MikroTik

gigabyte091

So when your AP arrive I think it would be the best to write here what are you trying to achieve.

So how many SSIDs, VLANs etc and then we start from that.

gigabyte091

Is your ax2 only AP in your network ? If yes then why are you using CAPsMAN ?

Local radio interfaces are managed locally, not via capsman, so radios on your ax2 are not configured by CAPsMAN, assuming ax2 is your CAPsMAN controller.

Second, you untagged all VLANs for all wireless interfaces. Why ?

gigabyte091

Thanks, this sounds like a solution I need. I will give it a try then.

gigabyte091

Just to prevent any attempt to connect to the switch with laptop or PC.

gigabyte091

That's why always have one port off the bridge so you can access device in case of misconfiguration. Do you see your device MAC address in neighbors in winbox ?

gigabyte091

Yea, they agreed to have another device so problem solved hehe.

gigabyte091

Not a bad idea but I would like to configure this without additional devices if possible.

gigabyte091

Hey guys, i'm having one situation where I have CRS112 as PoE switch for some VoIP devices. There are only two devices but customer have request so that they move one unit between two rooms when one of their colleague is on vacation. There is one solution but that includes switching cables in networ...

gigabyte091

I wouldn't power routers with low voltage such as 12V. I would always choose higher voltage, 24V for eg. in this case.

Look for an isolated converter if possible.

gigabyte091

My recommendation is to look at meanwell power supplies. I use them a lot in my line of work and they are great.

gigabyte091

Agree with @jaclaz here. When I know that my device needs to power other PoE devices then I power that device with dedicated PSU. At my office I have several switches on desks that are powered from central PoE switch. 7 desks, 7 switches. That's a lot power bricks...and space that is saved. But thos...

gigabyte091

You may or may not experience instability in operation. Just to be sure I would use DC-DC step up converter from 12 to 24V that can work in input voltage range that you expect.

gigabyte091

PoE in on hEX PoE is passive so while it's possible to power it by RB5009 which is active PoE you will most likely need to force PoE on on the desired port on the RB5009. Reason is that active PoE uses negotiation with client that requests PoE to be turned on. And passive PoE just sends and receives...

gigabyte091

You get 70°C in the attic ?? That device will not last long at such high ambient temperature.

gigabyte091

@infabo, yea I know it's a bad position. But hey, i'm getting full ISP speed at my living room so no problems so far. I want to put it on a wall besides my AC unit as i can run cable there. Still not the best position but running a cable to the ceiling is not an option... Armored concrete with a lot...

gigabyte091

I'm not having any problem with USB stick on ax3 at my parents house. Its some no name 64G stick. Working without a problem on 15beta9.

gigabyte091

If ether for is used as trunk port then frame types should be set as admit all, not admit only untagged and priority tagged. When set as admit only untagged and priority tagged then you are creating access port and VLAN that is specified in PVID, in your case VLAN 1 becomes untagged. That is visible...

gigabyte091

CAP AXs are oversized smoke detectors.

That's why my cAP ax sits behind TV and another one behind PC monitor

Wife didn't approved ceiling mount...

gigabyte091

Hello, you need to do your changes on your CAPsMAN, not CAP.

gigabyte091

You can use Mikrotik DAC https://mikrotik.com/product/xs_da0001

gigabyte091

I have several devices that are 2.5G and there is benefit of ROS and additional plus was UPS package that is working like a charm with my APC ups.

gigabyte091

It all depends on what you need. I have two CSS610-8G-2S-IN and never had any problem with them. My setup was simple VLANs, nothing fancy.

I replaced them with CRS310-8G+2S+IN because i wanted all devices to run ROS and because of the 2.5G ports.

gigabyte091

Why are you using VLAN1 on your ether4 ? Are DHCP servers created for every VLAN ?

gigabyte091

Did you make the changes to your firewall rules as @anav suggested you earlier in the topic and later mentioned again by @llamajaja?

