I'm running a CRS226-24G-2S+ with version 6.24. I have a couple simple example VLAN setups and have tried to follow the examples in the documentation and can't get them to work. My setup is simple. 2 ports in same VLAN where both are untagged. VLAN is 10 and I want both ports to be untagged. Since the CRS226 has every port with a master of ether1-master-local, I followed the example here *(except did not create a new group of ports) http://wiki.mikrotik.com/wiki/Manual:CR ... Based_VLAN

/interface ethernet switch ingress-vlan-translation
add ports=ether3-slave-local,ether4-slave-local customer-vid=0 new-customer-vid=10 sa-learning=yes

/interface ethernet switch vlan
add ports=ether3-slave-local,ether4-slave-local vlan-id=10 learn=yes

This didn't work. While FDB page shows each port in vlan 10 -- still can't ping computers plugged into each of these ports.

Any idea what is wrong?

The entry in "egress-vlan-tag" table is mandatory even if there are no tagged ports.

I gave that a try and it didn't fix the problem. The FDB page reports each port is only in VLAN 10, but I still can't pass traffic thru the ports.

Question -- does the VLAN header actually get stripped out entirely or does the header value get set to something like 0? I need the traffic to have no VLAN headers at all.

With the caveat that I'm doing this on CRS125's running v6.19 and not CRS226's running v6.24 (so I can't guarantee the config is the same between what I'm doing and what you're doing), I would need to add the following configuration in addition to what you already have to my CRS125:

/interface Ethernet switch egress-vlan-translation
add ports=ether3-slave-local,ether4-slave-local customer-vid=10 new-customer-vid=0

Without the egress translation, traffic from the switch to the connected devices goes out tagged with vlan10, instead of untagged like the connected device is expecting.