MikroTik User Management Engineer with LABS

Explore the pptp tunneling protocol, its 1995 origin, advantages and weaknesses, including security concerns, required ports 1723 and 47, and side to side versus client-side configurations.

Configure a pptp site-to-site vpn between headquarter and branch routers, including profiles, secrets, and encryption, and validate connectivity with ping.

Configure a pptp client-to-site vpn using a local ip pool, create a vpn profile, user, and secret, then troubleshoot same-ip range issues with proxy arp on the headquarters interface.

Configure PPTP with bridge control protocol (BCP) to enable layer 2 VPN connectivity between client and headquarter, by creating bridges, enabling encryption, and setting MRU to 1600.

Explore L2TP, the layer 2 tunneling protocol by Cisco and Microsoft, its UDP 1701 use and 256-bit encryption, and how it can run with or without IPsec for security.

Configure a site-to-site l2tp vpn between headquarters and branch office using l2tp server and client, with optional ipsec for stronger security and UDP ports 500 and 4500 considerations.

Configure L2TP/IPsec for remote client-to-site vpn using windows built-in vpn client; connect to the headquarter vpn server, verify ipsec profile settings, and test active connections.

Explore the MikroTik EOIP tunnel, a proprietary protocol that encapsulates layer 2 networks over IP, and learn to configure it in a lab to see networks on opposite sides communicate.

Learn to configure ethernet over ip (eoip) on MikroTik to encapsulate layer 2 ethernet frames in ip, creating seamless site-to-site layer 2 connectivity.

Configure an eoip tunnel over an l2tp tunnel to carry ip over it, then create ip tunnel interfaces and bridges on both ends to achieve layer 2 connectivity.

Explore internet protocol security (IPsec), a widely used vpn that secures connections between remote users and sites through confidentiality, integrity, and authentication.

ipsec is a protocol suite that protects ip traffic for vpn connectivity. It provides confidentiality through encryption, integrity via hashing, and mutual authentication.

Explore the IPsec protocol suite as a flexible IPCC framework for protocol negotiation. Learn how to select encryption, integrity, and authentication options to meet confidentiality goals.

Explain IPsec transport mode, which encrypts transport layer and above while leaving network and data-link unencrypted, and tunnel mode, which encrypts from the network layer and adds an IP header.

Explain encryption and its role in confidentiality for data sent over networks. Contrast symmetric encryption, using a shared key, with asymmetric encryption, using public and private keys.

Learn how IPsec uses a hybrid of symmetric and asymmetric keys to securely exchange a shared secret with Diffie-Hellman, then encrypts traffic using that key.

explains symmetric and asymmetric encryption protocols used in MikroTik, comparing des, 3des, aes, blowfish, camellia, rsa, and dh, and advises using aes with rsa/dh for secure ipsec setups.

Explore how data integrity ensures the data sent via IPsec remains unchanged by using hashing algorithms like MD5, SHA-1, SHA-256, and SHA-512 to generate and verify digests.

Explore ipsec authentication, comparing pre-shared keys and certificates, and learn how a certificate authority issues certificates, enabling mutual authentication and protecting against man-in-the-middle attacks.

Explore IPsec negotiation protocols, comparing AH and ESP, and explain how IKE phase 1 and phase 2 establish a VPN tunnel, selecting encryption and authentication methods.

Explore how IPsec works, the five phases of negotiation, and how to configure IPsec for VPNs, followed by a hands-on lab.

Explore the IPsec negotiation process, including five phases, and how interesting traffic triggers a VPN, with options to encrypt, transmit in clear text, or discard.

Explore how ipsec ike phase 1 negotiates security associations between two routers to form the isakmp tunnel, deciding hashing, authentication, dh group, encryption, and lifetime.

Learn how IKE phase 1 negotiates between two peers using main mode or aggressive mode, comparing six-message exchanges for version 1 and three-message exchanges for faster setup with security implications.

Learn how ike phase 2 establishes an ipsec tunnel to protect user data, using quick mode and negotiating protocol (esp/ah), encapsulation (transport or tunnel), encryption, hashing, and lifetime.

Explore how IPsec site-to-site VPN uses IKE phase one and phase two tunnels to securely transfer data with encryption and integrity protections in a lab on two routers.

