Sorry.
Model: CCR2116-12G-4S+
OS version: RouterOS 7.9.2
I've left out firewall rules and extra interfaces, also changed IP addresses. I can provide full config dump in PM.
/interface bridge
add admin-mac=BE:EF:BE:EF:BE:EF auto-mac=no frame-types=admit-only-vlan-tagged igmp-snooping=yes igmp-version=3 mld-version=2 name=bridge1 protocol-mode=none vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment="Connected to switch for VLAN trunking of WAN/LAN/Intra-AS" l2mtu=9570
[..]
set [ find default-name=ether13 ] l2mtu=9586
/interface vlan
add interface=bridge1 name=AS001-UPLINK vlan-id=885
add interface=bridge1 name=AS002-UPLINK vlan-id=900
add interface=bridge1 name=BGP-EVPN-INTERCONNECT vlan-id=1002
add interface=bridge1 name=OOB vlan-id=901
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface list
add name=WAN
add name=LAN
add name=Intra-AS
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip dhcp-server option
add code=114 name=default-url value="'some/address/here'"
/ip dhcp-server option sets
add name="onie installer" options=default-url
/ip pool
add name=DHCP-OOB ranges=172.17.0.5-172.17.0.250
/ip dhcp-server
add address-pool=DHCP-OOB interface=OOB lease-time=4w2d name=OOB
/port
set 0 name=serial0
/routing bgp template
set default as=123 disabled=no output.network=bgp-networks .redistribute=connected,static,bgp,vpn,dhcp router-id=1.2.3.4
/routing ospf instance
add disabled=yes name=default-v2
add disabled=yes name=default-v3 version=3
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
add disabled=yes instance=default-v3 name=backbone-v3
/snmp community
set [ find default=yes ] name=snmp
/interface bridge port
add bridge=bridge1 frame-types=admit-only-vlan-tagged interface=ether1
add bridge=bridge1 interface=ether2
/interface ethernet switch l3hw-settings
set ipv6-hw=yes
/ip firewall connection tracking
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m tcp-time-wait-timeout=2m udp-stream-timeout=2m udp-timeout=30s
/ip neighbor discovery-settings
set discover-interface-list=!WAN
/ip settings
set max-neighbor-entries=8192 rp-filter=loose tcp-syncookies=yes
/ipv6 settings
set max-neighbor-entries=8192
/interface bridge vlan
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=885,1002,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,999
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=929
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=930
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=931
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=932
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=933
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=934
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=935
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=936
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=937
/interface list member
add interface=ether13 list=LAN
add interface=AS001-UPLINK list=WAN
add interface=AS002-UPLINK list=WAN
add interface=BGP-EVPN-INTERCONNECT list=Intra-AS
add interface=OOB list=LAN
/interface ovpn-server server
set auth=sha1 certificate=server-certificate cipher=aes128-cbc,aes192-cbc,aes256-cbc default-profile=vpn-profile enabled=yes require-client-certificate=yes
/ip address
add address=172.17.0.1/24 interface=OOB network=172.17.0.0
/ip dhcp-server network
add address=172.17.0.0/24 boot-file-name=grub2/grubx64.efi dns-server=9.9.9.11,149.112.112.11 domain=oob.mytld.com gateway=172.17.0.1 next-server=111.111.111.111 ntp-server=123.123.123.123
/ip dns
set servers=9.9.9.11,149.112.112.11,2620:fe::11,2620:fe::fe:11
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=WAN src-address=!10.0.0.0/8 src-address-list=lan_subnets to-addresses=1.2.3.4
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set winbox port=800
set api-ssl disabled=yes
/ip ssh
set always-allow-password-login=yes forwarding-enabled=both strong-crypto=yes
/ipv6 address
add address=2a00::1 interface=OOB
/ipv6 nd
set [ find default=yes ] disabled=yes
add interface=OOB
/ipv6 nd prefix default
set preferred-lifetime=infinity valid-lifetime=infinity
/routing filter rule
add chain=AS123-v4-IN disabled=no rule="if (dst == 0.0.0.0/0) { accept} else {reject}"
add chain=AS123-v4-OUT disabled=no rule="reject;"
add chain=AS123-v6-IN disabled=no rule="if (dst in ::/0) { accept} else {reject}"
add chain=AS123-v6-OUT disabled=no rule="if (dst in bgp-networks && dst-len>31 && dst-len<49) {accept} else {reject}"
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=oob-rtr.mytld.com
/system note
set show-at-login=no
/system routerboard settings
set auto-upgrade=yes enter-setup-on=delete-key
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN