Basic Inter VLAN routing - not Working

vuk88 · February 20, 2016, 9:34am

Hello All,

So I setting up pretty basic corporate vlan routing.

Currently I have am struggling with an unorthodox problem.

Hardware>
CCR 1016 - central router, dhcp server, routing to other networks
3xCRS24g - access switches for office workstations

So as I said a straight forward setup

I have 6 VLANs and trunk ports configured from CCR to each of the CRSes - this is working fine.
On the CCR each of the VLAN has its own gateway IP, and isolated DHCP server for each vlan all with different DHCP pools.

On the CRSs i have multiple ports for each of the 6 VLAN`s, delivering untagged traffic to access ports.

When connecting workstations with Windows 7/8/10 everything is working fine.
But XP workstations or other network elements eg. TP-Link AP are not working !!! - this is so strange, it seems that DHCP server on the CRS catches the request but L3 communication never occurs it just hangs there.

Any Ideas, or workarounds ??

vuk88 · February 22, 2016, 10:55am

Bump,

Does VLAN tagging work properly on CRS or not ?

vuk88 · February 24, 2016, 10:01pm

Linux boxes ain’t working also…

CRS=Wast of money nothing more than a unmanaged gigabit switch…

w0lt · February 24, 2016, 11:06pm

I’d hardly call the CRS a waste of money.
Admittedly, it is however, difficult switch box to understand that seems to work great when you do finally understand it.
I also believe that it could have been done a bit more conventional instead of offering all things to all people and then not making it very intuitable…

vuk88 · February 24, 2016, 11:16pm

What is there to finally understand? Except that there are features and options in CRS that DON’T work, or that the CRS is advertised as a l3 switch that can’t do the basic L2 stuff, trunk to access port VLAN’s.

BASIC vlan features are NOT working, this means that all other advanced feature Mikrotik Company says their CRS switch has DON’T work, eg. QinQ

What is the point of advertising your product for something that its NOT… except maybe making a very unprofessional impression on the buyers…

gilljr · February 25, 2016, 3:04am

These switches are not intuitive at all to program but once you have done it a couple times it is easy enough.
Below is an example on how you could do it.

My example uses ether1 as the master switch port and trunking port. VLANs 10,20,30,40,50,60 are the 6 VLANs and 10 is the management VLAN.

First set every port to use port 1 as the master port.
/interface ethernet
set [ find default-name=ether2 ] master-port=ether1
set [ find default-name=ether3 ] master-port=ether1
set [ find default-name=ether4 ] master-port=ether1
…
set [ find default-name=ether24 ] master-port=ether1

Create a VLAN interface to manage the Switch by
/interface vlan
add interface=ether1 name=vlan10 vlan-id=10

Make port 1 the trunked port by tagging all of the ports ether 1 (Note the switch CPU is on VLAN 10 since that is the management VLAN)
/interface ethernet switch egress-vlan-tag
add tagged-ports=switch1-cpu,ether1 vlan-id=10
add tagged-ports=ether1 vlan-id=20
add tagged-ports=ether1 vlan-id=30
add tagged-ports=ether1 vlan-id=40
add tagged-ports=ether1 vlan-id=50
add tagged-ports=ether1 vlan-id=60

Add non-tagged ports to the VLAN (I assigned 3 ports to each vlan in order)
/interface ethernet switch ingress-vlan-translation
add new-customer-vid=10 ports=ether2,ether3,ether4 sa-learning=yes
add new-customer-vid=20 ports=ether5,ether6,ether7 sa-learning=yes
add new-customer-vid=30 ports=ether8,ether9,ether10 sa-learning=yes
add new-customer-vid=40 ports=ether11,ether12,ether13 sa-learning=yes
add new-customer-vid=50 ports=ether14,ether15,ether16 sa-learning=yes
add new-customer-vid=60 ports=ether17,ether18,ether19 sa-learning=yes

Add an IP address to the VLAN interface that you are managing it through
/ip address
add address=10.10.10.2/24 comment=“Switch Management IP” interface=vlan10
network=10.10.10.0

It should be as simple as that. I have a handful of these things deployed and have only had an issue with one that hangs up occasionally which I believe to be a firmware issue. I run 6.32.4 on all new deployments.

vuk88 · February 25, 2016, 9:47am

Did the exact same thing.

