I'm having issue configuring Swisscom Internet offering (FTTH Blue M - 1Gbit) with my Mikrotik setup. I was able to obtain the IP address through the DHCP (by setting option 60), but still no internet. I see some errors in log entries related to the invalid MAC address and missing IPv6 address. Tried also spoofing the MAC address of the Interne Box but without success. Does anybody have a more comprehensive instructions on how to configure the Mikrotik devices? Any help is appreciated.

@"bitracer"#1143665 then you know what to do to get the Mikrotik router up and running. DHCP60 option and VLAN10. It is important to register the MAC address of the router on the website [www.swisscom.ch/start](http://www.swisscom.ch/start). In case of problems with the registration, either contact the 2nd level support or use the MAC address of the registered router on the Mikrotik router. Without registering the router I get an IP address, but no services (telephony and Internet) TV service works. TV settings (firewall, multicast) on the Mikrotik are almost the same as on the Fiber7 or get this solution: [https://community.swisscom.ch/t5/Archiv-Swisscom-blue-TV/Swisscom-TV-an-Mikrotik-Multicast-Problem/m-p/534756#M36143](https://community.swisscom.ch/t5/Archiv-Swisscom-blue-TV/Swisscom-TV-an-Mikrotik-Multicast-Problem/m-p/534756#M36143) [https://community.swisscom.ch/t5/Nutzung-mit-TV-Box/Pfsense-2-5-1-und-Swisscom-Blue-TV/m-p/673916#M56926](https://community.swisscom.ch/t5/Nutzung-mit-TV-Box/Pfsense-2-5-1-und-Swisscom-Blue-TV/m-p/673916#M56926)

@"bitracer"#1143665 this discussion on the Community in German may help [G.Fast SFP direkt in Fremdrouter (MikroTik) | Swisscom Community](https://community.swisscom.ch/t5/Router-Hardware/G-Fast-SFP-direkt-in-Fremdrouter-MikroTik/m-p/658274) @"user109"#65426 any ideas?

I went through all these tips, but still no luck. I assume that something on administrative level needs to be done.

Configurations of mikrotik routers are always carried out in admin mode which router from mikrotik are you using with which firmware? which interfaces are in the bridge? (Software Switch) [https://community.swisscom.ch/t5/Off-Topic/MikroTik-FTTH-Einstellungen/td-p/630894](https://community.swisscom.ch/t5/Off-Topic/MikroTik-FTTH-Einstellungen/td-p/630894) @"bitracer"#1143665 here the configuration on Terminal: /interface vlan add interface=sfp1-gateway l2mtu=1480 name=sfp1-gateway\_vlan10 vlan-id=10 /ip dhcp-client option add code=60 name=classid-swisscom value="'100008,0001,,xxx fw dhclient'" /ip dhcp-client add default-route-distance=0 dhcp-options=classid-swisscom,hostname,clientid disabled=no interface=sfp1-gateway\_vlan10 use-peer-ntp=no and you must pair the Mikrotik with Swisscom [www.swisscom.ch/start](http://www.swisscom.ch/start)

I did all this, created the VLAN 10 interface on sfp1, configured the DHCP client to use the VLAN interface with option 60. I was getting the IP address but no internet. I have 3 Mikrotik devices managed in CAPsMAN setup, the main router was hAP AC running Router OS 7.3.1. The last link gave me an error when I tried the pairing. Will try again later or in the following days. In the meantime I configured the Internet Box 4 and it's working well. I'm missing the control the Mikrotik gives you, but I get WIFI 6 as a bonus with IB4. There are few kinks in the IB4 web UI that annoy me, but otherwise it's been smooth sailing so far. I added the WLAN-BOX2 and I'm getting good coverage where I previously used 3 Mikrotik APs (with reduced power, to be fair).

@"bitracer"#1143665 [https://community.swisscom.ch/t5/Router-Hardware/Kein-Internet-trotz-DHCP-Option-60-amp-WAN-IP-amp-Registrierung/td-p/622683](https://community.swisscom.ch/t5/Router-Hardware/Kein-Internet-trotz-DHCP-Option-60-amp-WAN-IP-amp-Registrierung/td-p/622683)

Hmm, I'll try again after the holidays. For the moment I caved in and installed the IB4 with WB2.

