hello,
Attached is the configuration that I am running on a CRS256, all the VLANs are working properly and they can navigate to internet via the WAN interface.
The APs are TPlink EAP where I created 3 SSID with relateive VLANs, I can connect to each SSID and get the right IP from the DHCP and navigate to intenret.
The problem is that I cannot find and then connect to the AP itself anymore, when I connect to any of these SSID I only see the other devices connected IPs, and from all these VLANs I can only connect to the default gw on WAN interface.
How can I reach the AP itself?
thanks
# software id = SYV6-G9YK
#
# model = CRS326-24G-2S+
# serial number = XXXXX
/interface bridge
add admin-mac=18:FD:74:E6:30:30 auto-mac=no comment=defconf ingress-filtering=\
no name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] disabled=yes
set [ find default-name=sfp-sfpplus2 ] disabled=yes
/interface vlan
add interface=bridge name=VLAN-Guest vlan-id=10
add interface=bridge name=VLAN-Home vlan-id=20
add interface=bridge name=VLAN-IOT vlan-id=30
add interface=bridge name=VLAN-TVCC vlan-id=40
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=Guest_pool ranges=10.0.10.2-10.0.10.254
add name=IOT_pool ranges=10.0.30.2-10.0.30.254
add name=Home_pool ranges=10.0.20.2-10.0.20.254
add name=TVCC_pool ranges=10.0.40.2-10.0.40.254
/ip dhcp-server
add address-pool=Guest_pool interface=VLAN-Guest name=Guest_DHCP
add address-pool=IOT_pool interface=VLAN-IOT name=IOT_DHCP
add address-pool=Home_pool interface=VLAN-Home name=Home_DHCP
add address-pool=TVCC_pool interface=VLAN-TVCC name=TVCC_DHCP
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf disabled=yes interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3 pvid=20
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=ether11
add bridge=bridge comment=defconf interface=ether12
add bridge=bridge comment=defconf interface=ether13
add bridge=bridge comment=defconf interface=ether14
add bridge=bridge comment=defconf interface=ether15
add bridge=bridge comment=defconf interface=ether16
add bridge=bridge comment=defconf interface=ether17 pvid=40
add bridge=bridge comment=defconf interface=ether18 pvid=40
add bridge=bridge comment=defconf interface=ether19
add bridge=bridge comment=defconf interface=ether20
add bridge=bridge comment=defconf interface=ether21
add bridge=bridge comment=defconf interface=ether22
add bridge=bridge comment=defconf interface=ether23
add bridge=bridge comment=defconf interface=ether24
add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus1
add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus2
/interface bridge vlan
add bridge=bridge tagged=bridge,ether2 vlan-ids=10
add bridge=bridge tagged=bridge,ether2 vlan-ids=30
add bridge=bridge tagged=bridge,ether2 untagged=ether3 vlan-ids=20
add bridge=bridge tagged=bridge untagged=ether17,ether18 vlan-ids=40
/interface detect-internet
set detect-interface-list=all internet-interface-list=all lan-interface-list=\
all wan-interface-list=all
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=bridge \
network=192.168.88.0
add address=10.0.10.1/24 interface=VLAN-Guest network=10.0.10.0
add address=10.0.30.1/24 interface=VLAN-IOT network=10.0.30.0
add address=10.0.20.1/24 interface=VLAN-Home network=10.0.20.0
add address=10.0.40.1/24 interface=VLAN-TVCC network=10.0.40.0
/ip dhcp-server network
add address=10.0.10.0/24 dns-server=8.8.8.8 gateway=10.0.10.1
add address=10.0.20.0/24 dns-server=8.8.8.8 gateway=10.0.20.1
add address=10.0.30.0/24 dns-server=8.8.8.8 gateway=10.0.30.1
add address=10.0.40.0/24 dns-server=8.8.8.8 gateway=10.0.40.1
/ip dns
set servers=8.8.8.8
/ip firewall address-list
add address=192.168.1.14 list=WAN-whitelist
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=accept chain=input protocol=icmp
add action=drop chain=input in-interface-list=!LAN
add action=accept chain=forward ipsec-policy=in,ipsec
add action=accept chain=forward ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward connection-state=\
established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=WAN
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=MTHome
/system note
set show-at-login=no
/system ntp client servers
add address=time.google.com
/system routerboard settings
set boot-os=router-os
Most likely something wrong on the setting of the AP itself or VLAN settings for default id=1.
