Hacker News Reader

Comment by tucnak | Hacker News Reader

For traversing public networks, simply consider BGP over Wireguard. VXLAN is not worth it.

I've used wireguard for a while, not sure why I never considered doing BGP over it, might make for a fun weekend project.

BGP is vastly superior to any L2 make-believe trash you can imagine, and amazingly, it often has better hardware offloading support for forwarding and firewalls. For example, 100G switches (L3+) like MikroTik's CRS504 do not support IPv6 in hardware for VXLAN-encapsulated flows, but everything just works if you choose to go the BGP route.

L2 is a total waste of time.

Any ASIC switch released in the last decade from Cisco/Juniper/Arista supports EVPN/VXLAN in hardware. EVPN is built on BGP. This has become the industry standard for new enterprise and cloud deployments.

The lack of support for hardware EVPN is one of the many reasons that Mikrotik is not considered for professional deployments.

Mikrotik is used for professional deployments all over the world. Right tool for the right job.

People who think one size fits all are not professional.

If I can source an enterprise Cisco/Juniper/Arista ASIC switch that is 1) rock-solid 2) full featured 3) cheaper - which I can - there is unfortunately no rationale where Mikrotik would be applicable in any professional project of mine.

With that said, I love Mikrotik for what it is: it is very approachable and it fills a niche. I believe it has added a lot of value to the industry and I'm excited to see their products mature.

You're delusional on price. I wouldn't touch severely overpriced and backdoored American switches with a 10-foot pole! Meanwhile, MikroTik just released a 400G switch in under two grand. To buy Cisco/Juniper/Arista with your own money in 2025 you have to be super rich and super stupid. And I say this as a guy that buys 100G stuff from Xilinx.

I have not seen a case where I could not source a Juniper switch (for example) for lower $/port than Mikrotik, even at 400GE. It is unheard of to pay MSRP. YMMV.

Based on the lldp messages I see across dozens of countries, the majority of business isps globally use mikrotiks at their edge.

I'm curious what you classify as a business ISP?

Take a look at AMS-IX, one of the largest internet exchanges: https://bgp.tools/ixp/AMS-IX

21/1020 (2%) of all peers are Mikrotik. 15 (1.4%) of those are >=1000mbps. 7 (0.6%) of those are 10gbps. None are larger than 10gbps.

Those selling end services to businesses.

I have a mix of equipment from heavyweight juniper mxs at peeing points to arista dcs/ccs in large sites to £50 mikrotiks in the smallest branch offices.

Right tool for the right job, mikrotik is often but not always the right tool.

Mikrotik can be popular for CE (Customer Edge) devices, that is correct. Those are not ISPs however, those are customers.

You're referencing backbone, not edge. It has only been a few years that MikroTik had offered a 100G solution, let alone became competitive in it. You won't find it in the backbone yet. However, many European ISP's have largely upgraded their distro and aggregation switches to MikroTik over the last five years. There's a sovereignty push, too. I would guess edge is similar, but there's too many cheap options there so probably not that much.

If your impression is based on data circa ~2020, you should re-evaluate your priors with the recent packages in mind. See https://mikrotik.com/product/crs812_ddq

CE (Customer Edge) is what you are referring to. ISPs would be the PE (Provider Edge). I am aware it can be popular for SMB CE devices, however that is simply not the case for PE devices.

Service Provider ISPs cannot use Mikrotik - It is impossible. RouterOS supports none of the features required for a service provider. VRFs are even still unsupported in HW [1]. I am confused why this is even a discussion as anyone with experience working at an ISP/SP would come to the same conclusion.

[1] https://help.mikrotik.com/docs/spaces/ROS/pages/62390319/L3+...

There are many ISP's that successfully run their networks on BGP, without VRF unless their customers specifically require it. It simply means that VRF-heavy architectures (like dense MPLS L3VPN etc.) would require additional hardware. Nobody says you have to use MikroTik for everything, and nobody says it's the ultimate solution to all ISP problems. I don't get it where this maximalist view comes from—all or nothing. The typical MPLS VPN scenario has to do with overlapping address spaces, and for customer separation most aggregation layer deployments use pure L3 routing with VLAN segmentation in the first place.

There's a famous use-case from 10 years ago (sic!) of using MikroTik for serving over 400 customers, see https://mum.mikrotik.com/presentations/ID16/presentation_340... proving you could do it on small scale many years ago. Needless to say, A LOT has improved since. MikroTik has become a serious, and affordable means to power a small-to-midsize ISP in the recent years. Of course there are "enterprise" features for some people to get knickers in a twist over, but they are well beyond necessity. It's often that people were taught certain techniques, a certain way to do things (which more often than not includes all this domain over-extension madness and all that it carries with it up to L7!) so they struggle to adapt to alternative architectures.

To say that it's "impossible" to provide ISP services with MikroTik is reaching.

Reply on news.ycombinator.com