Good news!
We have been using MT devices across our network for a long time and planning to do so in the future.
Implementing one solution that will help to update and backup configurations would be great.
Also, integrated netinstall feature(if possible) would solve so many unnecessary on site travels…
Rock on TIK!
we need:
- a list of router, one click access to open winbox
- graphs
- mass update
- automatic backup schedule
- local host in a VM
- mass configuration option. I.E : changing the value of a string for selected routers. Let say you want to change check IPSOCKS on 380 routers, just select routers in a list, and then send the script.
I think the general idea of TR069 is a good one, where the device “phones home” to be told what to do. This works great with devices behind NAT etc as only the server needs to be publicly accessible. Ideally the device would be configured with a URL for the server that it could get all of its config from with just port 443 open, so that you can easily put a device at any customer premises even behind existing firewalls and still have management of the device. This is the way Ubiquiti UISP works. I don’t like much about UISP, but I do like the decision to design it in this way.
TR069 itself however is ill-suited to managing anything other than CPE devices. The ACS systems are really only intended for CPEs as that is what the protocol is meant for, so it would be very strange to manage something like a BGP edge router for a big ISP with TR069. I am already managing our CPE devices through GenieACS but could use something like this for everything that is not a CPE device.
its been ages is there anything going
some thing which have everything hat dude have and also the flexibility to install any on-premise system and can at-lest show snmp data from other network equipment too
wich can give total network usage of any interface and performance graph of cpu, ram, flash, interfaces…etc
and most important have a web GUI which can be accessed anywhere the one think wich dude use to have and then removed in later vertion
Everything in Winbox + TR-069 in one on-prem solution would be killer in my use.
I would vastly prefer development effort be put towards making RouterOS 7 more automation-friendly rather than towards making another single-pane-of-glass management solution. I certainly understand the urge to do so, especially for single-vendor networks that want something that “just works”.
Nonetheless, I think Mikrotik’s strengths are in the form of innovative and cost effective hardware platforms, a fairly well-designed configuration paradigm, and that the configuration language is a domain-specific language that lends itself to scripting. If there is a desire to sell a management solution, Mikrotik should lean in to those strengths and do most of the work on the router side rather than the controller side.
One big example I can think of: give RouterOS 7 proper configuration transactions. The RouterOS configuration paradigm is already very database-like and, in my opinion, is well-designed compared to some of the big players like Cisco. A huge thing missing for automating Mikrotiks is the lack of native transaction support: the ability to stage a series of changes, commit them in their entirety, and if necessary roll them back. Work spent improving this would make the platform more attractive for all users, no matter whether they manually configure their devices with Winbox/web/CLI or whether they integrate them with an automation tool like Ansible.
Another big thing is configuration replacements. Since the strategy of most automation frameworks is to declaratively state the running state of the device now and then apply changes to get the device to a new state, the native ability to make these kinds of transformations would make RouterOS a lot more friendly to automate. For example, if I want the entire /ip/firewall tree to be different, either the script I’m writing or the automation platform I’m using has to compute the individual changes that are required to, say, add two address-lists, remove three other address-lists, add 4 new chains, modify the existing chain by a certain name, etc. etc. etc. and issue the commands to just change those pieces. All of this additional headache can be alleviated if RouterOS can be presented with a replacement hierarchy that should simply replace that whole subtree of the configuration and make it match after the transaction is committed.
Pretty much all of the network vendors (except JunOS frankly) have one or more of these exact problems and it is certainly a non-trivial effort to make big changes to the core configuration model. However, if you make these types of improvements on the RouterOS side, if you still want to implement an automation/controller/management kind of solution your own engineers won’t have to invent something with duct tape and glue on the controller side to keep things in sync or try and generate the API diffs under the hood. Instead, the resulting application can be a pretty basic web app that leverages a simple database or, say, Ansible and git under the hood. You could even partner with an existing automation platform and just make some good RouterOS integrations for it.
Thanks for reaching out for input and I hope you consider my case for where best to apply your development time and money in service of RouterOS mass management.
