Idea: Script to assign RND MAC to bridge on startup if no admin-mac has been assigned

[netravnen]

Disclaimer: tested on 7.14.3

---

Only function is to replace ":" with "," (explode string to array helper)

:global strEncode do={
  :local string $1;
  :local reEncoded;
  :local char;
  :if (([:typeof $string] != "str") or ($string = "")) do={ 
    :return "";
  } else={
    :for i from=0 to=([:len $string] -1) do={ 
      :set char [:pick $string $i];
      :if ($char = ":") do={
        :set $char ","
      }
      :set reEncoded ($reEncoded . $char) ;
    }
    :return $reEncoded;
  }
}

---

Only function is to replace ";" with ":" (concat array to string helper)

:global strDecode do={
  :local string $1;
  :local reDecoded;
  :local char;
  :if (([:typeof $string] != "str") or ($string = "")) do={ 
    :return "";
  } else={
    :for i from=0 to=([:len $string] -1) do={ 
      :set char [:pick $string $i];
      :if ($char = ";") do={
        :set $char ":"
      }
      :set reDecoded ($reDecoded . $char) ;
    }
    :return $reDecoded;
  }
}

---

Function does the following,

1. Find all bridge interfaces with no admin-mac defined,
2. Generate a random MAC address using the Vendor OUI based on the first port (idx 0) from /interface/ethernet/
   • 78:9A:18:12:34:56 -> 78:9A:18:XX:YY:ZZ
3. The bridge interface is supposed to have a new admin-mac set,
4. Rerun the script, same output,
5. Rerun the script, same output,
6. Rerun the script, same output,
7. Rerun the script, same output,
8. (...)

:foreach bridge in=[/interface/bridge/find where !admin-mac] do={
  :local mac [:toarray [$strEncode [/interface/ethernet/get 0 value-name=mac-address]]];

  :set ($mac->3) [:rndstr from="0123456789ABCDEF" length=2];
  :set ($mac->4) [:rndstr from="0123456789ABCDEF" length=2];
  :set ($mac->5) [:rndstr from="0123456789ABCDEF" length=2];

  :local rndMacAddr [$strDecode [:tostr $mac]];
  :local bridgeName [:tostr [/interface/bridge/get $bridge name]];
  :local bridgeMac [:tostr [/interface/bridge/get $bridge mac-address]];
  :local bridgeAdminMac [:tostr [/interface/bridge/get $bridge admin-mac]];
  :local bridgeAdminMacLen [:len $bridgeAdminMac ];
  :local newMacAssigned false;

  :if ($bridgeMac = $bridgeAdminMac) do={
    /interface/bridge/set $bridge admin-mac=$rndMacAddr;

    :set newMacAssigned true;

    :put ("Assigning " . $bridgeName . " a random Admin-MAC address of " . $rndMacAddr . " due to Admin Mac being identical to exiting bridge MAC");
  }

  :if ($bridgeAdminMacLen = 0) do={
    /interface/bridge/set $bridge admin-mac=$rndMacAddr;

    :set newMacAssigned true;

    :put ("Assigning " . $bridgeName . " a random Admin-MAC address of " . $rndMacAddr . " due to no Admin-Mac exisintg");
  } else={
    :put ("Skipping " . $bridgeName . ", Admin-Mac already assigned");
  }

  :if ($newMacAssigned = true) do={
    :put ("New Admin-MAC has been assigned to bridge " . $bridgeName);
  }
}

---

Test results

[admin@switch1] > /system/script/run test1
Assigning testbr1 a random Admin-MAC address of 78:9A:18:73:1C:52 due to no Admin-Mac exisintg
Assigning testbr2 a random Admin-MAC address of 78:9A:18:2B:90:37 due to no Admin-Mac exisintg
Assigning testbr3 a random Admin-MAC address of 78:9A:18:37:B6:12 due to no Admin-Mac exisintg

