RouterOS 7's routing stack does redistribution and BFD too — but through its filter-chain model, which trips up anyone coming from IOS. This is how to safely leak routes between OSPF, BGP, and static on RouterOS without building a loop, and how to bolt on BFD for millisecond failover. The twin of the Cisco redistribution & BFD post.
The concepts are identical to Cisco: redistribution shares routes between protocols (and is the classic loop-maker), BFD detects a dead neighbour in milliseconds regardless of the protocol's own timers. What's RouterOS-specific is where the control lives. In v7, each protocol has a redistribute toggle plus an output filter chain, and all the "which routes, with what tag/metric" logic is expressed as /routing filter rule chains — the same little scripting language used by BGP policy. If you learned this on IOS route-maps, the model maps one-to-one; the syntax does not.
The other RouterOS reality: BFD moved around across 7.x releases — the exact menu (/routing bfd) and how protocols reference it changed between versions. The approach below is the current-v7 shape; always check your version's menu. Get both right and you have a fast, loop-free multi-protocol core on MikroTik.
01
Turn on redistribution per protocol, then let an output filter chain decide exactly which routes go, with what tag and metric. Never redistribute wide open.
# The filter chain: which redistributed routes to allow, tagged for # loop-prevention, with a seed metric (OSPF external). /routing filter rule add chain=ospf-redist rule="if (dst-len<=24) { set ospf-type type-1; \ set bgp-metric 50; set route-tag 111; accept }" add chain=ospf-redist rule="reject" # Enable redistribution on the OSPF instance, pointed at that chain. /routing ospf instance set v7 redistribute=static,connected out-filter-chain=ospf-redist
If you set redistribute= but forget the out-filter-chain, RouterOS injects every matching route with default attributes — the RouterOS equivalent of an IOS redistribute with no route-map. On a router that also learns routes from the other protocol, that's how you leak a full table into OSPF or create a loop. Treat the filter chain as mandatory, and end it with an explicit reject so only what you intended gets through. Same discipline, different syntax, as the Cisco route-map.
02
With redistribution in both directions, tag routes leaving one protocol and reject that tag when they'd re-enter — the exact IOS tag-and-deny pattern, written as filter rules.
# OSPF->BGP redistribution stamped route-tag 111 (section 01). On the # BGP->OSPF direction, refuse anything already tagged 111 so it can't loop. /routing filter rule add chain=bgp-to-ospf rule="if (route-tag==111) { reject }" add chain=bgp-to-ospf rule="accept" /routing bgp connection set ISP-A output.redistribute=ospf output.filter-chain=bgp-out # (and the reverse import filtered by bgp-to-ospf on the OSPF instance)
RouterOS installs the route with the lowest distance when the same prefix is learned twice (connected 0, static 1, eBGP 20, OSPF 110, iBGP 200 — mirroring IOS). During mutual redistribution the redistributed copy can win over the native one and cause suboptimal paths or loops. Check with /ip route print detail where dst-address=… at each boundary, and set distance= on a route or protocol where you need the native path to win. Tag-and-reject plus a distance sanity-check is the safe recipe on either platform.
03
Configure BFD and reference it from the routing protocols so a dead neighbour is caught in a fraction of a second, not on OSPF's or BGP's slow timers. (Menu is version-dependent — verify on your build.)
# Define BFD timing (current v7 menu). Detection ~ min-interval x multiplier. /routing bfd configuration add interfaces=ether1 min-rx=300ms min-tx=300ms multiplier=3 # Have OSPF use BFD for neighbour liveness (interface-template flag): /routing ospf interface-template set [find interfaces=ether1] use-bfd=yes # And BGP drop the session the moment BFD reports the peer down: /routing bgp connection set ISP-A use-bfd=yes /routing bfd session print # sessions up, negotiated timers
BFD only works if both peers run it — one side enabling use-bfd does nothing until the other does too, and it fails silently as a "session never comes up." And exactly as on Cisco: aggressive sub-second timers on a wireless or congested link turn microbursts into false-positive failures and flap your routing. Reserve tight BFD for clean wired links; loosen the timers (or skip BFD) on lossy paths. Finally, don't assume the menu — the BFD configuration path genuinely changed between 7.x releases, so confirm against your running version rather than pasting blind.
04
Confirm what was redistributed (and its tag/type), and that BFD sessions are established with the intended timers.
/ip route print where ospf # external routes present /ip route print detail where dst-address=10.5.0.0/24 # tag, distance, source /routing ospf lsa print where type=external # what we injected /routing bfd session print # state=up, timers negotiated
Takeaways
reject) is mandatory, or you leak everything./routing filter rules.distance= so the native route wins.NOCTIS designs and audits multi-protocol routing on MikroTik and Cisco across Crete — safe redistribution with loop prevention and version-correct BFD for fast, stable failover.
Book a Discovery Call →