Best way to instal 30 CRS 328-24P with same config

RouterOS General
1

Hey,

I need to install 30 CRS328-24P-4S+RM switches with almost the same VLAN configuration. My plan was to configure one, then export and reuse the config. However, I read that this could cause issues with duplicate MAC addresses.

What’s the correct way to deploy them?

2

Yes and no.

The usual advice, and also Rule #6:
The twelve Rules of Mikrotik Club
is to have the bridge set as auto-mac=no and explicitly assign a static IP as admin-mac, but it is not carved in stone.

You can prepare your "base" configuration with auto-mac=yes, and then - while you make the needed small individual changes on the router configuration - set it statically (the usual MAC used is the one of the first interface in the bridge, usually ether2).

See also:

The possible issue (not really common in practice) with auto-mac=yes is that - should the order of the ports inside the bridge change - the bridge MAC may also change, creating havoc in certain setups, but while setting up the devices it should not be a problem.

3

Hi,

if you export configuration in plain text and correct/change static MAC assigned to router interfaces then import should be doable.
Do you assign any static MACs?

4

You can replace the bridge config with:

/interface bridge
add name=Bridge1 admin-mac=[ /interface/ethernet/get [ find name=ether1 ] value-name=mac-address ] auto-mac=no vlan-filtering=yes
5

Thanks that's perfect!

6

Don't forget that the mac addresses of the individual ports are also saved and restored with the configuration. They have to be reset before any other step is taken. (Otherwise auto-mac will select the same mac as well.)

Just my 2 cents: I think that for this many devices it's worth writing a custom def-conf (run after reset/run after install) script. The first one you write is a bit time consuming, but the effort quickly pays dividends.

7

They're not if export is "normal" (i.e. without using verbose modifier). Export (if it's not verbose) will only output things that are different than bare minimum default setup and MAC address settings on ethernet (and wifi) interfaces are normally not "add on" setup.

For bridge MAC address recipe by @oreggin does the trick.

8

Oh, somehow I got it in my head that OP wants to use the binary backup/restore.

With proper text export you're of course correct.

I still stand by the latter part of what I said: if you'll be mass installing things then it's worth taking the time to write a proper full script. (Of course relying on the export for lots of it.)

9

I fully agree with this part. :+1:

10

Better... this... if the bridge do not have ether1 inside... (work with v6 and v7)

/int bridge
:local briname "bridge" ; set $briname admin-mac=[/int ethernet get [/int bri port get ([find where bridge=$briname]->0) interface] mac-address] auto-mac=no

remove admin-mac=... and auto-mac=no on bridge creation
and add after all interfaces are added to the bridge.

This is also because the ether1 ports in switches and routers are usually the boot (etherboot for netinstall) ports, and I never leave them in use in production, using them as MGMT ports. It's best not to ruin the only port that, on some models, accepts netinstall.

11

If I had to mass install 30 identical devices I would definitely script it and use FlashFig - RouterOS - MikroTik Documentation for the task.

12

In fact, the first step is to create a generic script to be applied later...

13

Thanks for the help everyone. The installation works great using /system/reset-configuration run-after-reset=NewConfig.rsc

As a sanity check, could someone kindly double-check my config below for any security issues?

Setup details:

  • The 4 SFP ports are configured as trunks.
  • Port 24 will be used as the management port (Untagged VLAN 999).
  • The switches need to be accessible from management VLAN 999.
  • I have still to decide the password. Will add that one later in the config or manualy on the switches
{
:local i 0
#Number of interfaces. 
:local x 28
#Max time to wait
:local t 30
while ($i < $t && [:len [/interface find]] < $x) do={
:put $i
:set $i ($i + 1)
:delay 1
}
if ($i = $t) do={
:log warning message="Could not load all physical interfaces"
} else={


/interface bridge
add name=bridge admin-mac=[ /interface/ethernet/get [ find name=ether1 ] value-name=mac-address ] auto-mac=no vlan-filtering=yes protocol-mode=rstp disabled=no