[quote=liljenstolpe post_id=944444 time=1657396284 user_id=203439]
- Doing a controller without the ability to have idempotent commit is a fool’s errand, and will only end in tears, both for the developers and users. Fix that first, the rest becomes MUCH easier.
[/quote]
+100 on this and the rest of your suggestions.
In regards to the ‘Cloud’ solution.
Not everything I have in now >100 devices touches the public internet.
I would prefer a solution I can spin up on a Virtual Machine in a closed environment.
I understand that other people could benefit from a cloud controller, but not in my current use case.
I just saw the thread and it is GREAT news! What I would like to see:
- Controller accessible via both modern, sleek web UI AND familiar winbox, with different menus than those of regular devices
- Self-hosted (with support for all major hypervisors and docker) AND cloud-based, as-a-service, provided by Mikrotik at a reasonable cost
- Support for controller redundancy for high-availability
- Multisite AND multitenant
- Versatile device grouping by locations, tags, types, organizational units or any other attribute
- Rule-based and manual device tagging/ group assignment
- Automatic device discovery, adoption and provisioning
- Fully customizable lists with nice and informative visual elements
- Configuration via both GUI AND programmatically, with support for predefined AND user-definced variables/data structures
- Advanced configuration management functions (versions, comparison, visual block-based editing with ability to copy specific sections and sub-sections by dragging and dropping blocks from one config file to another etc.)
- Configuration templates with manual and automatic (based on triggers and criteria) provisioning on devices
- Manual and automatic device firmware upgrades, on groups or individually
- Support for devices hierarchy and dependencies (e.g. upgrade downstream device first, then upstream)
- Manual and automated backups with selectable retention
- Comprehensive builder for statistics and reports, exposed via the API for use in other platforms (e.g. PowerBI, Graphana, etc.)
- Topology mapping capability with automatic detection where possible (using wireless link clients/ L2 discovery etc.)
- Controller support for users, user roles and user groups
- Controller support for external authentication providers and 2FA
- Support for automatic IP blocklist import, for use on the controller and the managed devices (via firewall rules)
- Full LDAP and radius functionality
- Funtions fully accessible via a RESTful API
- Open architecture with active encouragment of plugin development
- Ability to use a Mikrotik router as an appliance to run the controller
- Specific appliance for the controller (like Mikrotik Cloudkey, with battery backup, info screen etc.)
It is a long but comprehensive list. Thank you for the great work!
The ability for controller and RouterOS to connect when they are both behind (different) NAT networks.
The ability to work on “air-gapped” networks.
See changes made over time.
All Dudes vibes, and better! 
- Web based UI, focused on desktop/tablet, but still be able to get useful info out of it in phone view
- Run it in a docker container, easiest way for people to just grab and run with it. Make sure to use some sensible port for it (not port 80) to not clash right off the bat. Ability to add a certificate to run it with https enabled.
European EID / OpenSC support.for.authentication.
Two factor authentication
I don’t want all my eggs in the same basket if this is not secure.
Open source and open standards eunning in containers and GNU/Linux
Peer review and certification of code by public agencies
That you have representation of running and start up configuration. Where are you can see the differences.
Yes that would be nice to have for “the general public”.
I have this function for ages as I export my configs to a locally hosted git versioning system with the additional “gitweb” program that shows output similar to the above via a web interface (only accessible locally).
Very useful to be able to look back at what you changed before. Also useful when having more than one admin.
Here are some suggestions.
-Configuration management, device policy groups, etc.
-Change management, authorized or approved changes, scheduled changes and a diff change log.
-Event based notifications channel. Like MQTT to trigger alerts and collect device metrics.
-SDWAN auto-deployment, failover.
-Deploy containers
-Schedule firmware upgrades with auto rollback on failure
-Configure single-sign-on authentication for VPNs and wireless using RADIUS or LDAP in a wizard.
I’m assuming this controller would have a web portal with reporting and live metrics.
For anyone interested in a solution like this, there’s Oxidized.
https://github.com/ytti/oxidized
A Script manager so an SD-WAN solution can be implemented. Web/Winbox interface.
any update? or demo? to see and tell our opinion
AHAHAHAHAHAAHAHHAH!!! 
Sorry…