i come from a Cisco/Juniper/Arista background and i am really just starting to play with Mikrotik in our lab.
I have a CRS317-1G-16S+ which we want to use as a media converter or "cloud" simulation between our Cisco Nexus or Juniper QFX devices.
I'm trying to make a very simple layer 2 setup (no inter-vlan routing what so ever) but i am struggling and i really cannot understand what is the logic behind the Router OS.
my goal is to do the following:
create vlan 100,200 and 3921
on port sfp-sfpplus3 i want to make it a trunk and ONLY allow vlan 3921 tagged
on port sfp-sfpplus5 and sfp-sfpplus6, i want to make it a trunk and allow ONLY vlan 100,200 and 3921 with vlan 100 as native
on port sfp-sfpplus7 i want to make it a trunk and allow all vlans so that i don't have to edit that interface everytime i create new vlans
This article I wrote will probably be very helpful since you’re familiar with Cisco. It translates cisco switching configs for VLANs to the MikroTik equivalent.
i will publish here my config once done but i begin to see the light
one thing that seems to be very annoying is that if i had vlan 100-300 to port1 , and then i go to add vlan 100 to port2, it will complain as vlan is already added.
It seems that in /interface bridge vlan one can only add config lines with unique combination of bridge= vlan-ids= … so defining a config line with range of VIDs complicates things later when one wants to make setup a tad more complex. Simplifying your example into 200 config lines doesn’t make much sense either.
BTW, if we constrain ourselves to slightly simpler example: you have a trunk port with a couple of VLANs and you later on decide to add another port with single VLAN, you’ do it like this:
#initial setup
/interface bridge vlan
add bridge=bridge1 vlan-ids=100 tagged=port-channel1
add bridge=bridge1 vlan-ids=200-300 tagged=port-channel1
# later addition
set bridge=bridge1 vlan-ids=100 tagged=port-channel1,eth5
Note use of set instead of add as you’re changing an existing entity rather than adding a new one.
Hi, just a quick question if i may, because i can’t really understand the login behind the routeros..
what’s the difference between those two commands? i understand they are required to make it the config work (simple access port) but i don’t understand why or what they do differently
i mean, an access port is a port where 1 and only 1 vlan is allowed nad traffic is untagged. (in contrast, a trunk allows multiple vlans, all tagged, with exception of 1 and only 1 untagged vlan, called native vlan)…
so what are the 2 commands doing differently? the first is saying that the port SFP1 has “port-vlan-id” set to 100.. unless i’m totally wrong here, the pvid is the untagged vlan.
the second commands says that vlan 100 is to be untagged on port SFP1 .. they seem redundant to me…
The first command configures ingress behaviour while the second one configures egress behaviour. Both commands are not entirely independant of each other though, setting ingress-filtering=yes establishes the dependency. Another important setting is frame-types= …
It is possible to set interface to accept untagged packets on ingress (as you did with the first command) and to transmit tagged packets on egress. Doesn’t make sense, I know.
You’re not alone in this feeling; basically the /interface bridge vlan defines the egress behaviour, and the /interface bridge port defines the ingress behaviour. To make things even more strange, the untagged list in /interface bridge vlan items seems to be optional in the manual configuration, as it is created automatically (in the actual configuration, not in the manually set one). So if you add port P to bridge B with pvid=V, a row will appear in /interface bridge vlan with vlan-ids=V untagged=P bridge=B; if a row with vlan-ids=V and bridge=B already exists, P will be added to its untagged list. All the above is true for SOHO devices; I could never test whether it works the same on a CRS 3xx as I haven’t got one.