#set switch IP here

/interface vlan
add interface=bridge name=vlan_management vlan-id=999
#Set Switch IP here
/ip address
add address=172.16.226.56/23 interface=vlan_management

/ip firewall filter
add action=accept chain=input in-interface=vlan_management src-address=172.16.226.0/23 comment="accept management vlan"
add action=drop chain=input comment="drop any"
add action=drop chain=forward comment="drop any"

/ipv6 settings
set disable-ipv6=yes

/interface bridge vlan
add bridge=bridge comment="Camera Security" tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=11
add bridge=bridge comment=IoT tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=12
add bridge=bridge comment=Staff tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=21
add bridge=bridge comment=Teachers tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=22
add bridge=bridge comment="Printer Staff" tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=23
add bridge=bridge comment=Students tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge untagged=ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23 vlan-ids=31
add bridge=bridge comment=Smartboards tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=32
add bridge=bridge comment="Printers Classroom" tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=33
add bridge=bridge comment="Computer Classroom" tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=34
add bridge=bridge comment=Servers tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=51
add bridge=bridge comment=IT tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=52
add bridge=bridge comment=BYOD tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=61
add bridge=bridge comment=Guest tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=62
add bridge=bridge comment=Internaat tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=71
add bridge=bridge comment=Klooster tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4,bridge vlan-ids=72
add bridge=bridge comment=management untagged=ether24 tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4  vlan-ids=999

#old network vlans will have to delete early next year 
add bridge=bridge comment=old_edu tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 vlan-ids=40
add bridge=bridge comment=old_WIFI_EDU tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 vlan-ids=100
add bridge=bridge comment=old_WIFI_LLN tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 vlan-ids=110
add bridge=bridge comment=old_BYOD_Guest tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 vlan-ids=120
add bridge=bridge comment=old_Secretariaat tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 vlan-ids=200
add bridge=bridge comment=old_Servers tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 vlan-ids=500
add bridge=bridge comment=old_Printers tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 vlan-ids=550
add bridge=bridge comment=old_VPN tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 vlan-ids=600
add bridge=bridge comment=old_IoT tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 vlan-ids=650
add bridge=bridge comment=old_Development tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 vlan-ids=900
add bridge=bridge comment=old_IT tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 vlan-ids=901

/interface bridge port
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether1 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether5 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether6 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether7 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether8 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether9 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether10 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether11 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether12 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether13 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether14 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether15 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether16 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether17 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether18 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether19 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether20 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether21 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether22 pvid=31
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether23 pvid=31
add bridge=bridge frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1 trusted=yes pvid=1
add bridge=bridge frame-types=admit-only-vlan-tagged interface=sfp-sfpplus2 trusted=yes pvid=1
add bridge=bridge frame-types=admit-only-vlan-tagged interface=sfp-sfpplus3 trusted=yes pvid=1
add bridge=bridge frame-types=admit-only-vlan-tagged interface=sfp-sfpplus4 trusted=yes pvid=1
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether24 pvid=999

/interface list
add name=management_vlan_list
/interface list member
add interface=vlan_management list=management_vlan_list

/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes

/tool mac-server
set allowed-interface-list=none
/tool mac-server ping
set enabled=no
/tool mac-server mac-winbox
set allowed-interface-list=management_vlan_list
}
}
14 
{
:local i 0
#Number of interfaces. 
:local x 28
#Max time to wait
:local t 30
while ($i < $t && [:len [/interface find]] < $x) do={
:put $i
:set $i ($i + 1)
:delay 1
}
if ($i = $t) do={
:log warning message="Could not load all physical interfaces"
}

What is the sense of it?
What info "load interface" should mean?

/ip address
add address=172.16.226.56/23 interface=vlan_management

Ale switches are supposed to have same IP? Put it in the variable at the very begining of the script. Put there all settings that should be set per device. All other settings in the script should use them to calculate detailed device settings.

