The RB1100AHx4 (product code RB1100x4) is a 1U rack router with thirteen gigabit ports. It belongs at the bottom of a cabinet, not on a desk. It fits where you need a lot of copper ports on one routing device: a building with several floors on their own cabling, a small provider with customers on separate ports, or an office where every department gets a port of its own.
Two things are missing, and they decide the choice. There is no Wi-Fi and there is no SFP cage: everything runs over copper, at gigabit. If you need fibre or 10 Gbit, a CCR2004 or an RB5009 suits you better.
The ports
Thirteen ethernet ports, ether1 through ether13, all 1 Gbit. ether1 is the default WAN port; the rest are yours to assign. There is no PoE-out on this model, so the PoE-out per port field does not appear: anything that wants power over the cable needs an injector or a PoE switch here.
With thirteen ports the question is not "do I have enough ports" but "what do I do with them". Two common answers:
- Everything in one bridge, with VLANs. The ports are then access or trunk ports and the router routes between the VLANs. See VLANs.
- Routed ports without a bridge. Every port its own subnet, with static routes or OSPF between them. That is what the Core router role writes. See Static routes and OSPF.
To bundle several ports towards a switch, use bonding; see Bonding. Several WAN connections are no problem with this many ports either; see Multiple WAN connections.
No Wi-Fi
There are no radios in this device. The Wi-Fi step does not appear in the wizard, and the Access point, CAP, Wi-Fi repeater and Wireless CPE roles are greyed out with the message that there is no Wi-Fi radio. LTE / 5G router is greyed out because there is no modem.
Wi-Fi here comes from access points on the ports. To manage them centrally, pick the Router + CAPsMAN role or switch the CAPsMAN controller block on alongside a router role. See CAPsMAN and, for a setup with several devices, Multiple devices.
What is inside
The catalogue records ARM 32bit, 1 GB of memory, the RTL8367 switch chip and RouterOS licence level 6. Level 6 is the top level: no limits on tunnels, sessions or routing daemons. With a gigabyte of memory the small-board note never appears here.
For VLANs there is no hw_vlan: switch-menu, so you do not get the note that bridge VLAN filtering turns hardware offload off. Bridge VLAN filtering is the ordinary route here. The catalogue names one switch chip for this model and does not record how the thirteen ports are divided behind it, so this page says nothing about that. If throughput between two particular ports matters to you, check on the device itself with /interface bridge port print whether hardware offload is active on them.
What it is good at, and where it runs out
Good at: many copper ports on one routing device, with enough memory and licence room for a serious firewall, tunnels and dynamic routing.
Where it runs out: everything is gigabit. A line above a gigabit does not fit on these ports, however you divide them. And as on every model, anything that has to go through the CPU, tunnels and queue trees first among them, does not scale with the port count. Our catalogue records no throughput figures for this model, so this page does not quote any. Measure it on your own device.
Which roles fit
- Core router: routed interfaces without a bridge, OSPF or BGP, a strict management ACL, no NAT and no fasttrack. A serious option on this device. See BGP.
- Office router with VLANs: thirteen ports is more than enough for desks, trunks and a WAN.
- VPN gateway: licence level 6 puts no limit on the number of tunnels. See Site-to-site tunnels.
- Hotspot: usable, with a guest VLAN on a port of its own.
- Home router and Harden only (baseline): available, though this is a large device for a household.
The quickest route to a working configuration
- Pick One device and search for
RB1100. - Pick Office router with VLANs if everything may share one bridge, or Core router if you want routed ports.
- Fill in your internet connection on
ether1. - Divide up the ports: which are access, which are trunk, which are unused. Unused ports can be switched off in Bridge and ports.
- Set an admin password, reset the device and paste the script. See Using the script.
If this device sits in a network with several sites, look at Hub and spokes and OSPF between sites.
What trips people up
- Expecting fibre. There is no SFP cage on this model. Everything goes over copper.
- Expecting PoE. This model powers nothing, not even on the last port.
- Assuming offload. Check on the device whether hardware offload is active between the ports you care about.
- Leaving all thirteen ports in the bridge. Ports with nothing on them are better switched off. That saves surprises when someone plugs something in later.
- Locking yourself out after pasting. In a Core router setup without a bridge there is no LAN port that "just works". Think about your management address in advance. See Locked out.