CloudLabBox
Try the free demo

Network automation lab 26 of 27

MikroTik RouterOS REST API: HTTPS, CRUD and desired state

Automate two RouterOS routers through their REST API: move it from plain HTTP to verified HTTPS, learn how GET, PUT, PATCH, DELETE and POST map to RouterOS commands, build a routed link and OSPF from a YAML file with a script you can run twice, and give an API account only the rights it needs.

Run this lab

It needs Lite: its 3 nodes are set to 3 vCPU and 1,536 MB in total. That fits the free demo too.

In your workspace: Shared, then Network Automation - CCNA and CCNP Automation guided labs, then 26 - MikroTik RouterOS REST API - HTTPS CRUD and desired state

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 70 minutes
Nodes need
3 vCPU, 1,536 MB
Smallest plan
Lite

The scenario

Kestrel's two smallest depots run MikroTik CHR routers. Nobody wants to log in to each one by hand, and RouterOS 7 has a REST API, so that's your way in. But it starts life on plain HTTP with a password on every request, so the first job is to fix that. Then you'll build the link between the depots from a YAML file, with a script that's safe to run twice.

RouterPlatformMgmt addressLoopback (to build)Link (to build)
mt1RouterOS 7.14 (CHR)10.10.20.6110.255.1.1/32ether2 10.1.62.1/30
mt2RouterOS 7.14 (CHR)10.10.20.6210.255.1.2/32ether2 10.1.62.2/30

What you’ll practise

  • Explain why basic authentication needs HTTPS, and enable www-ssl with certificates made on the router
  • Verify a device's certificate from a client, with cURL and Python, instead of switching verification off
  • Map GET, PUT, PATCH, DELETE and POST to RouterOS print, add, set, remove and commands
  • Filter replies with .proplist and .query, and read RouterOS error replies
  • Write an idempotent script that builds addresses and OSPF from a YAML file
  • Limit an API account with user groups and the rest-api policy

The tasks

  1. See the problem
  2. Move to HTTPS, with a certificate you can check
  3. Trust it properly
  4. The REST verbs, the RouterOS way
  5. Build from a file, safely
  6. Ask the routers how it went
  7. Errors and least privilege
  8. Configuration out over REST

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of MikroTik RouterOS REST API - HTTPS CRUD and desired state3 nodes and 1 network, 4 links. Every link is listed as text below the diagram.devboxmt1mt2Mgmteth0ether2ether2ether1ether1
3 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • devbox eth0 to Mgmt (network)
  • mt1 ether1 to Mgmt (network)
  • mt2 ether1 to Mgmt (network)
  • mt1 ether2 to mt2 ether2
Nodes in MikroTik RouterOS REST API: HTTPS, CRUD and desired state, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
devboxEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
mt1MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
mt2MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Network Automation - CCNA and CCNP Automation guided labs.

  3. Open 26 - MikroTik RouterOS REST API - HTTPS CRUD and desired state and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network automation labs

All Network automation labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.