[admin@switch1] > /system/script/run test1
Assigning testbr1 a random Admin-MAC address of 78:9A:18:56:6A:EA due to no Admin-Mac exisintg
Assigning testbr2 a random Admin-MAC address of 78:9A:18:D8:B4:CF due to no Admin-Mac exisintg
Assigning testbr3 a random Admin-MAC address of 78:9A:18:50:23:F7 due to no Admin-Mac exisintg

[admin@switch1] > /system/script/run test1
Assigning testbr1 a random Admin-MAC address of 78:9A:18:B4:CE:5D due to no Admin-Mac exisintg
Assigning testbr2 a random Admin-MAC address of 78:9A:18:0F:4F:88 due to no Admin-Mac exisintg
Assigning testbr3 a random Admin-MAC address of 78:9A:18:21:4F:C4 due to no Admin-Mac exisintg

---

Summary: I intend to submit a PR to the repo, once the "kink" of not assigning the admin-mac using the script works.

[netravnen]

SUP-153784

[eworm-de]

What is this support ticket about? Giving just the number is of little help.

[eworm-de]

This looks a bit over-complicated... This small snippet does the same, no?

:foreach Interface in=[ /interface/bridge/find where !admin-mac auto-mac ] do={
  /interface/bridge/set auto-mac=no admin-mac=([ :pick [ /interface/bridge/get $Interface mac-address ] 0 9 ] . [ $GetRandom20CharHex 2 ] . ":" . [ $GetRandom20CharHex 2 ] . ":" . [ $GetRandom20CharHex 2 ]); }

Some random thought on this:

• The scripts are intended to be installed on the device, to be used regularly. I do not accept scripts for one-time configuration.
• Most setups use a single bridge with vlan-filtering these days. Is it worth it having a script to set a mac address for that one interface?
• Using random mac address brings the risk of duplicate addresses. Not only on the device (that could be checked), but also in that network - which is even worse. Why not use the address of a physical interface?

... and possibly more. I see little gain here.

[netravnen]

The scripts are intended to be installed on the device, to be used
regularly. I do not accept scripts for one-time configuration.

👍

Most setups use a single bridge with vlan-filtering these days. Is it
worth it having a script to set a mac address for that one interface?

Correct. I do, too. There might be some interfaces that are firewalled
and not a bridge port (e.g. WAN, DMZ). At least for me. To be able to
turn off HW-offload and be able to run all traffic through the firewall.

Using random mac address brings the risk of duplicate addresses. Not
only on the device (that could be checked), but also in that network -
which is even worse. Why not use the address of a physical interface?

I essentially want to archive what MT describes in the documentation
concerning statically defining a bridge admin-mac.

Avoiding the bridge admin-mac changing upon reboot if the bridge-ports
has changed since last reboot.

link

To combine a number of networks into one bridge, a bridge interface should
be created. Later, all the desired interfaces should be set up as its
ports. One MAC address from slave (secondary) ports will be assigned to
the bridge interface. The MAC address will be chosen automatically,
depending on the port-number, and it can change after a reboot. To avoid
unwanted MAC address changes, it is recommended to disable auto-mac and
manually specifying the MAC address by using admin-mac.

I see little gain here.

Indeed a valid observation.

This looks a bit over-complicated... This small snippet does the same,
no?

:foreach Interface in=[ /interface/bridge/find where !admin-mac auto-mac ] do={
  /interface/bridge/set \
  auto-mac=no \
  admin-mac=(\
    [ :pick [ /interface/bridge/get $Interface mac-address ] 0 9 ]\
    . [ $GetRandom20CharHex 2 ]\
    . ":"\
    . [ $GetRandom20CharHex 2 ]\
    . ":"\
    . [ $GetRandom20CharHex 2 ]\
  );
}

Looks so much more manageable! Thank you for the pointer concerning
auto-mac=no. Had overlooked that in the MT documentation and could
not get the script to work before.

Will skip a PR to the repo. And just use it personally. But leave a copy here if others want to copy it for later use.