CCR1009-8G-1S-1S+ General info & Questions

Hardware MikroTik hardware general
41

I hoped both sfp ports are directly connected to the cpu. The Tile should support this.

From Tilera’s site:
“Integrated I/O features include up to 12 ports of 1Gb Ethernet and 2 ports of 10Gb Ethernet, along with multiple PCI Express controllers that can be configured as either root complex or endpoints. An assortment of USB, RS-232, I2C and GPIO ports further consolidate the system peripherals into the TILE-Gx9 System-on-Chip (SoC).”

UPS is delivering my CCR1009-8G-1S-1S+ today (Germany), can’t wait to put that thing under load testing :slight_smile:

42

I’ve had this CCR1009-8G-1S-1S+ in use for a week now with 6.12, and so far so good :slight_smile:

However my WAN uplink(15dB TX 1310\RX 1550) for Internet and IPTV is currently run throug a fiber converter (10/100/1000FD BiDI → 10/100/1000Base-T) before it is connected to my CCR.

I have tested 2 SFP’s, one mikrotik and one fiberworks, none of them are able to pass any traffic when used in the CCR(The Cisco one works in a media converter and switch. )
Mikrotik S-35LC20D is a 1.25G Single Mode, LC, T1310nm/R1550nm
Fiberworks(Cisco coded, dual rate) SFP-DR-BX40D-35 BiDi, 100 / 1000 Mbps, DDM, SM, 40km TX/RX=1310/1550nm, 20dB, LC

If SFP slot in the CCR is set to auto negotiation, then no link is established. If set to manual 100 or 1000Mbit, i get ‘link ok’, but no trafic is able to pass(no recieved packets). I think my fiber converter links towards my provider with 100Mbit over the fiber, and that causes the problems since I have read that mikrotik dont support 100Mbit over the SFP ports. Any thoughts about this?

The Fiberworks sfp module I have do support dual rate(100 and 1000Mbit) and is compliant to SFP MSA and SFF-8472. Will Mikrotik support 100Mbit on the SFP slot?

Best Regards
Joakim

43

I got my CCR-1009 4 days ago and testing some stuff, i found something strange. If i plug a 10 gig sfp+ in my CCR-1009, the device Fan slows down/almost stopped for a moment and speed up again, but not at the same speed without that sfp module. It happens on both ports. sfp and sfp+.

From information slide, Fan(s) running with 5400 rpm, with a sfp+ plugged in, it runs with 5000 rpm. I can’t see this behaviour Microtiks sfp+ cable.

Anyone else with sfp has this issue? maybe a power issue? the brocade sfp+ itself is detected and shows normal ddm stats.

Atm i only have sfp+ modules around for testing.

44

This also happends to me, on both SFP+ and the SFP port, with all the modules I have tested.

However I’m not sure if matters or affects the CCR, can’t say that I have encountered any strange behavior other that the sound itself. Maybe just a voltage drop, that gets readjusted after a while?

45

Hi Quindor any chance you have RB1100AHx2 to test against ? My 1100’s have served me really well so far but I would always welcome some extra performance.

46

Hello Quindor,

the same like the thread about the RB2011 well done and very informative for me,
it would be more interesting for my self to know what different kinds of VPN methods
would be natively supported by the hardware especial by the MiCA encryption engine.

And with DPI tasks is this device slowing down hard or not?

Related to the fans inside I found this one here, perhaps you would take a short overview
if this can be interesting for you. Noiseblocker BlackSilent Pro Fan PM2

@Vanta

How do I know if one of the PSUs broken?

  • PRTG
  • Nagios
  • Incinga
  • Zabbix

at max it is small office and Home-office (where noise is big problem

A little or small ventilated 19" Rack is in my eyes the best solution for becoming
a smooth work ground or a quiet office.

@KoDak

RB2011UiAS-2HnD-IN but on CPU: TLR4-00980CG-10CE

I didn´t consider, if I own a router such as the CCR1009-8G-1S-1S+ then
I want also to be free and setting up WLAN as I need or want it, and then
I will having more “fun” with the CCR1009 and a brand new RB953as an WLAN AP!!!