Can you confirm that cameras are using only those ports ? What camera brand are you using ?

gigabyte091

That's one possible solution, if you create VLAN then you can block traffic from one VLAN to another.

gigabyte091

One thing that comes to my mind is that your device roams between two APs, that can be checked in logs in winbox. If your APs are too close, make sure that they are on different channels and maybe it could help if you decrease transmit power. I did this in my house because some of my devices likes t...

gigabyte091

Best thing to do is to contact mikrotik support via email, describe your problem and attach created supout.rif file when problem occurs.

gigabyte091

Both bands in my case, ax2 also sustain higher connection speed at the same location. Granted that was some months ago, now i'm using cAP ax.

gigabyte091

Same here, somehow it seems that ax2 have better coverage than ax3.

gigabyte091

Agree, put wifiwave2 drivers on your ac3, it will make a big difference. No need to buy new router for now IMHO. Wait for WiFi 7.

gigabyte091

Suggestions ? Is there something wrong ? Something not working right ?

Anyway, after 200 CAPs you set up, i would suggest cold beer or two

gigabyte091

Check your CPU usage (not avg usage you get at the top of the winbox but per core usage in System/Resources/CPU).

If you are hitting something like 85-100% on any core you got your answer.

gigabyte091

Well, you can check DHCP leases under IP/DHCP Server/Leases. Here you will find all leases issued by your DHCP server. IP addresses, MAC addresses etc.

gigabyte091

If you are using your device as router then you need some WAN interface, so you can connect your device that is acting as router to the internet. In that case default configuration configure ether1 as WAN port and enable DHCP client on it. If you connect that port to your existing network then IF yo...

gigabyte091

Post your config please. Also tinkering with quickset and then tinkering with settings in other menus can cause unwanted behaviour.

If you reset router to factory default then default configuration will have DHCP client enabled on ether1.

gigabyte091

Check your logs, maybe 5GHz is dropping because radar is detected.

gigabyte091

Can't go wrong with RB5009. It's more than capable of 2Gig routing.

gigabyte091

On hAP ac2 I first uninstalled Wireless package and then installed Wifiwave2. Worked without a problem.

gigabyte091

Yea... It took them quite long to release WiFi6 devices. (Not saying that this was bad thing.)

gigabyte091

I will be surprised if Mikrotik releases their be devices this year...

gigabyte091

Baby steps is my advice, so get VLANs to work on your router without any trunking.

When you see that it's working and most importantly, you know why it's working then go to the next step.

gigabyte091

Hello,if you want to create access port you need to untag desired port, not set it to tagged as you did here. ROS will automatically untag you desired port with PVID you set. Also your pool starts with 192.168.0.30 and ends with 192.168.30.100. That is not possible with CIDR of 24. Probably just a t...

gigabyte091

What error are you getting ? radar detected ?

But I must agree with @anav here, with other vendors you will get much more smoother Wi-Fi experience. With Mikrotik it's just frustrating sometimes to get Wi-Fi to work right...

gigabyte091

Okay, so if you want to use device as plain switch then correct way to do this is to create a new bridge, add all interfaces to the newly created bridge and enable dhcp client on bridge interface. That way your switch will receive IP address from DHCP server. Or you can assing IP address to the brid...

gigabyte091

Your approach is wrong here, first you need to specify what do you want from the device ? Do you want plain switch ? VLANs ?

Check if SSH is enabled when default configuration is not applied.

Did you set static IP on your network card ?

gigabyte091

What do you need ? If you need 16 port desktop switch you have one in CRS series.

gigabyte091

Test results for ax2: Download: 644.3 Mbps (avg CPU usage 81%, cpu1 at 100%) Upload: 356.2 Mbps (avg CPU usage 74%, cpu1 at 100%) ROS version: 15beta8 on both devices. And don't use USB network cards for test... I changed 2 TP-Link cards, every time test starts, get up to speed and then you hear dis...

gigabyte091

I'm using Openspeedtest. Server is on one W11 machine connected to CHR (special PC running proxmox and all network interfaces are passed directly to the CHR) CHR connected to my switch on main network. Test device connected to the same switch and same VLAN as CHR. And then on test device any client ...

