I have 3 NetGear WAC720 access ports with 3 SSID defined and each is on a different VLAN. The 1st SSID is on the untagged VLAN (VLAN1) and the other 2 SSID are each on their own tagged VLAN (VLAN12 & VLAN22).
The router is TP-Link TL-ER7206 with one GbE RJ45 with all the VLANs defined
VLAN1 is currently the management network and I don't want to go to the hassle of configuring a Windows PC with a tagged VLAN for management. And, I want to be able to plug a non-managed switch or network device into any port and have it "join" VLAN1.
Will SwOS 2.18 let me setup four RJ45 ports with VLAN1 untagged (default?) and VLAN12 & VLAN22 as tagged?
Basically the 3 AP ports and the 1 uplink port to the router would be configured the same except the uplink would be a "trunk"?
If so, what is the recommended steps to get something like this setup? Is there a MikroTek guide for SwOS 2.18 that shows an example?
I'm new to SwOS. A DDG search seems to relate to earlier versions of SwOS. The terms used on the search results don't match the pull-down menus on the switch.
Yes, that's call a hybrid port. See the configuration example in the documentation:
Don't forget to specify port membership for VLAN-ID 1 first before turning on VLAN Modestrict. The Default VLAN ID is 1 for the configuration that you want (not 200, 300, 400 as in the example).
Thanks. But, while it's close, it isn't what I need. It's also the guide that AI pulled up when it told me the SwOS could not do what I wanted and I should change my network to match the guide.
In that diagram, ether6, 7 & 8 would be where the access points plug in. Each AP has 3 VLANs (VLAN1 = Untagged, VLAN12 = Tagged & VLAN22 = Tagged).
The diagram shows that Ether2 looks closest to what I need for all 4 ether-ports (assuming VLAN1 is the "default").
Another rational for this configuration is in rack of servers that need to be PXE booted from a master node. On power up, their NIC would not be tagged VLAN aware and ARP out on the native LAN of the ether-port they are plugged into. Then, after the OS image is installed, their kick-start configuration script would set up the VLAN tagging that would be needed on the NIC to match the tagged VLANs on the ether-port. To do this, the all of the switch's ether-ports need to have a "native" LAN plus any tagged VLANs needed after the servers come online.
We used to do this with DNSmasq, LLDP while using Arista or Allied Telesys switches in the '00's.
NO! Ether2 in the diagram of the example is a trunk port. A trunk port only carries tagged VLANs, with no untagged VLAN. That's why in this screenshotPort 2 has VLAN Receive set to only tagged. That is not what you need.
You need to configure your ports as a hybrid port. You can pick one of the port 6, 7, or 8 as an example for your configuration. Let's pick Port 6. We'll configure the 4 ports 1, 2, 3, 4 that you'll plugged into the TL-ER7206 and the 3 WAC720.
VLAN 200 in the example of Port 6 will have the role of VLAN 1 in your configuration. VLAN 300 is your VLAN 12, VLAN 400 is your VLAN 22.
So you follow the guide, and:
Enable Independent VLAN Lookup.
Add VLAN entries and specify port membership (this screen). Instead of 200, 300, 400, you'll add entries for 1, 12, 22. And you tick the checkboxes for the port 1, 2, 3, 4 (the example enable membership on port 2, 6, 7, 8).
Next you set the Default VLAN ID and Mode for the ports (this screen). As I wrote above, we follow the example of Port 6, just replace VLAN ID 200 with VLAN ID 1. Which means you edit the entries for port 1, 2, 3, 4, set VLAN Mode to strict, VLAN Receive to any, and Default VLAN ID is 1 (instead of 200 for Port 6).
The example also change the Management access to VLAN 200 (this screen). In your configuration 200 is 1, which means you'll need to have Allow From VLAN set to 1, which is the default already.
Again, stop depending too much on AI, read the documentation (that's only a few paragraphs), make some adjustments from the example documentation to your situation. Don't write things like this:
When it close, use some of your brain to make the necessary modifications. Do you expect MikroTik to put the example with your VLAN 1, 12, 22 in their documentation specifically for you, with the exact amount of ports? They provided an example for hybrid port and trunk port, in my first response, I already hinted that you need hybrid ports. Your only task is to change the VLAN ID to your need and copy the setup for hybrid ports.
There is no problem to configure a hybrid port on MikroTik switches, but remember: NEVER connect a Windows computer to such a hybrid port!!! (which has both untagged and tagged VLANs).
