{"id":2764,"date":"2019-01-25T06:21:27","date_gmt":"2019-01-25T06:21:27","guid":{"rendered":"http:\/\/www.mtin.net\/blog\/?p=2764"},"modified":"2019-01-25T06:36:20","modified_gmt":"2019-01-25T06:36:20","slug":"map-installer-toolbox","status":"publish","type":"post","link":"http:\/\/www.mtin.net\/blog\/map-installer-toolbox\/","title":{"rendered":"mAP installer toolbox"},"content":{"rendered":"

One of the problems installers run into on a few networks we manage is having the right tools to properly test a new install. Sure, an installer can run a test to speedtest.net to verify customers are getting their speed.\u00a0 Anyone who has done this long enough knows speedtest.net can be unreliable and produce inconsistent results. So, what then? Or what happens if you need to by-pass customer equipment easily? Most installers break out their laptop, spend a few minutes messing with settings and then authenticating themselves onto the network. Sometimes this can be easy, other times it can be challenging.<\/p>\n

\"\"
mAP with extenral battery pack<\/figcaption><\/figure>\n

In steps the Mikrotik mAP.
\nWhat you are about to read is based on a MUM presentation by Lorenzo Busatti from\u00a0http:\/\/routing.wireless.academy\/<\/a> with my own spin on it. You can read his entire presentation on the mAP in PDF at :\u00a0https:\/\/mum.mikrotik.com\/\/presentations\/US16\/presentation_3371_1462179397.pdf<\/a>\u00a0.\u00a0The meat of what we are talking about in this article starts on Page 50. If you want to watch the video you can do so at\u00a0https:\/\/www.youtube.com\/watch?v=VeZetH9uX_Y<\/a> . The focus of this article starts around 21:00.<\/p>\n

I have taken Lorenzo’s idea and have several different versions based upon the network.\u00a0 In most of our scenarios, the ethernet ports are what plug into the CPE or the customer’s equipment, and the technician connects to the mAP over wifi.\u00a0 This post covers using the mAP as an installer tool, not a traveling router. Lorenzo covers the travel option quite well in his presentation.<\/p>\n

In this post, we focus on networks which use PPPoE. PPPoE networks usually are the ones who take much time to set up to diagnose.\u00a0 \u00a0What we have done is set up an uncapped user profile that is available on every tower.\u00a0 Authentication can be done with local secrets or via radius.\u00a0 Depending on your IP design the user can get the same IP across the network, or have an IP\u00a0that assigned to this user on each tower\/routed segment. We could do an entire article on IP design.<\/p>\n

On our Mikrotik,\u00a0we setup ether1 to have a PPPoE\u00a0client running on it.\u00a0 When the installer plugs this into the customers CPE the mAP will automatically “dial-out” and authenticate using the technician user we talked about earlier.\u00a0 Once this connection has is established, the mAP is set to turn on the red “PoE out” light on the mAP using the following code.<\/p>\n

\/system leds\nadd interface=pppoe-out1 leds=user-led type=interface-status<\/pre>\n
Note. Our <\/em>PPPoE interface is the default “<\/em>pppoe-out1″ name. If <\/em>you modify this, you will need to modify the led setup as well to match.<\/em><\/p>\n
\"\"<\/p>\n
The red light gives the technician a visual indicator they\u00a0have authenticated and should have internet. At the very least their mAP has authenticated with PPPoE. There are netwatch scripts mentioned in the above presentation which can kick on another LED indicating true internet reachability or other functions.\u00a0 In our case, we can assume if the unit authenticates with the tower, then internet to the tower is up.\u00a0 While this isn’t always the case if the Internet is down to the tower you quickly know or the NOC quickly knows.\u00a0 At least you hope so. We chose the PoE out led because we are not using POE on this setup and a red light is noticeable.<\/p>\n
Once the technician has a connection they can connect to an SSID set aside for testing.\u00a0 In our case, we have set aside a “COMPANY_TECH” SSID. The tech connects to this on their laptop, and they are online.\u00a0 Since this is a static profile, you can set it up just like a typical customer, or you can give the tech user access to routers, APs or other devices.\u00a0 Our philosophy is you set up this SSID to mimic what a customer account experiences as closely as possible.\u00a0 It goes through the same firewall rules and ques just like a typical customer.<\/p>\n
To further enhance our tool we can set up a VPN.\u00a0 This VPN can is accessible from the laptop with a second SSID named “COMPANY_VPN”. Once the technician switches over to this SSID they have access, over a preconfigured VPN on the mAP, to the network, from where they can access things customers\u00a0can not, or at least should not be able to access. Many modern networks put APs, and infrastructure on separate VLANs not reachable from customer subnets.\u00a0 The VPN comes in handy here. You can access these things without changing security. If you plan on using this router internally, the type of VPN you choose is not as important as if you plan to modify the config so you can travel as is the case with the above MUM presentation. If you plan to travel an SSTP VPN is the most compatible.\u00a0 If it’s just inside your network, I would suggest an l2tp connection with IPsec.<\/p>\n
\"\"<\/p>\n
Our third configuration on this is to set up the second ethernet port to be a DHCP client.\u00a0 This setup is handy for plugging into the customer router for testing or for places where DHCP is the method of access, for example, behind a Baicells UE.\u00a0 If your network does not use PPPoE, you could have one ethernet be a DHCP client, and the other be a DHCP server. We have found having the technicians connect wirelessly makes their lives easier.\u00a0 They can plug the unit in and not have to worry about cables being too short, or getting behind a desk several times to plug and unplug things.<\/p>\n
So why go through all this trouble?<\/strong>
\nOne of the first things you learn in troubleshooting is to eliminate as many variables as you can. By plugging this into your CPE, you have a known baseline to do testing. You eliminate things such as customer routers, customer PCs, and premise wiring.\u00a0 The mAP is plugged directly in CPE, whether it be wired or wireless. Experience has shown us many of the troubles customers experience are traced back to their router. Even if you provide the router, this can eliminate or point to that router as being a source of the problem if a technician needs to visit the customer.<\/p>\n
Secondly, the mAP allows us to see and do more than your typical router. From the mAP we can run the Mikrotik bandwidth test tool from it to the closest router, to the next router inlines, all the way out to the internet.\u00a0A while back I did an article titled “The Problem with Speedteststs<\/a>“.\u00a0 This article explains many of the issues testing just using speedtest.net or other sites. \u00a0Being able to do these kinds of tests is invaluable.\u00a0 If there are four Mikrotik routers between the customer and the edge of your network all four of them can be tested independently. If you have a known good host outside your network, such as the one we provide to our clients, then you can also test against that.\u00a0\"\"<\/p>\n
Having a Mikrotik test tool like this also allows you access to better logging and diagnostics.\u00a0 \u00a0You can easily see if the ethernet is negotiating at 100 meg or a Gig.\u00a0 You can do wireless scans to see how noisy or busy 2.4GHZ is.\u00a0 You have easy to understand ping and traceroute tools.\u00a0 You also have a remote diagnostic tool which engineers can remote into easily to perform tests and capture readings.<\/p>\n
Thirdly, the mAP allows the installer to establish a good known baseline at the time of install.\u00a0 You are not reliant on just a CPE to AP test, or a speedtest.net test.<\/p>\n
How do we make this portable?<\/strong>
\nYou may have noticed in my above pictures I have an external battery pack hooked up to my mAP.\u00a0 \u00a0I am a fan of the Anker battery packs<\/p>\n