Connect a MikroTik antenna

1. Obtain the device token

The administrator signs in at the homepage, selects Enroll a device, enters a label such as SXT-Site-01, and optionally specifies an approved existing support VPN interface. The token is displayed once. Have the administrator send it through a private channel, separately from this public link.

Use a different token for every antenna. The dashboard label does not change the router's system identity. Leave the VPN field blank if remote VPN enable is not needed.

2. Check the router and verified HTTPS

In the WinBox terminal, inspect the version, clock, NTP, LTE interface name and certificate settings:

/system resource print
/system clock print
/system ntp client print
/interface lte print
/certificate settings print

Run this credential-free connectivity check:

:put ([/tool fetch url="https://mikrotik.pcsrt.com/healthz" check-certificate=yes http-max-redirect-count=0 output=user as-value]->"data")

Expected response: {"status":"ok"}. If verification fails, correct the clock, DNS, certificate trust or server certificate chain before proceeding. The built-in trust store must permit Fetch; if needed, obtain the appropriate CA through a trusted channel and import it as trusted. Do not disable certificate verification.

Official Fetch documentation · Certificate trust documentation

3. Customize your private copy

Download setup.rsc for a fresh installation. It includes telemetry, HTTPS support v2 and the local recovery guard. Open setup.rsc in a plain-text editor and edit these values near the top:

:local pcsrtBase "https://mikrotik.pcsrt.com"
:local pcsrtToken "PASTE_THIS_DEVICE_TOKEN"
:local pcsrtLte "lte1"
:local pcsrtVpn ""

Replace both REPLACE_WITH_DEVICE_TOKEN occurrences with the same device token, and check both LTE interface settings. Leave pcsrtVpn empty unless VPN enable is approved. If used, its name must exactly match the dashboard enrollment and an existing supported VPN interface.

Once edited, this file contains a credential. Keep it private; never publish it, attach it to a support ticket, or paste it into a shared terminal transcript.

4. Upload and import, with polling disabled

Upload your configured setup.rsc using WinBox Files. For a fresh installation, run:

/import file-name=setup.rsc

All schedulers are created disabled. Importing these files does not run the polling script. Do not import duplicates if any pcsrt-* scripts or schedulers already exist. For existing installations use the support upgrade instructions, leaving telemetry unchanged. Do not use verbose import with a token-bearing file.

For lab syntax checks, use a separate placeholder-token copy with /import file-name=setup.rsc verbose=yes dry-run. This checks import syntax, not every runtime branch. Telemetry uses read,write,test,reboot. Support v2 executes administrator-provided scripts and requests ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon. Use the same full-permission owner for support, undo and recovery scripts/schedulers; do not bypass permission checks. Device-mode and RouterOS restrictions still apply.

5. Send the first report and start polling

Ask the administrator to confirm this device's command queue is empty. A manual run can execute queued commands as well as report telemetry. Then run once:

/system script run pcsrt-poll
/system script run pcsrt-support

The administrator should see the antenna online with a recent last-seen time, CPU, memory, uptime, LTE readings and traffic counters. When the first report is confirmed, enable the scheduler:

/system scheduler enable [find where name="pcsrt-poll"]
/system scheduler enable [find where name="pcsrt-support"]

Confirm another report arrives after approximately one minute and that the HTTPS support console shows agent v2. The recovery scheduler enables itself only when a guarded command is armed. Test support v2 in the lab before production use; it has not been hardware validated. Ask the administrator to queue Collect diagnostics and verify its result is succeeded. History charts need multiple reports. After successful import, delete the uploaded token-bearing setup.rsc from WinBox Files; keep the installed script.

6. Troubleshooting and maintenance

Inspect generic client warnings:

/log print where message~"PCSRT"

If the health check fails, investigate network access, DNS, clock and certificate trust. If the health check succeeds but reports do not arrive, check the device token, revocation state, script permissions and LTE interface name. Missing radio readings may depend on the installed LTE modem. Do not enable Fetch debug logging with a real token.

Pause reporting locally:

/system scheduler disable [find where name="pcsrt-poll"]

To rotate a token, first finish any armed recovery guard, then pause both polling schedulers, have the administrator rotate it, privately update pcsrtToken in both installed polling scripts, and resume both schedulers. Revocation immediately stops the server from accepting that token.

The standard configuration job allows only system identity and the fixed LTE interface's comment. VPN enable only enables an existing approved interface; it does not configure a tunnel, verify its handshake or automatically disable it later.

A job marked uncertain is never automatically executed again. Inspect the device before approving a replacement. Reboot requested records intent; confirm a fresh check-in and uptime reset before treating the reboot as completed.