@SwissWISP

In my opinion such a device should have LEDs which are indicating the status of each PSU.

I am considering with you but the LED light should be more made for home usage
or SOHO usage, but having some would be great.
In bigger instalments or networks it should be more something like support for PRTG from Paessler
and/or support for the USPs from APC (both protocols from them) then you will be able to set up
a sensor for the dual PSU and if one is failing you will be informed by mail or sms if you are using
PRTG and Kentix equipment, because the PRTG is able to use the SMS unit insite of the Kentix
monitoring system! Quindor, the PRTG is comming for free with 10 Sensors and is supporting also
USPs from APC and if you are placing a banner on your homepage, you will be able to get up to
30 Sensors for free, enough for a small home network as I think.

47

Hi, just got a CCR1009-8G-1S-1S+ setting it up, would like some help.
I'm used to RB750 and RB2011 where quickset worked fine, but quickset on CCR not so much, e.g. sets SFP port as internet.

Any advice or pointers on proper config to help me set the device for NAT internet use, specifically the firewall rules?

I found several sources of firewall config, reasonably similar, but also slightly different to make me question why and what is current:

RB2011 backup config

/ip firewall filter
add chain=input comment="default configuration" protocol=icmp
add chain=input comment="default configuration" connection-state=established
add chain=input comment="default configuration" connection-state=related
add action=drop chain=input comment="default configuration" in-interface=ether1-gateway

RB2011 quickset config

/ip firewall filter
add chain=input action=accept protocol=icmp comment="default configuration"
add chain=input action=accept connection-state=established comment="default configuration"
add chain=input action=accept connection-state=related comment="default configuration"
add chain=input action=drop in-interface=ether1-gateway comment="default configuration"
add chain=forward action=accept connection-state=established comment="default configuration"
add chain=forward action=accept connection-state=related comment="default configuration"
add chain=forward action=drop connection-state=invalid comment="default configuration"

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter/ip firewall filter

add chain=input connection-state=invalid action=drop comment="Drop Invalid connections"
add chain=input connection-state=established action=accept comment="Allow Established connections"
add chain=input protocol=icmp action=accept comment="Allow ICMP"
add chain=input src-address=192.168.1.0/24 action=accept in-interface=!ether5-wan
add chain=input action=drop comment="Drop everything else"
add chain=forward protocol=tcp connection-state=invalid action=drop comment="drop invalid connections"
add chain=forward connection-state=established action=accept comment="allow already established connections"
add chain=forward connection-state=related action=accept comment="allow related connections"

Dstnat rules - server logs reporting access from router's IP firewall filter

add action=drop chain=input comment="Drop invalid connections" connection-state=invalid
add chain=input comment="Accept established connections" connection-state=established
add chain=input comment="Accept related connections" connection-state=related
add chain=input comment="Allow access from local network" in-interface=br-PrivateNetwork src-address=192.168.25.0/24
add chain=input comment="Allow access from guest network for DNS" dst-port=53 in-interface=br-GuestNetwork protocol=udp src-address=192.168.125.0/24
add action=log chain=input comment="Log everything else" disabled=yes log-prefix="IPv4 Drop input RR:"
add action=drop chain=input comment="Drop everything else"
add action=drop chain=forward comment="Drop invalid connections" connection-state=invalid
add chain=forward comment="Accept established connections" connection-state=established
add chain=forward comment="Accept related connections" connection-state=related
add chain=forward comment="Allow traffic from Local network" in-interface=br-PrivateNetwork src-address=192.168.25.0/24
add chain=forward comment="Allow Guest network going outside" in-interface=br-GuestNetwork out-interface=pppoe-***** src-address=192.168.125.0/24
add action=log chain=forward comment="Log everything else" disabled=yes log-prefix="IPv4 Drop forward RR:"
add action=drop chain=forward comment="Drop everything else"

http://wiki.mikrotik.com/wiki/A_script_to_set_up_WAN/LAN/WLAN_to_get_you_started/ip firewall filter