I'm puzzled as to why there is no official guide explaining what exactly needs to be configured in order for third party router to work. That should include the firewall settings for blue TV as well. For the vast majority of the users, the standard equipment is just fine. I've been using the IB and WB for some time now and it works very well. I'm questioning whether I should even bother messing with the third party router. Still, there will always be some users that need/want more control over their setup. It's this kind of users that are probably the best brand ambassadors. Why they have to guess the correct settings and rely on other peoples trial and error to configure their gear? One pager with all the necessary information would do.

@"bitracer"#1143665 you must learn Mikrotik OS. [https://www.amazon.de/s?k=routeros+book&\_\_mk\_de\_DE=%C3%85M%C3%85%C5%BD%C3%95%C3%91&crid=Z0C65GC1J2EM&sprefix=routeros+book%2Caps%2C93&ref=nb\_sb\_noss](https://www.amazon.de/s?k=routeros+book&__mk_de_DE=%C3%85M%C3%85%C5%BD%C3%95%C3%91&crid=Z0C65GC1J2EM&sprefix=routeros+book%2Caps%2C93&ref=nb_sb_noss) Here ist a older tutorial series only in german. [https://www.youtube.com/watch?v=UHyTbfC6Pys&list=PLnzEbgyK52GvvgQ4L2s\_kskQcFmTPVCX3](https://www.youtube.com/watch?v=UHyTbfC6Pys&list=PLnzEbgyK52GvvgQ4L2s_kskQcFmTPVCX3) Swisscom ist not a ISP for 3Party solutions, thats Fiber7. You must learn and try to run a 3Party Router on Swisscom Network. I have the following devices from mikrotik: CRS326-24S+2Q+, RB2011iL-RM, CCR1016-12S-1S+,hAP ac, mAP. All this devices with an SFP-Slot run on Swiscom FTTH on ROS 6.x. Today I can't try again ich have xgs pon technology from Swisscom.

Hi @"user109"#65426, I've been running Mikrotik gear for the past 5 years. I know how to configure it properly, I work in IT. Indeed I was previously Init7 customer. What I find missing is detailed instructions on what exactly needs to be configured, including firewall rules and admin procedures to register the device. I'm not expecting any product specific support form Swisscom. The page that mentions the usage of third party router should include all the necessary information on how to use a third party router. At the moment it just mentions the Option 60 and goes through the optics specification. It should be extended to include the firewall rules for the TV product as well as the device registration procedure that needs to be done.

It would be great if somebody gathered all this information and updated the third party router guidelines page: [https://www.swisscom.ch/en/residential/help/device/internet-router/external-router.html](https://www.swisscom.ch/en/residential/help/device/internet-router/external-router.html)

How to configure Mikrotik router with Swisscom Internet (FTTH)

bitracer

Yes, contact Customer Care and ask your connection to be changed to Internet M. Make sure with them that the line is point to point. In some places, 1Gbit is also delivered using XGS- PON.

user109

@bitracer Sooner or later, Swisscom will rely on XGS-PON. because it is expensive and inefficient to operate 2 systems.

swisspol

I forgot to say but I'm already on Internet M.

it's a brand new fiber installation: they finished wiring the town with fiber weeks ago. It may not be possible not use point to point but I will ask.

if they can change the connection to point-to-point, would I be able to use the SFP module I just bought?

bitracer

Your TP-Link optics are SFP type 1Gbit already. The question is whether this module is compatible with MikroTik.

Since the technician tested it with XGS-PON module, your line is likely already point to multipoint. In that case you're stuck with using the Swisscom router. The good news is that the upgrade to 10Gbit will be very easy.

swisspol

Thanks much for all the help. I'll reach out to Swisscom and see what happens.

user109

@swisspol

Here you have a network certified bridge for your XGS-PON connection and you need:

https://www.init7.net/de/support/faq/hybrid7-p2mp-hardware/

10Gbit/s SFP RJ45 Copper

https://mikrotik.com/product/s_rj10

You can buy it here (S+RJ10):

https://www.digitec.ch/de/s1/product/mikrotik-srj10-transceiver-6672094?pcscpId=1&utm_content=1-2&utm_campaign=preisvergleich&utm_source=toppreise&utm_medium=cpc

You can buy it here (NokiaNokia XS-010X-Q):

https://www.init7.net/en/internet/hardware/

It is also possible for non Fiber7 customers to purchase the NokiaNokia XS-010X-Q (XGS-PON bridge).

swisspol

This looks interesting, thanks for the links.

