MikroTik

artz

Yes, basically any decision to drop a packet based on its VLAN ID is done by checking the bridge VLAN table. Ingress filtering adds a second check when a packet is received (and then checked again before sent out). Of course frame-type will also be responsible for dropping appropriate packets. PVID ...

artz

Hopefully this post will answer most of your questions. anav - PVID to work you only need VLAN filtering to be enabled, ingress filtering has a different purpose that adds another layer of security when deciding if a packet with a VLAN tag needs to be dropped or forwarded. This has been studied in t...

artz

If am I correct, this port will be like an untagged port for vlan 20. So packed with no tag coming inn to this port will be marked as vlan 20. You can also send taggeed packed to the port (eks tagged with vlan 30) They will enter the bridge with tagg 30 intact if you have: /interface bridge vlan ad...

artz

You should check out this guide: https://wiki.mikrotik.com/wiki/Manual:Layer2_misconfiguration#Bonding_between_Wireless_links Also read a note about LACP and why it is not the best choice in this type of setup. If you are not able to add a logical interface into a bond on your Cisco, then there will...

artz

Hi regarding the issue: bridge - fixed packet forwarding when changing MSTI VLAN mappings could someone from MT please elaborate? we have been quite unsuccessfull integrating crs317 devices in our network using MSTP the RSTP from other devices arriving on vlans is simply not being replicated to oth...

artz

Wiki has been updated with a note for this special case. In short, you can't use VLAN filtering between different switch chips, you will have to use bridge VLAN filtering if you want to filter out VLANs between both switch chips, but that will lower the throughput for your device. Another option is ...

artz

This is a bad move! Now users of 6.40.x versions cannot install updates anymore. We need full support of hw-accelerated VLAN switching in the new bridge at some locations before versions >6.40 can be used. All VLAN related features are available in newer versions. they have been available since 6.4...

artz

It seems you discovered a bug, a fix will be released in the next 6.44beta version and later in 6.43.x

Currently you will have to reset the configuration and reapply the configuration in order to fix this issue or wait until an update is released.

Sorry for the inconvenience!

artz

CRS3xx series switches are using L2+L3+L4 as transmit hash policy globally, regardless what you select on the CRS3xx side. https://wiki.mikrotik.com/wiki/Manual:CRS3xx_series_switches#Bonding Note: The built-in switch chip will always use Layer2+Layer3+Layer4 for transmit hash policy, changing the t...

artz

By disabling MAC learning you are disabling a feature that prevents unnecessary traffic flood to all ports. If MAC learning is disabled (or rendered invalid due to an attack, not relevant for RouterOS), then all ports will be able to see the traffic that is passing through each port (broadcast traff...

artz

In such case it is possible, here is an example:

/interface ethernet switch rule
add new-dst-ports=ether2 ports=ether1 switch=switch1

artz

These values are related to bridge STP. By changing these parameters you push port priority or path-cost (in most cases you should only be using one of them depending on your network's topology) when the port is added to the bridge you specified. If your L2TP clients are simply PCs or other devices,...

artz

This is possible by using the latest RC and protocol-mode=none. Are you sure you want to use LACP on links that are bridged? There can be some throughput issues since LACP requires both links to be with the same speed. I would guess that you are trying to use Wireless links, which can change the Wir...

artz

IntrusDave - you can find more information about this option here: https://wiki.mikrotik.com/wiki/Manual:Scripting#Script_repository https://wiki.mikrotik.com/wiki/Manual:Tools/Netwatch#Properties diablothebest - this can be done under /interface bridge port https://wiki.mikrotik.com/wiki/Manual:In...

artz

*) bridge - added support for DHCP Option 82 (disables hardware offloading, CLI only); *) bridge - added support for DHCP Snooping (disables hardware offloading, CLI only); Could we please get some examples of how to use these features on the Wiki ? I cannot see any of the options I would expect, e...

artz

The current-* values under /interface bridge vlan are dynamic values, they are generated based on your PVID and untagged ports. These dynamic values should only be used for monitoring purposes.

artz

InoX - this bug has been fixed a long time ago and this warning message indicates a problem in network's topology or configuration. shunkica - by logic the warning tells you that this device has received a packet that it sent out, this means that another device in your network has decided to send ba...

