RouterOS for people who learned on IOS

MikroTik equipment is capable and inexpensive, which means it turns up in networks whose engineers learned on Cisco. Most of the knowledge transfers. A few assumptions do not, and those are worth knowing before you are troubleshooting at speed.

Everything is a list

There is no interface configuration mode. There are lists — addresses, routes, firewall rules, interfaces — and you add, remove and edit entries by index or by find expression.

/ip address print
/ip route print
/ip firewall filter print
/interface print detail

Ordering matters in the firewall list exactly as it does in an access list: first match wins.

Safe mode

The single most useful feature for someone working remotely. Press Ctrl-X, make changes, press Ctrl-X again to keep them. If your session drops in between, every change is reverted automatically. IOS has a clumsier counterpart in the archive-based configure terminal revert timer, but safe mode removes most of the fear from remote firewall work.

The bridge is not a switch

The assumption that catches people. On many models, adding ports to a bridge means traffic is handled in software by the CPU rather than by the switching hardware. A device rated for gigabit forwarding will struggle at a fraction of that if bridging is done the wrong way. Use hardware offload, and verify it is actually active rather than assuming.

/interface bridge port print detail    # the H flag means hardware offload is active
/system resource monitor               # watch CPU under load

The firewall default is permissive

A RouterOS device with a blank configuration forwards everything, much as a Cisco router with no access lists does. The default rule set is a starting point, not a security posture. Build input and forward chains deliberately, and put the rule that permits your own management access near the top before you add anything that could lock you out.

Connection tracking

Firewall rules matching connection state depend on connection tracking, which costs CPU. On a small router forwarding a lot of traffic, disabling tracking for traffic that does not need it is a real performance gain — and turning it off for traffic that does need it silently breaks return paths.