Ok, now starting to play around.
1.) First question: I add “/interface bridge vlan add bridge=bridge tagged=ether1,ether10 untagged=ether21,ether22 vlan-ids=100”. Then I decide to remove ether10 from that VLAN. So I issue “/interface bridge vlan add bridge=bridge tagged=ether1 untagged=ether21,ether22 vlan-ids=100” which does not work because the entry for VLAN 100 already exists. So I use “/interface bridge vlan set bridge=bridge tagged=ether1 untagged=ether21,ether22 vlan-ids=100” which requires me to enter the number of the ‘data-set’ referring to the VLAN 100. Instead of entering the number of the table row I can replace “vlan-ids=100” by “[find vlan-ids=100]”. Am I right assuming that there always is only one entry per VLAN-ID in the /interface/bridge/vlan table?
2.) If I look at the ethernet interfaces using “/interface ethernet print” or “/interface ethernet print detail” I won’t see the pvid and don’t see the association with the bridge named bridge. Where as when I “/interface bridge port print” I see the ethernet interfaces associated with the bridge and their pvid. To my question: I can not investigate the state/configuration of a physical ethernet port solely by looking at “/interface ethernet”, I would always have to check /interface bridges and maybe other places, or am I missing something?
Taking a closer look at the bridge. The bridge itself, as @mkx stated earlier has two personalities.
3.) Looking at the bridge as “the virtual device that does the switching between the added ports” it does not have any VLAN-related configuration by itself, besides setting vlan-filtering=yes/no and setting the stp to rstp, mstp or the like. But it does not have a VLAN-ID or pvid per se, right? At least it doesn’t show using “/interface bridge print” and it doesn’t show up using “/interface bridge port print”. Looking at the bridge as a ‘switching device’ there also wouldn’t be the need for. Do I understand that right?
4.a) Looking now at the bridge as the link to the underlying RouterOS. In general one would want to “get on the switch/router” in order to do the configuration etc. I can take an ether-port, configure it with a proper IP-Setting and voila, I can access the switch/router on the OS-Level. At least that’s what I’ve done on my RB3011. If now all ports on the CRS-Switch are added to a bridge, I can to the IP-configuration for that bridge and again, voila, I can access the OS-level. Now activating vlan-filtering: Traffic including access to the RouterOS comes from an access-port, get’s tagged, passes back/forth/through the bridge, but never to the bridge itself, as it would need to be a member of the same VLAN as from where the connection request originated. Is that logic right?
4.b) Looking at pcunites scripts, I can add the bridge to a vlan by tagging it: “add bridge=BR1 tagged=BR1,sfp1,sfp2 vlan-ids=99”. Does the bridge not have a pvid-setting? Or is it an “invisible default pvid=1”?
4.c) Would it work if I configure IP on the bridge as stated earlier and then add the bridge to the vlan untagged, for example by: “add bridge=BR1 tagged=sfp1,sfp2 untagged=BR1 vlan-ids=99” and if not, why not?
Sorry for the long post, but the last part will probably derive from question #4 so let me just as well put it in here and save another, last post:
After understanding all previous logic, I now can create VLANs on a switch using access ports, span the VLANs over switches using a trunk port. Connected devices can now talk to each other in the same VLAN. But now I want access from my PC in VLAN100 to a server/router/… on another VLAN. A blunt simple approach would be to configure some ports on my RB3011, for example by giving ether5,6,7,8,9,10 different IP-configurations and adding DHCP-Server and then plug them into the CRS. on the CRS I would assign the incoming ports originating from the RB3011 to different VLANs and voila, I have IP-Service in each VLAN including DHCP and could route traffic from one VLAN to another over the Router.
5.a) Technically, logically this would work, right?
The downside is, that this would limit the number of VLANs to the number of available Ports on the RB3011 and I assume it is not the “usual” way you would do this. So, according to what I have read and what is used in pcunite’s script, I create a “virtual device/interface” using: “/interface vlan add interface=BR1 name=BASE_VLAN vlan-id=99”. This creates an Interface named BASE_VLAN which I can use the same way as e.g ether8 previously for configuring IP.
5.a) Is there a difference between using the VLAN-Interface or the “ether-to-access-port” approach in terms of performance, limitations?
5.b) The RB3011 has two switch chips, connecting port 1-5 and 6-10. Does it make a difference if I add the VLAN-Interface on the first 5 ports together with the WAN-Port or should I rather move it as planned to the second because it then might utilise the hardwareoffloading better on the vlans or something?
Thanks for bearing with me so long, I already started to put the configuration together as I believe I nearly have everything together.
and based on the IP I can conclude that he/she landed in VLAN1 and then can transfer his/her accessport to the right VLAN. Any reason speaking against this approach?