Works only with Windows 7/8.1/10 Workstations.

So far I know i does not work with Windows XP, Linux, TPlink network equipment…

gilljr · February 25, 2016, 4:48pm

I know this is a basic question, but have you tried the same ports that work with the newer windows boxes with the linux and xp boxes.

vuk88 · February 25, 2016, 11:20pm

Yes,

When I plug XP workstation the DHCP server on the CCR sends the offer, and it just hangs there.
Plugging CentOS box just gets the port up on the layer 1 level but no communication occurs…

Various network elements eg. access points behave same as linux boxes…

Sending a trunk from CCR to Juniper Ex4200 and then sending an untaged traffic from the juniper switch to the same workstations works like a charm.

I also tested sending a trunk from Juniper Ex8208 to Mikrotik CRS and I have the same problem…

Obviously CRS can’t convert untagged traffic to VLANs properly…

jlvillal · February 28, 2016, 8:14pm

I tried to do something like that and I am also running to problems. I have a CRS125-24G-1S-IN. I have been reading the CRS examples, forum, and various blogs and still not succeeding

I am trying to setup port 17 for now as an untagged port for VLAN 100. I am unable to contact the management interface. I can not ping from the CRS or ping the CRS. I was trying to ping from/to 192.168.1.2

I setup ether9 to be the master port for ether10-24 ports. My end goal is to have ports 17-24 to be untagged VLAN100. And ports 9-16 be tagged VLAN100,200,300.

> /export
# feb/28/2016 12:04:42 by RouterOS 6.32.4
# software id = 36UD-T26V
#
/interface ethernet
set [ find default-name=ether2 ] master-port=ether1
set [ find default-name=ether3 ] master-port=ether1
set [ find default-name=ether4 ] master-port=ether1
set [ find default-name=ether5 ] master-port=ether1
set [ find default-name=ether6 ] master-port=ether1
set [ find default-name=ether7 ] master-port=ether1
set [ find default-name=ether8 ] master-port=ether1
set [ find default-name=ether10 ] master-port=ether9
set [ find default-name=ether11 ] master-port=ether9
set [ find default-name=ether12 ] master-port=ether9
set [ find default-name=ether13 ] master-port=ether9
set [ find default-name=ether14 ] master-port=ether9
set [ find default-name=ether15 ] master-port=ether9
set [ find default-name=ether16 ] master-port=ether9
set [ find default-name=ether17 ] master-port=ether9
set [ find default-name=ether18 ] master-port=ether9
set [ find default-name=ether19 ] master-port=ether9
set [ find default-name=ether20 ] master-port=ether9
set [ find default-name=ether21 ] master-port=ether9
set [ find default-name=ether22 ] master-port=ether9
set [ find default-name=ether23 ] master-port=ether9
set [ find default-name=ether24 ] master-port=ether9
set [ find default-name=sfp1 ] master-port=ether1
/interface vlan
add interface=ether9 name=vlan100 vlan-id=100
/interface ethernet switch egress-vlan-tag
add tagged-ports=ether9,switch1-cpu vlan-id=100
/interface ethernet switch ingress-vlan-translation
add new-customer-vid=100 ports=ether17 sa-learning=yes
/interface ethernet switch vlan
add ports=ether9,ether17,switch1-cpu vlan-id=100
/ip address
add address=192.168.1.16/24 interface=vlan100 network=192.168.1.0
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/system package update
set channel=bugfix
/system routerboard settings
set protected-routerboot=disabled

