Concerning the 1.2 release - what are the options to limit access to the device using ACLs?
The point is not to allow unrestricted access to the device and have something apart from username/password to protect the device.
The example applied for MAC filtering without setting port in the “Redirect to” section does not work. I’ve tried also filtering based on Dst IP, w/ and w/o protocol. Still not working.
BTW the intended usage is to have dedicated management VLAN ID.
Man what some dark fibre will do with $100 media converters…
What is the purpose of this network ?
F.
It connects a number of computers to some servers.
Are there plans to make SWOs access via telnet or ssh?
Because IMHO web UI is the worst it could be in such device 
I second this request.
My wish list is:
telnet/ssh
text based config that can be read and edited by field techs
“winbox-like” interface
If it costs $5 more because you have to add some memory, it is worth it. I will spend more than $5 on config time alone.
No comment. I don’t wish to anger the MT Gods.
don’t all switches have web config ?
I think it’s much quicker to apply a few checkboxes than to edit a text file in hex. If you really want, you can make some 10-20 standard configuration backup files and then just upload them. Much quicker than editing.
(I don’t think anyone wants to edit a hex file, although I have used Hex Workshop for years, ascii is OK)
Here’s my long winded problem with the SwOS config files:
I install networks that are usually remote. I am not there, there is no “IT guy” there.
I ship equipment to the site to save shipping costs. I design the networks and re-use configs as much as possible.
I “kit up” the job by emailing or posting to a website all the device configs:
“Bob here’s the configs for the Sunshine Ranch project”
MainRouter.rsc
AP21.rsc
AP22.rsc
SW1.cfg
SW2.cfg
APFlash1
APFlash2
etc.
Bob knows how to get the configs into the devices.
My field techs are good, but they are not network engineers. They are installers and very good at it.
They know enough and we have given them the tools to be able to unbox and then winbox/web/console/tftp/etc and install.
Fast, cost effective and excellent results.
I can almost script the install down to when and where each component gets installed and config’d.
As much as I like the idea of a low cost vlan capable switch, it will cost more in the long run if I can’t have a field tech quickly paste a config file into it and screw it to the wall.
It’s just that simple.
You might think that I could simply make the switch config sitting at my desk, but that is not feasible.
I will spend more in time setting it up (where is the power supply?) than it is worth.
With an [ascii] human readable text based config, I can cut and paste and have a config done in about a minute as I’m sure lots of others on this forum can. Once you work with configs long enough it is like the Matrix, you can read it quickly.
For ROS, I put a handful of variables near the top that I can change quickly: IP/GW/PW/ID
Once the main router is up, I can use it to tweak anything else.
This is a real scenario - for me at least. I’m a lean shop and I need my new install done fast and right the first time.
To sum it up, you gave us ROS that had winbox and rsc files and then took it away in SwOS.
SwOS configs are a step backwards as far as I am concerned. It is almost as useless as the bin config file for a consumer router.
Bad decision by MT for me and I expected something different.
Building a brand is a lot about consistency.
But you can already do the same with the backup files! Give your tech 10 different files, each for it’s own scenario. To make the files, you don’t need to write them, just click the appropriate checkboxes, SAVE, then change to another configuration - SAVE again. This way you will have your 10 config files that you can give to your personnel.
Normis,
I appreciate you taking the time to read my post, and reply.
This is a philosophical subject now, as it is clear MT has no intent of making changes, despite multiple users asking for it.
My personal feeling is that consistency in ui is important for a brand.
“It looks, feels and smells like a Mikrotik product.”
By not keeping the ui of ROS in SwOS, I think MT has made a mistake.
As one frequent user on this forum likes to say, “there are lots of ways to do it…”.
As for config files, in practice there are very few standard configs. Nearly everything is custom.
And I don’t want my “installer” (!tech) to think about which config file is which. They get paid to pull cable, terminate and plug in.
Besides, how would I name the 10 files so I remember which config is which? I can’t put the full config as the filename…and I can’t remember where I put my keys.
It is much easier, faster and logical to have a config file that can be edited and then sent to an installer:
RB450G_MPOE.rsc
RB250GS_Building1.cfg
RB250GS_Building2.cfg
RB250GS_Building3_1.cfg
RB250GS_Building3_2.cfg
And if during the install a problem is found with the physical layer, the config can be quickly changed and emailed to the installer or ftp’d to a RB.
