freezing after adding vlan access port to trunk router

antonymayi · Tue Oct 15, 2013 1:37 am

Hi,

I am using mikrotik router to route several VLANs on my network which are coming in via tagged trunks. This all works ok, I would like to attach one of the vlans as an untagged access port to one of the ethernet ports. When I do this, the whole routers stops answering - only thanks to safe mode it starts working again in few seconds when the change is reverted.

Following is the logical diagram of the interfaces. When adding the bridge130 the router freezes.

+------------------------------------------------------+
|                                             - ether1 +---- ~~ tagged trunk of vlans 128,129,130,200,10
|                                            /         |
|                                     - bond0          |
|              vlan128 --- \         /       \         |
|              vlan129 ---- \       /         - ether2 +---- ~~ tagged trunk of vlans 128,129,130,200,10
|              vlan10  ----- bridge1                   |
|              vlan200 ---- /       \         - ether3 +---- ~~ tagged trunk of vlans 128,129,130,200,10
|            - vlan130 --- /         \       /         |
|           /                         - bond1          |
|          /                                 \         |
| bridge130                                   - ether4 +---- ~~ tagged trunk of vlans 128,129,130,200,10
|          \                                           |
|           \                                          |
|            --------------------------------- ether13 +---- ~~ UNTAGGED vlan 130
|                                                      |
+------------------------------------------------------+

Full config is following:

ros code

/interface bridge
add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes disabled=no forward-delay=15s l2mtu=65535 max-message-age=20s mtu=1500 name=bridge1 priority=0x8000 protocol-mode=rstp \
    transmit-hold-count=6
/interface ethernet
set 0 arp=enabled auto-negotiation=yes disabled=no full-duplex=yes l2mtu=1600 mac-address=D4:CA:6D:42:40:A2 mtu=1500 name=ether12 speed=100Mbps
set 1 arp=enabled auto-negotiation=yes disabled=yes full-duplex=yes l2mtu=1600 mac-address=D4:CA:6D:42:40:A3 mtu=1500 name=ether13 speed=100Mbps
set 2 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no full-duplex=yes l2mtu=1598 mac-address=D4:CA:6D:42:40:97 master-port=none mtu=1500 name=ether1 speed=100Mbps
set 3 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no full-duplex=yes l2mtu=1598 mac-address=D4:CA:6D:42:40:98 master-port=none mtu=1500 name=ether2 speed=100Mbps
set 4 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=yes full-duplex=yes l2mtu=1598 mac-address=D4:CA:6D:42:40:99 master-port=none mtu=1500 name=ether3 speed=100Mbps
set 5 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=yes full-duplex=yes l2mtu=1598 mac-address=D4:CA:6D:42:40:9A master-port=none mtu=1500 name=ether4 speed=100Mbps
set 6 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=yes full-duplex=yes l2mtu=1598 mac-address=D4:CA:6D:42:40:9B master-port=none mtu=1500 name=ether5 speed=100Mbps
set 7 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no full-duplex=yes l2mtu=1598 mac-address=D4:CA:6D:42:40:9C master-port=none mtu=1500 name=ether6 speed=100Mbps
set 8 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no full-duplex=yes l2mtu=1598 mac-address=D4:CA:6D:42:40:9D master-port=none mtu=1500 name=ether7 speed=100Mbps
set 9 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=yes full-duplex=yes l2mtu=1598 mac-address=D4:CA:6D:42:40:9E master-port=none mtu=1500 name=ether8 speed=100Mbps
set 10 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=yes full-duplex=yes l2mtu=1598 mac-address=D4:CA:6D:42:40:9F master-port=none mtu=1500 name=ether9 speed=100Mbps
set 11 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=yes full-duplex=yes l2mtu=1598 mac-address=D4:CA:6D:42:40:A0 master-port=none mtu=1500 name=ether10 speed=100Mbps
set 12 arp=enabled auto-negotiation=yes disabled=no full-duplex=yes l2mtu=1600 mac-address=D4:CA:6D:42:40:A1 mtu=1500 name=ether11 speed=100Mbps
/interface vlan
add arp=enabled comment=Management disabled=no interface=bridge1 l2mtu=65531 mtu=1500 name=vlan128 use-service-tag=no vlan-id=128
add arp=enabled comment=Production disabled=no interface=bridge1 l2mtu=65531 mtu=1500 name=vlan129 use-service-tag=no vlan-id=129
add arp=enabled comment=Development disabled=no interface=bridge1 l2mtu=65531 mtu=1500 name=vlan130 use-service-tag=no vlan-id=130
add arp=enabled comment=CMS disabled=no interface=bridge1 l2mtu=65531 mtu=1500 name=vlan200 use-service-tag=no vlan-id=200
add arp=enabled comment=Internet disabled=no interface=bridge1 l2mtu=65531 mtu=1500 name=vlan10 use-service-tag=no vlan-id=10
/interface bonding
add arp=enabled arp-interval=100ms arp-ip-targets="" disabled=no down-delay=0ms lacp-rate=30secs link-monitoring=mii-type1 mii-interval=100ms mode=802.3ad mtu=1500 name=bond1 primary=none slaves=\
    ether1,ether2 transmit-hash-policy=layer-2-and-3 up-delay=0ms
add arp=enabled arp-interval=100ms arp-ip-targets="" disabled=no down-delay=0ms lacp-rate=30secs link-monitoring=mii-type1 mii-interval=100ms mode=802.3ad mtu=1500 name=bond2 primary=none slaves=\
    ether6,ether7 transmit-hash-policy=layer-2-and-3 up-delay=0ms
add arp=enabled arp-interval=100ms arp-ip-targets="" disabled=no down-delay=0ms lacp-rate=30secs link-monitoring=mii-type1 mii-interval=100ms mode=802.3ad mtu=1500 name=bond3 primary=none slaves=\
    ether11,ether12 transmit-hash-policy=layer-2-and-3 up-delay=0ms
/interface ethernet switch
set 0 mirror-source=none mirror-target=none name=switch2
set 1 mirror-source=none mirror-target=none name=switch1
/interface bridge port
add bridge=bridge1 disabled=no edge=auto external-fdb=auto horizon=none interface=bond1 path-cost=10 point-to-point=auto priority=0x80
add bridge=bridge1 disabled=no edge=auto external-fdb=auto horizon=none interface=bond2 path-cost=10 point-to-point=auto priority=0x80
add bridge=bridge1 disabled=no edge=auto external-fdb=auto horizon=none interface=bond3 path-cost=10 point-to-point=auto priority=0x80
/interface bridge settings
set use-ip-firewall=no use-ip-firewall-for-pppoe=no use-ip-firewall-for-vlan=no
/interface ethernet switch port
set 0 vlan-header=leave-as-is vlan-mode=disabled
set 1 vlan-header=leave-as-is vlan-mode=disabled
set 2 vlan-header=leave-as-is vlan-mode=disabled
set 3 vlan-header=leave-as-is vlan-mode=disabled
set 4 vlan-header=leave-as-is vlan-mode=disabled
set 5 vlan-header=leave-as-is vlan-mode=disabled
set 6 vlan-header=leave-as-is vlan-mode=disabled
set 7 vlan-header=leave-as-is vlan-mode=disabled
set 8 vlan-header=leave-as-is vlan-mode=disabled
set 9 vlan-header=leave-as-is vlan-mode=disabled
set 10 vlan-header=leave-as-is vlan-mode=disabled
set 11 vlan-header=leave-as-is vlan-mode=disabled

