Manual

CCR2004-16G-2S+

Sixteen gigabit ports, two 10-gigabit SFP+ cages and memory enough for a full routing table.

The CCR2004-16G-2S+ is the smallest Cloud Core Router you put in a rack and then forget about. It is meant for the place where routing is the actual work: an office or building with a lot of wired ports, an uplink faster than a gigabit, and a firewall or VPN that keeps going all day. For a house it is too much machine. For a building with thirty people and a server cabinet it is about right.

The ports

The catalogue lists eighteen interfaces on this model:

  • ether1 through ether16 — sixteen gigabit ports. In the configurator ether1 is the default WAN port; the rest are yours to use as LAN ports, as a trunk to a switch, or as routed interfaces.
  • sfp-sfpplus1 and sfp-sfpplus2 — two 10 Gbit SFP+ cages. This is where your uplink belongs, or the trunk to your switch. A 10 Gbit trunk between router and switch is the difference between a network that keeps up and a network where everyone queues behind everyone else.

There is no PoE-out on this model. Access points and cameras need their own injector or a PoE switch; a CRS328-24P next to it settles that in one go. How the tool writes PoE is in PoE-out.

What is inside

From the catalogue: a 64-bit ARM processor, 4 GB of RAM, an 88E6191X switch chip and a level 6 RouterOS licence. There are no radios, so no Wi-Fi. The data for this model has been checked against real hardware.

That 4 GB is the number that matters. It is why this board can hold a full BGP table, keep a large connection table without running into trouble, and still have room for a container beside it. Level 6 is the top licence level, so you will not hit a cap on tunnels or sessions. What a licence level actually limits is in RouterOS licences.

What it is good at, and where it runs out

Good at: routing and filtering with many simultaneous connections, terminating a 10 Gbit uplink, VPN tunnels, OSPF or BGP towards another site or a provider, and a firewall longer than ten rules.

Where it runs out:

  • No Wi-Fi. The tool blocks every wireless role on this model with "No wifi radio". Wi-Fi here comes from access points beside it, managed centrally through CAPsMAN if you want.
  • No PoE-out. See above.
  • Sixteen ports at 1 Gbit. That is a lot of ports, but they are gigabit ports. If you want 10 Gbit to several machines you need a switch as well; the two SFP+ cages are uplinks, not a switching fabric.
  • Throughput is not port speed. Two 10 Gbit ports does not mean you route 20 Gbit. What you get depends on your firewall rules, whether fasttrack is on, and how many connections are open.

Which roles fit

  • Core router (CCR / RB5009) — routed interfaces without a bridge, OSPF and BGP, static routes, a strict management ACL. Note that this role deliberately turns NAT and fasttrack off. That is right for a real core router and wrong for an office router that only has to share an internet connection.
  • Office router with VLANs — the role you want in most buildings: VLANs for office, guests, IoT and management, a trunk to the switch, isolation in the firewall.
  • VPN gateway — office router plus WireGuard, with ready-made client configurations.
  • Hotspot / guest portal — when a captive portal has to be part of it.
  • Harden only — for a CCR that already runs and that you do not want to rebuild.

The quickest route to a working script

Pick the model, pick Office router with VLANs and walk through the wizard. Set your uplink to sfp-sfpplus1 if that is where it arrives, leave the last port as the trunk to your switch, and mark one VLAN as the management VLAN. The remaining gigabit ports become access ports on your first VLAN. What every setting in the VLAN step decides is in VLANs.

If this is a core router with OSPF or BGP, pick the Core router role and read OSPF or BGP before you fill in the numbers. If the CCR sits in a site with a switch and access points, start at Multiple devices: then every device shares the same VLANs and the same password, and you get checks across the whole site.

What trips people up

  • Picking the Core router role for an ordinary office. No NAT means no internet for your LAN. If you want a normal router, pick Office router or Home router.
  • SFP+ without the right module. An SFP+ cage does nothing without a module that matches your cable. After pasting, check with /interface ethernet print that the port really came up at 10 Gbit.
  • Leaving the uplink on ether1 when it arrives on SFP+. The tool sets ether1 as WAN by default. Change it in the WAN step, or your fastest port ends up in the LAN and your internet on a gigabit port.
  • Pasting while sitting on a port you are rebuilding. Make sure your management session comes in on a port the script does not touch, or keep /system reboot without saving as your way back. See Using the script.
  • Expecting the switch chip to solve everything. This is a router. Traffic that crosses the firewall or moves between VLANs goes through the CPU. That is exactly what the 4 GB and the processor are for, but do not assume a bridge across sixteen ports is free.

Want to try it right away? Open the configurator