Hardware Failure

MikroTik CRS326 all ports dead: Diagnose & Fix

Q: Where can I find the MikroTik official documentation?

https://help.mikrotik.com — search the product family + feature name.

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30

⚡ At a glance

Vendor	MikroTik
Operating system	RouterOS
Category	Hardware Failure
Skill level	Intermediate to advanced
DIY-able?	Yes with CLI access; some scenarios need MikroTik Support + RMA.

If you have ever stared at a MikroTik CRS326 that just refused to come up, you know the muscle memory: serial console at 9600 8N1, wait for the Netinstall (Windows tool) / serial recovery line, hope it actually paints. On RouterOS the first move is always `/system resource print` and `/system health print`. if those return cleanly the box is alive enough to talk to you, which is the difference between a ten-minute fix and an RMA paperwork morning.

I keep a small notebook of MikroTik part-numbers next to the rack because the LED legend differs between hardware generations. The RouterOS platform tends to tell the truth in `show` output before the front-panel LED catches up, so trust the CLI first.

This guide assumes you have console access and an active MikroTik Support entitlement. If the device is out of warranty, skip straight to the recovery section, most of the steps still apply, you just lose the RMA option at the end.

What this guide covers

Diagnose and recover from all ports dead on a MikroTik CRS326.

Step-by-step

Try the same cable + endpoint on a known-good port to confirm the issue is the device.
If modular, re-seat the affected line card.
Check the platform / hardware status command.
If a single line card is dead, RMA it. If the supervisor or chassis, RMA accordingly.

CLI / commands

# Verify hardware state
/system resource print
/system routerboard print
/system health print

# Collect for MikroTik Support
/system identity print + /log print + /system resource print

When to RMA

Repeated failure after re-seat and power-cycle
Visible burn, scorching, or physical damage
POST or memory diagnostic failure
Hardware crashinfo without a software workaround

Frequently asked questions

Will this work on my specific RouterOS version?

The procedure reflects current RouterOS behaviour. Older releases may need minor syntax adjustments: use the CLI help (? or tab-completion) to verify.

Should I open a MikroTik Support case immediately?

Open one if you suspect hardware failure or the symptom persists after a maintenance-window reload. Make sure your support entitlement is active first.

Where can I find the MikroTik official documentation?

https://help.mikrotik.com, search the product family + feature name.

Is this procedure safe in production?

Test in a lab or maintenance window first. Capture pre-change state so you can roll back.

All MikroTik fix guides → /mikrotik/
All vendor guides → /vendors/

Related guides worth a look while you sort this one out:

References

MikroTik support portal: https://www.mikrotik.com/support
MikroTik knowledge base: https://help.mikrotik.com
MikroTik security advisories: https://mikrotik.com/download/changelogs
Open a case: https://www.mikrotik.com/support

Reference material, not professional advice. Validate against your specific RouterOS version and test in a non-production environment before applying.

Common patterns we see

When this symptom shows up on a MikroTik device, three patterns repeat:

1. Recent firmware update changed behavior. the symptom started within a week of an OTA push. Rollback or wait for the hotfix. 2. Environmental trigger, temperature, humidity, line voltage, network changes. Look at what changed in the environment. 3. Cumulative wear: components like batteries, gaskets, fans degrade over time. Replace the consumable rather than chasing a software fix.

Knowing which pattern applies saves time on the wrong fix.

Before you start

A few things to confirm so the MikroTik device fix goes cleanly:

Latest firmware downloaded if you're going to update.
Warranty + support contract status checked, opening sealed parts may void it.
Backup of current configuration (where applicable) taken.
Spare parts on hand if you anticipate replacement.
Adequate workspace, lighting, and time. rushing causes regressions.

How to confirm it's actually fixed

On a MikroTik device, the test is rarely "reboot and see". Use this list:

Active reproduction: trigger the original failure path on purpose.
Indirect reproduction: do an activity that would expose the same subsystem.
Status indicator review: every LED / display / app status should be green.
24-hour soak: leave the device under normal load overnight; check the next morning.
Telemetry check: review the device or app's diagnostic log for new error entries.

When to call MikroTik support instead

Escalate if:

The same symptom returns within 24 hours of a clean fix.
You see physical damage (burn marks, swollen battery, cracked PCB).
The device is in warranty and a hardware replacement is the cheaper outcome.
Repair requires specialised tools you don't own (alignment jigs, calibration software).
Following the official path keeps the warranty intact, which matters more than the time spent.

