CCR2004-16G-2S+PC

The CCR2004-16G-2S+PC is the passively cooled member of the CCR2004 family. Sixteen gigabit ports, two 10 Gbit SFP+ cages, and no fan. That last property decides where it belongs: in an office, a meter cupboard, a server room where noise counts. Its place in the network is the edge: the internet connection comes in, traffic moves on routed.

The catalogue records the default configuration router-ccr with ether1 as the WAN port. The port layout is verified, so you will not see the "port layout not verified" note on this model.

The ports

• ether1 through ether16: sixteen 1 Gbit ports. ether1 is your WAN by default; the rest are free.
• sfp-sfpplus1 and sfp-sfpplus2: two 10 Gbit SFP+ cages. These are your fast sides: a fibre uplink, a link to a 10 Gbit switch, or the two together as an LACP bundle towards the core. See Bonding and LACP.

There is no PoE-out: the catalogue records no feeding port on this model, so the PoE-out per port field never appears. Access points and cameras need an injector or a PoE switch here.

With eighteen ports you have room for VLANs with a real trunk. Which ports join the bridge and which one becomes the trunk is covered in Bridge and ports and VLANs.

What is inside

From the catalogue: ARM 64bit, 4 GB of memory, licence level 6 and the 88E6191 switch chip. That is ample: the small-board warning never appears here, and level 6 puts no limits on the parts the tool writes. See RouterOS licences.

hw_vlan is empty, so the warning about bridge VLAN filtering costing hardware offload does not apply to this model. The Hardware offloading (switch chip) toggle under Ports is on by default; leave it on.

No radios and no modem. The catalogue therefore records no Wi-Fi package and no Wi-Fi generation for this model.

What it is good at, and where it runs out

Good at: routing at the edge of a network, with plenty of copper and two fast sides. It also suits the router that speaks OSPF or BGP to a second site or to a provider; see OSPF and BGP.

Where it runs out:

• No Wi-Fi. Everything that needs a radio is greyed out with "No wifi radio". Wi-Fi comes from access points behind it, managed centrally with CAPsMAN if you want.
• No modem. LTE / 5G router is greyed out with "No LTE modem".
• No PoE-out. Plan for a separate PoE switch or injectors.
• Throughput figures. Our catalogue does not record them, so we do not quote them. What a routed setup reaches depends on your firewall rules, on fasttrack and on which queues you switch on; see QoS and bandwidth.

Which roles fit

• Core router (CCR / RB5009): the role that belongs to this device. Routed interfaces without a bridge, static routes, OSPF and BGP, a strict management ACL, no NAT and no fasttrack.
• Office router with VLANs: the ordinary choice when this is the only router in the office. Eighteen ports is well above the three the role demands.
• Home router, VPN gateway and Hotspot: all available, because this is not a switch and there are ports to spare.
• Router + CAPsMAN: available, and a sensible combination when access points come with it.
• Switch: technically offered, but a waste. This device was built to route.
• Harden only (baseline): for a CCR that is already running.
• All Wi-Fi roles are greyed out with "No wifi radio", LTE / 5G router with "No LTE modem".

The quickest route to a working configuration

1. Pick One device and search for CCR2004. Make sure you take the -16G-2S+PC and not the fibre variant.
2. Pick Office router with VLANs for an ordinary office, or Core router when this router only routes.
3. Fill in the internet connection on ether1. A second uplink on an SFP+ cage can come along, see Multiple uplinks.
4. Walk through the VLAN step: mark one VLAN as management and check which port becomes the trunk.
5. Set an admin password, reset the device and paste the script. See Using the script.

If a switch and a few access points sit behind it, Multiple devices is faster: you draw the cables on the network board and the cabling decides which ports become trunks.

What trips people up

• Mixing up the two CCR2004 variants. This one has sixteen copper ports; the CCR2004-1G-12S+2XS has one and the rest is fibre.
• Empty SFP+ cages. Without a module or a DAC the port does not come up; see SFP port does not link.
• Choosing the Core router role for an ordinary office. That role writes no NAT and no bridge. For an office with one internet line you want Office router with VLANs.
• Expecting PoE. This model powers nothing.
• Mixing fasttrack and queues. Switch queues on and fasttrack goes off; see QoS and bandwidth.