RoMON

CLI reference:/tool/romon/tool/romon/port/tool/romon/discover

RoMON (Router Management Overlay Network) builds an independent MAC-layer peer discovery and data forwarding network between routers. RoMON packets use EtherType 0x88bf and destination multicast MAC 01:80:c2:00:88:bf and are handled independently of L2 or L3 configuration: a router stays reachable through RoMON even when its IP configuration, routing or firewall is broken. That makes RoMON a recovery path into misconfigured routers, one overlay hop at a time.

Each router on the RoMON network has a RoMON ID, either selected automatically from a port MAC address or configured with id.

The RoMON protocol does not encrypt messages. Encryption comes from the application running on top of it, for example SSH or a secure WinBox connection.

info

RoMON packets can be forwarded through network switches or bridges, unless there are specific restrictions on multicast traffic. When using a MikroTik bridge with hardware offloading, these packets are treated like regular multicast packets and are flooded across the network.

If the RoMON service is enabled and the switch chip supports ACL rules, dynamic rules are automatically created to redirect these packets to the CPU, where the RoMON service operates. However, if the switch does not support ACL rules and the configuration does not align, such as when the CPU and RoMON untagged packets are not in the same VLAN, the RoMON service might not function as expected.

RB5009 (switch-chip 88E6393X) does not support this path. The chip's frame-types=admit-only-vlan-tagged filter drops RoMON frames before any ACL rule can be applied, so the packets never reach the CPU.

Enable RoMON

Enable the service in the /tool/romon menu:

/tool/romon/set enabled=yes

When the ID is not configured, it is selected automatically:

[admin@MikroTik] > /tool/romon/print
     enabled: yes
          id: 00:00:00:00:00:00
  current-id: DC:2C:6E:E7:10:6B

Choose ports

Ports that participate in the RoMON network are configured in the /tool/romon/port menu. Each entry matches one physical interface name (or the built-in wildcard all) and either forbids RoMON on it or allows it with a port cost. Bridge or other master interfaces are not accepted as RoMON ports — name the physical ports that talk to the network. More specific entries override the wildcard entry.

A default entry with the interface list all is preconfigured, so every interface participates with cost 100 until you change it:

[admin@MikroTik] > /tool/romon/port/print
Flags: * - DEFAULT
Columns: INTERFACE, FORBID, COST
#   INTERFACE  FORBID  COST
0 * all        no       100

RoMON should not listen on the untrusted side of a router (it accepts management connections by MAC address). Forbid the WAN port and keep the LAN:

/tool/romon/port/add interface=ether1 forbid=yes

Or the other way around: forbid everything with the wildcard entry, then allow the trusted interfaces one by one:

/tool/romon/port/set [find default=yes] forbid=yes
/tool/romon/port/add interface=ether2 forbid=no
/tool/romon/port/add interface=ether3 forbid=no

Protect the overlay with secrets

RoMON secrets authenticate messages, check their integrity and prevent replays by hashing the message contents with MD5. Every router in the same RoMON network should use the same secrets. On a fresh setup, set the secret on all routers:

/tool/romon/set secrets="mysecret"

The global list lives in /tool/romon; an interface-specific list can be set per port in /tool/romon/port (if the port list is empty, the global list is used).

When sending, messages are hashed with the first secret in the list, unless the list is empty or starts with the empty secret (in that case messages are sent unhashed). When receiving, unhashed messages are accepted only by an empty list or a list that contains the empty secret; hashed messages are accepted when they carry any secret in the list.

That behaviour makes a rolling change possible without splitting the network — and the rotation works even when you do it while connected through RoMON itself:

# 1. every router still sends unhashed, but also accepts "mysecret"
/tool/romon/set secrets=("","mysecret")
# 2. every router sends hashed with "mysecret", but still accepts unhashed
/tool/romon/set secrets=("mysecret","")
# 3. every router sends and only accepts "mysecret"
/tool/romon/set secrets="mysecret"

To change a secret later, run the same rotation with both the old and the new secret in the list for a while.

note

In the CLI, list entries that contain an empty secret need parentheses: secrets=("","mysecret"). In WinBox, press the small + in the Secrets field and leave the first row empty.

A client whose secret does not match gets no answer:

[admin@MikroTik] > /tool/romon/ping id=DC:2C:6E:E7:10:6B count=3
  SEQ HOST                                    TIME  SIZE STATUS
    0 DC:2C:6E:E7:10:6B                           32 timeout
    1 DC:2C:6E:E7:10:6B                           32 timeout
    2 DC:2C:6E:E7:10:6B                           32 timeout
    sent=3 received=0 packet-loss=100%

Find routers in the overlay

Run /tool/romon/discover to list the reachable routers:

[admin@MikroTik] > /tool/romon/discover
Flags: A - ACTIVE
Columns: ADDRESS, COST, HOPS, PATH, L2MTU, IDENTITY, VERSION
  ADDRESS            COST  HOPS  PATH               L2MTU  IDENTITY  VERSION
A F4:1E:57:46:89:89   200     1  F4:1E:57:46:89:89   1500  Router-B  7.26beta1

The discovery table keeps refreshing; with duration it stops after the given time. The address column holds the RoMON ID of the found router, which is what the other RoMON tools take.

Test connectivity with RoMON ping

[admin@MikroTik] > /tool/romon/ping id=F4:1E:57:46:89:89 count=5
  SEQ HOST                                    TIME   SIZE STATUS
    0 F4:1E:57:46:89:89                       1ms      32
    1 F4:1E:57:46:89:89                       0ms      32
    ...
    sent=5 received=5 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=1ms

Open an SSH session over RoMON

/tool/romon/ssh opens an SSH session through the overlay, even when the remote router has no IP address:

[admin@MikroTik] > /tool/romon/ssh F4:1E:57:46:89:89 user=admin

Connect with WinBox

In WinBox, select Connect To > RoMON Agent on the login screen and choose a saved router with RoMON enabled as the agent, then connect to the target by its RoMON ID (see WinBox). Watch the video tutorial.

You can also run WinBox from the command line with a RoMON agent and the target router's ID. The agent router must be saved in the WinBox managed router list for the connection to succeed:

winbox.exe --romon 192.168.88.24 F4:1E:57:46:89:89 admin ""

Technical details

• Discovery, ping and RoMON SSH all run over raw Ethernet frames, so they keep working without any IP configuration.
• RoMON frames are not special for the packet sniffer: capture them with filter-mac-protocol=romon (EtherType 0x88BF).
• hops, path and cost in the discovery table describe the RoMON path: routers that run RoMON forward the overlay traffic, so a target several segments away shows the intermediate IDs in path.
• A [find default=yes] wildcard port entry always exists: it cannot be removed, disabled or enabled — only its cost, forbid and secrets can be changed ("failure: only cost, forbid and secrets can be changed for preset"). Setting it to forbid=yes turns the default into "deny all".

For all parameters, see the /tool/romon, /tool/romon/port, /tool/romon/discover, /tool/romon/ping and /tool/romon/ssh CLI reference pages.