Is the AP set to connect to that specific VLAN ? I assume most can not.
So …
How do you treat devices belonging to VLAN 1 (= default VLAN) ? As far as I can tell, you do not ? You do something with 10 / 20 / 30 / 40 but nothing for 1.
I am not sure if I get yout reply.
I configured 3 SSID on the AP SSID1->vlanid 10, SSID2->vlanid 20 and SSID3->vlanid 30, if I connect to each of these SSID I will get the correct IP in the right VLAN, I did not configured vlan1, should I on the AP? how exactly, on EAP I can set VLANs only on the SSID if I am not wrong.
My point:
you did set the VLAN Ids for the SSIDs on AP and router and that works, perfect.
But your AP itself also needs to communicate. It is also a device somewhere on the network.
Is it VLAN Aware (the device itself) ? If not, it will most likely communicate using default vlan id which is 1 (if it is not set, all ethernet frames will have at least ID=1).
But your setup has nothing for vlan=1, so no communication.
I assume looking at your config your APs are connected to ether 2 (since all other VLANs also come there)?
What you could try is to set a separate mgmt VLAN on ether2 with untagged for that id. So everything which comes in on ether2 with default tag = 1 will be put on that mgmt-VLAN.
And then set router services for that VLAN as you did for the others.
On the router side (since it is Mikrotik) a lot of people here will be able to help.
On the AP side, that’s a bit less (for logical reasons. This is not a TP LINK forum).
got it.
So on the AP I enabled the management VLAN that is 1.
But I see that in the MT router the bridge vlan list the vlan 1 is created dynalically and the ether2 is already untagged there, but still I can’t see the AP. Is this dynalyc entry in the list something that I can configure or I have to assume that as is?
Specify it manually, add bridge as well as tagged.
Dynamic entry will disappear.
ok, I did:
on AP set the VLAN 99 for management (instead of 1)
on MT:
- created the VLAN 99, with all settings (dhcp, network, ip, etc)
- used pvid 99 on port ether10
- added vlan 99 in the bridge vlan list with bridge tagged and ether2 untagged
I connected a device directly on port ether10, the device is able to get the IP in the 99 network, but still don’t see the AP
Timeout … what ports do those APs connect to on your router ?
And how did you create that VLAN interface ? On an ether port ?