I have the 1Gbps plan so I don't need the 10Gbit/s SFP RJ45 Copper adaptor at this time.

So if I bug the "Nokia XS-010X-Q" bridge from init7, it will work out of the box on the Swisscom fiber XGS-PON network? If this system is using encryption, won't the bridge need to be "configured" for Swisscom to have the encryption keys or something?

If yes, then all I have to do is buy this Nokia bridge, plug-in it on the fiber in the wall outlet, on the Mikrotik in an RJ45 port, set the DHCP option 60, visit swisscom.ch/start and that's it? Like when I set up the VDSL bridge prior to getting fiber?

user109

@swisspol

Question 1:

No, a bridge is always transparent (you don't need anything to configure on bridge), the settings of the device behind the bridge are important. In the MT router, set DHCP 60 option and VLAN10 on the copper SFP port.

Question 2:

yes, don't forget the DHCP 60 option and VLAN10

swisspol

Thanks for your patience and kind answers. I just want to make to make sure I'm getting this right.

I don't need to plug-in the bridge into an SFP port with that SFP-RJ45 port, or do I? I'm confused: the bridge has an RJ45 10Gbps port so I can just connect it to one of the 24 RJ45 1Gbps port on the Mikrotik and just set DHCP 60 and VLAN 10, right?

Also if the current setup of IB3 + Swisscom provided SFP uses XGS-PON with requires encryption keys and all, how will it work if I'm using a XGS-PON <-> RJ45 bridge? Where are the encryption keys in this setup?

user109

@swisspol

The physical connection:

OTO -> Fiber patch cable -> Nokia XS-010X-Q-Bridge -> Coper patch cable (min cat5E) -> Copper-SFP(RJ45) or Cooper Port RJ45 MT Router.

The Nokia XS-010X-Q-Bridge copper port is backward compatible to 1 Gbit/s

The SHA 256 keys are provided by the bridge, so you don't have to do anything like with the IB3

bitracer

@user109 are you sure that the Nokia is officially certified by Swisscom?

bitracer

Also if the current setup of IB3 + Swisscom provided SFP uses XGS-PON with requires encryption keys and all, how will it work if I'm using a XGS-PON <-> RJ45 bridge? Where are the encryption keys in this setup?

You'll need support from Swisscom to configure it. Maybe it's possible to extract this information from the InternetBox. @user109 would know that.

user109

@bitracer yes it is on the BBCS List:

https://www.swisscom.ch/dam/swisscom/en/ws/documents/E_BBCS-Documents/e_bbcs_supporting-documentprovedequipment.pdf

bitracer

Swisscom should offer this device for purchase pre-configured. It would complete the hardware lineup nicely and offer an easy solution to customers that want to run their own router.

user109

@bitracer wrote:

Also if the current setup of IB3 + Swisscom provided SFP uses XGS-PON with requires encryption keys and all, how will it work if I'm using a XGS-PON <-> RJ45 bridge? Where are the encryption keys in this setup?

You'll need support from Swisscom to configure it. Maybe it's possible to extract this information from the InternetBox. @user109 would know that.

The requires encryption keys and the Fiber-Port are on the Bridge. You do nothing configure on the bridge.

The same as IB3 or IB4, you must connect the Fiberport only on Bridge and configure your device behind the bridge with DHCP option 60 an VLAN10 by Bussiness Contract VLAN11.

you then register the router in the Swisscom network
www.swisscom.ch/start

www.swisscom.ch/access

bitracer

@user109 sorry, maybe I'm blind, but I don't see this Nokia model in the document you linked. 🙂

swisspol

bitracer

No, no, it's in the list, I had the same problem, had to look twice.

I'll contact init7 tomorrow to purchase this bridge. Thanks everyone for the amazing help! I'll let you know how things turn out.

user109

@bitracer wrote:

@user109 sorry, maybe I'm blind, but I don't see this Nokia model in the document you linked. 🙂

@bitracer see the last post by @swisspol

user109

Here is the Swisscom config from RB2011UiAS-RM Router OS 6.xx

you can store the script in a xx.rsc file:

RB2011UiAS-RM:

/interface bridge
add \
name=bridge1 \
mtu=1598 \
protocol-mode=none

/interface ethernet
set [ find default-name=ether2 ] \
master-port=ether1
set [ find default-name=ether3 ] \
master-port=ether1
set [ find default-name=ether4 ] \
master-port=ether1
set [ find default-name=ether5 ] \
master-port=ether1
set [ find default-name=ether7 ] \
master-port=ether6
set [ find default-name=ether8 ] \
master-port=ether6
set [ find default-name=ether9 ] \
master-port=ether6
set [ find default-name=ether10 ] \
master-port=ether6

