Manual:Tools/RoMON

Overview

This page contains information about RoMON feature in RouterOS. RoMON stands for "Router Management Overlay Network". RoMON works by establishing independent MAC layer peer discovery and data forwarding network. RoMON packets are encapsulated with EtherType 0x88bf and dst-MAC 01:80:c2:00:88:bf and its network operates independently from L2 or L3 forwarding configuration. When RoMON is enabled, any received RoMON packets will not be displayed by sniffer or torch tools.

Each router on RoMON network is assigned its RoMON ID. RoMON ID can be selected from port MAC address or specified by user.

RoMON protocol does not provide encryption services. Encryption is provided at "application" level, by e.g. using ssh or by using secure winbox.

Configuration

In order for device to participate in RoMON network RoMON feature must be enabled and ports that participate in RoMON network must be specified.

RoMON feature is configured in /romon menu at version 6.28 and under /tool romon menu after version 6.28. It contains the following settings:

Property	Description
enabled (yes | no; Default: no)	Disable or enable RoMON feature
id (MAC address; Default: 00:00:00:00:00:00)	MAC address to use as ID of this router

When RoMON is enabled and ID is automatically selected, ID is reported in menu info:

Version 6.28:

[admin@R3] > romon print
       ;;; RoMON running, ID 00:33:00:00:00:02
  enabled: yes
       id: 00:00:00:00:00:00

After version 6.28:

[admin@R3] > tool romon print       
   enabled: yes
        id: 00:00:00:00:00:00
   secrets:
current-id: 00:33:00:00:00:02

Ports that participate in RoMON network are configured in romon port menu. Port list is a list of entries that match either specific port or all ports and specifies if matching port(s) is forbidden to participate in RoMON network and in case port is allowed to participate in RoMON network entry also specifies port cost. Note that all specific port entries have higher priority than the wildcard entry with interface=all.

For example, the following list specifies that all ports except ether1 participate in RoMON network with cost 100:

Version 6.28:

[admin@R1] /romon port print
Flags: X - disabled, D - dynamic 
 #    INTERFACE                                                                 FORBID       COST
 0    ether1                                                                    yes           100
 1    all                                                                       no            100

After version 6.28:

[admin@R1] /tool romon port print
Flags: X - disabled, D - dynamic 
 #    INTERFACE                                                                 FORBID       COST
 0    ether1                                                                    yes           100
 1    all                                                                       no            100

By default one wildcard entry with forbid=no and cost=100 is created.

Secrets

RoMON protocol secrets are used for message authentication, integrity check and replay prevention by means of hashing message contents with MD5.

For each interface, if interface specific secret list is empty, global secret list is used.

When sending out, messages are hashed with first secret in list if list is not empty and first is not "empty secret" (empty string = ""), otherwise messages are sent unhashed.

When received, unhashed messages are only accepted if secret list is empty or contains "empty secret", hashed messages are accepted if they are hashed with any of secrets in list.

This design allows for incremental introduction and/or change of secrets in network without RoMON service interruption and can happen over RoMON itself, e.g.:

- initially all routers are without secrets

- configure each router one by one with secrets="","mysecret" - this will make all routers still send unprotected frames, but they all will be ready to accept frames protected with secret "mysecret".

- configure each router one by one with secrets="mysecret","" - this will make all routers use secret "mysecret", but also still accept unprotected frames (from routers that have not yet been changed)

- configure each router with secrets="mysecret" - this will make all routers use secret "mysecret" and also only accept frames protected with "mysecret".

Changing of secret in network should be performed in similar fashion where for some time both secrets are in use in network.

Peer discovery

In order to discover all routers on RoMON network romon discover command must be used:

Version 6.28:

[admin@R1] romon discover 
ADDRESS                 COST       HOPS PATH                   L2MTU
00:22:00:00:00:02        200          1 00:22:00:00:00:02       1500
00:02:03:04:05:06        400          2 00:22:00:00:00:02       1500
                                        00:02:03:04:05:06

After version 6.28:

[admin@R1] tool romon discover 
ADDRESS                 COST       HOPS PATH                   L2MTU
00:22:00:00:00:02        200          1 00:22:00:00:00:02       1500
00:02:03:04:05:06        400          2 00:22:00:00:00:02       1500
                                        00:02:03:04:05:06

Applications

Multiple applications can be run over RoMON network.

Ping

In order to test reachability of specific router on RoMON network romon ping command can be used:

Version 6.28:

[admin@R1] romon ping 00:22:00:00:00:02
  SEQ HOST                                    TIME  STATUS                                       
    0 00:22:00:00:00:02                       0ms                                                
    1 00:22:00:00:00:02                       1ms                                                
    2 00:22:00:00:00:02                       1ms                                                
    sent=3 received=3 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=1ms 

After version 6.28:

[admin@R1] tool romon ping 00:22:00:00:00:02
  SEQ HOST                                    TIME  STATUS                                       
    0 00:22:00:00:00:02                       0ms                                                
    1 00:22:00:00:00:02                       1ms                                                
    2 00:22:00:00:00:02                       1ms                                                
    sent=3 received=3 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=1ms 

SSH

In order to establish secure terminal connection to router on RoMON network romon ssh command can be used, provided that security package is installed:

Version 6.28:

[admin@R1] romon ssh 00:22:00:00:00:02  

After version 6.28:

[admin@R1] tool romon ssh 00:22:00:00:00:02  

Run RoMON in Winbox by using CLI

In order to establish RoMON session directly by using command line on computer, you must specify RoMON agents and desired routers addresses. RoMON agent must be saved on Managed routers list in Winbox in order to make successful connection:

winbox.exe --romon 192.168.88.1 D4:CA:6D:E1:B5:7D admin ""