15

It’s one of the scripts from the MikroTik wiki. It waits for all interfaces to be up before exectuting the rest of the code. I’m not sure if RouterOS waits for all interfaces to be up before executing the install script after a reset, so I thought it would be safer to include it, as it doesn’t seem to have any downside.

The defconf script also includes similar code at the start that waits for the interfaces to come online.

They aren’t. Since it’s right at the top of the script, moving it a few lines up or down to edit the IP didn’t feel like a big deal to me. I just switched it to a variable as you suggested for best practice.

Besides the above, and adding a password/changing the admin account name, does the configuration seem secure?

16

Excerpt from the help

If your configuration relies on interfaces that might not yet have started up upon command execution

How many interfaces would be "on"/"running" when you configure a device locally with just one management interface used for configuration?

Point #1, #2 from The twelve Rules of Mikrotik Club

17

Not a script guru so will only comment on content.

  1. Already noted and fixed was the IP address of the switch. Dont forget to enter these as fixed leases in upstream router.
  2. Missing, IP neighours discovery on the main config and of course should be set to the management interface list.
/ip neighbor discovery-settings
set discover-interface-list=list=management_vlan_list
  1. You ignored rextended's sage advice about port1, use port 1 for vlan999 and not port24.
  2. Personally I dont see the value of putting vlan999 on lets say port 1 as recommended ( or any port ) as anyone can plug into the port and they are suddenly have access to the management network.
    Combined with the frustration of assigning vlans and bridges some come across, I would be inclined, to manage a switch locally, via the use an offbridge port. THis is a sure fire method to access the router when there has been a bridge or vlan glitch and one cannot access the router. In these cases your ON bridge vlan999 will be of no use.

example
/interface ethernet
set [ find default-name=ether1 ] name=OffBridge1
/ip address
add address=192.168.111.1/30 interface=OffBridge1 network=192.168.111.0

/interface list member
add interface=vlan_management  list=management_vlan_list
add interface=OffBridge1  list=management_vlan_list

Now all you need to do to access the switch locally is plug your laptop into ether1, type in the IP address 192.168.111.2 and with username and password you are in!

  1. Probably a good idea to ensure all switches are synced with main router time.
    /system ntp client
    set enabled=yes
    /system ntp client servers
    add address=172.16.226.1

  2. I dont see any need for the firewall rules you have......

  3. I would add, although optional
    /ip route
    add dst-address=0.0.0.0/0 gateway=172.16.226.1 routing-table=main
    /ip dns
    add set server=172.16.226.1

  4. A touch more to be sure..........

/ipv6 settings
set disable-ipv6=yes
/ipv6 firewall
add chain=input action=drop
add chain=forward action=drop

  1. Not sure if you put in PVID=1 manually onto /interface bridge vlan or thats just how its exported.
    If manual, remove it as not required and also looks confusing .........

  2. As noted, the bridge itself is ONLY required on switches for the config line that refers to the management vlan.

If following rextended excellent use of ether1 vice 24

add bridge=bridge comment=management untagged=ether1 tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4  vlan-ids=999

OR if even better use offbridge for access

add bridge=bridge comment=management tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4  vlan-ids=999
  1. I would also do the /bridge vlans a bit differently, ignoring the old you are getting rid of and assuming offbridge on 1.
/interface bridge vlans
add bridge=bridge comment="Camera Security" tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3, \
sfp-sfpplus4   vlan-ids=11,12,21,22,23,32,33,34,51,52,61,62,71,72
add bridge=bridge comment=Students tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3, sfp-sfpplus4 \ untagged=ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13, \ ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24 vlan-ids=31
add bridge=bridge comment=management  tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4  vlan-ids=999
  1. Lastly change the frame types for the bridge to only-vlan-tagged as well.
18

A late reply but I just wanted to thank everyone for the insight. I applied all recommendation and the switch (no pun intended) to routerOS went well!