The Wiert Corner – irregular stream of stuff

[Wayback/Archive] GitHub – Benewend/mikrotik-config-templates: A comprehensive collection of MikroTik RouterOS scripts and configurations for various networking scenarios. This repository contains tested and documented scripts for basic configurations, security implementations, and monitoring solutions. · GitHub

One missing script is the (very simple) switch configuration, for which I published the RB960PGS hEX PoE one at Factory reset a MikroTik hEX PoE RB960PGS using the reset button and a similar one on [Wayback/Archive] How to use Mikrotik router as a “switch”? – General – MikroTik community forum.

I need to dig into the switching anway as one day, I had trouble getting that to work, and I wasn’t sure if the problem was hardware or software related.

So here are some links, including some on centrally managing configurations:

• [Wayback/Archive] 1.4.2-basic-configuration-with-mikrotik-cli.pdf (pdf)
• [Wayback/Archive] How do you automate your Mikrotik devices configuration? Script? Terraform? : mikrotik
• [Wayback/Archive] Command Line Interface – RouterOS – MikroTik Documentation
• [Wayback/Archive] default Mikrotik configuration script · GitHub
• [Wayback/Archive] Basic Script to Configure a Blank MikroTik Router
• [Wayback/Archive] CRS112-8 Won’t pass DHCP traffic. : mikrotik
  • [Wayback/Archive] Manual:Interface/Bridge – MikroTik Wiki (not sure where this documentation went after September 2024, so quoted in full)
    

    DHCP Snooping and DHCP Option 82

    Sub-menu: /interface bridge /interface bridge port

    Starting from RouterOS version 6.43, bridge supports DHCP Snooping and DHCP Option 82. The DHCP Snooping is a Layer2 security feature, that limits unauthorized DHCP servers from providing a malicious information to users. In RouterOS you can specify which bridge ports are trusted (where known DHCP server resides and DHCP messages should be forwarded) and which are untrusted (usually used for access ports, received DHCP server messages will be dropped). The DHCP Option 82 is an additional information (Agent Circuit ID and Agent Remote ID) provided by DHCP Snooping enabled devices that allows identifying the device itself and DHCP clients.

    

    DHCP Snooping and Option 82 setup

    In this example, SW1 and SW2 are DHCP Snooping and Option 82 enabled devices. First, we need to create a bridge, assign interfaces and mark trusted ports. Use these commands on SW1:

    /interface bridge
    add name=bridge
    /interface bridge port
    add bridge=bridge interface=ether1
    add bridge=bridge interface=ether2 trusted=yes
    

    For SW2 configuration will be similar, but we also need to mark ether1 as trusted, because this interface is going to receive DHCP messages with Option 82 already added. You need to mark all ports as trusted if they are going to receive DHCP messages with added Option 82, otherwise these messages will be dropped. Also, we add ether3 to the same bridge and leave this port untrusted, imagine there is an unauthorized (rogue) DHCP server. Use these commands on SW2:

    /interface bridge
    add name=bridge
    /interface bridge port
    add bridge=bridge interface=ether1 trusted=yes
    add bridge=bridge interface=ether2 trusted=yes
    add bridge=bridge interface=ether3
    

    Then we need to enable DHCP Snooping and Option 82. In case your DHCP server does not support DHCP Option 82 or you do not implement any Option 82 related policies, this option can be disabled. Use these commands on SW1 and SW2:

    /interface bridge
    set [find where name="bridge"] dhcp-snooping=yes add-dhcp-option82=yes
    

    Now both devices will analyze what DHCP messages are received on bridge ports. The SW1 is responsible for adding and removing the DHCP Option 82. The SW2 will limit rogue DHCP server form receiving any discovery messages and drop malicious DHCP server messages from ether3.

    

    Note: Currently only CRS3xx devices fully support hardware DHCP Snooping and Option 82. For CRS1xx and CRS2xx series switches it is possible to use DHCP Snooping along with VLAN switching, but then you must make sure that DHCP packets are sent out with the correct VLAN tag using egress ACL rules. Other devices are capable of using DHCP Snooping and Option 82 features along with hardware offloading, but you must make sure that there is no VLAN related configuration applied on the device, otherwise DHCP Snooping and Option 82 might not work properly. See Bridge Hardware Offloading section with supported features.

• [Wayback/Archive] DHCP Offer not received on other side of trunk [solved] – Beginner Basics – MikroTik community forum (this is about VLANs)
• [Wayback/Archive] Netonix Forums • View topic – DHCP Not passing through Switch

Queries:

• [Wayback/Archive] mikrotik basic switch configuration script at DuckDuckGo
• [Wayback/Archive] download “1.4.2-basic-configuration-with-mikrotik-cli.pdf” at DuckDuckGo
• [Wayback/Archive] routeros dhcp traffic not reaching other side at DuckDuckGo

-–jeroen