I guess I could always write a config converter app.
Is the config file format published?
We can confirm Dude still loosing SMNP connection to RB250GS devices continously.
We can confirm loosing ability to ping TO devices at random times, the devices still reachable via http, only pings stop responding, and after a few minutes they start responding again, bridged plain network, not a NAT or routing problem.
Currently we have 2 RB250GS on our network both behave similar.
Ver. 1.2
Any ideas or updates on this?
+1
Update, sometimes (most of the time) HTTP access is also unavailable.
For the ping issue, I added static arp entries for the switches in the RB450G and I have not missed a ping since that time using netwatch.
This may help other access issues as well?
Thanks for the TIP, I’ll do that… but that should be fixed by MTIK, I guess… isn’t it?
JB
No they don’t.
It’s not easy or quick to click, because you need to hawe X interface etc, and this is hard to create such conf by scripts.
If you don’t want to create CLI, maybe there is way to make the backup file in some human editable form anf create tftp acces to maintain the conf file on the switch?
No they don’t.
Maybe it’s easy to click some checbox but with few switches, not with hundreds of ports 
And this hard and impractical to make configuration changes drought scripts.
If you are so much against CLI, then maybe you can make the backup file “human editable” so there will by way of creating conf “by hand” or script and uploading it to switch by tftp or sth. similar.
I don’t understand your point
What is so hard in making predefined config files and then just forget about the web interface?
Why edit the files by hand every time, when you can have predefined setting files that need no editing? just pick the config you need.
Although I don’t have this problem directly, I will throw in my thoughts (for what it’s worth):
RouterOS has a CLI with ways to access it, and a built-in scripting language to configure things. This has helped in standardizing configuration, and in some cases to create “templates” for multiple devices.
When SwOS came, there were much speculation about it having a CLI, or at least a scripting language of some sort. At least Winbox. Since none of this is the case, what is SwOS doing in the well-known Mikrotik “style” of operating systems (aka RouterOS). As a previous poster said, it’s all about consistency. I’m going to be blunt here: Cost means a little, but stability and consistency can mean the death of a company as we know it.
Mikrotik, please focus on these issues, instead of price as much. Cheaper isn’t better in all cases. After all, we are real network admins/engineers who do real work pushing important data across our devices. It’s much more important that we have solid hardware with few bug/few features that work very well.
I truly believe, in this market with lots of manufactures of network OS’s and hardware, Mikrotik should be more open in it’s design. Things like, “how would you like to improve config management?” You will get lots of suggestions, but at least they will be from the users who have been through the trenches to make this stuff work.
Just my thoughts (getting tired though).
Because I would have to create config for every possible situation.
If I would like to connect every customer to different vlan let say with the same id that he has in my database
(lets not consider neither it’s good or bad idea for now 
)How can I predefine the config if I don’t know what id would have potential customer etc. etc.
The point is that there are conf. that cannot be predefined(or predefining them makes no sense) but can be easily scripted through templates etc.
Of course you can always create web parser that will “click out” these conf for you but why go around, if?
@Normis.
We agree to disagree? Cool? I hate to upset the hand that feeds my need for mt products.
@dssmiktik
My thoughts exactly. MT should decide what it wants to be when it grows up. ROS was a nice start, now follow it through.
“SwOS”, as it is branded, is not an OS.
It is an interface to an asic based router chip, the TF470
http://www.taifatech.com/Files/TF470_Product_Brief_02.pdf
An interesting device, by the way. 200Mbps WAN-LAN throughput.
The hardware does all the work, not the software.
This may be part of the reason there is no winbox, etc. BUT, the chip does have a serial port!
Perhaps a few more $$ would have given us winbox, ssh and telnet, console…
Ditto.
Besides, what would I name the “variant” files?
Example: “10.10.1.xxx_p1_t_v10:15_p2_v11u_p3v12u_p4_v13u_p5_t_v10,16:20.cfg”
At some point the entire config is in the filename. I can’t add comments that I can later search and I can’t even read the files to find out what they do.
variant1.cfg, variant2.cfg, variant3.cfg will mean nothing a few days after I create them