artz

The duplicate MAC address behaviour is expected. When you create a bridge, it requires a MAC address and by default it will use the same MAC address as one of its slave. This behaviour does not affect packet processing since packet handling for this port is overridden by the bridge (master) interfac...

artz

The wiki has been updated to be less confusing when using different CRS series switches: https://wiki.mikrotik.com/wiki/Manual:CRS_Router Hybrid ports are possible, use the guide provided above and combine it with this guide: https://wiki.mikrotik.com/wiki/Manual:CRS1xx/2xx_series_switches_examples#...

artz

It is possible to isolate multiple networks using VLANs, even on a hardware level. Check this guide to see how this can be done:
https://wiki.mikrotik.com/wiki/Manual:Switch_Router

artz

You can't, this is a hardware limitation. You should check this wiki page to understand this better: https://wiki.mikrotik.com/wiki/Manual:Layer2_misconfiguration#Bridges_on_a_single_switch_chip If you are looking for isolated ports, then you might want to consider to use port isolation feature: htt...

artz

CVID Stacking is now possible in the latest RC version, here is an example how to configure it:
https://wiki.mikrotik.com/wiki/Manual:I ... g_stacking

artz

*) bridge - added per-port based "tag-stacking" feature Can this also be explained. Similar to selective q-in-q? Wiki has been updated with an example: https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Tag_stacking Selective QinQ is not possible yet, only port based QinQ or CVID stac...

artz

Can you share more details about your setup? RB1<->CCR<->RB2 #RB1 /interface ethernet set [ find default-name=ether1 ] l2mtu=9000 mtu=9000 /ip address add address=192.168.1.2/24 interface=ether1 /ip route add gateway=192.168.1.1 #RB2 /interface ethernet set [ find default-name=ether2 ] l2mtu=1580 mt...

artz

Did you change L2MTU as well?

https://wiki.mikrotik.com/wiki/Manual:M ... 2.2FL2_MTU

artz

As soon as you set vlan-protocol=802.1ad, then all VLAN tagging, untagging and filtering is done by checking VLAN tag with Ethertype=0x88A8 (SVID), all CVID tags are ignored and considered as untagged traffic. Selective QinQ currently is not supported on CRS3xx. Also note that by setting vlan-protoc...

artz

Note that frame-type applies to ingress traffic. We recently discovered a bug on CRS326 that it allows to forward packets that are internally tagged with PVID=1, this will be fixed in future versions, though this bug does not exist on CRS317. To avoid this bug, simply set PVID=2 to all ports that cu...

artz

One option is to simply leave the MGMT Ethernet port out of a bridge and use Firewall filter rules to limit access to the device. There is a way if you really need to allow forwarding one SVID, but allow MGMT access from a certain CVID (trunk/access port setup with VLAN filtering), find an example b...

artz

This is a hardware limitation, this has also been added to the wiki:
https://wiki.mikrotik.com/wiki/Manual:C ... Based_VLAN

artz

Which RouterOS version are you using? There was a bug in 6.41 related to IGMP Snooping in 6.41, the problem description seems to match your problem, but it was fixed in 6.42

If you are already using 6.42, then you should send a supout.rif file to support@mikrotik.com since this might be a bug.

artz

I have some more questions: I have couple of VLANs: 10,20,30, 100 and 192 I created bridges for each vlan: bridge-vlan10,bridge-vlan20,bridge-vlan30,bridge-vlan100 and bridge-vlan192 My trunks are on physical ports SFP1, SPF2, SFP3 and SFP4 According to proposed solution (example): /interface bridg...

artz

This is possible on switch chips that are capable of ACL rules, you can find examples using CRS3xx and non-CRS1xx/CRS2xx devices here:
https://wiki.mikrotik.com/wiki/Manual:C ... t_Security

artz

Most likely the Netgear is dropping tagged BPDUs, which are being sent out of your device because of misconfiguration.
You should read more about this case here:
https://wiki.mikrotik.com/wiki/Manual:L ... _interface

artz

This is a common access-trunk port setup, you should follow this guide;
https://wiki.mikrotik.com/wiki/Manual:B ... s_switches

artz

Scripts come in handy. Similarly you can monitor link flaps as well. :global InformedLinkStatus 0; #Monitor link rate /system script add name=ether1check owner=admin policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":local ss [/in eth mo \ ether1 as-value once];\...

