MikroTik Invisible Tools. By : Haydar Fadel 2014

Transcription

1 MikroTik Invisible Tools By : Haydar Fadel 2014

2 Tool A tool that allows you to send from the router. It can be used, along with other tools, to send the network administrator regular configuration backups, for example. Tool CLI path /tools

3 , Example Configuring tool parameters: For Gmail configuration: /tool set address= set port=587 set set user=routerid set password=mypassword /tool send server= subject=host-monitor Above script used to verify tool working normally

4 Send Automatic Backup -Tool example will end auto Backup to network administrator. The following steps must be implement : 1. System script and name the script (export-send) /export compact file=export /tool send to= router@doamin.com" subject="$[/system identity get name] " \ body="$[/system clock get date] configuration file" file=export.rsc 2. System schedule /system scheduler add on-event="export-send" start-time=00:00:00 interval=24h name=

5 Send Automatic Backup 1 2

6 Netwatch A tool that allows you to monitor the status of network devices For each entry, you can specify: IP address Ping interval Up and/or Down scripts

7 Netwatch VERY useful to: Be made aware of network failures Automate a change of default gateway, for example, should the main router fail Just to have a quick view of what is up Whatever else you can come up with to simplify and speed up your job (and make you look efficient!)

8 Netwatch Host: IP address of host that should be monitored. Intervals: the time between pings.

9 Netwatch Netwatch Use these scripts: /tool send server= subject=host-monitor Above script used to verify tool working normally Up /tool send to="<your- -address>" subject="$[/system identity get name] Netwatch status" \ body="$[/system clock get date] $[/system clock get time] Node up." Down /tool send to="<your- -address>" subject="$[/system identity get name] Netwatch status" \ body="$[/system clock get date] $[/system clock get time] Node down."

10 Netwatch In this example the Netwatch will monitor specific host and it is will send to network administrator every time where that host will goes down or up.

11 Interface Traffic Monitor The traffic monitor tool is used to run scripts when an interface traffic reaches a certain threshold. Example /tool traffic-monitor add interface=ether1 name=trafficmon1 on-event=script1 threshold= \ traffic=received /system script add name=script1 policy=ftp,read,test,winbox,api source="/tool send to=\"\ YOU@DOMAIN.CA\" subject=([/system identity get name]. \" Log \ \". [/system clock get date]) body=\"hello World. You're going too fast!\""

12 Interface Traffic Monitor 1 3

13 Watchdog This menu allows to configure system to reboot on kernel panic, when an IP address does not respond, or in case the system has locked up. Software watchdog timer is used to provide the last option, so in very rare cases (caused by hardware malfunction) it can lock up by itself. There is a hardware watchdog device available in all RouterBOARD PowerPC and Mipsbe models, which can reboot the system in any case.

14 Watchdog Properties Property watch-address (IP; Default: none) watchdog-timer (yes no; Default: yes) no-ping-delay (time; Default: 5m) automatic-supout (yes no; Default: yes) auto-send-supout (yes no; Default: no) send- -from (string; Default: ) send- -to (string; Default: ) send-smtp-server (string; Default: ) Description The system will reboot in case 6 sequental pings to the given IP address (sent once per 10 seconds) will fail. If set to none this feature is disabled. Whether to reboot if system is unresponsive for a minute Specifies how long after reboot not to test and ping watch-address. The default setting means that if watch-address is set and is not reachable, the router will reboot about every 6 minutes. When software failure happens, a file named "autosupout.rif" is generated automatically. The previous "autosupout.rif" file is renamed to "autosupout.old.rif" After the support output file is automatically generated, it can be sent by address to send the support output file from. If not set, the value set in /tool is used address to send the support output file to. SMTP server address to send the support output file through. If not set, the value set in /tool is used.

15 Watchdog Example

16 Traffic Flow MikroTik Traffic-Flow is a system that provides statistic information about packets which pass through the router. Besides network monitoring and accounting, system administrators can identify various problems that may occur in the network. With help of Traffic-Flow, it is possible to analyze and optimize the overall network performance. As Traffic-Flow is compatible with Cisco NetFlow, it can be used with various utilities which are designed for Cisco's NetFlow.

17 Traffic Flow Traffic-Flow supports the following NetFlow formats: version 1 - the first version of NetFlow data format, do not use it, unless you have to. version 5 - in addition to version 1, version 5 has possibility to inlude BGP AS and flow sequence number information. Currently RouterOS does not include BGP AS numbers. version 9 - a new format which can be extended with new fields and record types thank's to its template-style design.