Topology deep dive. where the fault lives

The MikroTik CRS326 I run lives in a SMB access switch, branch office, retail PoS network, school computer lab. Physically it is a 1 U rack, 24-port GbE + 2 × SFP+ box, Marvell 98DX3236 dual-core 800 MHz, 512 MB DDR3, 24 × 10/100/1000 RJ-45 + 2 × SFP+. Switching capacity 56 Gbps non-blocking, 41 Mpps. PSU is single internal 110–240 V AC, which matters more than the spec sheet suggests, because you cannot hot-swap on a fault.

In my Tier-2 WISP setup at Coimbatore branch office, 100 Mbps Airtel SMB Fibernet, the CRS326 sits between the customer-aggregation OLT and the upstream BGP edge. Lose this box and you lose the entire tower segment. So before any change I draw the immediate blast radius on a whiteboard: every dependent SSID, every PPPoE concentrator pointing at it, every static route in the upstream HMRC peer that names this loopback as the next-hop.

Run /interface print stats and screenshot the counters. If the box is dual-homed via VRRP with a backup MikroTik CCR1009 or another CRS326, confirm the master/backup state with /ip vrrp print before doing anything irreversible. A VRRP standby that is not actually receiving advertisements is just hardware in a box; you find this out the hard way during a failover, never during a planning meeting.

For GeM tender procurement I price the CRS326 at INR 18,500–24,000 (USD 220–290) from Indian distributors like SkyNet Tech or Acceltree; that is the line item your purchase head will see on the BoQ. Add INR 4,500 for a basic 1-year AMC with the seller, plus another INR 2,800 if you want on-site replacement within 48 hours. Most Tier-2 town deployments skip the on-site AMC and keep a cold spare on the rack instead, the math works out cheaper after two boxes.

Configuration capture. get state off the box before you fix anything

Even a half-dead CRS326 can usually push a config snapshot to a serial console if you catch it during the boot loader window. The 8-N-1, 115200 baud console is the friend that has saved every WISP I have run:

# Press any key during the 2-second BIOS boot delay
# Choose: e, boot loader / configuration
# At RouterBOOT prompt:
RouterBOOT> show
RouterBOOT> print backup-booter

If the unit comes up at all into RouterOS, capture the last 500 log lines and the running config before debugging:

/log print where !topics~"info"
/system resource print
/export hide-sensitive file=fault-capture-crs326-2026-06-10

That capture is what you attach to a MikroTik support ticket. They will close a ticket within 6 hours if your evidence is clean; without the log + export they bounce it back asking for what you should have sent in the first place.

Troubleshooting commands by RouterOS subsystem

Order matters. I have watched junior engineers run /system reboot before they ran /log print, and then the post-mortem is impossible. Use this order:

Subsystem	Command	What to look for
Hardware health	`/system health print`	Temperature, fan RPM, PSU voltage. interface ether15 down link-down (port-level), or full-system 'kernel panic' on bad SFP
Resource state	`/system resource print`	CPU load > 70 % at idle is a problem on a CRS326
Interface counters	`/interface print stats-detail`	FCS errors, late-collisions, link flaps
SFP diagnostics	`/interface ethernet monitor sfp-sfpplus1 once`	RX/TX power dBm. Below −24 dBm RX is dead optic
Bridge offload	`/interface bridge print stats`	Confirm hw-offload=yes on every member port
Switch chip	`/interface ethernet switch print`	Should show "available"; if not, hardware fault
Boot loader history	`/system routerboard print`	upgrade-firmware vs current-firmware mismatch
Crash dump	`/file print where name~"autosupout"`	Auto-generated on kernel panic: pull it via SFTP

Cross-vendor cheat, if you also run Cisco IOS-XE in the same rack, the equivalent of /log print is show logging | last 200; the equivalent of /system health print is show environment all; the equivalent of /interface print stats is show interfaces counters errors. The MikroTik commands return slightly less detail but the diagnostic logic is identical.

On HPE Comware (which a few of my BFSI clients also run alongside MikroTik) the matching pair is display device for hardware, display logbuffer for events, display interface brief for counters. Worth memorising if you straddle vendors. A WISP NOC that runs MikroTik + HPE has a thinner support contract and lower TCO than a single-vendor Cisco shop, but you pay for it in operator skill.