Now trying to add bridge130:

ros code

[admin@rt] /interface bridge<SAFE> add name=bridge130 protocol-mode=rstp
[admin@rt] /interface bridge<SAFE> port
[admin@rt] /interface bridge port<SAFE> add bridge=bridge130 interface=vlan130
... Dead after few seconds, then losing the SSH session
Connection to rt closed.
antony@antony-laptop:~$ 62;9;c62;9;c62;9;c62;9;c62;9;c62;9;c62;9;c62;9;c62;9;c62;9;c62;9;c62;9;c62;9;c

What am I doing wrong?

Thanks Antony.

samsung172 · Tue Oct 15, 2013 1:42 am

I think you somehow loop untag 130 and untag default. It freeze course of the loop.

antonymayi · Tue Oct 15, 2013 10:43 am

any suggestions how to make it right? all I want is the ether13 to be vlan130 access (untagged) port.

samsung172 · Wed Oct 16, 2013 12:36 am

Do you have some kind of switch chip config enabled? Remove this. and see if loop is gone.

To get vlan from a bridge, and to add to another bridge, is a pain in mikrotik. Since the "wired" setup of vlan in mikrotik. If vlan interface, come from a physical port, its possible to just add this to another bridge with another interface to untag. If the vlan come from a bridge, its not possible to also put this in one more bridge.

You could try some firewall rules. Get all packets with vlan 130. strip vlan and forward out of ether 13. Im not 100% sure of code to this now. I don't have a device to test this.