18 Traffic Flow Sub menu :/ ip traffic-flow This section lists the configuration properties of Traffic-Flow. Property interfaces (string all; Default: all) cache-entries (128k 16k 1k 256k 2k... ; Default: 4k) active-flow-timeout (time; Default: 30m) inactive-flow-timeout (time; Default: 15s) Description Names of those interfaces which will be used to gather statistics for traffic-flow. To specify more than one interface, separate them with a comma. Number of flows which can be in router's memory simultaneously. Maximum life-time of a flow. How long to keep the flow active, if it is idle. If connection does not see any packet within this timeout, then trafficflow will send packet out as new flow. If this timeout is too small it can create significant amount of flows and overflow the buffer.

19 Traffic Flow Note: Starting 6.0rc14 release setting interface will show RX and TX for the interface. Previously traffic-flow reported only RX fraffic for the interface and to see bidirectional data it was required to set up more interfaces.

20 Targets Traffic Flow Sub-menu / ip traffic-flow target With Traffic-Flow targets we specify those hosts which will gather the Traffic-Flow information from router. Property address (IP:port; Default: ) v9-template-refresh (integer; Default: 20) v9-template-timeout (time; Default: ) version (1 5 9; Default: ) Description IP address and port (UDP) of the host which receives Traffic- Flow statistic packets from the router. Number of packets after which the template is sent to the receiving host (only for NetFlow version 9) After how long to send the template, if it has not been sent. Which version format of NetFlow to use

21 Targets Traffic Flow Notes : By looking at packet flow diagram you can see that traffic flow is at the end of input, forward and output chain stack. It means that traffic flow will count only traffic that reaches one of those chains. For example, you set up mirror port on switch, connect mirror port to router and set traffic flow to count mirrored packets. Unfortunately such setup will not work, because mirrored packets are dropped before they reach input chain. Other interfaces will appear in report if traffic is passing through them and monitored interface.

22 Traffic Flow Example This example shows how to configure Traffic-Flow on a router. Enable Traffic-Flow on the router: [admin@haydar-router] > ip traffic-flow set enabled=yes [admin@haydar-router] > ip traffic-flow print enabled: yes interfaces: ether1 cache-entries: 256k active-flow-timeout: 30m inactive-flow-timeout: 15s [admin@haydar-router] >

23 Traffic Flow Example Specify IP address and port of the host, which will receive Traffic-Flow packets: > ip traffic-flow target print Flags: X - disabled # ADDRESS VERSION : [admin@haydar-router] >

24 Traffic Flow Example Now the router starts to send packets with Traffic-Flow information. Some screenshots from NTop program, which has gathered Traffic-Flow information from our router and displays it in nice graphs and statistics. Really I prefer manageengine management. for network programs monitoring and Please visit : For example, where what kind of traffic has flown:

25 Traffic Flow Example

26 Traffic Flow Example

27 Traffic Flow Example

28 Traffic Flow Example

29 Open Flow Overview OpenFlow is an open standard that enables researchers to run experimental protocols in the campus networks we use every day OpenFlow is added as a feature to commercial Ethernet switches, routers and wireless access points and provides a standardized hook to allow researchers to run experiments, without requiring vendors to expose the internal workings of their network devices OpenFlow is currently being implemented by major vendors, with OpenFlow-enabled switches now commercially available.

30 Open Flow Overview What does this really mean, though? You start with an OF switch and a controller. The OF switch is a switch/router/access point that runs the OF client. Most switches have a flow table built from TCAM. This flow table determines which traffic moves where.

31 Open Flow Overview

32 Open Flow Overview OpenFlow(OF) is meant to be a means of testing new routing or forwarding methods to build these flow tables. It is designed to allow for layer 3 or layer 2 forwarding based on: port, MAC, VLAN, TCP header, or IP header. The way it accomplishes this is to establish a secure SSH tunnel between the OF switch and the controller. When a new flow starts, it sends the first packets to the controller. The controller then builds an entry into the flow table to handle the remainder of this connection.

33 Open Flow Overview They also have the ability to segregate the OF flow table from that of the standard switch. The idea is you can choose a handful of ports on a device and have them participate in the OF test. Your controller will then update all of the OF switches in the chain with the new flow information. Since this is a separate flow table the device will continue to process all other traffic based on the standard flow table.