the AP is connected to the ether2 and I created the vlan99 on bridge
/interface bridge
add admin-mac=18:FD:74:E6:30:30 auto-mac=no comment=defconf \
ingress-filtering=no name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] disabled=yes
set [ find default-name=sfp-sfpplus2 ] disabled=yes
/interface vlan
add interface=bridge name=VLAN-Guest vlan-id=10
add interface=bridge name=VLAN-Home vlan-id=20
add interface=bridge name=VLAN-IOT vlan-id=30
add interface=bridge name=VLAN-MNGMT vlan-id=99
add interface=bridge name=VLAN-TVCC vlan-id=40
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=Guest_pool ranges=10.0.10.2-10.0.10.254
add name=IOT_pool ranges=10.0.30.2-10.0.30.254
add name=Home_pool ranges=10.0.20.2-10.0.20.254
add name=TVCC_pool ranges=10.0.40.2-10.0.40.254
add name=MNGMT_pool ranges=10.0.99.2-10.0.99.254
/ip dhcp-server
add address-pool=Guest_pool interface=VLAN-Guest name=Guest_DHCP
add address-pool=IOT_pool interface=VLAN-IOT name=IOT_DHCP
add address-pool=Home_pool interface=VLAN-Home name=Home_DHCP
add address-pool=TVCC_pool interface=VLAN-TVCC name=TVCC_DHCP
add address-pool=MNGMT_pool interface=VLAN-MNGMT name=MNGMT_DHCP
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf disabled=yes interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3 pvid=20
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10 pvid=99
add bridge=bridge comment=defconf interface=ether11
add bridge=bridge comment=defconf interface=ether12
add bridge=bridge comment=defconf interface=ether13
add bridge=bridge comment=defconf interface=ether14
add bridge=bridge comment=defconf interface=ether15
add bridge=bridge comment=defconf interface=ether16
add bridge=bridge comment=defconf interface=ether17 pvid=40
add bridge=bridge comment=defconf interface=ether18 pvid=40
add bridge=bridge comment=defconf interface=ether19
add bridge=bridge comment=defconf interface=ether20
add bridge=bridge comment=defconf interface=ether21
add bridge=bridge comment=defconf interface=ether22
add bridge=bridge comment=defconf interface=ether23
add bridge=bridge comment=defconf interface=ether24
add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus1
add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus2
/interface bridge vlan
add bridge=bridge tagged=bridge,ether2 vlan-ids=10
add bridge=bridge tagged=bridge,ether2 vlan-ids=30
add bridge=bridge tagged=bridge,ether2 untagged=ether3 vlan-ids=20
add bridge=bridge tagged=bridge untagged=ether17,ether18 vlan-ids=40
add bridge=bridge tagged=bridge untagged=ether2 vlan-ids=99
/interface detect-internet
set detect-interface-list=all internet-interface-list=all lan-interface-list=\
all wan-interface-list=all
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=bridge \
network=192.168.88.0
add address=10.0.10.1/24 interface=VLAN-Guest network=10.0.10.0
add address=10.0.30.1/24 interface=VLAN-IOT network=10.0.30.0
add address=10.0.20.1/24 interface=VLAN-Home network=10.0.20.0
add address=10.0.40.1/24 interface=VLAN-TVCC network=10.0.40.0
add address=10.0.99.1/24 interface=VLAN-MNGMT network=10.0.99.0
/ip dhcp-server network
add address=10.0.10.0/24 dns-server=8.8.8.8 gateway=10.0.10.1
add address=10.0.20.0/24 dns-server=8.8.8.8 gateway=10.0.20.1
add address=10.0.30.0/24 dns-server=8.8.8.8 gateway=10.0.30.1
add address=10.0.40.0/24 dns-server=8.8.8.8 gateway=10.0.40.1
add address=10.0.99.0/24 dns-server=8.8.8.8 gateway=10.0.99.1
/ip dns
set servers=8.8.8.8
/ip firewall address-list
add address=192.168.1.14 list=WAN-whitelist
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=accept chain=input protocol=icmp
add action=drop chain=input in-interface-list=!LAN
add action=accept chain=forward ipsec-policy=in,ipsec
add action=accept chain=forward ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward connection-state=\
established,related hw-offload=yes
add action=accept chain=forward connection-state=\
established,related,untracked
add action=drop chain=forward connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=\
WAN
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=MTHome
/system note
set show-at-login=no
/system ntp client servers
add address=time.google.com
/system routerboard settings
set boot-os=router-os
What do you mean with “I don’t see the AP” ?
Is that AP configured for DHCP or does it use a set IP address ? If the latter and the IP range is not within scope for any of your VLANs, then nothing will happen.
Have you used tool/torch to check what’s happening on ether2 ?
Also, if you connect your PC on ether2, does it get an IP address ? Can you reach gateway for VLAN99 that way ?
yes! Correct, the dhcp was set on the old subnet, because the tpink configuration interface needs to save on each page, so if I do a change on a page and without saving switch on another I lost the change.
thank you for the hits.
Sweet !
Glad it works now.