Scaling Subscriber Cores Without Carrier-Grade Price Tags
The Growing Pressures on Regional ISPs
Regional Internet Service Providers (ISPs), campus broadband operators, and fiber infrastructure providers face mounting bandwidth demands alongside severe IPv4 address exhaustion. Proprietary carrier routing platforms often impose exorbitant recurring software subscription licenses per gigabit of throughput. By architecting ISP cores around MikroTik Cloud Core Routers (CCR2216-1G-12XS-2XQ and CCR2116-12G-4S+), operators achieve 100G line-rate forwarding and multi-million packet-per-second performance at predictable hardware costs.
Phase 1: Multi-Homed BGP Edge Design
A reliable ISP edge requires independent upstream transit redundancy:
- Full Internet Routing Tables: CCR2216 equipped with 16GB RAM comfortably hosts 4+ full IPv4/IPv6 internet routing tables across upstream Tier-1 providers.
- RPKI Validation: Enforce Resource Public Key Infrastructure (RPKI) cache validation to protect the network from BGP prefix hijacking and route leaks.
- BGP Flowspec & Communities: Implement automated upstream DDoS blackholing communities to mitigate volumetric attacks at the transit provider edge before line saturation occurs.
Phase 2: Deterministic Carrier-Grade NAT (CGNAT)
With public IPv4 exhaustion, CGNAT is mandatory for subscriber connectivity:
- Port Block Allocation (PBA): Assign deterministic port blocks (e.g., 1024 or 2048 ports per subscriber IP) rather than dynamic single-port tracking. This eliminates CPU-intensive connection tracking overhead and satisfies lawful interception / audit compliance requirements without multi-terabyte log bloat.
- Hardware Offloading (L3HW): Configure RouterOS v7 hardware L3 routing offload to switch FastPath traffic directly on the Marvell Prestera switch ASIC, bypassing the CPU for subscriber-to-transit forwarding.
Phase 3: BNG / BRAS & FreeRADIUS AAA Integration
Centralize subscriber lifecycle management by separating authentication from traffic routing. MikroTik Broadband Network Gateways (BNG) terminate PPPoE and IPoE subscriber VLANs, authenticating via FreeRADIUS against MariaDB backends for sub-second session establishment and dynamic bandwidth rate-limiting (CoS/QoS queues).