CloudLabBox
Try the free demo

MikroTik MTCNA lab 2 of 19

Users, services and secure management access

Give each administrator their own account with the right rights, switch off the management services nobody needs, and allow SSH, WinBox and MAC access only from the IT network.

Run this lab

It needs Lite: its 3 nodes are set to 3 vCPU and 1,280 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCNA RouterOS v7 guided labs, then 02 - Users services and secure management access

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Beginner
Time
About 50 minutes
Nodes need
3 vCPU, 1,280 MB
Smallest plan
Lite

The scenario

The bakery's router from lab 1 is now in a bigger customer: a vet practice with an IT room and a staff office. Three people at Fernvale log in to it, all as admin, and nobody can tell who changed what. The router also answers Telnet, FTP and the API on every interface, so anyone in the staff office can try to log in.

Your job: named accounts with the right rights, only the management services that are needed, and management only from the IT LAN.

DeviceInterfaceAddressConnects to
R1ether2192.168.10.1/24Admin-PC (IT LAN)
R1ether3192.168.20.1/24Staff-PC (Staff LAN)
Admin-PCeth0192.168.10.10/24, gateway 192.168.10.1R1 ether2
Staff-PCeth0192.168.20.10/24, gateway 192.168.20.1R1 ether3
AccountGroupPassword
netadmin (Fernvale engineer)fullNet-admin1
support (helpdesk, look but don't touch)helpdesk (you create it)Help-desk1

What you’ll practise

  • Explain RouterOS user groups and policies, and create a read-only helpdesk group
  • Create named administrator accounts instead of sharing admin
  • List the management services and their ports, and disable the insecure ones
  • Restrict SSH and WinBox to a management subnet
  • Limit MAC-WinBox, MAC-Telnet and neighbour discovery to a trusted interface list
  • Prove the result from an allowed and a non-allowed host

The tasks

  1. Prepare the two PCs
  2. See what the router exposes
  3. Create a read-only helpdesk group
  4. Create named accounts
  5. Test the helpdesk account
  6. Switch off the services nobody needs
  7. Limit layer-2 access and discovery to the IT port
  8. Prove it from both offices

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Users services and secure management access3 nodes, 2 links. Every link is listed as text below the diagram.R1Admin-PCStaff-PCether2eth0ether3eth0
3 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 ether2 to Admin-PC eth0
  • R1 ether3 to Staff-PC eth0
Nodes in Users, services and secure management access, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
Admin-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
Staff-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCNA RouterOS v7 guided labs.

  3. Open 02 - Users services and secure management access and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCNA labs

All MikroTik MTCNA labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.