Project

General

Profile

How to configure mikrotik network equipment » History » Version 29

Nico Schottelius, 07/28/2020 03:22 PM

1 1 Nico Schottelius
h1. How to configure mikrotik network equipment
2
3 6 Nico Schottelius
{{toc}}
4 1 Nico Schottelius
5
h2. Status
6
7
This document is **PRE PRODUCTION**.
8
9 27 Nico Schottelius
h2. Finding a directly connected Mikrotik switch
10
11
If you don't know the IP address of a Mikrotik switch, just connect a direct cable to it and ping the IPv6 multicast all nodes address:
12
13
<pre>
14
5: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
15
    link/ether 80:1f:02:d6:4c:50 brd ff:ff:ff:ff:ff:ff
16
    inet6 fe80::821f:2ff:fed6:4c50/64 scope link 
17
       valid_lft forever preferred_lft forever
18
bridge:~# ping ff02::1%eth1
19
PING ff02::1%eth1 (ff02::1%5): 56 data bytes
20
64 bytes from fe80::821f:2ff:fed6:4c50: seq=0 ttl=64 time=0.115 ms
21
64 bytes from fe80::c6ad:34ff:fe88:832b: seq=0 ttl=64 time=0.588 ms (DUP!)
22
64 bytes from fe80::821f:2ff:fed6:4c50: seq=1 ttl=64 time=0.109 ms
23
64 bytes from fe80::c6ad:34ff:fe88:832b: seq=1 ttl=64 time=0.432 ms (DUP!)
24
^C
25
--- ff02::1%eth1 ping statistics ---
26
2 packets transmitted, 2 packets received, 2 duplicates, 0% packet loss
27
round-trip min/avg/max = 0.109/0.311/0.588 ms
28
bridge:~# 
29
</pre>
30
31
* One of the ip address is you, the other one is the switch
32
33 28 Nico Schottelius
Connecting to it via ssh:
34
35
<pre>
36 29 Nico Schottelius
[15:21] bridge:~% ssh admin@fe80::c6ad:34ff:fe88:832b%eth1
37 28 Nico Schottelius
admin@fe80::c6ad:34ff:fe88:832b%eth1's password: 
38
</pre>
39
40
</pre>
41
42 1 Nico Schottelius
h2. Setting up a newly arrived Mikrotik switch
43
44
This part is specific for mikrotik-crs326 devices and should
45
46
After arriving within 1 work day do:
47
48
* Unpack
49
* Find out which name the switch should have
50
** go to https://netbox.ungleich.ch
51
** search for crs326
52
** identify the last used number
53
** Create a new device
54
*** go to devices 
55
*** devices
56
*** add
57
**** name: "mikrotik-crs326-XX"
58
**** device-role: a device role
59
**** device-type: CRS326
60
**** serial-number: <from the device>
61
**** site: placeX -
62
**** create
63
* Add a physical label with its name
64
** Do not continue before you have done that!
65
* configure your notebook with the ipv4 address 192.168.88.23/24 
66
* connect to the crs326: @ssh admin@192.168.88.1@
67
* Configure the switch
68
** Set identity: @/system identity set name=mikrotik-crs326-XX@ # use the correct name
69
** Set password: @/user set admin password=@ # use the password for mikrotik in the place that you are, use password store
70
** Enable IPv6: @/system package enable ipv6@
71
** Reboot so that IPv6 is enabled: @/system reboot@
72 2 Nico Schottelius
** Add a place indendent, unrouted IPv6 address: @/ipv6 address add eui-64=yes advertise=no interface=bridge address=2a0a:e5c0:1:c::/64@
73
** Get the assigned IPv6 address: @/ipv6 address print@
74
** Disconnect from the switch
75
* Assign your notebook the IPv6 address *2a0a:e5c0:1:c::23/64*
76 1 Nico Schottelius
* Connect to the switch via IPv6
77 3 Nico Schottelius
** Remove the IPv4 address 192.168.88.1 to avoid collisions with other switches: @/ip address remove numbers=0@
78
*** Verify: @/ip address print@
79
* Verify / update entries in netbox:
80
** Verify that the serial number is correct: @:put [ /system routerboard get serial-number ]@
81 4 Nico Schottelius
** Netbox
82
*** go to the ipv6 prefix https://netbox.ungleich.ch/ipam/prefixes/216/
83
**** create a new ipv6 address
84
**** set the DNS name to *mikrotik-crs326-XX*
85 5 Nico Schottelius
**** role = loopback
86 6 Nico Schottelius
* Ensure all steps are taken correctly
87
* Move the device to our inventory / stock if not directly used
88 7 Nico Schottelius
89
90
h2. Configuring a Mikrotik switch for integration into the network
91
92
Depending on the usage scenario, we will define a variety of bridges and assign ports to it.
93
94
* In almost all cases the uplink port will be the *sfp-sfpplus1* port.
95
* In almost all cases we want to apply vlan tagging to that port
96
* For server networks, we configure the MTU to the highest value the switch supports
97
** Devices are configured with a 9200 MTU
98
** So the MTU on the switch ports needs to be at least 9200
99
100
h3. First step for all integrations
101
102 8 Nico Schottelius
Setup MTU of all *sfp-sfpplus* ports (plural) to 9200 and the L2MTU to 9204:
103 1 Nico Schottelius
104 8 Nico Schottelius
Use @/interface print@ to find out the maximum MTU:
105
106
<pre>
107