artz

This is a known issue and will be fixed in the next RC version. Currently you will have to configure switch related features using the terminal, you can use this guide as an example:
https://wiki.mikrotik.com/wiki/Manual:B ... witch_chip

artz

It means that only 1 bridge is going to use the built-in switch chip, other bridges will be using the CPU to forward packets. You can control which bridge is going to use hardware offloading with "hw=yes" and "hw=no".

artz

You can have 1 bridge with hardware offloading on RB850Gx2 and more than 4096 (the limit is a lot higher) software bridges.

artz

If you want to use your hEX as a router and a switch at the same time, you should follow this guide:
https://wiki.mikrotik.com/wiki/Manual:Switch_Router

artz

huntah - can you please elaborate what is missing in the new bridge implementation and what should be added to the wiki page? whatever - 1) Bridge VLAN filtering is not so easy to implement on these switch chips. 2) Which examples are missing vlan-header values? If you are talking about the hybrid ...

artz

The wiki page is not outdated, we try to keep our wiki pages updated, the provided wiki link is fairly new, only 1 month old. You can always check how old is the wiki page by clicking on "View history". As shown in the wiki link, only CRS3xx is capable of bridge VLAN filtering in conjuncti...

artz

Please note that multiple master-port/bridge setup is not supposed to work properly with VLANs. You should use a single bridge instead, it is very likely that your described issues are caused because of multiple isolated port groups by using multiple bridges. This has been mentioned in the manual as...

artz

The bridge interface itself (LAN) is needed to allow VLAN5 to communicate with the CPU in order for DHCP to work. A physical port is also needed to allow the specified port to forward VLAN5 packets to the CPU. With your current configuration VLAN5 is allowed to access the CPU, but there is no way VL...

artz

You are missing a tagged port on the CRS, most probably in your setup it is going to be ether8. Add ether8 to bridge VLAN table as a tagged port for VLAN5. Also note that RB3011 is capable of VLAN switching on a hardware level, you can find an example how to set it up here: https://wiki.mikrotik.com...

artz

You should check this guide: https://wiki.mikrotik.com/wiki/Manual:Spanning_Tree_Protocol It contains a lot of useful information about how ports are elected and what does each port role mean. A "root port" is a port that is facing towards the root bridge, you shouldn't be worrying about w...

artz

There is a known issue with CRS328 running SwOS with SFP3, this port will not forward any traffic under some conditions. This will be fixed in SwOS 2.8, currently you will have to use RouterOS.

artz

The throughput issue, LAG issue and SFP port issue are known issues in SwOS, all of them will be fixed in upcoming SwOS version. Currently you will have to use RouterOS until the new SwOS version is released. The LAG issue will be fixed in RouterOS 6.43rc33 as well as SwOS 2.8

artz

You can set the switch to accept only tagged packets on the ingress port. To do so, set "VLAN Receive = only tagged" under the "VLAN" tab for Port1-Port4. To filter out all unknown VLANs and allow only 10,20,30, you need to set VLAN mode to either enabled or strict. Under the &qu...

artz

When hardware offloading is active, then bridge filter rules will be ignored since the packets are not processed by the CPU. You can read more about this case here: https://wiki.mikrotik.com/wiki/Manual:Layer2_misconfiguration#Packet_flow_with_hardware_offloading_and_MAC_learning You either need to ...

artz

Wiki has been updated, thank you for pointing out the imperfections! The setup is not very simplistic, for this reason the configuration is going to be a bit more complex. Since you are using CRS1XX, then you have the option to use the built-in switch chip to offload some portion of traffic, the CAP...

artz

All ports that are involved into switching MUST be added to a bridge. Trunk ports must be specified in /interface ethernet switch egress-vlan-tag: /interface ethernet switch egress-vlan-tag add tagged-ports=ether1,ether21,ether22,switch1-cpu vlan-id=10 add tagged-ports=ether1,ether21,ether22,switch1...

artz

It seems you found an imperfection in the Wiki guide. Before 6.41 you should have created the VLAN interface on top of the master-port interface, but after 6.41 the VLAN interface should be created on top of the bridge interface. This is actually a common mistake that has been studied here: https://...

artz

You can always find MTU values for all our products here:
https://wiki.mikrotik.com/wiki/Manual:M ... 2.2FL2_MTU