jlvillal · February 29, 2016, 1:41am

So I noticed that my untagged ports seem to have tags on them

# tcpdump -i p6p1 -nn -vvv -XX arp or icmp
tcpdump: listening on p6p1, link-type EN10MB (Ethernet), capture size 65535 bytes
17:28:09.045666 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.16 tell 192.168.1.8, length 28
        0x0000:  ffff ffff ffff 0019 d104 2db4 0806 0001  ..........-.....
        0x0010:  0800 0604 0001 0019 d104 2db4 c0a8 0108  ..........-.....
        0x0020:  0000 0000 0000 c0a8 0110                 ..........
17:28:09.045778 ARP, Ethernet (len 6), IPv4 (len 4), Reply 192.168.1.16 is-at 4c:5e:0c:00:cb:fe, length 42
        0x0000:  0019 d104 2db4 4c5e 0c00 cbfe 8100 0064  ....-.L^.......d
        0x0010:  0806 0001 0800 0604 0002 4c5e 0c00 cbfe  ..........L^....
        0x0020:  c0a8 0110 0019 d104 2db4 c0a8 0108 0000  ........-.......
        0x0030:  0000 0000 0000 0000 0000 0000            ............

In particular in the Reply:
0x0000: 0019 d104 2db4 4c5e 0c00 cbfe 8100 0064

8100 is 802.1q VLAN and then the 0064 = 100 decimal for VLAN 100

I tried to remove it by doing:

/interface ethernet switch egress-vlan-translation
add customer-vid=100 new-customer-vid=0 ports=ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24

But no success.

Here is my current config. Not sure if I am running into a bug or I have a config issue.

# feb/28/2016 17:31:04 by RouterOS 6.32.4
# software id = 36UD-T26V
#
/interface ethernet
set [ find default-name=ether2 ] master-port=ether1
set [ find default-name=ether3 ] master-port=ether1
set [ find default-name=ether4 ] master-port=ether1
set [ find default-name=ether5 ] master-port=ether1
set [ find default-name=ether6 ] master-port=ether1
set [ find default-name=ether7 ] master-port=ether1
set [ find default-name=ether8 ] master-port=ether1
set [ find default-name=ether10 ] master-port=ether9
set [ find default-name=ether11 ] master-port=ether9
set [ find default-name=ether12 ] master-port=ether9
set [ find default-name=ether13 ] master-port=ether9
set [ find default-name=ether14 ] master-port=ether9
set [ find default-name=ether15 ] master-port=ether9
set [ find default-name=ether16 ] master-port=ether9
set [ find default-name=ether17 ] master-port=ether9
set [ find default-name=ether18 ] master-port=ether9
set [ find default-name=ether19 ] master-port=ether9
set [ find default-name=ether20 ] master-port=ether9
set [ find default-name=ether21 ] master-port=ether9
set [ find default-name=ether22 ] master-port=ether9
set [ find default-name=ether23 ] master-port=ether9
set [ find default-name=ether24 ] master-port=ether9
set [ find default-name=sfp1 ] master-port=ether1
/interface vlan
add interface=ether9 name=vlan100 vlan-id=100
/interface ethernet switch egress-vlan-tag
add tagged-ports=ether9,switch1-cpu vlan-id=100
/interface ethernet switch egress-vlan-translation
add customer-vid=100 new-customer-vid=0 ports=ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24
/interface ethernet switch ingress-vlan-translation
add new-customer-vid=100 ports=ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24
/interface ethernet switch vlan
add ports=ether9,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24,switch1-cpu vlan-id=100
/ip address
add address=192.168.1.16/24 interface=vlan100 network=192.168.1.0
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/system clock
set time-zone-name=America/Los_Angeles
/system package update
set channel=bugfix
/system routerboard settings
set protected-routerboot=disabled

gilljr · February 29, 2016, 5:41pm

Sorry about the drop off in replies. I have been chasing my tail on other issues and have not been on the forum.

/interface ethernet switch egress-vlan-tag
add tagged-ports=ether9,switch1-cpu vlan-id=100
/interface ethernet switch egress-vlan-translation
add customer-vid=100 new-customer-vid=0 ports=ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24
/interface ethernet switch ingress-vlan-translation
add new-customer-vid=100 ports=ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24
/interface ethernet switch vlan
add ports=ether9,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24,switch1-cpu vlan-id=100

In the above snippet that you posted, you are have to many things going on. It should be changed to the following…

/interface ethernet switch egress-vlan-tag
add tagged-ports=ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,switch1-cpu vlan-id=100
add tagged-ports=ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16 vlan-id=200
add tagged-ports=ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16 vlan-id=300
/interface ethernet switch ingress-vlan-translation
add new-customer-vid=100 ports=ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24

Remove the following from your switch as I do not know that this will do to how the switch works…

/interface ethernet switch egress-vlan-translation
add customer-vid=100 new-customer-vid=0 ports=ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24
/interface ethernet switch vlan
add ports=ether9,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24,switch1-cpu vlan-id=100

I always make sure my Master Port is a port that I am always going to have something plugged into, so make sure the Master port is plugged into a device. All of the rest of your code looks good.