gigabyte091

Don't know but can measure tomorrow, for hAP ac2 i get about 363Mbps DL/ 341 Mbps UL

gigabyte091

If you have IoT network then why blocking some devices... Just block IoT VLAN access to the other VLANs (but leave communication open to the HA server) Did you created VLANs on Mikrotik ? If not here is great tutorial for that: https://forum.mikrotik.com/viewtopic.php?t=143620 Read it, try it yourse...

gigabyte091

Is there ISP gear that can be powered via PoE in? I'm not aware of that (at least in Italy).

Yes, my antenna was powered by port1 of the ax3, so there are a real use cases.

gigabyte091

@OP welcome to the club here... Like you, I also wait for Mikrotik to implement something other vendors have for some time now... And nothing...

gigabyte091

Wireless package is used for devices that uses legacy drivers and old CAPsMAN. WiFi is for newer devices and old devices that supports wifiwave2 drivers and CAPsMAN v2

gigabyte091

Can you see SSID when frequency set to auto ?

gigabyte091

P.S. Just checked Rubycon 50ZLJ1000M12.5X25, the lifetime is 2,000 hours at 85 degree, that is 83 days...

But I highly doubt that your PSU will run at 85°C...

gigabyte091

Can you share your configuration ? Did you try to downgrade ROS to version your WiFi worked ?

gigabyte091

Ofcourse it wouldn't but all future device won't be affected by low flash space.

gigabyte091

Or... Mikrotik just put 32 or more MB of flash into your devices for f... sake. It's 2024...

gigabyte091

@OP, why not just use cAP ac then ? I doubt smart devices will benefit wifi6

gigabyte091

WAF factor strikes again

gigabyte091

So you have roadwarrior setup i presume from the logs on wireguard.

Where are you connecting to, does other side router have public IP ? Can you export your configuration. On the first look it looks to me that you could have firewall problem if other side is reachable.

gigabyte091

In this case good solution is to use isolated DC/DC converter.

gigabyte091

When you did netinstall, did you follow instructions for netinstalling ? Are you using windows machine ?

gigabyte091

Yea but you have 2 wifi interfaces and one wired interface to add to bridge. (second one off bridge management)

Not so much more work.

gigabyte091

Or maybe it's better to reset cAP ax without default configuration applied ?

That way OP will remove all unnecessary configuration.

gigabyte091

Start by exporting your configuration.

gigabyte091

If there is possibility mount them on the ceiling.

gigabyte091

What are you trying to achieve with this ? /ip address add address=192.168.31.0/24 interface=bridge1 network=192.168.31.0 add address=192.168.50.1/24 interface=bridge1 network=192.168.50.0 You assigned two IP addresses to the bridge ? And first one is not assigned good. Can you ping for eg. 8.8.8.8 ...

gigabyte091

You do realise that CRS326 is a switch, not a router ? You can expect max about 250-270 Mbps bandwidth...

You should export your configuration and post it here.

gigabyte091

@OP

Why don't you post your configuration here if something is not working right ?

@anav helped me with my configuration so if you are willing listen and learn from him im sure you will have no problem with your wireguard setup.

gigabyte091

1 wireguard with 11 peers.

gigabyte091

So I would recommend you to read this before starting messing with VLANs: https://forum.mikrotik.com/viewtopic.php?t=143620

If you plan to use VLANs then don't use VLAN1.

gigabyte091

Right now I have 11 wireguard connections between RB4011 and wAP LTE and don't have any problems. There is no much traffic at all, it's for management only and to access device on the other side if needed so i can't tell how it will work with some real traffic. Plan is to have all 42 sites connected...

gigabyte091

hAP be² would be nice or cAP be

gigabyte091

Problems like this are the best, self solving one

gigabyte091

Also quite often IoT devices have problem with WPA2-EAP, i tried that and most of IoT devices refused to connect. I tried user manager, you helped me and it was working nice but as you said, good for corporate not home user. This shouldn't be a problem for mikrotik to implement and I believe that th...

gigabyte091

So, if you plan to use ax2 or 3 as a router instead of your existing ISP router then you should consider what is max speed you want to have. AX3 is more futureproof but AX2 have great WAF factor. I have cAP ax and for eg i can confirm WAF factor here is terrible. Both of my APs must be behind TV or ...

gigabyte091

Nothing will happen, RB3011 will not see compatible device and will not output power to it. Be careful not to have PoE forced on, then it will output 24V all the time.

