Swap the MokerLink for the CRS326 (ADR-0041)

[Gerrrt]

Where this stands

Bought 2026-09-13 (#463): a used MikroTik CRS326-24G-2S+RM, in hand since 2026-09-23 without a power adapter; the MikroTik 24HPOW for it was delivered 2026-09-26. Phase 1 was done at the bench on 2026-10-05, apart from the SNMP proof, which needs the switch racked. What's left is Phase 2, the rack window. Decided by ADR-0041 ahead of the window: RouterOS over SwOS; it inherits the name neo and 10.7.7.2; www-ssl from the estate's CA with plain www off; an SNMPv3 authPriv user; port mirroring left disabled per ADR-0006. Procedure written: docs/runbooks/swap-the-switch.md, two phases — Phase 1 is two hours at a bench, everything but the cabling, and can happen the day the box lands; Phase 2 is the rack window, which shares a visit because neo carries every VLAN and no reboot happens while Mekenna is on the clock.

Moved to Nothing blocks these today: nothing in any other milestone gates it, and it is the thing that closes #84.

What the body as filed got wrong

• SNMPv3 was never a selection criterion. ADR-0036 found the MokerLink answers v3 on the wire; the comment of 2026-09-10 called the "Move the iLO and the UPS card to SNMPv3 authPriv (ADR-0036) #85 — no SNMPv3" residual "already wrong when the issue was written". The switch was bought for the TLS management interface, the one argument left standing, with Retire the MokerLink switch's previous SNMP community #84 riding along. The buy list says so in those words.
• "Purchases this needs: the switch, $150–350" — bought; the roadmap took the row off the buy table in the same commit.
• "Replace neo" — the name and address stay. What is replaced is the MokerLink.

Done when

swap-the-switch.md Phase 3: snmp-verify.sh clean over GET and GETBULK against the CRS326, the UI reachable over https with the estate's chain, the MokerLink out of the rack. Then close #84, then this.

---

Body as filed, superseded 2026-09-19

neo is now carrying its third accepted firmware residual, and
ADR-0018 says
what to do about it: "A TLS management interface belongs in the selection
criteria whenever this switch is replaced."

This is the issue for that.

The three residuals, and why they are one purchase

• #84 — it still accepts its
  previous SNMP community, and the stock public and private besides,
  measured twice. The firmware will not persist a deletion, and drops its SNMP
  agent on each attempt. The other three devices refuse both.
• #85 — no SNMPv3. Three of
  four devices could move to authPriv; this one is the blocker for doing it
  uniformly.
• ADR-0018 — no TLS listener and no certificate import, checked against the
  live device. So the switch admin password crosses the wire in cleartext,
  through neo itself — the device the password protects. A mirrored port or
  a foothold on the switch sees the credential to the switch. And unlike the
  SNMP communities, that one is read-write.

The roadmap already names a replacement as the thing that would close #84, #85
and ADR-0018's residual together, and records that it was never decided. This
is the decision.

Selection criteria, from ADR-0018 and #85

• A TLS management interface.
• SNMPv3 authPriv.
• 24+ ports with 802.1Q.
• Port mirroring — worth having even though
  #437 mirrors at the
  hypervisor, because it is the thing that would let the estate inspect a
  segment morpheus cannot see.

Roughly $150–350: MikroTik CRS326 around $180, TP-Link TL-SG3428 around
$200, Ubiquiti USW-Pro-24 around $380.

What replacing it costs

A cabling window with the house offline — neo carries every VLAN. Worth
pairing with another rack visit rather than scheduling its own.

Per the roadmap's own rule, the PR that acts on this edits Everything still to
buy in the same commit.

Purchases this needs

The switch. $150–350.

[Gerrrt]

Correction: one of the three residuals had already gone when this was filed

This issue lists #85 — no SNMPv3 as one of three things a replacement would
close. That is wrong, and it was already wrong when the issue was written —
ADR-0036
had landed on main and I had not read it.

ADR-0036 decides SNMPv3 per poll, by where the poll travels: the iLO first,
because its poll is delivered into the lab segment layer-2 adjacent to the
attack VM; then the UPS card on the same procedure; the firewall stays on v2c
because bsnmpd is the only daemon that serves the pf MIB and pfSense writes no
v3 user for it.

