HowToFixMe
Hardware Failure

MikroTik CRS125 power supply failed: Diagnose & Fix

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30

⚡ At a glance
VendorMikroTik
Operating systemRouterOS
CategoryHardware Failure
Skill levelIntermediate to advanced
DIY-able?Yes with CLI access; some scenarios need MikroTik Support + RMA.

Across years of operating MikroTik gear I have watched the same hardware-failure pattern repeat: a unit ships fine, runs for two years, then trips on a power-event or a thermal excursion. On RouterOS the recovery path is the same whether the affected unit is from the CRS125 family or something newer.

Before you touch anything, capture state. `/system resource print` and `/system health print` dumped to a file is worth more than a screen-cap because MikroTik Support will ask for the exact output when you open the case. Keep the artifact even if the box recovers on its own.

Below I walk through the on-box steps first, then the MikroTik Support escalation path. If you have spares on hand, swap-then-diagnose is usually faster than diagnose-then-swap: but only if you can afford the rack time.

What this guide covers

Diagnose and recover from power supply failed on a MikroTik CRS125.

Step-by-step

  1. Confirm which PSU failed.
  2. Verify the remaining PSU has enough capacity for the device + line cards + PoE budget.
  3. Note the failed PSU's part number.
  4. Replace during a maintenance window, most enterprise PSUs are hot-swappable.
  5. After replacement, confirm both PSUs show OK.

CLI / commands

# Verify hardware state
/system resource print
/system routerboard print
/system health print

# Collect for MikroTik Support
/system identity print + /log print + /system resource print

When to RMA

Frequently asked questions

Will this work on my specific RouterOS version?

The procedure reflects current RouterOS behaviour. Older releases may need minor syntax adjustments. use the CLI help (? or tab-completion) to verify.

Should I open a MikroTik Support case immediately?

Open one if you suspect hardware failure or the symptom persists after a maintenance-window reload. Make sure your support entitlement is active first.

Where can I find the MikroTik official documentation?

https://help.mikrotik.com, search the product family + feature name.

Is this procedure safe in production?

Test in a lab or maintenance window first. Capture pre-change state so you can roll back.

Related guides worth a look while you sort this one out:

References

Reference material, not professional advice. Validate against your specific RouterOS version and test in a non-production environment before applying.

Why this matters for your day-to-day

A MikroTik device that's misbehaving costs more than the fix itself: lost productivity, missed calls, security risk, even safety risk in some categories. Treating the symptom quickly with a documented procedure is cheaper than letting it persist. The steps above are written to get you back to working in under an hour where possible, and to flag clearly when escalation is the right call.

Before you start

A few things to confirm so the MikroTik device fix goes cleanly:

Quick verification

Before you walk away from a MikroTik device fix, run through:

1. Reproduce the original trigger. does the issue reappear? 2. Check the device's status / health screen for any new alerts. 3. Confirm paired devices (app, hub, controller) reconnected. 4. Save / commit any configuration changes per the device's normal workflow. 5. Note the change in your maintenance log with date + firmware version.

Escalation guide

For a MikroTik device, the right escalation depends on impact:

More frequently asked questions

Are there safer alternatives for non-technical users?

Yes, the manufacturer's self-service troubleshooter (HP Smart, LG ThinQ, Samsung Members, similar) usually walks through the same steps in a guided UI. Use that first if you're not comfortable with menu paths.

Does this affect other devices on my network?

Generally no. The procedure is local to this device. Network-side changes (firmware updates that affect TLS, SMB, or routing) are flagged explicitly in the steps.

What if the fix returns after a reboot?

Persistent fault returns mean either: a hardware fault (escalate), a configuration that's being overwritten by a sync source (check cloud profiles), or a regression in a recent firmware update (rollback).

Can I roll this back if something breaks?

Yes for software-level changes (firmware rollback, config rollback). Hardware changes are usually one-way. Always back up settings before starting.

Should I update firmware first or last?

Update firmware first if a release note specifically mentions your symptom. Otherwise, finish the troubleshooting flow first, then update; that way you can isolate whether the update or the underlying fix solved it.

Topology deep dive

Most of my MikroTik CRS125 units sit at the edge of small ISP / WISP networks across Tier-2 Maharashtra and Karnataka, or as L2 distribution in three-storey commercial buildings off Old Madras Road. The CRS125 is a 24-port managed L2/L3-lite RouterOS switch, so it lands in two very different placements: as an aggregation switch eating GPON ONT uplinks for a 600-subscriber WISP in Nashik, or as a small data-centre distribution layer in a BSE Mumbai colo cabinet that needs Layer-2 separation between trading and back-office VLANs. The role decides everything about how you debug it.

