Manual

CCR2004-1G-12S+2XS

Twelve 10 Gbit and two 25 Gbit fibre cages, with one copper port beside them.

The CCR2004-1G-12S+2XS is the fibre member of the CCR2004 family. Twelve 10 Gbit SFP+ cages, two 25 Gbit SFP28 cages and one gigabit copper port. That is the shape of an aggregation router: fibre to servers, to switches and to a second building, with one copper port that in practice becomes your management port.

The catalogue records the default configuration router-ccr with ether1 as the WAN port, and the port layout is verified, so you will not see the "port layout not verified" note here.

The ports

  • ether1: one 1 Gbit copper port, the WAN port according to the catalogue. In practice this is often your management port: plug a laptop in and you can reach the router even when something is wrong with the fibre.
  • sfp-sfpplus1 through sfp-sfpplus12: twelve 10 Gbit cages. This is the bulk of the device.
  • sfp28-1 and sfp28-2: two 25 Gbit cages. The obvious place for the uplink to your core, or for two servers that really need it.

There is no PoE-out: the catalogue records no feeding port on this model, so the PoE-out per port field never appears.

If you want two or more cages to act as one logical link, that is bonding with LACP. Think about the MTU too if you want jumbo frames between servers and switch.

What is inside

From the catalogue: ARM 64bit, 4 GB of memory and licence level 6. A switch chip is not recorded for this model in our catalogue, so this page does not name one. That does not mean there is none; it means we make no claim about it.

With 4 GB the small-board warning never appears. hw_vlan is empty, so the warning about bridge VLAN filtering and hardware offload does not apply here. No radios and no modem, and therefore no Wi-Fi package or Wi-Fi generation in the catalogue entry.

What it is good at, and where it runs out

Good at: bringing a lot of fibre together in one place and routing it. As an aggregation point between server racks, as the router between two buildings over fibre, or as the router that speaks BGP to your provider. See BGP, OSPF and Fibre across a campus.

Where it runs out:

  • One copper port. Anything on copper hangs off a switch. Use ether1 as the WAN and nothing wired is left but fibre.
  • No Wi-Fi and no modem. All Wi-Fi roles are greyed out with "No wifi radio", LTE / 5G router with "No LTE modem".
  • No PoE-out.
  • Throughput figures. Our catalogue does not record them. What you get depends on firewall rules, fasttrack and queues, not on the cages.

Which roles fit

  • Core router (CCR / RB5009): the role this device is meant for. Routed interfaces without a bridge, a loopback, OSPF and BGP, a strict management ACL, no NAT and no fasttrack.
  • Office router with VLANs, Router + CAPsMAN and Hotspot: available, because there are fifteen wired ports, well over the three these roles demand. Whether they suit is another question: on a device with one copper port a hotspot is rarely the plan.
  • Home router and VPN gateway: offered, because this is not a switch.
  • Switch: technically offered. If you want pure layer 2 with this many cages, a CRS is usually the better tool.
  • Harden only (baseline): for a CCR that is already running.

The quickest route to a working configuration

  1. Pick One device and search for CCR2004. Watch for the -1G-12S+2XS; the other variant has sixteen copper ports.
  2. Pick Core router if this device only routes, or Office router with VLANs if it also does the LAN.
  3. In the Core role, the Routing step is where you enter the address per interface, plus a loopback if you use OSPF or BGP.
  4. Under Management access, keep the source ACL tight: this router should only be reachable from your management network. See Management access.
  5. Set an admin password, reset the device and paste the script. See Using the script.

With a row of switches behind it, Multiple devices works out the cables and trunks for you on the network board.

What trips people up

  • Empty cages. Without a matching module or DAC there is no link. Check with /interface ethernet print and see SFP port does not link.
  • Expecting 25 Gbit modules in a 10 Gbit cage. The two SFP28 cages are sfp28-1 and sfp28-2; the other twelve are SFP+.
  • Using the copper port as LAN. The catalogue lists it as the WAN. If you use it differently, change that deliberately in the WAN step.
  • Setting jumbo frames on one side only. A higher MTU has to match on both ends of every cable; see MTU.
  • Picking the Core role and expecting NAT. That role writes no NAT. For an ordinary internet connection with NAT you want Office router with VLANs.

Want to try it right away? Open the configurator