And on neo specifically:

the switch was never what blocked it. The switch stays on v2c and its UI gets
checked once for a v3 user page — its agent answers v3 on the wire, which
ADR-0018 did not know.

So the count is two, not three:

Residual	Still true?
#84 — firmware will not persist a community deletion	Yes. Unchanged.
#85 — no SNMPv3	No. The agent answers v3; what remains is a one-time UI check for a v3 user page, and the switch was never the blocker.
ADR-0018 — no TLS listener, admin password crosses the wire in clear through the device it protects, and that credential is read-write	Yes. Unchanged, and it is the real argument.

The purchase still stands, and the reason narrows to one thing: the TLS
management interface. #84 rides along. SNMPv3 should be struck from the
selection criteria in the issue body above — a switch that does v3 is no longer
a discriminator, because the one in the rack already does.

This matters beyond tidiness: a purchase justified by three residuals when one
has quietly gone is precisely the shape roadmap.md's buy list exists to
prevent, and it is the same failure ADR-0025 recorded against itself — carrying
a sentence forward instead of re-reading the source.

Recorded rather than edited into the body, so the reasoning is visible.
#456 carries the matching fix to
the roadmap row.

---

Generated by Claude Code

[Gerrrt]

Bought: a used MikroTik CRS326-24G-2S+RM, 2026-09-13

The ~$180 candidate this issue named, bought used on eBay
(listing) and in transit. 24 × 1 GbE,
2 × SFP+, 1U, dual-boot RouterOS (L5) / SwOS. Recorded in
hardware.md
by #463, which also takes the row off Everything still to buy in the same
commit — four rows to three — as the issue body asked.

It is recorded as bought for one property, the TLS management interface,
per the correction above: RouterOS serves its UI over www-ssl and imports a
certificate. #84's GETBULK residual rides along. SNMPv3 is not the argument.

On arrival, before it touches the network

• Which OS it boots and the version on it (/system resource); the serial and
  the management MAC — these go into hardware.md.
• Rack ears and the power supply are in the box. It is a used listing.
• A netinstall or factory reset. A used RouterOS device arrives with whatever
  its last owner left on it, users and all.

The cutover, which is what closes this issue

Nothing but the purchase record changes until a cabling window. neo carries
every VLAN, so the swap is a house-wide outage and shares a rack visit rather
than getting its own — not while Mekenna is on the clock. When it happens:

1. An ADR for the new switch: its name (whether it inherits neo and
   10.7.7.2, or the switch LAN goes away now that the management interface
   can bind to a tagged one), RouterOS vs SwOS, a lab-CA certificate on
   www-ssl with plain www off, an SNMPv3 authPriv user per
   ADR-0036's procedure, and whether port mirroring is configured.
2. network.md (U9 row, 10.7.7.2 section, [^MokerLink] footnote) and
   hardware.md's Rack table; architecture.md labels.
3. generator.yaml's mokerlink module and auth_mokerlink,
   targets/snmp.yaml, the switch block in network.rules.yaml,
   snmp-walk.sh's defaults, and snmp-verify.sh's GETBULK WARN — which
   should become a FAIL again once the switch it excuses is gone.
4. The switch-ui blackbox target and its via: dns twin, http → https.
5. SECURITY.md and docs/security.md: the GETBULK and plain-HTTP residuals
   close; ADR-0018 gets its superseding note.
6. Retire the MokerLink switch's previous SNMP community #84 closes with snmp-verify.sh --device <new> and --old both clean
   over GET and GETBULK — the acceptance criteria there, met by a switch that
   checks what it serves rather than by another window on this one.

Then this issue closes.

🤖 Generated with Claude Code

[Gerrrt]

2026-09-26: The CRS326 has been in hand since 2026-09-23, per hardware.md. It came with no power adapter, and its only input is a 10–28 V DC barrel jack. A MikroTik 24HPOW (24 V) is in transit, and Phase 1's bench steps wait for it. The swap is not done and neo is still the MokerLink. Draft #653 carries Phase 3 and stays unmerged until after the window.

[Gerrrt]

2026-10-04: The 24HPOW was delivered on 2026-09-26, the evening of the comment above that called it in transit. Phase 1 of swap-the-switch.md waits only on bench time now, and has not started. #912 records the delivery in hardware.md, roadmap.md, the runbook and the changelog.