Good afternoon...
Litle question, im relatively new to RouterOS:
I have a setup with 16 vLans, a router/firewall and 2 managed switchs, replacing access points and choosed the Mikrotik hAP couse i need 2 kinds of setup...
1 - The hAPs will work purely as access points, ports 2 to 5 disable.
2 - The hAPs will work as access points but keep the ports up
All of them will have atleast 2 vLans and are connected to a Tagged only port on the switch.
Its on 4 buildings with multple tenants, mi goal is to "flash" the hAP so that if any one gets too curious and resets the hAP the default config will be port 1 to 4, standar original config from Mikrotik, port 5 gets moved to a second bridge, with a vLan tag so i can remotly restore configuration to the device by simply requesting the tenant to plug the cable on port 5 and injecting the conf script via ssh, at the same time if i leave, the next tech that comes doesnt need to scrap the hAPs couse i flashed the entire software and he has no clue how RouterOS works.
This is the script i prepared, is it the right way to do it?
# 1. Remove port 5 from deafault bridge
/interface bridge port
remove [find interface=ether5]
# 2. Create a new bridge for Netinstall/OOB
/interface bridge
add name=bridge-oob
# 3. Add port 5 to bridge-oob
/interface bridge port
add bridge=bridge-oob interface=ether5
# 4. Create a VLAN 10 (Recover) bridge-oob
/interface vlan
add interface=bridge-oob name=vlan10-mgmt vlan-id=10
# 5. Get IP from DHCP
/ip dhcp-client
add interface=vlan10-mgmt disabled=no
# 6. Grant access (Winbox/SSH/Web) via VLAN 10
/interface list member
add interface=vlan10-mgmt list=LAN
I am not sure to understand the mechanism.
Usually through changing default configuration or through "branding" the device hypothetically subject to unauthorized resets Is setup so that a reset reloads the intended configuration, not the default one, no need for a dedicated manual intervention.
Good morning, thanks for taking time to answer me.
You have a point there, and would be the most practical way.
But the issue is, I'm just the guy you recommended the hardware and set it up, once I leave or get replaced, most likely the first person they will call is the guy that works on the store at the corner, and for him Tplink is the best, RouterOS is kinda weird stuff.
So mi goal is to besides having everything documented, and on the server have a VM with scripts capable of "injecting" diferent config .rsc on the Mikrotik and set up new wifi keys on demand, leave the Mikrotik in way that if they want to simply use them as a router or AP with the original setup they can easily by only deleting brige 2 e putting port 5 back in bridge 1.
However, you don't really need a second bridge to take a port offbridge (and it would make the "offbridge" become "onanontherbridge" ) compare also with this:
What I would do, as hinted before, is to apply a "static" default configuration that will be restored whenever only mechanical (press the reset button) actions are performed.
This configuration would have (permanently) the offbridge port (on vlan10 as you made it) and have a "diff configuration script" stored on the device itself.
This script should be capable - if manually run - be capable of restoring the original default configuration. I.e. no need to "upload" a new configuration (that will soon be lost, or confused with that of another device, etc.), the operator connected to the offbridge port would only need to invoke the script on the device.
Hi, thank you very much for the help, managed to get it to work...
Used the off bridge port vlan tagged(ether5), works perfect.
Your quote on your previous post was quite helpful.
.
) compare also with this: