MikroTik netFiber 9 5×SFP 4×SFP+ 10G Outdoor Switch

The MikroTik netFiber 9 is the direct successor to MikroTik's beloved FiberBox — the outdoor fiber switch that established MikroTik's position in the ISP and WISP optical aggregation market — rebuilt on the Marvell 98DX226S platform with 10G SFP+ capability, doubled RAM, and an upgraded passive cooling architecture. Where the original FiberBox was a pure 1G SFP platform, the netFiber 9 adds four 10G SFP+ ports alongside five 1G SFP ports and a full-speed Gigabit Ethernet port — making it the correct choice for any outdoor fiber aggregation deployment where 10G uplinks or inter-switch connections are required alongside 1G SFP access ports.

**The Marvell 98DX226S — the same integrated CPU + switch ASIC as the CRS310-8G+2S+IN**

The 98DX226S is the same Marvell Prestera Lite integrated device documented for the CRS310-8G+2S+IN in this product batch — a single chip that is simultaneously the dual-core ARM32 CPU at 800 MHz and the switch ASIC managing all ports. In the netFiber 9, the 98DX226S drives a different port configuration than the CRS310-8G+2S+IN's 8× 2.5G Ethernet + 2× SFP+ — here it drives 5× SFP (1G), 4× SFP+ (10G), and 1× Gigabit Ethernet. The switching fabric, hardware-offloaded Layer 2 forwarding, VLAN management, ACL capability, and L3 hardware routing offload are identical across both products — the 98DX226S's capabilities are unchanged by the port configuration it drives.

Key 98DX226S capabilities in the netFiber 9 context:

- **Hardware-offloaded Layer 2 switching:** VLAN tagging and filtering, MAC address table forwarding, STP/RSTP, LACP 802.3ad link aggregation, and QoS queue management — all processed in the 98DX226S switch ASIC at line rate across all 10 ports simultaneously. Traffic forwarding between SFP ports, between SFP+ ports, and between SFP and SFP+ ports does not involve the ARM CPU in the data path.

- **Hardware-offloaded Layer 3 routing:** The 98DX226S supports hardware-offloaded inter-VLAN routing — as documented for the CRS310-8G+2S+IN, MikroTik explicitly describes the netFiber 9 as a switch that "can even perform some light routing." The L3 hardware offload is the same qualified capability: established inter-VLAN flows are forwarded in the ASIC at line rate; complex multi-VRF or BGP routing requires a separate router in the path. For a tower site where the netFiber 9 handles both fiber aggregation switching and basic inter-VLAN routing between the tower's operational and management VLANs, the 98DX226S's L3 offload handles this without dedicated router hardware.

- **Hardware ACL:** Layer 2, 3, and 4 ACL rules processed in the 98DX226S ASIC at line rate — traffic isolation between SFP access ports, between VLANs, and between the Gigabit management port and the fiber ports is enforced in hardware without CPU overhead.

- **Jumbo frames:** Jumbo frame support for high-efficiency storage and inter-switch traffic — relevant for ISP backhaul deployments where jumbo frames are standard configuration between aggregation switches.

**The 10-port fiber architecture — 5× SFP + 4× SFP+ + 1× GbE**

The netFiber 9's port mix is specifically engineered for the outdoor ISP aggregation and optical distribution use case:

**5× SFP ports (1G):**

The five standard SFP ports accept any 1G SFP transceiver — 1000BASE-SX (multimode 850nm), 1000BASE-LX (single-mode 1310nm), 1000BASE-ZX (single-mode 1550nm for long-reach), BiDi SFP transceivers, and 1G SFP DAC cables. For a tower site connecting 5 downstream 1G fiber-fed CPE aggregation points, ISP PoP distribution switches, or building distribution frames, the five SFP ports provide the 1G access-layer fiber connections. MikroTik's compatibility list for SFP transceivers is extensive — confirm specific transceiver compatibility from the MikroTik SFP compatibility list before ordering transceivers for a specific fiber type and distance requirement.

**4× SFP+ ports (10G):**

The four SFP+ ports accept 10G SFP+ transceivers and DAC cables — 10GBASE-SR (multimode 850nm, up to 300m on OM3), 10GBASE-LR (single-mode 1310nm, up to 10km), 10GBASE-ER (single-mode 1550nm, up to 40km), and 10G SFP+ DAC cables for short-reach direct-attach connections. The four 10G SFP+ ports serve multiple deployment roles simultaneously:

- **10G inter-switch uplinks:** Connecting the netFiber 9 to an upstream 10G switch or router — a CRS510-8XS-2XQ-IN, CRS518-16XS-2XQ-IN, CRS504-4XQ-OUT, or a third-party 10G aggregation switch — via 10G SFP+ fiber or DAC. The netFiber 9 connects to the aggregation layer at 10G while distributing to 5 downstream 1G SFP-fed nodes.

- **10G direct device connections:** Connecting 10G-capable servers, NAS devices, or routers directly to the netFiber 9 via 10G SFP+ — for a tower site where the primary router (CCR2004, RB5009UPr+S+OUT) has an SFP+ port and needs a 10G fiber connection to the netFiber 9.

- **LACP 802.3ad bonding of SFP+ ports:** Two or more SFP+ ports bonded via LACP provide 20G, 30G, or 40G aggregate inter-switch bandwidth — for a deployment where a single 10G uplink is insufficient for the combined throughput of 5× 1G SFP downstream connections.

- **Mixed SFP and SFP+ operation:** SFP+ ports are backward compatible with 1G SFP transceivers — a 1G SFP transceiver operates in an SFP+ port at 1G, extending the netFiber 9 to up to 9 simultaneous 1G SFP connections if all four SFP+ ports are used with 1G SFP transceivers instead of 10G SFP+ transceivers. This backward compatibility is particularly useful during a phased migration from 1G to 10G infrastructure — existing 1G SFP transceivers operate in the SFP+ ports today, replaced with 10G SFP+ transceivers as 10G endpoints are deployed.

**1× Gigabit Ethernet port (direct switch chip connection, PoE-in):**

The single Gigabit Ethernet port is explicitly not a management-only port — MikroTik's product description is specific: "the Gigabit Ethernet port is not just for management purposes. It has a direct connection to the switch chip — so you can enjoy full gigabit speed." This means the GbE port participates in the switch fabric at full Gigabit throughput — it can carry production traffic (not just management traffic) as a member of a bridge, a VLAN, or a routed interface.

The 802.3af/at PoE-in on the GbE port is the power flexibility feature that makes the netFiber 9 deployable in locations without AC power or DC cable access — a rooftop, a tower mid-point, a building exterior enclosure, or a pole-top mounting where running a separate DC power cable is impractical. An 802.3af/at PoE switch or injector in the equipment room below sends both the management Ethernet connection and power up a single Cat5e/Cat6 cable to the netFiber 9 at the outdoor location. The included Gigabit PoE injector provides this capability out of the box for deployments without a native PoE switch port available.

**The IP54 outdoor enclosure — designed for optical cable management**

IP54 provides dust protection (no harmful dust ingress) and splash water resistance from any direction — the correct rating for an outdoor enclosure mounted under a roof overhang, inside a vented outdoor cabinet, or on a sheltered building exterior. IP54 is not IP66 — it is not rated for direct rain exposure or power jet water cleaning — but for the intended deployment scenarios MikroTik describes ("outdoors with some light coverage — like a roof overhang or a simple cabinet"), IP54 provides adequate protection.

MikroTik's product description highlights a specific cable management design feature: "we designed the case to have some handy little additional features on the bottom of the case to help you keep everything neat and tidy." With 5 SFP ports, 4 SFP+ ports, 1 GbE port, 1 console port, and 1 DC jack — up to 11 cable/transceiver connections — the netFiber 9's outdoor enclosure includes physical cable routing features on the bottom of the case to organise fiber patch cables, SFP+ DAC cables, and the Ethernet cable at the mounting point. For a tower or rooftop installation where the netFiber 9 is mounted at a fiber distribution point with multiple fiber runs, neat cable organisation is not an aesthetic preference — it is a maintenance and fault-isolation requirement. Disorganised cables at height or in an outdoor enclosure make troubleshooting and transceiver replacement significantly more difficult.

**The rear heatsink — passive thermal management and mounting stability**

The netFiber 9's rear heatsink serves two explicitly stated functions in MikroTik's product description:

- **Primary function — heat dissipation:** The large rear heatsink provides passive thermal management for the 98DX226S ASIC and associated components across the -40°C to +70°C operating range. At 17W max power consumption in a passively cooled outdoor enclosure, the heatsink's surface area dissipates the thermal load to the ambient environment by natural convection and radiation — no fan required, no fan maintenance, no fan failure risk in an outdoor enclosure.

- **Secondary function — centre of mass management:** MikroTik specifically notes that the heatsink "moves the centre of mass towards the side with all the mounting options — keeping the board firm and strong upon installation." The heatsink's mass is positioned toward the mounting side of the enclosure — pole, wall, or mast — so that gravity and wind load on the SFP/SFP+ cable connections on the front face of the enclosure do not create a torque moment that would stress the mounting hardware. This is a thoughtful mechanical engineering detail for an outdoor enclosure that may be carrying up to 9 SFP/SFP+ transceivers with fiber patch cables attached.

The K-66 fastening set and 2× hose clamps included in the package provide pole, wall, and mast mounting options — the standard MikroTik outdoor hardware for outdoor enclosure installation. No additional mounting hardware is required for standard tower or rooftop installations.

**The FiberBox heritage — what the netFiber 9 replaces**

MikroTik explicitly positions the netFiber 9 as "the spiritual successor to the beloved FiberBox" — the FiberBox Plus (CRS305-1G-4S+OUT) was MikroTik's previous outdoor SFP+ switch: 4× SFP+ (10G) + 1× GbE, passively cooled, IP54. The netFiber 9 extends the FiberBox Plus architecture with:

- **5× additional SFP (1G) ports:** The FiberBox Plus had no standard 1G SFP ports — all four fiber ports were SFP+ (10G only). The netFiber 9 adds five dedicated 1G SFP ports, making it the correct choice for deployments with a mix of 1G and 10G fiber endpoints — where the FiberBox Plus required 1G SFP transceivers in its SFP+ ports at reduced capability utilisation.

- **Doubled RAM:** 256 MB vs the FiberBox Plus's 64 MB — significantly more headroom for RouterOS v7, larger MAC address tables, and more complex VLAN/ACL configurations.

- **Upgraded to 98DX226S:** The FiberBox Plus used the 98DX3236 switch chip with a separate QCA9531 management CPU. The netFiber 9 uses the 98DX226S integrated device — CPU and switch ASIC in one chip — with the hardware L3 offloading capability the 98DX226S provides.

- **RouterOS v7 License 5:** The FiberBox Plus shipped with License 5 on RouterOS v6; the netFiber 9 ships with RouterOS v7 License 5 — the current generation OS with container support, WireGuard, wifiwave2, and all v7 features.

For any ISP or WISP currently running FiberBox or FiberBox Plus units at tower sites, the netFiber 9 is the direct replacement path — same physical mounting footprint, same IP54 outdoor rating, same PoE-in and DC jack power options, with additional 1G SFP ports and upgraded silicon.

**Fiber versus copper at tower sites and outdoor aggregation points — the netFiber 9's operational context**

MikroTik's product description frames the fiber advantage for outdoor deployments specifically: "optic fiber can be a great alternative to copper if you are worried about electromagnetic interference or maybe even tampering and eavesdropping." Three distinct operational advantages of fiber over copper at tower and outdoor aggregation deployments:

- **Electromagnetic interference immunity:** Tower sites are high-RF environments — multiple transmitting sector APs, backhaul radios, cellular base stations, and microwave links operate in proximity. Copper Ethernet cables act as antennas in high-RF environments, picking up interference that causes packet errors, CRC errors, and link instability. Optical fiber has no electrical conductors — it is completely immune to RF interference regardless of transmit power or frequency environment at the tower site.

- **Ground loop elimination:** Long copper Ethernet runs between buildings or between tower levels at different ground potentials create ground loops — current flows through the cable shield, causing interference and potentially damaging equipment. Optical fiber has no electrical conductivity between endpoints — no ground loop is possible regardless of the grounding differential between the fiber endpoints.

- **Physical security:** Copper Ethernet cables can be physically tapped — a clip-on inductive tap or a splice into the cable exposes the electrical signal without breaking the connection. Optical fiber cannot be passively tapped without measurably attenuating the optical signal — any physical tap reduces received optical power, which can be detected by monitoring the SFP transceiver's received power level in RouterOS. For a deployment where the cable run passes through areas outside the operator's physical security perimeter, fiber provides meaningful tamper-detection capability that copper cannot.

The 100-metre limitation of Gigabit Ethernet copper is also relevant for outdoor tower deployments — a tower cable run from ground level equipment room to a tower-top aggregation point may easily exceed 100 metres, where copper Gigabit Ethernet's IEEE 802.3 distance limit applies. Single-mode fiber SFP transceivers in the netFiber 9's SFP ports reach kilometres rather than metres — eliminating the tower height constraint entirely.

**RouterOS v7 License 5 / SwitchOS — dual-boot**

RouterOS v7 License 5 on the netFiber 9 provides the complete RouterOS management feature set — VLAN, bridge, firewall, SNMP, WireGuard, IPsec, scripting, and the 98DX226S's L3 hardware routing capability. SwitchOS provides the simplified managed switch UI for operators who want VLAN management, port statistics, and SNMP without RouterOS complexity. For an ISP deploying the netFiber 9 as a managed outdoor fiber switch in a MikroTik-managed infrastructure, RouterOS v7 provides native integration with the broader RouterOS management ecosystem — Dude network monitoring, RouterOS scripting for automated maintenance, and SNMP for third-party NMS integration.

**5-year software support guarantee:** RouterOS v7 and SwitchOS updates free for life of product or minimum 5 years from date of purchase.

**Canadian market note:** Certifications are CE, EAC, and RoHS — no FCC or IC (ISED) published. The netFiber 9 is a wired switch with no wireless transmitter. No ISED wireless device certification advisory applies. Confirm any applicable Canadian electrical safety certification (CSA, cUL) requirements with your distributor before listing. The absence of FCC/IC is not a compliance concern for a wired switch in Canada.

Key specifications:

- **Product code:** CRS310-1G-5S-4S+OUT

- **Architecture:** ARM 32-bit

- **CPU / Switch ASIC:** Marvell 98DX226S, dual-core ARM32, 800 MHz (integrated CPU + switch)

- **RAM:** 256 MB

- **Storage:** 16 MB FLASH

- **OS:** RouterOS v7 License 5 / SwitchOS (dual-boot)

- **SFP ports (1G):** 5×

- **SFP+ ports (10G):** 4×

- **Gigabit Ethernet ports:** 1× (direct switch chip connection, 802.3af/at PoE-in)

- **Serial console:** RJ45

- **DC jack input:** 18–57V

- **PoE-in:** 802.3af/at, 18–57V (GbE port)

- **DC inputs:** 2 (DC jack + PoE-in)

- **Max power consumption:** 17W

- **Max power without attachments:** 10W

- **Cooling:** Passive (rear heatsink)

- **IP rating:** IP54

- **Operating temperature:** -40°C to +70°C

- **MTBF:** ~200,000 hours at 25°C

- **Monitors:** CPU temperature, voltage

- **Certifications:** CE, EAC, RoHS — no FCC, no IC published

- **Included:** 48V 0.95A power adapter, Gigabit PoE injector, K-66 fastening set, hose clamp ×2