Also, to be extra safe you can disable PoE on port 10.

gigabyte091

When do you plan to implement feature that just about any other vendor have ? PPSK... what are you talking about? PPSK feature exists since forever, long before other vendors supported it. WiFi -> Access List (capsmanv2) Wireless -> CAPsMAN -> Access List (legacy capsman) Wireless -> Wireless -> Ac...

gigabyte091

I've seen a lot of home users asking for help here so...It's not quite true that home users don't know about this forum

gigabyte091

When do you plan to implement feature that just about any other vendor have ? PPSK...

gigabyte091

Check sticker on your box, there should be password on it if device is purchased recently. My RB4011 arrived without a password but I bought my about 2 years ago.

gigabyte091

What is the area you are trying to cover ? Are walls from brick or is it drywall ? Is your space more open or not ? Do you have one floor or more ?

gigabyte091

Please Mikrotik, implement PPSK already...

gigabyte091

No PPSK again...

gigabyte091

Thanks for explanation

gigabyte091

Is there any benefit of configuring VLANs this way when supported ?

gigabyte091

You can't just made up any port. To address means to internal IP address where your device you want to forward port resides not your public IP. Think a little, you have DST-NAT, so you are forwarding all traffic coming to th router on port 6667 to your INTERNAL IP on that port (or it caen be differe...

gigabyte091

Follow this video from Mikrotik: https://youtu.be/a_8AV6vIDYQ?si=hbNL6aQfUyM73luG

gigabyte091

Did you port forward those ports on your ax2 ?

gigabyte091

I think moderators should intervene here...

gigabyte091

Buy a new router and put the old one above fireplace with "In loving memory of CCR1036" sign.

gigabyte091

I highly doubt that ISP is blocking 443 and 123 as those are used for HTTPS and NTP.

Did you do port forward on ax2 ?

gigabyte091

@gigabyte091,
Have you tried deleting BTH and recreating it?

No, BTH worked every update until now...

gigabyte091

That was a shitty router if you have signal problem 4ft away... But if you plan to move to smaller house soon then maybe you should wait a little bit ? Or you can provide floor plan if possible so we can help you with device placement. In current house you can have 2-3 AP but maybe in new you need o...

gigabyte091

BTH not working after update to 7.14... App keep saying connecting... And I can see handshake timeout error...

gigabyte091

Yea, thanks, i almost forgot about ax2. Personally my favourite router. To bad it doesn't have USB port...

gigabyte091

RB5009, ax3, CRS310, cAP ax updated without a problem for now, Container and UPS works. CRS310 took 3 and a half minute to upgrade... Other devices minute or so.

gigabyte091

What is your current internet speed ? And if you have low speed (dsl line for eg.) is there a possibility that you get fibre in the future ? AX3 is great home router with WiFi 6 but then maybe single AP is not enough. What are dimensions of your place ? Is there a single floor ? Are walls made from ...

gigabyte091

I agree, i had S-RJ10 and I replaced it with 10gig fibre run between my RB5009 and CRS310. I knew that S-RJ10 can heat up but i didn't feel comfortable leaving it in my RB5009... There was quite a lot of heat...

gigabyte091

Both ports are connected to the switch chip and I don't see any reason why they can't be used at the same time. Add them to your bridge and that's it.

gigabyte091

Seems that 7.14 stable is near...

gigabyte091

What ROS are you running ?