add action=accept chain=input comment="Local access to RB for Winbox" disabled=no dst-port=8291 protocol=tcp src-address-list=local
add action=jump chain=input comment="Treat all traffic equally" disabled=no jump-target=inbound
add action=jump chain=forward comment="Treat all traffic equally" disabled=no jump-target=inbound
add action=drop chain=inbound comment="Drop invalid" connection-state=invalid disabled=no
add action=accept chain=inbound comment="Allow limited icmp" disabled=no limit=50/5s,2 protocol=icmp
add action=drop chain=inbound comment="Drop excess icmp" disabled=no protocol=icmp
add action=accept chain=inbound comment="Accept established" connection-state=established disabled=no
add action=accept chain=inbound comment="Accept related" connection-state=related disabled=no
add action=accept chain=inbound comment="Internal traffic can do what it wants." disabled=no src-address-list=local
add action=drop chain=inbound comment="And drop everything else" disabled=no
add action=accept chain=output comment="Allow everything out" disabled=noWhat would a reasonable set of rules look like?


From what I gather ether1 to ether4 is on a switch, so I can config them for a switch.
Ports 5 to 8 is not on a switch, so no switch config.
I tried disabling all unused ports, including SFP and SFP+, and then noticed that ether5 and ether6 does not want to disable.
/interface set ether5,ether6 disabled=yes
failure: master-port and bandwidth settings not supported on this portWhat ethernet (non-SFP) ports should be used for LAN and for WAN links?
Do you config ports 1 to 4 for LAN and switch, or if they are switch no rules, or just no rules between ports?


Lastly, is there an easier way to reset to factory defaults (after I screwed up network access) than pressing reset while powering on, impossible for one person to do that with the device in the rack?

P.

48

I have CCR1009 since 2 weeks but I remember from a mistake I disabled Ether1. and I connected in Ether2 without any problem. So you can configure from any port you want

49

I can’t wait to get my hands on one of these…I just “finished” setting up my new CRS226-24G-2S+RM (I’ll never really finish because I’m always playing with it) and I’m loving it. I’m interested to see just what the maximum wire-speed routing capacity of the CCS1009 is…obviously it only has 5 gigabit ports connected directly to the CPU, but with the 10Gb SFP+, I wonder if it can reach 10+ Gb/s total routing before maxing out the CPU.

50

I wonder too. Have you tried it? What routing maximum you were able to achieve? Packets-mbits-cpu utilisation.

51

I have not yet tried with routing, but NAT it seems capable of doing at least 2Gbit sustained without too much trouble. Maybe 35% CPU utilization. I do not have the equipment to test more. But if it can do NAT at those speeds I would expect it to be quite capable in routing only!

52

Does anybody know if SFP+ port supports also SFP modules (1,25gbps).
I would like to replace actual config (RB1100AHx2 + 2 gigabit media converters) with 1 CCR1009-8G-1S-1S+ and 2 SFP modules.

53

I might be wrong, but I don’t believe the 10G SFP+ port supports 1.25G modules. Usually, when they do, the port will be labeled 1/10G, but the picture Quindor posted clearly only shows 10G on the SFP+ port. At this point, your best bet to get multiple SFP cages is the CCR1036-12G-4S

54

Hi mmigoro , MTK have noted that certain SFP+ routers are backwards compatible with SFP but requires it to be hard set on both sides to 1GB iirc.

http://forum.mikrotik.com/t/sfp-transceiver-at-ccr1036-8g-2s-em/73537/1

55

Thanks for info.

I only have access to my side of the link, the other ends are at provider PoP’s. So I guess I’m stuck with 1100AHx2…

56

You are paying for the link right? Just ask them to set it to the specified settings and they should?

57

If you’re currently using 1100AHx2 with fiber-to-copper media converter, why not use that with the CCR1009 too ?

It’s a waste to use an SFP+ for 1Gbps connection when it’s capable of 10Gbps.

58

By replacing three devices with only one we figured we will have full power redundancy because two sfp’s being powered by device itself (which in turn is dual-powered (even three as i understand)).

59

Perhaps this answer from @janisk will matching best this question.
Topic: CCR1036-8G-2S+ SFP Problems

60

Did anyone ever tried to use the smart card slot? i wonder if that slot really works.
Anyone knows a compatible card for that slot?