Good Luck,
Gilbert

jlvillal · March 1, 2016, 2:19am

Gilbert,

Thanks for the reply. I just got a chance to try out your suggestions. Still no joy for me

Connections:

9 → EdgeRouter Lite unused port
17 → D-Link DGS-1100-8 8-port switch
22 → Windows 10 system
24 → Ubuntu/Linux 14.04 system

I’m doing all my configuration via the serial port. I don’t have VLAN200 or 300 setup yet. Though I did do a quick test with them set and no change. I also often did “/system reboot” just to make sure that I didn’t need to reboot before a change would work.

# feb/29/2016 17:55:34 by RouterOS 6.32.4
# software id = 36UD-T26V
#
/interface ethernet
set [ find default-name=ether2 ] master-port=ether1
set [ find default-name=ether3 ] master-port=ether1
set [ find default-name=ether4 ] master-port=ether1
set [ find default-name=ether5 ] master-port=ether1
set [ find default-name=ether6 ] master-port=ether1
set [ find default-name=ether7 ] master-port=ether1
set [ find default-name=ether8 ] master-port=ether1
set [ find default-name=ether10 ] master-port=ether9
set [ find default-name=ether11 ] master-port=ether9
set [ find default-name=ether12 ] master-port=ether9
set [ find default-name=ether13 ] master-port=ether9
set [ find default-name=ether14 ] master-port=ether9
set [ find default-name=ether15 ] master-port=ether9
set [ find default-name=ether16 ] master-port=ether9
set [ find default-name=ether17 ] master-port=ether9
set [ find default-name=ether18 ] master-port=ether9
set [ find default-name=ether19 ] master-port=ether9
set [ find default-name=ether20 ] master-port=ether9
set [ find default-name=ether21 ] master-port=ether9
set [ find default-name=ether22 ] master-port=ether9
set [ find default-name=ether23 ] master-port=ether9
set [ find default-name=ether24 ] master-port=ether9
set [ find default-name=sfp1 ] master-port=ether1
/interface vlan
add interface=ether9 name=vlan100 vlan-id=100
/interface ethernet switch egress-vlan-tag
add tagged-ports=ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,switch1-cpu vlan-id=100
/interface ethernet switch ingress-vlan-translation
add new-customer-vid=100 ports=ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24
/ip address
add address=192.168.1.16/24 interface=vlan100 network=192.168.1.0
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set www-ssl certificate=test.crt_0 disabled=no
/lcd
set time-interval=hour
/system clock
set time-zone-name=America/Los_Angeles
/system package update
set channel=bugfix
/system routerboard settings
set protected-routerboot=disabled

As a note, my Windows 10 system (Intel Gigabit NIC) works fine, which I take is because it just ignores the VLAN tags which are being generated.

On my Linux box though it fails:

# tcpdump -i p6p1 -nn -vvv -XX arp or icmp
18:01:29.650675 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.16 tell 192.168.1.8, length 28
        0x0000:  ffff ffff ffff 0019 d104 2db4 0806 0001  ..........-.....
        0x0010:  0800 0604 0001 0019 d104 2db4 c0a8 0108  ..........-.....
        0x0020:  0000 0000 0000 c0a8 0110                 ..........
18:01:29.650846 ARP, Ethernet (len 6), IPv4 (len 4), Reply 192.168.1.16 is-at 4c:5e:0c:00:cb:fe, length 42
        0x0000:  0019 d104 2db4 4c5e 0c00 cbfe 8100 0064  ....-.L^.......d
        0x0010:  0806 0001 0800 0604 0002 4c5e 0c00 cbfe  ..........L^....
        0x0020:  c0a8 0110 0019 d104 2db4 c0a8 0108 0000  ........-.......
        0x0030:  0000 0000 0000 0000 0000 0000            ............

jlvillal · March 1, 2016, 4:44am

OMG!

