Twenty branches with the same design is not twenty rounds of thinking. It is one round of thinking and nineteen careful repetitions, and the mistake you make is nearly always in whatever you fill in by hand per site.
Finish one branch first
Make a site with the equipment of a single branch: the router, the switch, the access points. Fill in the VLAN table, the SSIDs, the management VLAN, and draw the cabling on the network board the way it will be laid everywhere. Generate the scripts and read the checks across the site until nothing is left that you do not understand.
Then install that branch for real and use it for a week. Whatever you run into there you would otherwise run into twenty times. Adjust the design, generate again, and only then start the rollout.
What is the same everywhere
- The VLAN numbers and their names.
- The SSIDs, their security and their passphrase. Those live in the shared settings and reach every access point.
- The firewall, the DNS settings, the time zone, the country.
- The port layout: which port is the trunk, which ports are workstations, where the access point goes.
- The roles and the models. One model per role keeps it simple; a branch with a different model needs a different script, because the port names differ.
What differs per site
| What | Where you fill it in |
|---|---|
| Address range | The location on the board, field Own address range, for example 10.21 |
| Device names | Per device in the site; the identity has to be unique |
| Internet connection | The Internet node on the board: provider, speed, medium |
| PPPoE credentials or a static IP | Per device, WAN section |
| Public address for the tunnel | Per router, field Public address |
| The tunnel to the head office | Right-click the router, Tunnel to |
| Administrator password | One per site, overridable per device |
That last one deserves a decision up front. One password for all twenty branches means a single leaked installer laptop opens everything. The site password applies to every device, but whatever you enter on a device itself wins over it. Choose deliberately: one site password with management over a tunnel, or a password per branch in a password manager.
Two ways to organise it
- Everything in one site, with twenty locations. You get the checks across all branches at once, you can draw the tunnels to the head office on the same board, and the tool warns you when two branches get the same range. The board does get large, and a share link in a URL no longer fits. Save it as a file.
- One site per branch, from the same template. Save the finished first branch as a file, load it again per branch, change the address range and the names, generate, and save the scripts under that branch's name. Tidier per branch, but you lose the check that spots clashing address ranges. Keep a list yourself in that case.
The first shape is the safer one when the branches are connected to each other. The second is more pleasant when each branch stands alone and is installed by a different engineer.
Note that a saved file holds passwords, wifi keys and private keys in plain text. Keep it with the customer records, not in a mailbox or a shared folder.
Preparing the scripts in advance
- Generate all the scripts per branch and use Download all. You get one file per device.
- Put them in a folder per branch, with the branch name in it. An installer pasting the wrong script on the wrong device costs you a drive out there.
- Print the handover sheet per branch. It says which port goes where, which VLAN has which subnet and at which address each device can be reached. That sheet goes in the box.
- Keep the rollback script next to it. It belongs to that one device and that one version of the script.
For branches with a SwOS switch, note that it gets no RouterOS script but a setup sheet and a push script that is in beta. Budget a manual step for it.
On site: the checklist
- Check the model. Is the model in the box the one the script was generated for? Port names differ per model, and a script for a hEX does very little on an RB5009.
- Put the device back to factory defaults. The scripts are written for that. A device the previous installer already half configured gives strange results.
- Check the RouterOS version. The scripts are for v7. Upgrade before you paste, not after.
- Paste in the right order: the router first, then the switch, then the access points. The router hands out the addresses; without it the rest gets nothing.
- Check each management address against the handover sheet. If you cannot reach the switch, do not carry on to the access points.
- Plug a laptop into a workstation port and see whether you get an address from the right VLAN, with the right gateway.
- Test the wifi on both SSIDs and confirm a guest really cannot reach the office network.
- Test the tunnel to the head office, in both directions. Testing one direction is worth an hour of searching.
- Leave the handover sheet behind and sign the branch off with the serial numbers.
What goes wrong in practice
- Forgetting to change the address range. Two branches on the same range works fine until you join them with a tunnel. In one site the tool tells you; in separate files nobody notices.
- The same identity on twenty routers. The check catches that within one site, and it is also the first thing you break in a monitoring system.
- A branch with a different internet connection. PPPoE instead of DHCP, or a static address: that is filled in per branch and tested per branch.
- An engineer pasting a script on the wrong device. One folder per branch, file names carrying the device name, and the handover sheet in the box.
Further reading: Saving and sharing, The handover sheet and A head office with five branches.