Windows CANNOT HANDLE THAT! There is a serious design error in the networking stack (that they cannot fix without breaking legacy ethernet drivers) that will bite you really hard when you connect your Windows PC to the hybrid port. Always configure a port to which Windows PCs are to be connected with only a single untagged VLAN!
Windows supports that fine unless you have some ancient hardware / driver. Both adapters from Intel and Realtek on this PC I am currently on are connected to hybrid ports:
You might need to adjust the adapter's settings. Or if the PC has Hyper-V enabled (you can also do it with the Home Edition), then you don't even need to change the setting of the network adapter. Hyper-V allows the use of all the tagged VLANs (as separate virtual adapters).
The default action of Windows is to strip all VLAN tags and merge all incoming traffic into a single datastream so Windows sees all traffic incoming on all VLANs, and even a program like wireshark will not be able to tell that it is from a VLAN.
The setting above is not the default, and it is not even available on all network cards...
"Independent VLAN Lookup" was already set when I posted this, but thanks for being thorough.
Starting simpler, if we are starting with only VLAN 1 (untagged) & 12 (tagged) on ports 1-4, then I need to create both a VLAN 1 & VLAN 12 in the "VLANS" screen and make them both "Members" of ports 1-4?
"System > Allow From VLAN" is already set to 1, but should "VLAN > Default VLAN ID" on ALL ports (1-24 & SFP+ 1 & 2) also remain set to 1?
"VLAN > VLAN Mode", ports 1-4 should be set to "Strict". But should "VLAN > VLAN Receive" remain set to "Any" on ports 1-4?
FYI related to Windows 10 & 11 supporting tagged VLANs - It works if your system has Realtek or Intel Ethernet NICs.
Realtek has a download to help set theirs up and Intel seems to work using the Adaptor Properties in the Advanced screen.
I use the WisdPi USB3.2 5Gbps RJ45 adapter (Realtek chip set) and configured it with the "Realtek - Network Diagnostic Tool" (Diagnostic_v2.0.8.1_1.zip) with no problems. It creates new Network Adaptor in the Device Manager named "Realtek Virtual Adapter". I'm not sure how many you could add, but you can change the tag ID so it will join different tagged VLAN
The original Realtek NIC (Realtek USB 5GbE Family Controller) stays untagged and connects to the default VLAN on what ever port it's plugged into.
I run untagged default VLAN 1 and 4 other tagged VLANs on my CSS612, CSS318, and CRS305 (running SwitchOS) with no issues whatsoever. PVID is the untagged, and tagged need to be configured on the port. I run strict on all, but "allow from" does need to be set to "any" if you mix tagged and untagged.
If you want to present a tagged VLAN as untagged on a port, set the PVID accordingly, and I also set "untagged only" although "any" would also likely work.
It's a solid solution that has worked on any switch I have ever used . . . (Oh, and it also worksmon RouterOS - these basically distribute/trunk out of my RB5009 on a 10gig inter switch backbone.
The VLANS tab screen is related to the vlan table, and to what vlans a particular port is a member of. In your case if you want ports 1-4 to be configured identically and to associate untagged traffic with VLAN 1 and to accept tagged traffic for VLAN 12, then ports 1-4 must be members of both VLAN 1 and VLAN 12. The VLANS screen doesn't affect the framing format used (tagged or untagged, ingress filtering, or how frame formats are filtered); those are all controlled on the VLAN tab screen.
MikroTik is inconsistent in the terminology used for SwOS comparted to RouterOS. "Default VLAN ID" in the VLAN tab is specifying the PVID of the switch port. The PVID is the vlan that any (standard ethernet frames with no vlan indicated) untagged ingress traffic will be assigned to. Since you want untagged traffic to be associated with VLAN 1, that is what you need to have as the Default VLAN ID (for at least those four ports), by default every port is setup with VLAN 1 as the default VLAN ID. You need to have VLAN receive set to "Any" because you want those ports to be able to receive both tagged (for vlan 12) and untagged (for vlan 1), that's why it is called a hybrid port, it can process both tagged frames and up to one vlan can be carried with untagged traffic; the PVID/Default VLAN ID specifies which vlan that untagged traffic is associated with.
You would set the Default VLAN ID to something other than 1 if you want to create an access port for a vlan other than 1.