I figured it out finally.

This post made it clear, after a thorough reading:
http://forum.mikrotik.com/t/possibility-of-multiple-trunked-vlan-master-ports-on-single-crs125-switch-chip/95398/1

Basically DO NOT use multiple master ports if you want to do VLANs.

This super easy to miss note from http://wiki.mikrotik.com/wiki/Manual:CRS_examples sort of explains it:

Note: Multiple master-port configuration is designed as fast and simple port isolation solution, but it limits part of VLAN functionality supported by CRS switch-chip. For advanced configurations use one master-port within CRS switch chip for all ports, configure VLANs and isolate port groups with port isolation profile configuration.

Here is my working config. And by working I mean I can ping 192.168.1.16 (the CRS) from my Linux box (port 22) and also SSH into the CRS from ports 17-24 without the Linux box being aware of the VLAN.

Ports 9-16 are setup to be tagged as VLAN 100. Tested and working.
Ports 17-24 are setup to be untagged VLAN 100. So VLAN tags are not seen by the connected devices, but traffic will get put onto VLAN 100. Tested and working.

This is not a fully complete setup. VLAN isolation should be turned on and maybe other things.

# feb/29/2016 20:37:17 by RouterOS 6.32.4
# software id = 36UD-T26V
#
/interface ethernet
set [ find default-name=ether2 ] master-port=ether1
set [ find default-name=ether3 ] master-port=ether1
set [ find default-name=ether4 ] master-port=ether1
set [ find default-name=ether5 ] master-port=ether1
set [ find default-name=ether6 ] master-port=ether1
set [ find default-name=ether7 ] master-port=ether1
set [ find default-name=ether8 ] master-port=ether1
set [ find default-name=ether9 ] master-port=ether1
set [ find default-name=ether10 ] master-port=ether1
set [ find default-name=ether11 ] master-port=ether1
set [ find default-name=ether12 ] master-port=ether1
set [ find default-name=ether13 ] master-port=ether1
set [ find default-name=ether14 ] master-port=ether1
set [ find default-name=ether15 ] master-port=ether1
set [ find default-name=ether16 ] master-port=ether1
set [ find default-name=ether17 ] master-port=ether1
set [ find default-name=ether18 ] master-port=ether1
set [ find default-name=ether19 ] master-port=ether1
set [ find default-name=ether20 ] master-port=ether1
set [ find default-name=ether21 ] master-port=ether1
set [ find default-name=ether22 ] master-port=ether1
set [ find default-name=ether23 ] master-port=ether1
set [ find default-name=ether24 ] master-port=ether1
set [ find default-name=sfp1 ] master-port=ether1
/interface vlan
add interface=ether1 name=vlan100 vlan-id=100
/interface ethernet switch egress-vlan-tag
add tagged-ports=ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,switch1-cpu vlan-id=100
/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=100 ports=ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24 sa-learning=yes
/interface ethernet switch vlan
add ports=ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24,switch1-cpu vlan-id=100
/ip address
add address=192.168.1.16/24 interface=vlan100 network=192.168.1.0

jlvillal · March 1, 2016, 6:07am

vuk88,

Please post your config. I think you had same situation as me with more than one master port.

My Windows 10 machine ignored VLAN, so it worked. But my Linux box did not and failed. This was because the untagged port was not actually untagged, because I had multiple master ports.

chechito · March 1, 2016, 6:23am

i have find config on CRS switches is better via winbox

look at this topic

http://forum.mikrotik.com/t/swithing-without-master-port/95495/10

from another topic this tip can help:

when setting ingress vlan (untagged vlan of the port) be sure to include that “0”
example
/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=20 ports=ether03 sa-learning=yes

without that “0” tagged vlans on the port will not work

also check the unicast forwarding database to confirm vlan behavior