We’re planning to design the network which will cover 30k concurrent clients in the guest network. We don’t have any questionmark on wired/wireless network but gateway is our main concern. Will mkt’s be able to handle that dhcp/dns load and also traffic? There won’t be much fw rule only NAT to WAN, DHCP and DNS. There will be external hotspot/radius connection with MKT and the logs will be stored in the virtualisation system located same network. So, virtualisation for RouterOS is also possible.
Do you have any recommendation for hw selection or virtualisation? Has anyone ever run a scenario on mkt before like that?
Can I guess that this is some type of show or event where you will be providing WiFi to attendees that need access to the internet and nothing else? And what is your internet access? Bandwidth, media, single or multiple IPs?
“Concurrent” clients does not mean that much.
I mean, of these 30k connected Wifi most could be pretty idle, only doing few 100 kbits/sec for som sync tasks.
If we think about 1Mbps / user (if your Wifi setup supports this) then you are looking at 30Gbit/sec Internet backhaul. That is quite a lot and I would split this up across at least 2 gateways…
You’ll have to split it up anyway from a redundancy perspective.
I think you should be OK using 2 ISP lines of 10Gbits/sec, each connected to a beefy CCR-type of box and doing some routing-protocol and NAT for the clients.
Is there any firewall in the picture that perhaps takes care of the NAT-aspect ?
As you guessed, its a event scenario. And also yes it mainly will feed the WLAN network. We don’t have any issue on WLAN/LAN design. We’re planning to use 2x10Gig Metro Uplink from ISP. Our concern is how we should meet such big dhcp requests, arp load and LAN-WAN NAT on a mikrotik infrastructure.
With those many clients, you’re going to have a lot of connections which means a multi-core router with slower individual cores would be better than a few-core one with speedy cores, so that means a CCR. You also have not one but two 10Gbit ethernet links, so you need something with 2+ of those ports. If you’re willing to segregate your network into two halves, just get 2 CCR1036-8G-2S+EM routers and connect each one to each 10Gbit link. Alternatively, get a single CCR1072 and have that handle everything. I don’t think DHCP would be a big problem because assuming each client on average makes about 10B/s of that, than 30K clients is 300 kilobits which isn’t much. Make sure your leases are long!
Pushing the traffic will not be an issues, but perhaps a large churn will impact DHCP services & wait times?
No clue what Mikrotik DHCP servers has been tested for.
Eg. 1000 concurrent requests arriving at the same time.
But its true this is probably a “gradually” process as visitors arrive at the venue, having a large enough DHCP lease time makes things more relaxed.
Same for DNS, is this “offloaded” to another DNS or do you expect the CCR also handle it? Or do you simply provide in the DHCP-settings something like a 8.8.8.8 or 1.1.1.1 DNS-server and don’t care about it further?
→ Routing 2*10Gbps
→ DHCP for 30k
→ NAT for 30k (connection tracking might be a resource hogger, but probably optimisations exist)
→ Some very basic FW-rules, things like client-side isolation you probably take care already on the WLAN side, perhaps some QoS/airtime too.
Must you be compliant to some lawful intercept regulations ? I guess you handle that aspect on the WLAN part? (AAA etc)
We are trying to clearify CCR or CHR will be the best for our scenario if we decide we’re ready to go with MKT. This will also directly affects HA scenario too.
Our main concern comes with DHCP as you also highlighted, there will be a instant loads on the dhcp server when guests arrived the venue. We can use global DNS instead of locally manage.
External radius server and log server for compliancy. But the MKTs will be the bridge for getting/sending details to external resources. Logs will be dhcp lease details ip-mac details just it.
Client based configurations such as airtime, isolation will be configured on Wireless Controller so there won’t be any load for this on MKTs.
the CPU is directly connected to the SFP+ ports, so the DHCP server isn’t limited by some low-bandwidth port. Alternatively, you could get a CCR2004 which has the highest single-core performance of any Mik router and that might get you even better DHCP performance.
I’m curious to hear any results on this event? What’d you go with? I have a similar goal but with a smaller event.. shooting for 4K to 6k clients on a CCR2004-1G-12s+… all the same situations. Nat dhcp .. maybe a few different source nat rules.
This is kind of my approach right now.. I have a pretty hefty.. Pfsense router but its so expensive and Im just really getting sucked into the mikrotik world.. Feel like im learning more and just so much for value for the money.. the big pfBOX was almost 4k.. Could get 3 or 4 Mts that can do just as much as a router.. Really the pfsense is more of a firewall anyway..
but here is how ive got it going now.. as far as my attack for these big shows..