RB450Gx4
ether1-ether5:9214

RB760iGS
ether1-ether5:2026; sfp1:2026

artz

There is no need to change anything. When upgrading to 6.41.x or newer the master-port part is converted automatically, everything else will stay the same and does not require any adjustments. The /interface ethernet switch part will not change and is fully compatible with 6.41.x and newer. DIscover...

artz

Thank you for pointing that out!
I fixed the issue, it should have been "below".

artz

We found a software issue that prevented SFP ports linking up properly after a power cycle in some cases. The fix will be included in the next SwOS version.

artz

*) dhcp - added dynamic IPv4/IPv6 "dual-stack" simple queue support, based on client's MAC address; *) dhcp - fixed DHCP server stuck in invalid state; *) dhcpv4-server - added "allow-dual-stack-queue" implementation (CLI only); *) dhcpv6-server - added "allow-dual-stack-qu...

artz

Please send supout.rif files from both devices to support@mikrotik.com
Also tell us how the two devices are connected, is it a SFP DAC or maybe using a S-RJ01 or S+RJ10 module with a Ethernet cable?

artz

First of, you should upgrade, one of your devices is using a bridge without hardware offloading. Upgrade to 6.41.x or newer and enable hardware offloading with /interface bridge port set [f] hw=yes Secondly, you are making a very common mistake: https://wiki.mikrotik.com/wiki/Manual:Layer2_misconfig...

artz

Currently it is not possible to select which frames are going to be tagged with an outer tag and which not. It is possible to use CRS3xx ACL rules to achieve a similar result though. /interface bridge add name=bridge vlan-filtering=yes vlan-protocol=802.1ad /interface bridge port add bridge=bridge i...

artz

You can find an example here: https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#VLAN_Tunneling_.28Q-in-Q.29 Note that the same principles can be applied as for regular VLAN filtering (trunk, access, management port and so on). Do note that QinQ with RSTP is not supposed to work with bridges tha...

artz

You can find examples with the new hardware offloading feature as well as for pre-6.41 here:
https://wiki.mikrotik.com/wiki/Manual:S ... s_Ports.29

artz

Currently RouterOS bridge is only 802.1Q aware, support for 802.1ad is planned (with hardware offloading for CRS3xx). RouterOS checks the outer tag and checks if the tag is 802.1Q (0x8100), but in case of SVID it sees 802.1ad (0x88A8) and assumes it as an untagged frame since a tagged frame is consi...

artz

With RouterOS v6.43rc11 it is possible to do port isolation on devices with a switch chip, this includes CRS3xx as well.
Example can be found here:
https://wiki.mikrotik.com/wiki/Manual:S ... _isolation

artz

In simple terms, yes, you assumptions are correct.
Updated the wiki to have more detailed explanation:
https://wiki.mikrotik.com/wiki/Manual:I ... t_Settings

To be more specific, traffic is dropped when it should be sent out (egress), not when received (ingress).

artz

VLAN switching will not be removed and it is still possible to do VLAN switching when you have configured your device with 6.41.x or later. The configuration stays the same, only the master-port part is replaced (even converted) to a bridge configuration, VLAN switching configuration part has not be...

artz

"Port based" VLANs is the old type of configuration that has been left in the wiki page for legacy reasons, but it is known to cause issues with RSTP and can even cause loops. The "bridge based" VLANs should be used whenever possible since this type of configuration complies with...

artz

Note that bonding interfaces on CRS1xx/CRS2xx are not hardware offloaded, you should use trunking interfaces instead. You should check this guide for similar setup to yours: https://wiki.mikrotik.com/wiki/Manual:CRS1xx/2xx_VLANs_with_Trunks If you choose to use trunking interfaces (balance-xor), the...

artz

Currently only CRS3xx series switches are able to hardware offload configurations with /interface bridge vlan. If a device (including the old CCR1009) has a switch chip and is capable of VLAN switching on a hardware level (look for VLAN table here: https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_F...

artz

There is an error in your configuration, you have created a VLAN interface on top of a slave interface, you can read more about this case here: https://wiki.mikrotik.com/wiki/Manual:Layer2_misconfiguration#VLAN_interface_on_a_slave_interface If this is all of your configuration, then with this confi...