Maybe it's best for you to connect your 2.5G device to ether5, enable auto negotiation if you disabled it and create supout.rif file and send it to support so they can see what is the problem.

gigabyte091

Don't ditch swOS, it's working really well and setting up VLANs is for eg much more easier on swOS than on RouterOS.

gigabyte091

Hello, did you try to do some configuration yourself ? If yes, can you post it here ?

Also, no need to use bridge for every network. One bridge is enough. How many VLANs do you need ? From WiFi diagram i presume 3 at least ?

Be aware, cAP ax doesn't have 6 GHz radio !!

gigabyte091

There was a tutorial but it was taken down. But of you open new topic with description on what are you trying to do im sure that @Mesquite will help you. He's reincarnation (3rd i believe

) of this forums wireguard guru.

gigabyte091

That's why @Mesquite proposed access via wireguard

gigabyte091

And CRS have RouterOS where CSS is SWOS only device.

gigabyte091

What port will be used as your trunk from RB4011 ? What VLAN would you like to use as your management ?

gigabyte091

He wants to recreate configuration from CSS326 on his new CRS125 and ROS. So i believe screenshot is here just as an information on how CSS is configured.

gigabyte091

@holvoetn, but OP said that he was given CRS125 and want to configure it in ROS not SWOS.

gigabyte091

I hope not... I mean they have routers for home and small business users, so why not switch that they can use. Not everyone needs switch with that kind of bandwidth and redundancy.

gigabyte091

I would like to see cheaper version, for eg 16 x 2.5gbit ports, two sfp+ and one mgmt port aaaand poe

desktop or RM. Price 350-450$

gigabyte091

What port is your trunk ? I can't see any trunk ports that would carry your VLANs from RB4011.

Study this on how to configure VLANs on CRS1xx series of switches:

https://help.mikrotik.com/docs/pages/vi ... 03841835

gigabyte091

@OP did you check WiFi menu ??

gigabyte091

Save a little bit more money and buy this beauty: https://mikrotik.com/product/crs326_4c_20g_2q_rm

To bad it isn't poe...

Thank God my wife don't ask to many questions, she just doesn't want to see cables on the floor

gigabyte091

I have one question, why all of that ?
Not knowing how to spend 400 Euro in excess?

Then OP should ask his wife, she will know how to spend it

gigabyte091

If someone wants to hack you they will find a way. There is no perfect security but i think it's much better to educate your family how internet can be a dangerous place instead of buying expensive equipment. I have VLANs and Adguard and never had any problem. IoT devices have their own VLAN. Camera...

gigabyte091

I have one question, why all of that ?

gigabyte091

Yes, also you can setup replacement router before you connect it to the network so you avoid such a thing 8) What I do is I connect devices, leave them to pick up IP via DHCP and then I simply create a lease and modify IP to desired one. Disconnect and connect again and device have desired IP which ...

gigabyte091

What exactly do you need ? What are you trying to achieve ? Maybe you will be happier with another MT router/AP

gigabyte091

Didn't you once say that you will give capsman a try ?

gigabyte091

I use CAPsMAN for Router + 2 APs. Roaming and stuff. But someone will say that there is no need for CAPsMAN with only 2 APs.

gigabyte091

You are only sending 1 VLAN to this powerbox ? Why is your trunk port in WAN list on device you are using as a switch ?

Can you show config from your device that is used as a router ?

gigabyte091

What router are you using ?

You need to give us more information.

gigabyte091

Did you even try to configure it yourself ? If yes then please post your configuration here.

gigabyte091

Hi, thank you the workaround. I bought CRS310 so problem is solved. It would be nice to have port security like in other switches but there is example in Router OS wiki about that and it's working like it's supposed to.

gigabyte091

Didn't google it, sorry..

gigabyte091

Golden rule for BIOS, if it's working don't upgrade it :D Today motherboard pretty much all of them have dual BIOS so no problem there. But once I had to remove BIOS chip and flash it with programmer because there was a power fail in the middle of update. So two lessons learned there. One, never, ev...

gigabyte091

Yea, I know... It was my mistake, I admit it. I wasn't at home at the time so quick read at the phone cause mistake.

