Rebuilding a core router from yesterday's recon
The PoP router died with no current export on file. The previous morning's read-only recon had 48 sections of its configuration. We turned that into a restore script, with every assumption and gap written down.
The situation
On a Wednesday morning the router that anchors a region's client services was gone. The operator had a spare of the same model. What they did not have was a recent export. What we had was the monitoring collector's hourly recon of that router: 48 /print sections, gathered read-only for the report, never intended as a backup.
What we did
We wrote a converter that reads a recon dump and emits a RouterOS .rsc. The service tunnels come back with their original MAC addresses and tunnel IDs, so the far ends reconnect without anyone touching 128 CPEs. Bridge ports keep their horizons. VLANs, addresses, static routes, the firewall filter, OSPF instances and interfaces, DNS, SNMP and services follow.
Everything the dump did not contain is named in the README, in two lists. Assumptions: the OSPF area IDs, one routing filter and the BFD timers, taken from the neighbouring router's export. Gaps: users, NAT and address lists, queues, NTP, logging, scripts, interface lists. The operator rebuilds from the script and the lists, not from memory.
What changed
The converter works on any recon dump we hold, so the next loss starts from a script rather than a blank config. The lesson is sharper: a recon is not a backup. The next step is a scheduled /export per anchor alongside the recon, so the next rebuild has no gap list at all.
Sound familiar?
Tell us which part. A first look is usually read-only, and you get the write-up either way.
Start a conversation →