[admin@mikrotik-crs326-1] > /interface print 
108
Flags: D - dynamic, X - disabled, R - running, S - slave 
109
 #     NAME                                TYPE       ACTUAL-MTU L2MTU  MAX-L2MTU MAC-ADDRESS      
110
 0   S ether1                              ether            9200  9204      10218 B8:69:F4:8E:AC:BA
111
 1   S ether2                              ether            9200  9204      10218 B8:69:F4:8E:AC:BB
112
...
113
24  R  sfp-sfpplus1                        ether            9200  9204      10218 B8:69:F4:8E:AC:D2
114
25     sfp-sfpplus2                        ether            9200  9204      10218 B8:69:F4:8E:AC:D3
115
</pre>
116
117
Above is already setup, but the values differ, use the following to set it correctly:
118
119
<pre>
120
/interface set sfp-sfpplus1 mtu=9200 l2mtu=9204
121
/interface set sfp-sfpplus2 mtu=9200 l2mtu=9204
122
</pre>
123
124 7 Nico Schottelius
h3. Use case 1: coworking network
125 1 Nico Schottelius
126 9 Nico Schottelius
To use the switch in a coworking network, we keep the MTU
127
128 16 Samuel Hailu
* Create a vlan interface named *vlan-coworking*: @/interface vlan add  vlan-id=15 name=vlan-coworking interface=sfp-sfpplus1@
129
** Verify that it is created: @/interface vlan print@
130 1 Nico Schottelius
** Lookup the vlan-id from https://netbox.ungleich.ch/ipam/vlans/
131 9 Nico Schottelius
** The vlan will be added to *sfp-sfpplus1*
132 16 Samuel Hailu
* Create a bridge named *bridge-coworking*: @/interface bridge add name=bridge-coworking@
133
** Verify that it is created: @/interface print@
134
* Add the interface *vlan-coworking* to the *bridge-coworking* as a port: @/interface vlan add interface=vlan-coworking@
135
** Verify that the port is added: @/interface vlan print@
136 15 Nico Schottelius
* Add all ethernet ports that you need for coworking to the *bridge-coworking*
137 16 Samuel Hailu
** For instance to add port 7: @/interface bridge port set bridge=bridge-coworking numbers=6@ 
138
*** Find the number of the interface with @/interface bridge port print@
139 15 Nico Schottelius
** Verify again like you did above
140 8 Nico Schottelius
141 17 Nico Schottelius
h3. Use case 2: server or internal network
142
143
Steps similar to above, BUT ensure that the MTU is set correctly on all interfaces.
144
145
* Ensure that the mtu is correct on the *sfp-sfplus* interfaces (see above)
146
** This is important
147
* We create a bridge named
148 20 Samuel Hailu
** *bridge-server*: @/interface bridge add name=bridge-server@
149
** *bridge-internal*: @/interface bridge add name=bridge-internal@
150 17 Nico Schottelius
* We create a new vlan interface on *sfp-sfpplus1* named
151 21 Samuel Hailu
** *vlan-server*: @/interface vlan add name=vlan-server interface=sfp-sfpplus1 mtu=9200@
152 22 Samuel Hailu
** *vlan-internal*: @/interface vlan add name=vlan-internal interface=sfp-sfpplus1 mtu=9200@
153 17 Nico Schottelius
* Add the
154 20 Samuel Hailu
** *vlan-server* interface as a port to *bridge-server*: @/interface  bridge port add interface=vlan-server bridge=bridge-server@
155
** *vlan-internal* interface as a port to *bridge-internal*: @/interface  bridge port add interface=vlan-internal bridge=bridge-internal@
156 17 Nico Schottelius
* Verify that the MTU is correct
157 23 Nico Schottelius
** On the VLAN interface: @/interface vlan print@
158
** On the bridge: @/interface bridge print@
159
** On the sfp-sfpplus interfaces: @/interface print@
160 17 Nico Schottelius
161
162 19 Nico Schottelius
<pre>
163
If the MTUs are wrong, you can encounter hanging connections, while ping (small packet) still works. Be careful to do it right.
164
</pre>
165 17 Nico Schottelius
166 25 Nico Schottelius
h2. Typical setup for a new mikrotik-crs326 in place6
167
168
You need to insert a GBIC module *BEFORE* seting mtu on the sfp-sfpplus interface
169
170
<pre>
171
/interface set sfp-sfpplus1 mtu=10216 l2mtu=10218
172
173
/interface bridge add name=bridge-server
174
/interface vlan add name=vlan-server interface=sfp-sfpplus1 mtu=10214 vlan-id=11
175
/interface bridge port add interface=vlan-server bridge=bridge-server
176
177
/interface bridge add name=bridge-internal
178
/interface vlan add name=vlan-internal interface=sfp-sfpplus1 mtu=10214 vlan-id=10
179
/interface bridge port add interface=vlan-internal bridge=bridge-internal
180
181 26 Nico Schottelius
/ipv6 address add eui-64=yes advertise=no interface=bridge-internal address=2a0a:e5c0:2::/64
182
/ipv6 address print
183 25 Nico Schottelius
184 26 Nico Schottelius
</pre>
185 25 Nico Schottelius
186 8 Nico Schottelius
h2. Update the switch to the latest version
187
188
(TBD for IPv6 only networks)