But now when you make it larger makes it so much better to read on the phone.

gigabyte091

Until fan speeds up

gigabyte091

Nah, it's just Mr.Hyde screwing with me

But on CRS310, have one in my living room and soon one in my work room. Great little devices.

gigabyte091

Well it's not my material but I wanted to add it so beginners can see it. But before that i think that it's proper thing to ask for permission

It would be a shame that this fade out when this topic is solved and pushed down.

gigabyte091

Also here you can find excellent post from our member @tangent

https://tangentsoft.com/mikrotik/wiki?n ... figuration

This should be your first step after connecting to your new device if you are new to networking and Mikrotik environment.

gigabyte091

I missed that part... But anyway for OP is more than enough

gigabyte091

In that case, it's capable of almost 40Gbps if you look at the test results

gigabyte091

I know, but that is for routing performance. I hope OP here plan to use it strictly as switch. Not router.

gigabyte091

@tangent can I link your article in post where I did quick tutorial on config export for beginners ? This is really great stuff and I think it will be useful for them.

You did something that Mikrotik wiki lacks, explanations.

gigabyte091

It would push 2.5

https://mikrotik.com/product/crs310_8g_ ... stresults

gigabyte091

It's easy to make a mistake with Mikrotik. You really need to be careful when deciding what device you will buy.

There was a lot of topics where people bought CRS devices and use them as routers. As you can imagine it didn't go well...

I thought you said you will buy CRS310, my mistake

gigabyte091

When you open each interface you added to the bridge you will find check box hardware offloading. Its under general tab

gigabyte091

Do you have hardware offloading enabled ?

gigabyte091

add bridge=main_bridge_switch tagged=main_bridge_switch untagged=ether2_trunk \
    vlan-ids=5

You should tag ether2_trunk here, not untag it.

gigabyte091

Your point is valid and this was topic of many discussions here on forum but unfortunately i don't think that Mikrotik will ever have simpler and user friendlier interface. Quickset is "#$%& and i wouldn't use it... First time you do something in your configuration that is out of quickset r...

gigabyte091

Post configuration, this untagging of the trunk port raises some concern..

gigabyte091

You can't update because your CRS didn't recieve IP address from upstream router and have no route to the internet. Use for eg VLAN 5 as trusted VLAN. Create VLAN interface in interface/vlan Then in interface/bridge/vlans tag bridge only to VLAN 5 and create dhcp client on interface VLAN 5. Then you...

gigabyte091

There is no difference in VLANs on ax2 and ax3

gigabyte091

I hope there is no much Italians reading this... I thought it's a sin to break them in half...

On topic, is your switch working ?

gigabyte091

hey Giga,

i'm doing the unboxing video in my kitchen this evening.. while i'm cooking spaghetti & tomato sauce!

Will you break spaghetti in half so they can fit in cooking pot ??

gigabyte091

Welcome to the forum

Start here: viewtopic.php?t=143620

If something is not clear or your configuration is not working then come back and we will help you.

gigabyte091

guys,

my switch is in my kitchen ..

no one ever comes into my kitchen with a lan cable and a laptop..

Maybe someone wants to steal your pizza dough recipe...

Be careful...

gigabyte091

In some corporate network or business network that is valid but at home, I mean... like @jaclaz said, if someone have access inside my house that shouldn't have then access to the router is least of my problems. Good, strong password is great starting point. DHCP or not router will be visible in Win...

gigabyte091

Yea, there is security aspect. What I usually do is I have USB NIC that I use for that. On laptop I assigned IP to that NIC and that's it.

So you have to decide here, safety or convenience.

Don't forget one pizza for @Mesquite

gigabyte091

You can, can't see the reason why not

gigabyte091

Your switch has to get IP address from somewhere so if there is no management VLAN simply use VLAN you trust the most and that's it. That is how I do. Delete configuration so you have clean start. And you can take one port off bridge and assign it with static IP. That port you can use for configurat...

gigabyte091

Anyways, we have connected the ISP 4011 and our RB2004 with 3m copper interlink S+DA0003, and now all works. We didn't have one drop since.

