MikroTik recently updated their documentation site from an Atlassian Confluence Wiki to much more AI-friendly Docusaurus here: https://manual.mikrotik.com/
Any page can be easily converted into Markdown by appending .md to the URL. I mention this because in my experience, the agent is much more accurate when it has access to the docs.
It’s interesting to observe and build LLM-driven solutions in Networking.
The biggest challenges that most of us networking people have are around velocity (how fast we can build and scale networks) and how effectively we can operate them (avoid defects, fix them fast when something breaks).
LLMs are great in both areas. AI helps with deployment challenges by speeding up tooling development and the creation of workflows on orchestration platforms. A manual process step today, say - reserving an IP address in an IP DB — is automated the next day instead of on a backlog for years. This post is an example of that (config-gen/config-deploy).
Operations use-cases are more interesting, IMO, and address the “too many signals” problems that we face. Network substrate telemetry, overlay telemetry, service host metrics, service metrics, customer metrics, recent change data, prior alarms - the list goes on. Being a network operator is not for the faint of heart and is under-mentioned on high stress job lists. AI makes AMAZINGLY good network operations triage agents, since they are able to immediately process so many signals.
Nuance. LLMs are just going to report that they cant SSH to an endpoint, after delivering your vibeconfig, and throw it back to you to resolve connectivity. Your velocity with LLMs will stall at break fix every time.
>AI makes AMAZINGLY good network operations triage agents, since they are able to immediately process so many signals.
I have seen a lot of tokens spent on solutions that could have just been grafana.
I've been doing some of this too. It's great just messaging claude in discord when I want to make a new device's IP static. I also put my mikrotik config sans passwords in (local only) version control, just in case.
And perhaps it's significantly easier on other routers, but I would not have gotten VLANs working without claude doing it for me...
The important thing you need to do is specify which Mikrotik version you're using; apparently the syntax for some things changed between 6 and 7.
It does pretty well, but you need to iterate. I was trying to get it to disallow internet access for non-DHCP clients, and in the end there were so many limits to what was possible that it wasn't worth it. But it did it, and when I was testing I found them.
So like everything for best results you need to know what you're doing so you can test effectively...but it saves you from learning the syntax etc.
A word of warning, my experience with mikrotik in the WiFi-6 space has been overwhelmingly negative, both in a single AP setup at home and on a corporate WiFi network managed by someone else.
Bugs, random drops, poor performance on some machines. It is not set and forget and I gave up on it.
I would expect LLMs to be especially excellent at configuring Mikrotik stuff, given MT publishes markdown reference docs for LLM ingestion, the full config without secrets can be dumped to one text file, and their cli commands are very stable between versions.
I switched recently to OpenWrt from MT, which code agents are also good at. I'd wager most issues are going to be related to the user not specifying what they want clearly enough. The translation from network concepts to RouterOS config is pretty 'fat-free', so there's not much room for hallucinations beyond syntax errors, which can be verified via the API.
Yes! Recently connected two disparate systems (ubiquiti and mimrotik) using their exposed API’s and a Claude session so that systems I have on either environment could talk to each other. I am not a network engineer so it was liberating to get my gear working together. That said it’s a work in progress and just today I noticed something weird that one of my computers can’t access Minecraft servers while the rest of my network can
Probably a routing issue. Shot in the dark would be that one of these routers is NATing traffic, and the other router doesn’t have a route to that NAT’d range.
I only have the agent investigate directly. To actually configure the Mikrotik, I have the agent write a script that is aimed to be idempotent and then run the script. Investigation is fine, but the script acts as a memory of intent which I find useful. As agents get better, it can be a textual representation rather than a script, but for now that suffices.
> I have the agent write a script that is aimed to be idempotent and then run the script.
You can take this one step further and have the agent write Terraform configs [1]. I did this (including having the agent import all the initial resources from the live device), works great and is generally more robust than a script.
I originally wrote specific terraform providers (even one for just configuring an Ubuntu machine), but over time I found that TF is a bit too heavyweight for my use-cases. The shell script works well because state divergence can be investigated by the LLM. The slowness of state refreshing etc. does make a TF apply painful. For me at least.
> As agents get better, it can be a textual representation rather than a script, but for now that suffices
I can’t see any reason to have agents do what a script can do. If the operation is deterministic then why pay every time it gets done? This is why MCP seems so pointless to me.
It's adaptive and can handle config drift if someone has altered the machine in the meantime between script invocations. Not required if you're disciplined, of course.
I’ve been using ChatGPT to configure my mikrotik gear for about a year it’s pretty awesome. And the end result is well documented reusable scripts rather than my usual set of random stack overflow copy pastes and shitty inscrutable notes
I want something similar to this but for Ubiquiti. I don’t need anything fancy, just something that audits my home config and tell me if I’m doing something stupid, dangerous, or both.