artz

There is a problem in your AP's configuration, please check this guide:
https://wiki.mikrotik.com/wiki/Manual:L ... _interface

artz

It is required to create the VLAN interface on the bridge interface, you have done that correctly. If you are intending to filter invalid VLANs on your switch (which you should), then you must specify which VLANs are allowed on each port, otherwise all VLANs will be dropped. Before you enable invali...

artz

Please don't put VLAN interfaces in a bridge with a physical interface, that is known to cause issues: https://wiki.mikrotik.com/wiki/Manual:Layer2_misconfiguration#VLAN_in_bridge_with_a_physical_interface You should follow this guide for RB3011 to achieve wirespeed VLAN switching performance: https...

artz

Note that this message means that a packet, that was sent out from this device, was received back. This means that something in your network is creating a loop and by logic this is most probably another device that is connected to that interface. Make sure you have not used this type of configuratio...

artz

This does not sound right. SOHO devices with switch chips, e.g. hap ac and hap ac 2, can be entirely configured for VLANs via bridge and with hardware support. There is no need to touch the /interface ethernet switch. No, bridge VLAN filtering is not hardware offloaded on any other device than CRS3...

artz

Assuming that you are intending to do some routing with that untagged traffic on your router: /interface bridge add name=bridge /interface ethernet switch port set 0 vlan-mode=secure set 1 vlan-mode=secure set 2 default-vlan-id=6 vlan-mode=secure /interface bridge port add bridge=bridge interface=et...

artz

You can add a single interface to a bridge and use bridge filters on it. /interface bridge add name=bridge /interface bridge port add bridge=bridge interface=ether1 /interface bridge filter add action=drop chain=input in-bridge=bridge in-interface=ether1 src-mac-address=4C:5E:0C:4D:12:45/FF:FF:FF:FF...

artz

Jamesits, csi -

Please write to support@mikrotik.com
We will need to see your network topology and your supout.rif from both devices.
There is something specific in your configuration or your setup that might be causing these issues.

artz

Please don't post the same question in multiple topics. It is not always needed to specify ports as untagged ports. Ports are added dynamically as untagged ports for the VLAN that matches the PVID. For a simple trunk/access/hybrid port setup this behaviour can be untouched and let the bridge dynamic...

artz

You are missing the management port.
https://wiki.mikrotik.com/wiki/Manual:I ... ement_port

You need to add the bridge interface itself as a tagged port in /interface bridge vlan.

artz

CRS1xx/CRS2xx and CRS3xx require a different approach to configure VLAN switching on a hardware level. Since 6.41 the master-port configuration is discarded and is replaced with a bridge configuration. Now in 6.41 as soon as you add ports to a bridge hardware offloading is enabled by default, this i...

artz

Make sure that the traffic is not single destination and make sure you are using a proper transmit hash policy.
You can read more about it here:
https://wiki.mikrotik.com/wiki/Manual:L ... _balancing

artz

It is very likely that you have misconfigured your device.
Check this guide to make sure you are not using a configuration that is known to cause issues:
https://wiki.mikrotik.com/wiki/Manual:L ... _interface

artz

My understanding of how VLAN's work in RouterOS when it comes to bridges.... (Correct me if i'm wrong) - If you add physical interfaces to a bridge, along with a vlan interface, then traffic going OUT all physical interfaces will be untagged for that VLAN. Traffic going OUT the vlan interface will ...

artz

Note that in most cases the device that has detected loops is not causing the loop. What this error means is that a packet, that was sent out by the device, is received back after it was forwarded into your network. You should check devices that are connected to ether1. We have noticed quite a few c...

artz

Since RouterOS 6.42rc23 LAG interfaces are hardware offloaded on CRS3xx series devices.
More information can be found here:
https://wiki.mikrotik.com/wiki/Manual:C ... es#Bonding

artz

Well done!
I can confirm it's working on a CRS326 now. Still open is the issue to change MTU size.
Code: Select all
[admin@MikroTik] /interface bonding> set bond2 mtu=8148
failure: could not set mtu
[admin@MikroTik] /interface bonding>

You must set L2MTU on slave interfaces first.

artz

Are you aware and have reproduced the LACP problem aswell? There is something specific to your setup that is causing access to the CPU being lost. Please write to support@mikrotik.com, attach the supout.rif file and a small, simplified network diagram (preferably with device's model name on the oth...

Search found 88 matches