Go figure.

You connected RB4011 with S+DA0003 and it's working ? But i think that RB4011 doesn't support that cable...

gigabyte091

RB5009 can handle 3096 Mbps so you are pretty safe here

gigabyte091

It's good and affordable replacement but it would be a good choice to invest in something more powerful. Internet speeds are increasing and while L009 is a good replacement, OP here have 300/150 internet connection and L009 can route at 323.6 Mbps so no much room for faster internet.

gigabyte091

My advice, replace the router.

87% is a lot, that's probably your bottleneck. If you don't need wireless on your router then look at RB5009. It's more expensive but you will be safe for a long time.

gigabyte091

RB2011 is pretty old device, and according to the Mikrotik website it's capable of only 244 Mbps routing when you have about 25 firewall rules. As stated above, what is CPU load when doing speedtest ?

Maybe you can consider upgrading it to L009 ?

gigabyte091

And maybe increase dhcp lease time, now is 5 min...

gigabyte091

That's because new routers ships with admin password, it's not blank anymore.

gigabyte091

AP will stop transmitting then it will preform DFS check to see if channel is available. What are other frequencies ?

gigabyte091

You are using CH132 which is DFS channel: https://www.aami.org/medical-device-connectivity/medical-device-connectivity-faqs-standards-802-11#:~:text=What%20are%20Dynamic%20Frequency%20Selection,is%20vacated%20within%2010%20seconds. If radar signal is detected router must immediately stop transmittin...

gigabyte091

Deal, i will bring ketchup

gigabyte091

Just saying...

If you broke something you owe me pizza in Trieste

gigabyte091

hi Giga, thanks sounds straightforward let's see what happens when i put hands on the thingy... :lol: thanks for the post from Mesquite! in truth I just received also the AX3 for my second home (this is the real device i will use) , this is where I will install it upstream from the CRS112 I'm curre...

gigabyte091

Are you planning to use wired ports on your devices or you just want wireless ? In that case you really don't need to complicate your life with VLANs on switch chip. You just do it like usual and in that case no configuration has to be done on CAP, only on CAPsMAN controller itself.

gigabyte091

guys as you know on the ax2,I currently have: VLAN2 -> wifi2ghz,Wifi5ghz,eth_port2 VLAN3-> wifi_guest,eth_port3 VLAN4->eth_port4 VLAN5->eth_port5 working perfectly! i should be receiving the CRS112 switch Next week , and was thinking of also sending all the VLANs down through eth_port5, and wanted ...

gigabyte091

And yet, he reincarnated as new user and is still helping others. One shouldn't forget that he also have great respect from many users here on forum.

gigabyte091

Mikrotik usually give out addresses from end of the pool but this shouldn't present any problem for you.

gigabyte091

I have 2 S-RJ01 running for 2 years now in CSS610, never had any problem. Have one in CRS310 but this is new install.

gigabyte091

I only hope he saved the material so it can be brought back (by him or his alter ego...

Which one ?

gigabyte091

There was a good tutorial for this scenario... Unfortunately it's taken down...

gigabyte091

But remember, if you have multiple VLANs going to the AP/Switch then on AP/Switch you create VLAN interface only for VLAN that you use to manage that device. (And you create DHCP client on that VLAN interface if you want your IP to be assigned by DHCP)

gigabyte091

No problem, but as @holvoetn said, read this tutorial if you are interested in learning VLANs

gigabyte091

Forget VLAN1, if you go VLAN then you shouldn't use VLAN1. Create management VLAN and use that VLAN for configuration. VLAN1 will run in the background. Tag bridge to VLAN200, no VLAN1

gigabyte091

That's normal, how will router know where to send handshake and establish connection if you remove endpoint.

If you look at the post from @Mesquite he didn't remove endpoint...

gigabyte091

Go to Tools -> MAC server -> MAC Winbox server. Here you can select allowed interface list.