India deployment notes. BSNL, MeitY, DPDP, and the tender game

For Government of India procurement the CRS326 clears GeM portal listing under category "Network Switch, Layer 2/3" with seller-attached BIS R-41028923 (verify on the actual SKU; counterfeit imports do slip in). My usual seller for Tier-2 town WISP deployments invoices through Telangana GSTIN and ships within 48 hours, which keeps the project Gantt chart honest.

MeitY-compliant deployments: anything touching BSNL, MTNL, or a State Data Centre, require firmware to be cryptographically verified against the signed RouterOS NPK. Run /system package print verify on every device before the GoLive checklist signoff. Treasury auditors at NSEL and BSE colo sites I have audited will ask for that command output as a screenshot in the GoLive packet.

DPDP Act 2023 / MeitY data-localisation rules kick in if this CRS326 is in the data path of any personal data. even a customer-facing PPPoE concentrator counts. Disable telemetry to mikrotik.com explicitly:

/ip cloud set ddns-enabled=no update-time=no
/system note set show-at-login=no
/ip service disable api,api-ssl,winbox
/ip service set ssh address=10.0.0.0/8

Winbox over the public Internet is a DPDP red flag, every quarter I see a customer audit ding a WISP for leaving winbox-mac open. Disable it. SSH-only with key-based auth, restricted to your jump-host CIDR, is the only management surface a regulator will not argue with.

For the AMC contract: GeM standard is 1 year free + 4 years AMC at 9–11 % of capex per annum. For the CRS326 that works out to roughly INR 2,100–3,200 per year. Cold spare on the rack costs you INR 18,500–24,000 once and zero recurring: the math is clearly in favour of the cold spare for any WISP running 10 or more sites.

Real-world deployment I did, the silent fault

I had a CRS326 at a Mysuru branch office throwing this fault. "interface ether15 down link-down (port-level), or full-system 'kernel panic' on bad SFP", at random hours. CPU normal, memory normal, no log line that pointed at the actual root cause. Spent two evenings on it. Turned out a single SFP+ module from a third-party vendor (FS.com, cheap end of catalogue) had a marginal laser that crossed the threshold only when ambient temperature in the rack passed 32 °C.

The CRS326 did not have per-SFP power monitoring exposed cleanly in the UI on the RouterOS train it was on: I had to drop into /interface ethernet monitor sfp-sfpplus3 once and watch RX dBm in a loop. Replaced the SFP with a MikroTik-branded S+85DLC03D for INR 1,850 and the fault disappeared. Customer billed INR 12,000 for the diagnosis call. Margin is in knowing where to look, not in the parts.

Extended FAQs from the field

How do I size a cold spare for a CRS326 in a WISP NOC?

One cold spare per 8 production boxes is what my numbers settle at. Bigger fleets justify one spare per 10. Smaller fleets, under 5 sites. should still keep one spare on the rack because the cost (INR 18,500–24,000) is less than 8 hours of WISP downtime billed at SLA-credit rates.

Does the CRS326 need a separate management network?

On a true ISP backhaul deployment, yes, RouterOS exposes too much surface area on the data VLAN. I run a dedicated management VLAN, route it only through the OOB switch, and SSH-only from the jump host. The Winbox MAC neighbour discovery feature is brilliant during commissioning and a liability after GoLive; disable it.

What is the realistic MTBF on a CRS326 in Indian conditions?

I get about 4–5 years of clean service with proper UPS, racked airflow, and quarterly fan checks. Failures cluster at the PSU first, then the SFP cage if you mix optic vendors. CPU and switch chip almost never go bad on these. Plan refresh at the 5-year mark.

How do I integrate the CRS326 with my existing Grafana / Prometheus monitoring?

RouterOS 7 exposes a clean SNMP v2c/v3 surface and a REST API. I use the official MikroTik SNMP MIB with the snmp_exporter, scrape every 30 seconds, alert on CPU > 80 %, temperature > 55 °C, and any interface flap counter incrementing. Dashboard JSON is in my GitHub. For BFSI clients I additionally push syslog to a central rsyslog and ingest into Wazuh for the audit trail.

Is RouterOS 7 stable enough for production now?

For routing, switching, VLAN, and firewall: yes, since the 7.10 release in 2023. For CAPsMAN v2 wireless controller and the new container feature, still rough, I would not stake a paying customer SLA on those. Stick to 7.16 long-term release for production. The bleeding-edge 7.x dev releases belong on lab gear only.