CCR2216-1G-12XS-2XQ

The CCR2216-1G-12XS-2XQ is the largest router in our list. Twelve 25 Gbit SFP28 cages, two 100 Gbit QSFP28 cages and one gigabit copper port. It belongs in a rack at a provider, in a datacentre or at the core of a large network. If you are wondering whether you need this device, you probably do not.

There is no Wi-Fi in it, and no LTE modem. This is a routing device with fibre, and nothing else.

The ports

• ether1: one gigabit copper port. The catalogue records it as the default WAN port, but in practice this is the port you manage the device on while the real work goes over fibre.
• sfp28-1 through sfp28-12: twelve 25 Gbit SFP28 cages. These are your ordinary uplinks and links to switches and servers.
• qsfp28-1-1 and qsfp28-2-1: two 100 Gbit QSFP28 ports. The catalogue lists one interface per cage; how a cage splits into several lanes depends on the module and on RouterOS, and our catalogue does not record that. Check with /interface ethernet print which interfaces actually appear on your unit.

There is no PoE-out on this model, so the PoE-out per port field does not appear.

The cables and modules matter more than the script here. An SFP28 cage often accepts 10 Gbit modules as well, a QSFP28 cage needs a module or DAC that matches the far end, and a wrong combination gives you a port that never comes up. See also Bonding if you want to bundle several cages towards the same far end.

What is inside

The catalogue records ARM 64bit, 16 GB of memory, the 98DX8525 switch chip and RouterOS licence level 6. Level 6 puts no limit on tunnels, sessions or routing daemons, and 16 GB is ample for full internet routing tables.

The catalogue's default configuration is router-ccr: this is a router, not a switch. For VLANs there is no hw_vlan: switch-menu, so you do not get the note that bridge VLAN filtering turns hardware offload off. The small-board note does not apply here either.

What we do not state: throughput figures, forwarding capacity, or how much of that 100 Gbit really gets through. Our catalogue does not record it for this model, and at this level the answer depends entirely on your configuration. Measure it on your own device, in your own setup.

What it is good at, and where it runs out

Good at: routing at high speed with dynamic routing, many sessions and full routing tables.

Where it runs out: here too, anything that has to go through the CPU does not scale with the port speed. Encryption, queue trees and complex mangle rules are CPU work on this device just as on a small board, only with more CPU behind them. And the configurator is a generator for a device at factory defaults: for a router already in production that you want to change in steps, you write the work yourself, or use the generated lines as a starting point. See Advanced.

Which roles fit

• Core router: the only role that belongs on this device. Routed interfaces without a bridge, OSPF and BGP, static routes, a strict management ACL, no NAT and no fasttrack. See BGP and OSPF.
• Harden only (baseline): for a CCR that already runs and where you only want to settle management access and brute-force protection.

Greyed out are Access point, CAP, Wi-Fi repeater and Wireless CPE, with the message that there is no Wi-Fi radio, and LTE / 5G router, because there is no modem. The routing roles such as Home router and Office router with VLANs are still offered, but they write a NAT router with a bridge, and that is not what this device does.

The quickest route to a working configuration

1. Pick One device and search for CCR2216.
2. Pick Core router.
3. At the routing step: addresses per interface, a loopback, and OSPF or BGP with your neighbours.
4. Restrict management access to your management network and switch off the services you do not use. See Management access and Hardening.
5. Set an admin password, reset the device and paste the script. See Using the script.

For a setup across several sites, see OSPF between sites and A numbering plan.

What trips people up

• Taking the QSFP interface names on trust. Our catalogue knows one interface per QSFP28 cage. What actually appears depends on the module and the breakout setting. Check it on the device.
• Modules that do not match. A cage does not come up when the module at the other end wants something else. That is not a scripting error.
• Using the gigabit port as an uplink. ether1 is one gigabit. On this device that is a management port, not an uplink.
• Pasting a script onto a router in production. The generated scripts assume factory defaults. Read them first, or use only the parts you need.
• Locking yourself out. Without a bridge no port works by itself. Arrange your management address and your serial access before you paste. See Locked out.