Same. Recently Ubiquiti has been putting more and more into the local API, so this should be getting easier to do. The Home Assistant UniFi integration just recently has started moving from private undocumented API endpoints to the newer public API endpoints.
In other news, Meraki has an AI assistant feature now.
>One of the usual complaints about MikroTik has been its complex ui/configuration. In a sense, I don’t know if that’s true inasmuch as networking is complicated in itself
Really? Its standard point and click engineer stuff. The biggest issues with Mikrotik are the features not implemented in the gui, or the way config is interpreted between versions. Also the term of hardware support, and generally flaky code in general.
>The point I’m trying to make is yeah, networking can just be hard. I’ve been half-networking, amateur-ishly, for a while now - setting up networks for friends and friends’ offices, making cables, patching small panels etc. I almost certainly couldn’t pass an official “Certified Routing Engineer” cert - well, not without studying a lot (believe in yourself).
Ok so just a hobbyist perspective.
It seems like this article is just "Point an LLM at your mikrotik api, have fun"?
Any page can be easily converted into Markdown by appending .md to the URL. I mention this because in my experience, the agent is much more accurate when it has access to the docs.
The biggest challenges that most of us networking people have are around velocity (how fast we can build and scale networks) and how effectively we can operate them (avoid defects, fix them fast when something breaks).
LLMs are great in both areas. AI helps with deployment challenges by speeding up tooling development and the creation of workflows on orchestration platforms. A manual process step today, say - reserving an IP address in an IP DB — is automated the next day instead of on a backlog for years. This post is an example of that (config-gen/config-deploy).
Operations use-cases are more interesting, IMO, and address the “too many signals” problems that we face. Network substrate telemetry, overlay telemetry, service host metrics, service metrics, customer metrics, recent change data, prior alarms - the list goes on. Being a network operator is not for the faint of heart and is under-mentioned on high stress job lists. AI makes AMAZINGLY good network operations triage agents, since they are able to immediately process so many signals.
Exciting times!
Nuance. LLMs are just going to report that they cant SSH to an endpoint, after delivering your vibeconfig, and throw it back to you to resolve connectivity. Your velocity with LLMs will stall at break fix every time.
>AI makes AMAZINGLY good network operations triage agents, since they are able to immediately process so many signals.
I have seen a lot of tokens spent on solutions that could have just been grafana.
And perhaps it's significantly easier on other routers, but I would not have gotten VLANs working without claude doing it for me...
It does pretty well, but you need to iterate. I was trying to get it to disallow internet access for non-DHCP clients, and in the end there were so many limits to what was possible that it wasn't worth it. But it did it, and when I was testing I found them.
So like everything for best results you need to know what you're doing so you can test effectively...but it saves you from learning the syntax etc.
Bugs, random drops, poor performance on some machines. It is not set and forget and I gave up on it.
I switched recently to OpenWrt from MT, which code agents are also good at. I'd wager most issues are going to be related to the user not specifying what they want clearly enough. The translation from network concepts to RouterOS config is pretty 'fat-free', so there's not much room for hallucinations beyond syntax errors, which can be verified via the API.
Networking can be complex. Standards allow interoperability but they do not magically make everything work with no configuration.
Just because standards like DNS, NAT64, OSPF, ARP, etc, exist doesn't means its easy to get these things to communicate.
Ubiquiti isn't exactly known for being the best in terms of standard adherence, especially with their historically week IPv6 support.
You can take this one step further and have the agent write Terraform configs [1]. I did this (including having the agent import all the initial resources from the live device), works great and is generally more robust than a script.
[1] https://github.com/terraform-routeros/terraform-provider-rou...
I can’t see any reason to have agents do what a script can do. If the operation is deterministic then why pay every time it gets done? This is why MCP seems so pointless to me.
In other news, Meraki has an AI assistant feature now.
[0] https://pfrest.org/api-docs/ [1] https://docs.opnsense.org/development/api.html
Really? Its standard point and click engineer stuff. The biggest issues with Mikrotik are the features not implemented in the gui, or the way config is interpreted between versions. Also the term of hardware support, and generally flaky code in general.
>The point I’m trying to make is yeah, networking can just be hard. I’ve been half-networking, amateur-ishly, for a while now - setting up networks for friends and friends’ offices, making cables, patching small panels etc. I almost certainly couldn’t pass an official “Certified Routing Engineer” cert - well, not without studying a lot (believe in yourself).
Ok so just a hobbyist perspective.
It seems like this article is just "Point an LLM at your mikrotik api, have fun"?