For example, assume you want to connect a windows PC that only understands untagged traffic, and you want it to be connected to port 5 of the switch and also be connected to only vlan 12. Then you would set port 5 as a member of VLAN 12 (but not VLAN 1) in the VLANS screen, and in the VLAN screen you would set the Default VLAN ID to 12 for port 5. To make it a "pure access port" where only only vlan 12 could be used, you would also set the VLAN Receive to "only untagged". Also by setting "Strict" you are enforcing ingress vlan filtering (which makes less difference on an access port, because only one vlan will be associate with the port, and only one framing format - untagged). Strict is more important on ports that can receive tagged traffic, since unless it is set to strict, it will receive traffic for any vlan, even if the port is not a member of that vlan specified by the vlan tag. When VLAN Mode is set to Strict, any traffic received by the port that is for a vlan the port is not a member of will be dropped before being allowed into the switch; it will be filtered out on ingress. You should always use strict VLAN Mode unless you have a good reason and understand why. If you are using vlans, you almost always want VLAN Mode to be set Strick. It prevents unwanted traffic from getting into the switch (e.g. crafted packets generated with something like scapy specifying a vlan tag for a vlan the port is not a member of).
In summary:
Yes, you have to specify what vlans you want the port to be able to pass traffic for. In your case 1 and 12.
If if want all ports to have access to vlan 1, then yes. That's the default and will remain that way until you change it.
Yes to both parts. The Any in VLAN Receive is related to whether the ethernet frames have vlan tags or not; it doesn't relate to what vlans are allowed in. That is done by the VLAN Mode. VLAN Receive Any allows the ports to receive either untagged or tagged traffic, which is your stated requirement.
Read this section of the documentation for the details of what the different options in the VLAN and VLANS screens do.
Also see the section that has settings for Trunk and Access ports
Yes, the CSS326-24G-2S can handle one untagged VLAN along with multiple tagged VLANs on the same port, provided it is configured correctly. The untagged VLAN is typically assigned as the port's default (PVID), while any additional VLANs are carried as tagged traffic. This setup is commonly used for connecting devices like access points, IP phones, or managed switches that need access to multiple VLANs. Just make sure the connected device is configured to understand the tagged VLANs and that the switch's VLAN settings match on both ends.
The problem (here) is that it should work just with default settings. I remember it was not working with Realtek adapters in HP computers. We now have Dell computers with Intel adapters and it seems it is OK there by default.
I don't know if it makes a difference, but like I said, I used the "Realtek - Network Diagnostic Tool" to set it up on my WisdPi USB3.2 5Gbps RJ45 adapter with the Realtek chip set.
Also, when I checked my Lenovo laptops with the Intel 82579LM Gigabit Network Adaptors, it has the option in Device Manager > Advanced > Packet Priority & VLAN to enable VLAN, but I haven't played with it yet to see if that pans out.
On my MinisForum MT90 systems running MS Windows Server 2019, they have Intel I255-LM 2.5Gbps RJ-45 chip set, and they already have options for VLAN ID and the Packet Priority & VLAN. This looks the same as the settings I saw in when I set up the Realtek chip set. But, I haven't bothered to mess with this yet.
I think it is a stupid design decision in Windows to make this VLAN setup a responsibility of each ethernet card driver, instead of having it in a separate 802.1q layer (part of the Windows OS) on top of the driver (like in Linux).
Now every driver has to implement such a setting, often done in different ways and with different naming, and when they do not do it or the user does not set it correctly, all tagged VLAN traffic is merged into one.
As I wrote above, if you enable the Hyper-V Platform feature (can be done for Home Edition too) then you have that layer, without touching the manufacturer's driver settings. The VLANs are not merged! You have Windows standard management (with PowerShell) for managing virtual switches (like bridges in RouterOS), VLANs (tagged, untagged, hybrid). You can also setup NAT & firewall on them and give the desktop PC the functionality of a router.
That's part of Hyper-V management tools, but it doesn't mean that you have to create and manage any virtual machine at all.
What version of Windows was that? XP? Windows7? Any driver that silently strips the the ethertype 0x8100 TPID and treats it as it it wasn't there, is broken in my opinion. I don's use ipv6, so I never noticed the problem, but I didn't start using vlans at home until 2017, and windows 10, and still don't have my home router configured to use ipv6 (but I am not behind cgnat), so maybe the problem exists but I just never noticed it. But I have an old HP laptop that had win10 education edition (my Son's discard) and it doesn't see traffic from tagged vlans if I plug it into a "hybrid" link.
While it may be best practice to not plug a window pc into a hybrid link, I don't think the problem is quite as prevelent as what you suggest when you state:
Windows 8 and Windows 10. I think the architecture is that the card strips the VLAN header and sends a message to the driver that contains the received VLAN, and when things are not configured correctly this message somehow gets lost and the network stack believes the packet was untagged. That is confirmed by the fact that wireshark also sees the packet as untagged.
