# Runbook — CRS310 switch (`crs310-maker`)

The "new switch" at the makerspace. MikroTik **CRS310-8G+2S+IN**, RouterOS
7.19.6. Managed by Ansible from `~/Projects/MakerFLOSS_Mikrotik`.

**Authoritative sources:**
- Live topology + cutover runbook:
  `MakerFLOSS_Mikrotik/docs/superpowers/specs/2026-06-09-crs310-flat-mgmtvlan-design.md`
- Running config snapshot: `MakerFLOSS_Mikrotik/backups/crs310-maker/export.rsc`
- Device vars: `MakerFLOSS_Mikrotik/host_vars/crs310-maker.yml`
- Field guide: `MakerFLOSS_Mikrotik/docs/makerspace-switch-fieldguide.md`

## Topology recap

- **Transparent L2.** The switch is *not* a router — no inter-VLAN routing, no
  presence on the data network.
- **Data VLAN 30** (`10.2.30.0/24`, gw `.1`): `ether1` = uplink, `ether2–7` =
  access (untagged), SFP+ reserved (deferred). Users plug in here.
- **Mgmt VLAN 99** (`192.168.88.0/24`): switch at `192.168.88.1`, reachable
  **only via `ether8`** (untagged). DHCP `.10–.254`, web UI on. CPU is the only
  tagged member. No default route, no DNS, no NTP — isolated by design.
- `vlan-filtering=yes` went live **2026-06-09**.

## Reach

- **Mgmt (reconfig, SSH, web UI):** you need a host on **`ether8`**. On-site:
  plug mamba into `ether8`, SSH `192.168.88.1` (or `http://192.168.88.1`).
  Remote: there is no standing tunnel to the mgmt VLAN — forward through a host
  that *is* on `ether8`. See [access.md](../access.md) §A / §B.
- **Data path test:** plug into `ether2–7`, expect a `10.2.30.0/24` lease.

## Diagnose

| Symptom | Check |
|---------|-------|
| No link / no DHCP on an access port | Confirm you're on `ether2–7` (data), not `ether8` (mgmt). Verify uplink `ether1` is up to `10.2.30.1`. |
| Can't reach switch mgmt | Are you on `ether8`? Mgmt is reachable **nowhere else**. Confirm a `192.168.88.x` lease. |
| Suspected config drift | Diff live vs repo: run a backup play, compare `backups/crs310-maker/export.rsc` to git. |
| Lockout after a change | See recovery below. |

Connectivity test via Ansible (from `MakerFLOSS_Mikrotik`, mamba on `ether8`):

```bash
ansible -m community.routeros.command -a "commands='/system/resource/print'" crs310-maker
```

## Fix

Changes land in **`MakerFLOSS_Mikrotik` on `main`** (per the repo's own
workflow). Device-touching rules — **do not skip**:

- Run any device-touching play **twice**; the second run must report no changes
  (idempotency).
- **Enable `vlan-filtering` last**, after bridge/PVID/mgmt-VLAN are proven.
- Network-affecting changes (mgmt IP/VLAN) should run as a **self-reverting
  detached job** (240s timeout) so a bad flip auto-rolls-back.
- Keep a **WinBox MAC-telnet or serial** recovery channel open when touching
  network settings.

```bash
# from ~/Projects/MakerFLOSS_Mikrotik, mamba on ether8
yamllint . && ansible-lint && ansible-playbook play_switch.yml --syntax-check
ansible-playbook play_switch.yml                 # full day-2
ansible-playbook play_switch.yml --tags vlans    # one domain
ansible-playbook play_backup.yml                 # snapshot config into the repo
```

## Recovery (lockout)

Documented gotchas from the 2026-06-09 cutover (see the spec):
- **mamba NetworkManager flap** on the bench — pin the `crs310-bench` profile
  `autoconnect yes`, static `192.168.88.2/24`.
- RouterOS `find ... address=` does **not** match IP prefixes — use
  `find interface=` instead (caused a bridge-IP removal bug).
- If locked out over the network, recover via **WinBox MAC-telnet** on `ether8`
  or serial console; the detached-job timeout should also self-revert.

## Verify

- `ansible-playbook play_switch.yml` second run → **no changes**.
- Access-port client gets a `10.2.30.0/24` lease and reaches the gateway.
- `ether8` client gets `192.168.88.x` and can SSH `192.168.88.1`.
- `export.rsc` committed and matches intent.