Community discussions

 
SpartanX
just joined
Topic Author
Posts: 22
Joined: Mon Jun 27, 2016 6:13 pm

Can RouterOS replace my Cisco 1841?

Mon Jun 27, 2016 10:51 pm

RouterOS Newb alert... ;)

I'm about to upgrade from ADSL to 80/20Mbps Fibre on Plusnet. My current setup follows; it's probably a bit unusual. What I need to know is if I can replace the Cisco 1841 with a RouterOS based device doing the same job. Probably a RouterBoard; I can't be bothered building PCs any more. I just want something that works pretty-much out of the box (+/- configuring).

I have a Zyxel VMG8324 on the way which will probably see duty just as a modem; ideally as a stand-alone L3 bridge with just a public IP address that handles the PPPoA connection itself, like I have my Bintec configured. If I can't make it do that, then just a dumb modem driven by the router.

I have:
  • /29 routed subnet over ADSL. Call the subnet x.0/29. Will be replaced with faster FTTC VDSL2.
  • A huge IPv6 global unicast range from Hurricane Electric.
  • A L3 3560G switch that I can use to break out VLANs if needed, and some local interVLAN routing to take pressure of the router.
Trying to simplify what I want from the router:
  • Control the modem and make PPPox connection if necessary.
  • WAN-side router port with an ACL to forward incoming server traffic and stateful firewall.
  • Applying the protection directly to this port should provide protection for all the following:
  • Bridge the WAN port to another port (or VLAN) so I can use a server or two with a public IPv4 address on my public subnet. Did I mention protected by the ACL on the WAN port?
  • Another two ports/VLANs in private IPv4 ranges for my LANs (House LAN and Cisco Lab), NAT/PAT to the main IP address. DHCP and OSPF required.
  • One of the PCs in the above requires static NAT to its own public IPv4 address due to occasional very high traffic.
  • Terminate my HE IPv6IP tunnel on the main IPv4 public interface and route outgoing IPv6 traffic through this tunnel. IPv6 ACLs and Stateful inspection required here.
  • All the above interfaces need IPv6 addresses assigning manually. Plus IPv6 DHCP and OSPFv3.
  • NTP service. Sometimes DNS, but not essential.
My current setup:
  • Bintec ADSL modem/router, configured with WAN and LAN bridged but still doing the PPPoA connection itself. It takes a single, manually configured public address (x.1) and routes to my ISP. It is the default gateway for everything else on this subnet.
  • Cisco 1841 connected to the Bintec's bridged LAN port. I call this Cisco's RED port.
  • The RED port has no IP address. It is a member of a bridge group along with a VLAN and the bridge has IPv4 address x.2 and a manually configured IPv6 address on my global unicast range from HE.
  • The RED port itself has an ACL to forward allowed traffic for my servers and an Inspect-Out configuration for stateful firewalling for all traffic entering via the RED port.
  • Another port is a member of the above bridged VLAN and allows connectivity on the public subnet to a server, giving it a firewalled connection with a public IP address (x.3).
  • The bridge interface is the outside NAT for other VLANs (below).
  • A second VLAN exists in the IPv4 subnet 192.168.1.0/24 and a subnet on my IPv6 range, with IPv4 NAT/PAT (using the bridge IP address) for my main LAN. It also has one static NAT to another public IP address (x.4) for a specific PC on the 192.168.1.0 subnet.
  • A third VLAN, similar to above but a different range, for my Lab. Again both IPv4 and IPv6.
  • An IPV6IP tunnel terminates on the bridge's interface, for my HE IPv6 service. This is where any IPv6 traffic destined for outside routes through. ACL and Inspection applied here.
  • DHCP on the LAN VLANs for IPv4 and IPv6.
  • OSPFv2 and v3 on internal interfaces.
  • NTP client and server.
  • Sometimes DNS server.
So... Can RouterOS replace my Cisco 1841? I doubt it can cope with 80MBps although it does admirably with my ADSL. I can't afford a new Cisco router and the 28xx series in my lab are too big and noisy to run all the time.
 
SpartanX
just joined
Topic Author
Posts: 22
Joined: Mon Jun 27, 2016 6:13 pm

Re: Can RouterOS replace my Cisco 1841?

Tue Jun 28, 2016 1:09 am

Possibly answering my own question... I've just installed RouterOS on an ESXi host. It seems to be failing at the first test.

Using the web interface, I've done simple config with my public IP on ether1 (seems fixed as the WAN port) and private range on ether2. Fine so far.

I create a bridge, and add ether3 and ether1 to extend my public network onto ether3. As soon as I do that, the mode (on the Quick Set page) changes from Router to Bridge. If I set it back to Router, ether1 is disabled in the bridge config.

So, is it not possible to do simultaneous routing and bridging on the WAN port? I've tried searching, but even though I included RouterOs in the search terms, most of the results tell me about IRB on Cisco. I know that... it's what my 1841 is doing. Or am I missing something? (I hope I am)
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: Can RouterOS replace my Cisco 1841?