Explore the differences between IKEv1 and IKEv2, including bandwidth use, built-in NAT traversal, authentication, phase one mechanics, and keep-alive, for choosing the right ipsec setup.

Move from theory to ipsec lab, wiring two hosts and isp adapter to reach each other's outside ip, and configure ipsec phase one and two with main and aggressive modes.

Configure the ipsec tunnel preconfiguration by interconnecting two routers to the internet, assigning ip addresses, setting default routes, and implementing nat masquerade to enable cross-network reachability.

Explore configuring a site-to-site ipsec tunnel on MikroTik devices using IKEv1 and IKEv2, including phase 1 and phase 2 setups, profiles, peers, proposals, and policies in a lab walkthrough.

Configure a site-to-site IPsec tunnel using IKEv1 and IKEv2, adjusting main and aggressive modes on both sides, and apply firewall rules with masquerade to allow and test traffic via IPsec.

Explore PPPoE, the ISP style PPP over Ethernet, and learn to create a PPPoE server, authenticate clients with usernames and passwords, and test internet sharing in a lab.

Explain how PPPoE works, detailing server-client base, multi-link support, and authentication options, and walk through the discovery to session establishment using PADI, PADO, PADR, PADS, and PADT.

Explore how pppoe establishes connectivity through lcp negotiation, authentication, and ipcp, and learn to capture and analyze the traffic between pppoe server and client in a lab.

Configure a MikroTik PPPoE server with pools, profiles, and secrets to distribute internet to two customers, using an outgoing interface, local addresses, and NAT masquerade.

Turn a MikroTik router into a switch by bridging ports, then configure PPPoE clients for two customers, set up DHCP and masquerade, and validate connectivity and speeds.

Explore PPPoE options in MikroTik labs by adjusting customer profiles, IP pools, and local and remote addresses, then set session and idle timeouts to manage disconnects.

Configure PPPoE profiles to assign usernames and passwords with specific rate limits (1 Mbps vs 2 Mbps) and enforce single-use connections per profile.

Explain and configure wireless hotspots on the router by using captive portals, open wireless networks, user accounts with speed profiles, and external authentication via a radio server or user manager.

Learn how the MikroTik hotspot provides a wireless public network, assigns IP addresses via DHCP, and redirects users to a captive portal for authentication before Internet access.

Identify and verify the key prerequisites for configuring a MikroTik hotspot, including a valid IP address on the external interface, internet connectivity, a functional DNS server, and an open WLAN.

Enable hotspot, configure dhcp client on the internet interface, set wlan as ap bridge with an open ssid 'wifi hotspot', assign 192.168.30.1/24, test dns and update routeros.

Configure the hotspot on a MikroTik router using the wizard, set up IP pool, masquerade, DNS, and a captive portal, then verify client connectivity and hotspot status.

Configure MikroTik hotspot cookies and a free 10-minute trial to manage user access via captive portal, disable cookies for privacy, and monitor active sessions.

Learn how to manage MikroTik hotspot users by enforcing time-based access and bandwidth limits, including uptime caps and download or upload byte limits.

Learn to create and apply MikroTik hotspot user profiles to regulate bandwidth, including a trial profile with 256 kbps upload and 512 kbps download, plus per-user limits.

Create and manage user profiles to enforce speed limits on a MikroTik hotspot; test logins from mobile and PC, verify bandwidth caps, and configure session and idle timeouts.

Configure MikroTik hotspot advertising by creating an advertise user profile, enabling ad banners, and cycling web site prompts every 30 seconds with a 10-second timeout, using transparent proxy.

Explore how IP bindings bypass hotspot authentication, allowing devices to access the internet without username and password, with MikroTik hotspot management techniques demonstrated in practical lab steps.

Learn how to use MikroTik hotspot walled garden to let users access specific websites without authentication by configuring destination hosts with a star rule and leveraging IP lists.

Change the captive portal's appearance by editing hotspot pages, swapping in your logo, applying a new theme, and configuring login redirection on MikroTik's hotspot system.

Enable a MikroTik hotspot to show a secure splash page with a self-signed certificate. Create and trust a certificate authority, sign the hotspot certificate, and apply it to IP services.

Become a MikroTik certified engineer through official trainings with Maher Haddad and pass the exam, with in-person sessions in Netherlands or online courses and contact via phone, WhatsApp, or email.