-2 and Canada country profiles for LHG-5HPnD-US, RBLHG-5HPnD-XL-US and SXTsq5HPnD-US devices;
- wireless - fixed 5GHz interface disappearing after upgrade (introduced in v6.45beta19);
- wireless - fixed incorrect IP header for RADIUS accounting packet;
- wireless - improved DFS radar detection when using non-ETSI regulated country;
- wireless - improved wireless country settings for EU countries;
- wireless - updated "india" regulatory domain information;
- wireless - updated "new zealand" regulatory domain information;

About Router Firmware:

Before you consider downloading this firmware, go to the system information page of the router and make sure that the currently installed version isn't either newer or matching this release.

Due to the large variety of router models and different methods for upgrading the device, it is highly recommended that you read and, above all, understand the installation steps before you apply the new firmware, even if you are a power user.

In theory, these steps shouldn't be much of a hassle for anyone, because manufacturers try to make them as easy as possible, even if they don't always succeed. Basically, you must upload the new firmware to the router through its administration page and allow it to upgrade.

If you install a new version, you can expect increased security levels, different vulnerability issues to be resolved, improved overall performance and transfer speeds, enhanced compatibility with other devices, added support for newly developed technologies, as well as several other changes.

If you're looking for certain safety measures, remember that it would be best if you perform the upload using an Ethernet cable rather than a wireless connection, which can be interrupted easily. Also, make sure you don't power off the router or use its buttons during the installation, if you wish avoid any malfunctions.

If this firmware meets your current needs, get the desired version and apply it to your router unit; if not, check with our website as often as possible so that you don't miss the update that will improve your device.