The router worked, so you pasted the script for the switch. Or for the access point. Straight afterwards the device is gone: it does not answer on the address in the handover sheet, it is no longer in WinBox, and the Wi-Fi that was there a minute ago has vanished.
This is a different problem from locking yourself out of the router. There you lost the way to the device that routes; here it is a device with no route of its own, entirely dependent on what the router and the cable in between let through.
The quick checks, in this order
- Does the router still see it? On the router:
/ip neighbor print. A good answer: the device is listed, with its identity and the port it hangs on. If it is there, layer 2 is fine and the problem is the address or the VLAN. If it is not, look at the cable first. - Which address should it have? Look in that device's script, or in the handover sheet. Inside a site every device gets a fixed address in the management VLAN: the router itself, then the second device, then the third. Ping that address from the router.
- Is the port towards it a trunk? On the router:
/interface bridge vlan print. A good answer: the port to the switch is undertaggedfor the management VLAN. An access port passes one VLAN, untagged, and tagged management traffic never leaves it. - Does the device carry the management VLAN? Search its script for an
/interface vlanline with the management VLAN and an/ip addressline on it. If that is missing, the device has no address in the network you are looking on. - Are you allowed in? With "management VLAN only" on, or Management allowed from limited to the management VLAN, an ordinary desk deliberately cannot reach it. Try from the router itself with
/tool tracerouteor a plain ping.
If you still cannot get in, MAC WinBox is what is left: open WinBox, the Neighbors tab, double-click the MAC address. That works as long as you are in the same layer-2 network.
The usual causes
- The device does not carry the management VLAN. The most common mistake in a site with VLANs. The device does build a configuration, but has no address in the network you manage on.
- The port towards it stayed an access port. That happens when the device is not in the cabling on the board: the tool then has to guess the trunk port, and guesses the port that suits the role.
- Two devices with the same address. Give two devices the same management address by hand and sometimes one answers, sometimes the other.
- Two devices with the same name. The name becomes
/system identity, which is what WinBox neighbours and CAPsMAN match on. Two "sw-01" entries make all of that unreadable. - No gateway on the device. A switch without a WAN needs a gateway to be managed from another network, and for updates and NTP.
What the configurator does about it
This is exactly what the site checks are for. A device that does not carry the management VLAN is an error: does not carry management VLAN 10 and cannot be managed. A device that carries no VLAN at all is an error too. And when a VLAN stops at a cable because one end knows it and the other does not, the tool names the cable and both ports. See Checks about VLANs.
A device that is not in the cabling gets a note: not in the cabling, so the trunk port there is still a guess. Draw the cable on the network board and the trunk lands on the port you really use, with a comment saying what is on the other end. See Checks about cabling.
The management address itself is handed out for you inside a site: if the management VLAN has an address, every following device gets the next address in it, fixed, with the router as gateway and no DHCP. Two devices with the same address, or the same name, are both errors in the site check.
What the tool does not do is check whether a switch you did not put in the site passes the management VLAN. Anything not on the board does not exist as far as the checks are concerned.
When it is not your router
- Another vendor's switch in between. It has its own VLAN table and has to pass the management VLAN tagged on both ports.
- The device runs SwOS. Then there is no RouterOS script but a setup sheet and a push script in beta. See SwOS.
- Power. An access point on PoE that sits slightly over budget boots, drops, boots again. Look at the light before diving into the configuration.
Further reading: Several devices in one site, VLANs and Management access.