34 Open Flow Overview So long as you can maintain the SSH connectivity to the controller you can write your own proprietary mesh algorithm and have the MTKs use it. You could write your own algorithm that monitors all of your ISP interfaces via SNMP and adjust routing on the fly according to congestion really the sky is the limit at this point. Right now there are really only two commands in the Mikrotik

35 Open Flow Overview

36 Open Flow Implementation Currently RouterOS implements OpenFlow version required features. Support for newer versions, optional features and switching hardware acceleration are to be added. Current implementation should be considered experimental - NOT production ready and is available for evaluation purposes. OpenFlow support is available as standalone openflow package.

37 Open Flow Implementation Due to this care must be taken to not disable access to the device when configuring OpenFlow. Currently only unencrypted TCP is available as the communications channel between RouterOS OpenFlow switch and controller.

38 Open flow Implementation RouterOS supports multiple OpenFlow switch instances, each of which can have separate controller(s) and sets of ports. Switch instance can be added using command: > /openflow add name=ofswitch1 controllers=

39 Open flow Implementation

40 Open flow Implementation > /openflow add name=ofswitch1 controllers= Switch ports can be added using command: > /openflow port add switch=ofswitch1 interface=ether2 > /openflow port add switch=ofswitch1 interface=ether2

41 Traffic Generate Overview Traffic Generator is a tool that allows to evaluate performance of DUT (Device Under Test) or SUT (System Under Test). Tool can generate and send RAW packets over specific ports. It also collects latency and jitter values, tx/rx rates, counts lost packets and detects Out-of-Order (OOO) packets. Traffic Generator can be used similar to bandwidth test tool as well as generate packets that will be routed back to packet generator for advanced status collection.

42 Traffic Generate Overview RouterOS Version 6 introduces a new tool - "traffic generator", which allows to perform performance testing without expensive testing hardware. Traffic is generated from one more router in the network. This article shows necessary configuration and hardware to replicate the tests published in routerboard.com.

43 Traffic Generate Implementation

44 Traffic Generate Implementation

45 Traffic Generate Implementation

46 Traffic Generate Implementation

47 Traffic Generate Implementation

48 Traffic Generate Implementation

49 Traffic Generate Implementation

50 IPsec-Tunnel IPsec Tunnel, Site-to-Site VPN So you have multiple sites that all have internet connections. You want to securely connect the internal subnets together how would one accomplish this? You would use an IPSEC tunnel. Imagine it as a nice secure pipe that connects one site to the other. This tutorial will show you just how this configuration is accomplished.

51 Site 1 MT 1 Step 1: Configuring NAT

52 Site 1 MT 1 Step 1: Configuring NAT

53 Site 1 MT 1 Step1: Configuring NAT Troubleshooting The NAT Rule We created must be the first rule in the Nat configuration.

54 Site 1 MT 1 Step 2: add IPsec Policy 1. src.address will be local network address. 2. dst.address will be destination network.

55 Site 1 MT 1 Step 2: add IPsec Policy 1. SA src.address it s source public IP address. 2. SA dst.address it s destination public IP address.

56 Site 1 MT 1 Step 3: add IPsec Peer Notes : 1. Address it s destination router public IP address. 2. Secret must be match between two public routers. 3. If packet going through any natted devices check NAT Traversal and you will be fine when always check it.

57 Site 1 MT 1 Step4: optionally you can change phase two connection of IPsec

58 Site 2 MT 2 Step 1: Configuring NAT

59 Site 2 MT 2 Step 1: Configuring NAT

60 Site 2 MT 2 Step1: Configuring NAT Troubleshooting The NAT Rule We created must be the first rule in the Nat configuration.

61 Site 2 MT 2 Step 2: add IPsec Policy 1. src.address will be local network address. 2. dst.address will be destination network.

62 Site 2 MT 2 Step 2: add IPsec Policy 1. SA src.address it s source public IP address. 2. SA dst.address it s destination public IP address.

63 Site 2 MT 2 Step 3: add IPsec Peer Notes : 1. Address it s destination router public IP address. 2. Secret must be match between two public routers. 3. If packet going through any natted devices check NAT Traversal and you will be fine when always check it.

64 Site 2 MT 2 Step4: optionally you can change phase two connection of IPsec

65 IPsec Connectivity Check IPsec automatic Peer from Router 1

66 IPsec Connectivity Check Traceroute from Router 2 to LAN 1