/interface ethernet
set [ find default-name=sfp1 ] \
name=sfp1-gateway

/interface wireless security-profiles
set [ find default=yes ] \
supplicant-identity=MikroTik

/ip hotspot user profile
set [ find default=yes ] \
idle-timeout=none \
keepalive-timeout=2m \
mac-cookie-timeout=3d

/interface vlan
add \
name=sfp1-gateway_vlan10 \
interface=sfp1-gateway \
l2mtu=1596 \
vlan-id=10

/ip pool
add \
name=dhcp \
ranges=192.168.88.10-192.168.88.254

/ip dhcp-server
add \
name=dhcp1 \
address-pool=dhcp \
disabled=no \
interface=bridge1

/port
set 0 \
name=serial0

/interface bridge port
add \
bridge=bridge1 \
interface=ether1
add \
bridge=bridge1 \
interface=ether6

/ip address
add \
address=192.168.88.1/24 \
interface=bridge1 \
network=192.168.88.0

/ip dhcp-client option
add \
name=classid-swisscom \
code=60 \
value="'100008,0001,,xxx fw dhclient'"

/ip dhcp-client
add \
default-route-distance=0 \
dhcp-options=classid-swisscom,hostname,clientid \
disabled=no \
interface=sfp1-gateway_vlan10 \
use-peer-ntp=no

/ip dhcp-server network
add \
address=192.168.88.0/24 \
dns-server=195.186.4.162,195.186.1.162 \
gateway=192.168.88.1

/ip firewall filter
add \
comment="permit ICMP" \
chain=input \
protocol=icmp
add \
comment="permit NTP" \
chain=input \
protocol=udp \
src-port=123
add \
comment="allow DNS resolution from local router" \
chain=input \
protocol=udp \
src-port=53
add \
comment="permit local access" \
chain=input \
in-interface=bridge1
add \
comment="permit connection state related inbound connections to local router" \
chain=input \
connection-state=related
add \
comment="permit connection state established inbound connections to local router" \
chain=input \
connection-state=established
add \
comment="drop everything else to local router" \
action=drop \
chain=input
add \
comment="permit connection state related inbound connections to forward chain" \
chain=forward \
connection-state=related
add \
comment="permit connection state established inbound connections to forward chain" \
chain=forward \
connection-state=established
add \
comment="drop everything else to forward chain" \
action=drop \
chain=forward \
connection-state=invalid

/ip firewall nat
add \
action=masquerade \
chain=srcnat \
out-interface=sfp1-gateway_vlan10 \
to-addresses=0.0.0.0

/ip firewall service-port
set ftp \
disabled=yes
set tftp \
disabled=yes
set irc \
disabled=yes
set h323 \
disabled=yes
set sip \
disabled=yes
set pptp \
disabled=yes

/ip service
set telnet \
disabled=yes
set ftp \
disabled=yes
set www-ssl \
disabled=no
set api \
disabled=yes
set winbox \
disabled=yes
set api-ssl \
disabled=yes

/ip upnp
set \
allow-disable-external-interface=no

/lcd
set \
default-screen=stats \
time-interval=hour

/lcd pin
set \
pin-number=8400

/lcd interface
set sfp1
set ether1 \
disabled=yes
set ether2 \
disabled=yes
set ether3 \
disabled=yes
set ether4 \
disabled=yes
set ether5 \
disabled=yes
set ether6 \
disabled=yes
set ether7 \
disabled=yes
set ether8 \
disabled=yes
set ether9 \
disabled=yes
set ether10 \
disabled=yes

/lcd interface pages
add \
interfaces=sfp1

/lcd screen
set 1 \
disabled=yes
set 2 \
disabled=yes
set 3 \
disabled=yes
set 4 \
disabled=yes
set 5 \
disabled=yes

/system clock
set \
time-zone-name=Europe/Zurich

/system ntp client
set \
enabled=yes \
primary-ntp=82.197.188.130 \
secondary-ntp=82.197.164.46

bitracer

@user109 could you also include the IGMP Proxy config? It would be helpful fir Mikrotik users that are also Blue TV customers.

« Previous page Next page »