Hi all, have old router 1100 and i need to migrate all settings to new 3011, how i can do that right?
I trued to use backup option but it is not work for me. Then i trued to use import/export tool from comand line, but its is still not working for me, some settings be migrate but many functions still not work... Then i true to migrate "by hands" i copied all settings, edit ports, gre, briges and other< but< still not work correctly. Meybe some one have script or instructions how it will be do corectly... Thanks
Re: Migrate from 1100 to 3011
Export is the best option, make sure that the 3011 is Reset to Defaults with No Default Configuration before importing the export file.
Be aware (please check the export file before importing it into the 3011) that the 1100 has more ethernet ports than the 3011. You will have to remove them from the export manually.
Be aware (please check the export file before importing it into the 3011) that the 1100 has more ethernet ports than the 3011. You will have to remove them from the export manually.
First the problem, then the solution
Re: Migrate from 1100 to 3011
There is no "correct" way as the machines are different model (for migration to exactly the same model, backup/restore is permitted and even recommended).
The process is relatively easy if the machines run the same RouterOS version, in that case, export on the 1100 can be copy-pasted line by line to the 3011 previously reset to defaults. Unfortunately, practical experience shows that some incorrect settings which older version of ROS has accepted are happily exported by a current version but not imported. So /system reset-configuration run-after-reset=the-export-from-1100.rsc fails in such case.
If the RouterOS releases are different, the structure of the configuration of same things may look different, and some functionality may not be available in the newer version (like auth-metod=pre-shared-key-xauth with exchange-mode=ike2 has been removed starting with 6.45.something).
As you mention GRE in particular, there was a security patch in 6.45.something which has made the firewall mistreat GRE - received packets whose connection-state is actually new are labeled with connection-state=invalid, so you have to add protocol=!gre to the action=drop connection-state=invalid firewall rule in filter chain input if your firewall is based on the default one, or address that in some other way if it is not.
Just for the sake of completeness, of course you also have to deal with the fact that a 1100 was a 13-port machine whereas the 3011 is a 10-port one, so you have to move any configuration referring to ether11-ether13 to other ports or drop that part completely.
The process is relatively easy if the machines run the same RouterOS version, in that case, export on the 1100 can be copy-pasted line by line to the 3011 previously reset to defaults. Unfortunately, practical experience shows that some incorrect settings which older version of ROS has accepted are happily exported by a current version but not imported. So /system reset-configuration run-after-reset=the-export-from-1100.rsc fails in such case.
If the RouterOS releases are different, the structure of the configuration of same things may look different, and some functionality may not be available in the newer version (like auth-metod=pre-shared-key-xauth with exchange-mode=ike2 has been removed starting with 6.45.something).
As you mention GRE in particular, there was a security patch in 6.45.something which has made the firewall mistreat GRE - received packets whose connection-state is actually new are labeled with connection-state=invalid, so you have to add protocol=!gre to the action=drop connection-state=invalid firewall rule in filter chain input if your firewall is based on the default one, or address that in some other way if it is not.
Just for the sake of completeness, of course you also have to deal with the fact that a 1100 was a 13-port machine whereas the 3011 is a 10-port one, so you have to move any configuration referring to ether11-ether13 to other ports or drop that part completely.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.