Devices and sites

Devices and sites

Publishing…Source of truth: mikrotik-dashboard/inventory.json. REST is allow-listed to hp02. Addresses below are the management IPs the dashboard uses (vlan89 10.9.8.x first).

L3 routers

Role Device OOB Notes Core CCR2116-12G-4S+ 10.9.8.252 RSTP root of production (0x1000). OSPF RID 10.255.255.16. Standby core-sb (CHR on hp02) 10.9.8.251 VRRP backup, OSPF vlan34/36. Primary WAN CCR2004 Quickline 10.9.8.200 OSPF vlan33 cost 10 + BFD. WAN on CRS317. Backup WAN CCR2004 Wingo 10.9.8.216 OSPF vlan32 cost 20 + BFD. Mgmt island CCR2004-16G-2S+ 10.9.8.1 vlan89 gateway, own WAN, WireGuard 10.9.9.1.

Switch fabric

Role Device OOB STP ISP switch CRS317-1G-16S+ 10.9.8.212 vlan448 island root Spine CRS326-24S+2Q+_A 10.9.8.205 production 0x2000 Access-core CRS326-24S+2Q+_C 10.9.8.213 production 0x3000; servers, UniFi, garage, core-sb trunk Copper access CRS326-24G-2S+ 10.9.8.249 vlan50 / vlan62 / vlan59 Desk CRS310-8G+2S+ 10.9.8.203 work / IoT / brother PoE (vlan448 + OOB) CRS418-8P-8G-2S+ 10.9.8.204 access Mgmt fabric CRS309-1G-8S+ 10.9.8.210 vlan89 star Mgmt PoE CRS328-24P-4S+ 10.9.8.232 hp02 mgmt, iLO, NanoKVM, hex-ci Mgmt leaf CRS305-1G-4S+ 10.9.8.202 vlan89

Servers and DNS

Host Addresses What it is hp02 172.16.62.253 vlan62, 10.9.8.253 vlan89 Dashboard :8787, Gitea :3030, CHR labs, syslog, backups. Only host allowed to hit RouterOS REST. iLO 10.9.8.218. hp04 172.16.62.40 vlan62 and 213.221.211.30/28 public Workspace + CI runners. Cannot reach vlan89. Must not forward public ↔ LAN. iLO 10.9.8.224. mag01 172.16.62.246 CI lab runner (lab label). apu01 10.9.8.206 / 192.168.53.3 / wg0 172.16.75.1 Unbound + FRR. SSH bodo. DNS APUs. apu02 10.9.8.207 / 192.168.53.2 Same without wg-home. NanoKVM 10.9.8.225 / .229 / .230 OOB console.

CPE and lab hardware

Device Address Notes hEX S garage 172.16.99.69 Trunk vlan58/59/99 to CRS326-C sfp14. ether2 = Luxtronik. REST from hp02's vlan62 address (no vlan89 route). Luxtronik 172.16.58.10 Isolated on vlan58. Path attested on /pathproof. hex-ci 10.9.8.240 Physical hEX lab on vlan89. Agents may reconfigure it. Dual uplink into CRS328, RSTP blocks one. Rescue 192.168.88.1. hex-ci2 10.9.8.241 Same pattern, CRS328 ether7/8.

Lab networks on chrlab/fwlab stay in 198.18.0.0/15 (and the other documentation prefixes). Never put a lab bridge on 10.9.8.0/24, 172.16.0.0/12, 192.168.53.0/24, or 100.64.0.0/10.

Remote sites

Reached from hp02's production NIC, not vlan89.

Site Prefix / CPE Path hex_51 172.16.52.1 Quickline WG / EoIP; prefixes also via apu01 OSPF hex_19 172.16.18.1 Same hex_81 213.221.211.19 On the vlan448 public segment

/sites is the live tunnel view (peers, last handshake). A leftover NEVER peer is a display bug, not a down site.

Operator surfaces

Surface URL Use Overview http://172.16.62.253:8787/overview Fleet health, issues, WAN, DNS, pathproof VLAN plan http://172.16.62.253:8787/vlanplan Intent vs live bridges WAN http://172.16.62.253:8787/wan Which ISP, canary Sites http://172.16.62.253:8787/sites Remote tunnels SFP / optics http://172.16.62.253:8787/sfp DDM, path loss DNS / APU http://172.16.62.253:8787/dns · /apu Anycast probes; metrics over SSH after HOST-APU-01 Gitea http://172.16.62.253:3030/bodo/mikrotik-dashboard Issues, PRs, CI Grafana APUs http://10.9.8.206:3000/ · http://10.9.8.207:3000/ vlan89 only

Related books

DNS APUs — Unbound anycast, self-heal, listen map Fiber at home — splice plant, FHD boxes, 2020 rack photos Network — historical iWay / t-online / DrayTek, not this fabric

Rules that do not change because a page exists

Agents never write production routers. Deliverable is a dry-run script plus a one-liner for bodo. hp02 is the jump host. This book is the picture, not a change ticket.