BE AWARE: Changing this could result in lockout... Be careful

gigabyte091

Welcome to the forum

So on RB5009 under /interface bridge vlan you need to tag bridge as well as ether7 and set ether7 frame types as: admit only vlan tagged.

On AP you also need to tag bridge as well as ether2 for VLAN200. Also where are your wireless interfaces and other ports on your AP ?

gigabyte091

Do you need more ports ? Because for 5 ports ax2 is great, wifi interfaces can be disabled if not needed.

gigabyte091

Under Interface List you have button Lists. Here you can create your lists

gigabyte091

In short, interface list enables you to have easier management of your interfaces in for eg. firewall, you have input rule to drop all traffic coming to the router that is not originated from LAN. With interface list you just add all of your LAN side interfaces to the LAN interface list and then whe...

gigabyte091

You forgot about the RB50009!

I didn't see that new model in the newsletter.

gigabyte091

Any reason not to suggest VLANs here ?

gigabyte091

Let the people have some fun...

Why don't you block porn on all networks then

Didn't even noticed OP is using OpenDNS. For winbox access you surely don't need access from all VLANs. You don't even have interface lists ?

gigabyte091

One thing that catches my eye, how do you plan to block porn ? Do you have local DNS or something ?

gigabyte091

Delete ip pools and dhcp servers you don't need, you have 4 VLANs, leave 4 dhcp servers.

gigabyte091

Think about it, what is wifi ? Wireless connection to client device instead of the wired one, so if there is no connected devices there is no link and its reported as down and inactive. Down and inactive are two different things so you're sort of agreeing with me :D Down clearly is confusing even i...

gigabyte091

Much cleaner, but it's not enough to just untag him, you need to set what VLAN ID port use. Under bridge ports open port 5 and under VLAN tab select frame types to admit all and set PVID to 5, this way you will create something called hybrid port where VLAN 5 is untagged and other VLANs are tagged. ...

gigabyte091

Disconnected ethernet cable is different. That port then is down. No devices connected to WiFi isn't really down is it? Idle is IMO a better term. Think about it, what is wifi ? Wireless connection to client device instead of the wired one, so if there is no connected devices there is no link and i...

gigabyte091

Yes, so assign DHCP server to the VLAN interface, then untag wanted interfaces to desired VLAN.

For eg VLAN2 is for guest wifi, untag desired interface for that VLAN and when guests connects to that interface they will be in correct VLAN.

Your configuration is a mess right now.

gigabyte091

Okay, so this should be easy then. First thing to do is to delete default configuration because you are using device as switch/AP so there is no need for dhcp server, firewall rules etc. That is job for your router. Go to System -> Reset configuration. There check box that says no default configurat...

gigabyte091

Hello, download wifi-qcom package located in extra packages on mikrotik web site, be careful to download package for your CPU.

Then drag it into Files tab on your router, reboot it and that's it.

Regarding AP config, do you have any vlans ?

gigabyte091

Glad you solved your problem. For other answers mabye someone with mAP can answer.

Maybe reset somehow corrupted files on HDD rendering device useless.

gigabyte091

@jaclaz You can as well ignore other people's comments and not turn some topic into another discussion. Not defending someone here but I don't but there was a topic about that, this is about VLANs and I think we should stick to it until we go completely off topic. @OP You need to understand that wha...

gigabyte091

Please, without forum politeness posts again. This topic is about VLANs on ax2.

Mr. Hyde here was direct, no need for three bridges. If OP wants it can be solved with one bridge.

gigabyte091

Yea, you can see that wifi interface which has no connected devices became inactive. It's same thing if you disconnect eth cable from port.

gigabyte091

Why are you insisting on multiple bridges ? They are not needed in your case. @anav... I mean @Mesquite provided you with good tutorial on VLANs.

gigabyte091

If not wrong, this indicate that 16 times you didn't have any client connected to this interface so interface became inactive thus link down count goes up

Search found 1312 matches