Tue Jun 28, 2016 4:37 am

It's very possible to simultaneously route and bridge the WAN connection.
The part that's not obvious to a novice ROS user is that whenever you add interfaces to a bridge, it converts them into layer 2 interfaces, and the bridge interface is now the layer3 interface - in other words, the public IP address should be moved from ether1 onto the WAN bridge you created, and any firewall rules / nat rules / etc should all have any references to ether1 changed to be references to the WAN bridge interface instead.
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
SpartanX
just joined
Topic Author
Posts: 22
Joined: Mon Jun 27, 2016 6:13 pm

Re: Can RouterOS replace my Cisco 1841?

Tue Jun 28, 2016 2:24 pm

Ah-ha - thank you!

That's what I was expecting, but I could not see a way to assign an IP address to my bridge. I should have dug a little deeper before asking. Or just got some sleep, which I did.

IP->Addresses is the answer! (I don't know how I missed that, but I did).

The one thing I could never get my 1841 to do was dial the PPPoE modem, and let me bridge the dialer interface to my VLAN instead of the physical WAN port. Hence my odd config on the Bintec to have it dial itself. It seemed perfectly simple, but whenever I tried to configure it that way, I completely lost routing. If RouterOS can do this, it will be beating IOS. I always suspected a bug in IOS's IRB because of its failure there.

Anyway, I'll continue testing :)
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: Can RouterOS replace my Cisco 1841?

Tue Jun 28, 2016 6:37 pm

You can easily do this - instead of adding the ether1 interface to the WAN bridge, just add the pppoe1-out interface.
(if you bridge ether1, then anything else attached to the bridge would need to also use pppoe to make connections to the Internet)

When you create a bridge, you've essentially created a "dumb switch" - and when you assign ports to it, you're making those ports behave as if they're interfaces on this virtual switch.
If you connect the ether1 port to it, then the raw ether1 connection is what goes onto the bridge, but if you connect the pppoe interface (dialer) then the IP layer of that pppoe interface goes onto the bridge.... but of course the PPPoE connection needs to have more available IP addresses on it.

If you're getting a public /29 (for instance) then bridging isn't really what you need to do. Just make a "DMZ" interface/bridge, and put your local IP from the PPPoE connection directly onto that.
e.g. 192.0.2.33/29 -> interface DMZ (don't connect the pppoe interface to the bridge - this is a routed connection)

Now, anything else connected to the DMZ interface will be able to use 192.0.2.33 as its default GW. Your default GW route in the router should just point to interface pppoe1-out (or whatever IP the ISP's router is using, which need not be part of the 192.0.2.32/29 network)
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
SpartanX
just joined
Topic Author
Posts: 22
Joined: Mon Jun 27, 2016 6:13 pm

Re: Can RouterOS replace my Cisco 1841?

Wed Jun 29, 2016 6:55 pm

Thanks for that - I've just come back here and that's exactly what I've been trying to do.

The web gui did not give pppoe-out1 (I'm using the default names in my config) as an option to add to the bridge, so I tried the command line:
[admin@MikroTik] /interface bridge port> add bridge=bridge1 interface=pppoe-out1
failure: pppoe-out1 is not allowed to be put in bridge
This is the sort of place that the Cisco always failed, although it gave no error. It just stopped routing.

I have a few RouterOS instances set up. One is configured as a PPPoE server, the next as Client that gives the above error. It all works if I just have the PPPoE Client on the physical port (or even the bridge which I tried just out of curiosity, but as you say, it's pointless bridging the PPPoE itself)

So... what am I missing here?

Just adding: Everything else seems to be working fine... ACLs (Filters) on the bridged incoming port (not including the PPPoE troubles), IPv6 tunnel termination and filters there... all good. It's just a learning curve figuring out the commands. I think it's just the PPPoE left to sort out.
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 5942
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: Can RouterOS replace my Cisco 1841?

Wed Jun 29, 2016 7:15 pm

PPP bridging works only if BCP protocol is enabled, and BCP must be enabled on both client and server
http://wiki.mikrotik.com/wiki/Manual:BC ... _bridging)
 
SpartanX
just joined
Topic Author
Posts: 22
Joined: Mon Jun 27, 2016 6:13 pm

Re: Can RouterOS replace my Cisco 1841?

Wed Jun 29, 2016 7:31 pm

Ahh.. BCP... that explains that then, thank you. Never heard of that one. By the way, that manual page is blank, not that it matters. I very much doubt my ISP will turn on BCP for me (although I think I'll ask on the forum, just to enjoy the blank stares :) ). Back to the drawing board.

@ZeroByte, As I was just thinking anyway, your signature phrase is quite appropriate. I'm not sure exactly what you are suggesting though.

Do you mean to put the IP address assigned to the PPPoE dialer onto this 'DMZ' interface, as well as having it on the dailer still? That's actually exactly what I did to my Bintec modem/router to make it transparent, but I always thought it was a bit dodgy having the same IP address assigned to two interfaces.

Who is online

Users browsing this forum: No registered users and 96 guests