Community discussions

MikroTik App
 
Charg
newbie
Topic Author
Posts: 30
Joined: Wed Apr 07, 2021 11:49 am

How to properly manage multiple mikrotik routers?

Tue Oct 05, 2021 8:55 am

So my org plans on deploying mikrotiks in our retail shops across the country, so we'll end up having about 100 of routers all of which are remote.

What is the proper way of managing them? I.e. making sure some parts of config are more or less synchonized, routeros version control and stuff like that? Like maybe there's some kind of controller-like software?
 
erlinden
Forum Guru
Forum Guru
Posts: 1920
Joined: Wed Jun 12, 2013 1:59 pm
Location: Netherlands

Re: How to properly manage multiple mikrotik routers?

Tue Oct 05, 2021 9:13 am

Are you aware of The Dude and its functionality?

https://mikrotik.com/thedude
 
Charg
newbie
Topic Author
Posts: 30
Joined: Wed Apr 07, 2021 11:49 am

Re: How to properly manage multiple mikrotik routers?

Tue Oct 05, 2021 9:48 am

Are you aware of The Dude and its functionality?

https://mikrotik.com/thedude
I am not, but description inclines that this software is for devices within your own LAN, which is not the case for me as all the devices are going to be remote, even sometimes behind shitty ISP NAT.
Unless I'm wrong about 'devices within LAN' part?
 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 11982
Joined: Tue Feb 25, 2014 12:49 pm
Location: Italy
Contact:

Re: How to properly manage multiple mikrotik routers?

Tue Oct 05, 2021 4:19 pm

The Dude work perfectly also on remote devices, also by VPN...

If you have at least one public IP, you can make VPN between all remote devices and the Router with public IP.
If that link is for administrative purpose only (not for link the shops) you can, with proper config, "see" all remote routers on winbox and you manage what you want.

Obviously some rigid rules must be followed like:

"Open" winbox and ssh services only on remote vpn (accept only on local reserved physical ethernet port or from well knowed remote static IP)
Do not use same password for each device, if only one is compromised, all is compromised...
Delete the user admin after create another, but do not use "standard" names like root, ubnt, sysadmin, etc.
Use one "downgraded" user for remote access, and use the privileged user just only when strictly needed
Use complex password
Do not use RouterOS below 6.47.10, too much knowed hack...
Do not use RouterOS beta or release candidate
Do not reboot router uselessly
Do not do auto-upgrade
Do not save credentials on winbox adress list if the PC is not a "desktop"
Do not save credentials on USB
Do not put export on forum (hide-sensitive or not) untill you have read and understand the leaking risk of each line.
Do not follow rules :lol:
 
tmarch
just joined
Posts: 3
Joined: Tue Oct 05, 2021 6:53 pm
Location: Austria

Re: How to properly manage multiple mikrotik routers?

Tue Oct 05, 2021 7:14 pm

Hi, here's the way i do it:

I create a scripted Template. Most company's have some sort of ID or number for their offices. I try to derive most unique parameters from that ID. (like Loopback IP's, internal LANs, Router ID, ....)
If no such ID exist's you can just number them from how you like.
In the scripts header are some variables that are unique to each office (ID, Public IP, IPsec Secrets, users and passwords).
For every new office, i copy the Template and fill in what's needed.

Also I make sure that mostly everything is commented. It makes changes a lot easier.

For changes and additions I use Ansible. 1 Playbook per change.
You can also create 1 playbook which includes all the other playbooks in order. So it's easy to setup a new branch office with the same configuration as every other office.
Also in case of a hardware failure it's easy to setup a replacement router within minutes.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19099
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: How to properly manage multiple mikrotik routers?

Tue Nov 16, 2021 7:52 pm

I use wireguard to access my routers remotely. (just a few).
I use winbox remote as a backup router access to my wireguard setup.
Its SSTP vpn which is okay for my home but not really good enough for a business, but it attempts to centralize access, so thats a bonus.
Dude seems like one to one connections for everything and for 100 devices that has to be tedious (old skool).
 
Charg
newbie
Topic Author
Posts: 30
Joined: Wed Apr 07, 2021 11:49 am

Re: How to properly manage multiple mikrotik routers?

Tue Dec 14, 2021 10:00 am

Cloud-based router management sounds really bad, as in do I trust some random developers with entering creds to all my devices? No way.

Who is online

Users browsing this forum: Bing [Bot], giovanniv and 40 guests