NZ Tik

When you have 100+ routers or servers you manage, it is a bit tedious to make a configuration change to all of them manually, especially when that change is exactly the same for all of them. There is tons of software for this scenario. I have used a few different ones in the past, but parallel-ssh (formerly pssh) is what I use for Mikrotik. Example: Need to enable and set primary and secondary ntp servers on 100 devices. First you need to create a text file with all your devices IP addresses, and optionally port and username. 10.10.10.1:22 10.10.10.2:22 10.10.10.3:22 save it as ips.txt for instance, and use the command bellow to blast commands to all listed devices. parallel-ssh -l admin -x "-o  StrictHostKeyChecking=no"  -A -h /home/sam/ips.txt -v -t 10 -o /home/sam "/system ntp client set mode=unicast enabled=yes primary-ntp=1.2.3.4 secondary-ntp=1.2.3.5" Explanation: -l      Specify the user here instead of txt file -A    ...

Although IPSec is an industry standard, there are a few gotchas that crop up when dealing with inter-vendor set ups. Especially involving Cisco. A couple of well known snags include the use of DPD -Cisco does not support this so turn it off. Dynamic policies - I personally like to specify my ipsec policies, but if you want to be able to initiate the tunnel, then this must be done. All you need to specify is the source and destination pairs, and 'untick' or disable Generate Policy. /ip ipsec peer  add address=172.16.2.2/32:500 secret=shhhh send-initial-contact=yes nat-traversal=no hash-algorithm=md5 enc-algorithm=3des auth-method=pre-shared-key dh-group=modp1024 generate-policy=no exchange-mode=main /ip ipsec policy add src-address=10.10.10.0/24:any dst-address=10.20.20.0/24:any sa-src-address=172.16.1.1 sa-dst-address=172.16.2.1 proposal=default disabled=no tunnel=yes src-address=10.10.10.0/24:any dst-address=10.30.30.0/24:any sa-src-address=172.16.1.1 sa-dst-add...

By default when configuring OSPF on a Mikrotik router, it will be a broadcast network type. This will work for most situations, but it uses multicasting to communicate with other ospf nodes on the network segment. For this reason it is recommended to use network type NBMA or Non Broadcast Multi Access for wireless network segments. This requires more configuration, such as specifying the neighbors manually and setting priorities. The reason NBMA is recommended is because in  802.11 wireless networks multicast packets are not always reliably delivered (read   Multicast in wireless networks   for details); using multicast here can create OSPF stability problems. Neighbors are created dynamically when you specify broadcast as the network type. If you create an NBMA neighbor and add a new OSPF interface with network type NBMA, then this will take place of the broadcast neighbor configuration. Example configuration (from MikroTik wiki) ...

Mikrotik support /31 addressing across p2p links between 2 Mikrotik interfaces. This is useful for conserving address space. As you probably know, usually a subnet's network and broadcast addresses are unusable. That means for a p2p link, we need 2 x usable addresses - or a /30 which is a chunk of 4 addresses! So for every link we waste 2 valuable addresses. No good if you are using public address space and have a limited number. It's not so critical if you are using a private range obviously - but it does make it nice and tidy :) For example: In the above example, it uses 4 addresses - 10.20.20.12 (network) 10.20.20.13 (usable) 10.20.20.14 (usable) 10.20.20.15 (broadcast) We can split this into 2 x /31 by making the address of the local router the network address and the remote end the broadcast. R1 /ip address add address=10.20.20.12/31 interface=ether1 network=10.20.20.13 broadcast=10.20.20.12 R2 /ip address add address=10.20.20.13/31 interface=ether1 ...

A common way to backup routeros is to use a script on each device that saves the config and emails it to a dedicated mailbox. Although this works as advertised, I prefer this centralised approach that pulls the configuration from each device. The method I chose was to backup each device using FTP to a central server. Yes there is some configuration required on each device, but once set up, it's definitely a set and forget solution. This requires routerOS on x86 platform - the free 'demo' license will do :) No fancy-pants features, just some basic IP addressing. This works perfectly as a virtual machine. In my case, ESXi. Create a VM with enough storage for all your backups. Basically, you create a CSV file of all your devices and IP addresses. The script below will ftp to each entry and GET the backup file appropriately named 'HOSTNAME.backup'. It will just overwrite the last one, but it would be easy to change this behaviour and have it append. ...

The history of system configuration changes is held until the next router shutdown. The invoked commands can be 'undone' using the /undo command. By invoking the command several times, the configuration changes can be 'undone' in reverse order they have been invoked. Use the /system history print command to see the list of performed actions: [MikroTik] system history> print Flags: U - undoable, R - redoable, F - floating-undo    ACTION                                   BY            POLICY           U nat rule changed                         admin         write            U nat rule changed                         admin         write ...

Extend USB up to 45 meters over cat5e/6. I was wanting to get my big ugly printer off the desk next to the computer and put it in another room. I don't have the luxury of a wireless printer. This would be perfect. http://www.monoprice.com/products/product.asp?c_id=103&cp_id=10303&cs_id=1030304&p_id=6042&seq=1&format=2