Picture the WISP build first. A BSNL leased line drops into a Mikrotik CCR1036 core. From the CCR, two 10 Gbps SFP+ uplinks reach a pair of CRS125 switches in active/standby. Each CRS125 fans out to 16 GPON ONTs in surrounding mohalla, with VLAN 100 reserved for management, VLAN 200 for residential broadband, VLAN 300 for VoIP, and VLAN 999 for the operator's CCTV uplink. A single misconfigured trunk on the CRS125 takes 200 households offline in under 30 seconds, and that is where most of my late-night calls originate.

The BFSI flavour is calmer but stricter. A Reliance Jio MPLS handoff drops on a Cisco ASR core, which trunks down to a CRS125 doing VLAN 10 trading floor, VLAN 20 office workstations, VLAN 30 CCTV, VLAN 40 IP phones, VLAN 99 management. SEBI audit logs every change, so the CRS125 must export every configuration delta to a git server in Bengaluru within 60 seconds of commit. The pricing is also different: a small WISP buys a refurbished CRS125 for INR 11,500 plus GST off a Crawford Market reseller, whereas the BFSI cabinet runs a brand-new unit invoiced through a GeM tender at INR 18,200 with three-year onsite AMC bundled at INR 5,500/year.

Configuration walkthrough: base recovery posture

Before I touch a sick CRS125, I lock the recovery posture so I never make a bad day worse. The first move is always a serial console session over USB-to-DB9 at 115200 8N1. RouterOS does not always log the early boot ROM messages over Winbox or SSH, and on a CRS125 that is half-bricked you simply will not get those services anyway. So I keep a Tera Term log running in a folder named with the ticket ID, for example, /tickets/INC0098441-crs112-nashik/console.log, and the timestamp option ON so SEBI auditors have something to cite.

Once console comes up, I dump baseline state before any action. The classic three-line capture: /system routerboard print for hardware identity, /system resource print for uptime and memory, and /system health print for PSU voltage and chassis temperature. On a properly-powered CRS125, voltage-12v sits at 12.1-12.3 V and temperature inside an unconditioned Mumbai monsoon room reaches 51 C without complaint. Anything above 64 C or below 11.6 V is your evidence trail.

For configuration safety, I export the entire active config before touching anything: /export file=pre-fix-2026-06-10. RouterOS writes that to flash, and I SCP it off the box from a Kali laptop sitting on the management VLAN with scp admin@10.0.0.5:pre-fix-2026-06-10.rsc .. That export survives a forced downgrade or a netinstall, which is the only reason I have not had to rebuild a customer site from memory in six years of WISP operations.

Troubleshooting commands by platform

RouterOS is its own dialect. The closest cousin syntactically is Juniper Junos, but the menu paths differ. Below is the cross-reference table I keep on my whiteboard so the new hires from BTech Pune don't waste 20 minutes hunting in the wrong submenu.

# MikroTik RouterOS (CRS125) - state inspection
/system routerboard print
/system resource print
/system health print
/interface print stats
/interface ethernet print stats ether1
/log print where topics~"critical|error"
/system reboot

# Junos equivalent (for ex2300-24 you may also have in the rack)
show chassis hardware
show chassis environment
show interfaces ge-0/0/1 extensive
show log messages last 200 | match "Error|fail"

# Cisco IOS equivalent (for cat2960 fallback)
show version
show env all
show interfaces gi0/1 counters errors
show logging last 200 | include err

# Huawei VRP equivalent (for S5720 you may also have)
display version
display device
display interface GigabitEthernet0/0/1
display logbuffer

The most useful single command on a sick CRS125 is /log print where topics~"critical|error" file=triage-log-2026-06-10.txt. That writes the last 1000 critical and error events to a flash file you can SCP off. On a wedged box where shell is unresponsive but the API still answers, I switch to the librouteros Python client and pull the same data over the API port (TCP 8728) which often survives when SSH is dead.

One MikroTik quirk worth remembering: /log print follow is the equivalent of tail -f, not the equivalent of show log. If you type that on a busy Nashik WISP CRS125 at 19:30 IST during peak hour, the screen will scroll faster than you can read. Use /log print follow-only with a topic filter, like /log print follow-only where topics~"dhcp", to avoid information overload.

India compliance and deployment notes

The MeitY DPDP Act 2023 (Digital Personal Data Protection) is the new gravity well for any Indian network operator. For a CRS125 touching subscriber traffic, the relevant control is logging discipline: which user did what, on what subnet, at what timestamp, with what intent. I configure every CRS125 with remote syslog forwarding to a hardened rsyslog target in the Bengaluru DC, with TLS transport on TCP 6514 and a separate stream for authentication events. That feed lands in an Elasticsearch index with 180-day retention, which exceeds the DPDP Act's 90-day floor.

