🌐 Lacerie Network — 10-Site MikroTik Infrastructure (Paraguay)

Production network powering 10 retail stores + HQ across Paraguay — MikroTik CRS3xx/CRS1xx, GRE/SSTP/OSPF, Netwatch, The Dude monitoring.

Topology

                    ┌─────────────────────────────────────┐
                    │         ASUNCIÓN HQ (Core)          │
                    │  10.0.0.0/24  •  100.126.5.100/32   │
                    │  CRS317-1G-16S+ (core)              │
                    │  CRS354-48G-4S+2Q+ (dist ×2)        │
                    │  CRS354-48P-4S+2Q+ (PoE dist ×3)    │
                    └──────────────┬──────────────────────┘
                                   │ GRE/SSTP Tunnels
         ┌─────────────────────────┼─────────────────────────┐
         │                         │                         │
    ┌────▼────┐             ┌─────▼─────┐            ┌─────▼─────┐
    │ AREGUÁ  │             │FILADELFIA │            │MINGA GUZÚ │
    │ 10.0.4  │             │ 10.0.5    │            │ 10.0.6    │
    └────┬────┘             └─────┬─────┘            └─────┬─────┘
         │                        │                        │
    ┌────▼────┐             ┌─────▼─────┐            ┌─────▼─────┐
    │ CDE 1   │             │ CDE 2     │            │ CDE 3     │
    │ 10.0.7  │             │ 10.0.8    │            │ 10.0.11   │
    └─────────┘             └───────────┘            └───────────┘
         │                        │                        │
    ┌────▼────┐             ┌─────▼─────┐            ┌─────▼─────┐
    │ CDE 4   │             │ CDE 5     │            │ SAN LORENZO│
    │ 10.0.12 │             │ 10.0.13   │            │ 10.0.14    │
    └─────────┘             └───────────┘            └───────────┘

Device Inventory

Role	Model	Location	Firmware	Notes
Core Switch	CRS317-1G-16S+RM	Asunción	7.15.3	10G uplinks
Dist Switch A	CRS354-48G-4S+2Q+	Asunción (.7)	7.12	Row A
Dist Switch B	CRS354-48G-4S+2Q+	Asunción (.11)	7.15.3	Row B
PoE Dist A	CRS354-48P-4S+2Q+	Asunción (.8)	7.15.3	Fresh, 6d uptime
PoE Dist B	CRS354-48P-4S+2Q+	Asunción (.10)	7.12	512MB, needs update
SSTP Gateway	CRS354-48P-4S+2Q+	Asunción (.9)	7.15.3	10.0.0.0/24 home
Edge Router	RB4011iGS+RM	Each store	7.15.3	SSTP client

Protocols & Services

Protocol	Purpose	Config
OSPF	Internal routing (Area 0)	network=10.0.0.0/8 area=backbone
GRE	Store ↔ HQ tunnels	keepalive=10s,3
SSTP	Encrypted overlay (Areguá/Filadelfia/Minga)	Port 443, cert auth
Netwatch	Link monitoring → failover	host=8.8.8.8, interval=10s
The Dude	Central monitoring/server	On CRS317 (.2)
DHCP	Per-store pools (10.0.x.10-254)	Option 43 for CAPsMAN
CAPsMAN	Central WiFi (hAP ax³)	802.11ax, WPA3-Enterprise
MNDP	Neighbor discovery	Native MikroTik

Store Subnets (10.0.x.0/24)

Store	Subnet	VLAN	Gateway	Notes
Areguá	10.0.4.0/24	4	10.0.4.1	First deployment
Filadelfia	10.0.5.0/24	5	10.0.5.1	Chaco region
Minga Guazú	10.0.6.0/24	6	10.0.6.1	Industrial zone
CDE 1	10.0.7.0/24	7	10.0.7.1	Ciudad del Este
CDE 2	10.0.8.0/24	8	10.0.8.1
CDE 3	10.0.11.0/24	11	10.0.11.1
CDE 4	10.0.12.0/24	12	10.0.12.1
CDE 5	10.0.13.0/24	13	10.0.13.1
San Lorenzo	10.0.14.0/24	14	10.0.14.1	Near Asunción

Automation Scripts

Script	Purpose	Schedule
backup-config.sh	Export .rsc + .backup → OMV	Daily 03:00
firmware-check.sh	Compare running vs latest stable	Weekly
netwatch-health.sh	Alert on tunnel flaps	Every 5m
capman-audit.sh	WiFi client count + signal audit	Daily
ospf-neighbor-check.sh	Verify adjacency count	Every 15m

Monitoring (The Dude + Prometheus)

• The Dude on CRS317: maps, device status, link utilization
• Prometheus Exporter (custom): /interface/ethernet, /routing/ospf/neighbor, /tool/netwatch
• Grafana Dashboards:
  • Tunnel latency (p95, p99)
  • OSPF neighbor state
  • Per-store traffic (in/out)
  • CPU/Memory per device
  • PoE power draw

Password Patterns (Standardized)

Type	Pattern	Example
WiFi	Lacerie{NNN}!	Lacerie987!
Router/Winbox	lacerie{NNN}	lacerie987
MikroTik admin	Lacerie{NNN}**	Lacerie975**

Infrastructure as Code

All configurations managed as code:

/configs
  /core
    crs317-core.rsc
  /dist
    crs354-dist-a.rsc
    crs354-dist-b.rsc
  /poe
    crs354-poe-a.rsc
    crs354-poe-b.rsc
    crs354-sstp-gw.rsc
  /stores
    /aregua
      rb4011.rsc
    /filadelfia
      rb4011.rsc
    ...

Deployed via CI/CD pipeline:

1. git push → GitHub Actions
2. Syntax check (mikrotik-config-check)
3. Dry-run on staging device
4. Approve → deploy to production (Netwatch-verified)

Results (2023-2024)

Metric	Value
Uptime (all sites)	99.97%
Mean tunnel latency	12ms (Asunción↔CDE)
OSPF convergence	<3s
Failover time (Netwatch)	<10s
Config drift incidents	0 (GitOps enforced)
Firmware compliance	100% (auto-check)

Stack

• Switching: MikroTik CRS317, CRS354 (SwOS/RouterOS)
• Routing: RB4011, CCR2004 (RouterOS 7.x)
• WiFi: hAP ax³ (CAPsMAN)
• Monitoring: The Dude + Prometheus + Grafana
• Backup: rsync → OMV ZFS (immutable snapshots)
• Automation: GitHub Actions + SSH + RouterOS API
• Secrets: HashiCorp Vault (synced to devices via API)

License

MIT — Part of MINIX stack 🇵🇾