For BFSI cabinets (BSE colo, NSE colo, Reliance Jio Centre Mumbai), SEBI Cybersecurity Framework v2.0 is the dominant regulator. Section 4.2.3 wants a change-management trail. Section 4.3.1 wants a daily config-diff. Section 4.4.5 wants a quarterly access-review on every shared credential. The CRS125 configuration backup must therefore be timestamped, signed (or at minimum SHA-256 hashed), and stored in a write-once medium. I use restic against a Backblaze B2 bucket in Mumbai region (b2_keepers cost INR 0.45 per GB per month) for the immutable copy.

For state PSU customers buying via GeM portal, the procurement quirk to watch is the MII (Make in India) certification clause and Class-I local content threshold. MikroTik is a Latvian brand assembled in Riga, so a CRS125 usually qualifies under the Class-II local content tier at best. For a strict MII tender I have had to swap to a generic Indian-OEM L2 switch, which is half the feature set but clears the procurement audit. Always read the tender Annexure-A before promising the customer a CRS125 build.

Real-world deployment I did

The Vizag port logistics job last August stuck with me. The customer ran a CRS125 as the building-A distribution switch, and at 21:18 IST a Tata Power outage tripped the UPS into pass-through, which dropped 16 ms of mains. Long enough for the CRS125 PSU to brown out, short enough that the building emergency lights stayed on so nobody noticed until the housing-society admin called at 22:04 to complain that CCTV had gone dark.

When I drove up the next morning (75 km from my Pune flat via NH60), the switch was in a partial-boot loop. Front-panel LED would cycle amber-green-amber every 41 seconds. Console showed RouterOS hanging at the "checking ext flash" stage and then resetting the CPU. I had two suspects: PSU brownout damage to the boot flash, or a transient bit-flip in the boot sector recoverable by netinstall.

I tried the cheap option first. Pulled the unit, dropped it on the workbench, ran netinstall from a Windows laptop with the CRS125's bootloader put into etherboot mode via the reset-pin trick. Reflashed RouterOS 7.16.1, the version we had committed to git on the previous Friday, and the box booted clean on the first try. Total downtime, end to end: 14 hours. Bill: INR 6,400 for one engineer day plus INR 1,800 for the round trip. Customer was thrilled because the BSNL replacement quote had come in at INR 28,000 plus four working days.

Extended FAQs

Does the CRS125 support Long-Range PoE for outdoor CPE?

Not natively, no. The CRS125 is an indoor managed switch family. If you need to power a UBNT NanoStation or LiteBeam over 100 m of outdoor Cat6, you put a passive 24 V PoE injector in line, or you buy a small MikroTik RB260GSP / GPEN11 PoE injector switch for INR 4,800. Do not try to abuse the CRS125 PoE-OUT pins (where present) for outdoor runs; the spec is conservative and you will get LLDP power-negotiation failures in monsoon humidity.

Can the CRS125 run BGP for a small ISP?

Yes, RouterOS includes a full BGP daemon, but the CRS125 CPU is not sized for a full DFZ feed. For a small WISP that just needs to announce one /22 to a Reliance Jio or BSNL upstream peer, the CRS125 is fine. For anything beyond that, scale up to a CCR1009 or CCR2004 as the BGP-speaking core and let the CRS125 stay at Layer 2.

What is the realistic MTBF on a CRS125 in a 35 C Coimbatore cabinet?

Field reality: about 4-5 years on the original PSU, longer on the mainboard. The first thing to fail is always the PSU electrolytic capacitors under sustained 38-42 C cabinet temperature. I budget one PSU swap per 24 deployed units per year, at INR 1,800 for a third-party Lamington Road PSU module or INR 4,200 for the MikroTik OEM part.

Does MikroTik Support actually help in India?

Support is email-only via support@mikrotik.com, and the SLA is "best effort", measured in business days not hours. Realistic response: 24-72 hours for a non-critical bug. For production-down you escalate via the India distributor (Tricom Multimedia in Mumbai, or M D Computers in Kolkata) who will sometimes pull strings, but do not budget on a 4-hour fix from them.

Is RouterOS 7 stable enough for production?

RouterOS 7.16.x is the version I trust in production as of June 2026. Earlier 7.x had a rough patch in the 7.10-7.12 range with BGP and CAPsMAN bugs. The current stable train is solid; the long-term 6.49.x branch is sunset for new deployments and I only keep it on customer sites still running RB951-series consumer routers.