Cannot connect to router/switch on mgmt vlan - No route to host (ssh) / Destination Host Unreachable (ping)

zauberfisch · December 14, 2023, 8:57pm

Good day,

I have configured my switches (CRS switches running routeros) for management through vlan 50. However, I usually* can’t access the switch (no route to host).

if I connect to the switch via serial, I can ping the rest of the network. And after I used ping from the switch to my workstation, now my workstation can connect to the switch.
I feel like this might be a routing/arp problem, but I haven’t been able to figure out what’s wrong with my limited networking knowledge.

I’ve basically followed this guide https://help.mikrotik.com/docs/display/ROS/Bridge+VLAN+Table with only slight modifications.
And looked around on the internet and this forum, but didn’t find anything that helped me.

Any pointers would be appreciated.

/export:

# 1970-01-02 02:00:55 by RouterOS 7.12.1
# software id = 0000-0000
#
# model = CRS326-24G-2S+
# serial number = <removed>
/interface bridge
add admin-mac=A0:A0:A0:A0:A0:A0 auto-mac=no frame-types=admit-only-vlan-tagged name=bridge pvid=50 vlan-filtering=yes
/interface vlan
add interface=bridge name=VLAN_MGMT_BR vlan-id=50
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether1 pvid=50
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=50
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=50
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=50
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether5 pvid=50
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether6 pvid=50
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether7 pvid=50
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether8 pvid=50
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether9 pvid=100
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether10 pvid=100
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether11 pvid=100
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether12 pvid=100
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether13 pvid=100
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether14 pvid=100
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether15 pvid=100
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether16 pvid=100
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether17 pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether18 pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether19 pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether20 pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether21 pvid=90
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether22 pvid=91
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether23
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether24
add bridge=bridge frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1
add bridge=bridge frame-types=admit-only-vlan-tagged interface=sfp-sfpplus2
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge comment=VLAN_PUBLIC tagged=ether23,ether24,sfp-sfpplus1,sfp-sfpplus2 untagged=ether17,ether18,ether19,ether20 vlan-ids=10
add bridge=bridge comment=VLAN_IOT tagged=ether23,ether24,sfp-sfpplus1,sfp-sfpplus2 vlan-ids=20
add bridge=bridge comment=VLAN_MGMT tagged=ether23,ether24,sfp-sfpplus1,sfp-sfpplus2 untagged=bridge,ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8 vlan-ids=50
add bridge=bridge comment=VLAN_PL tagged=ether23,ether24,sfp-sfpplus1,sfp-sfpplus2 untagged=ether21,ether22 vlan-ids=90
add bridge=bridge comment=VLAN_PRINT tagged=ether23,ether24,sfp-sfpplus1,sfp-sfpplus2 vlan-ids=91
add bridge=bridge comment=VLAN_SERVER tagged=ether23,ether24,sfp-sfpplus1,sfp-sfpplus2 untagged=ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16 vlan-ids=100
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=10.111.50.15/24 interface=VLAN_MGMT_BR network=10.111.50.0
/system clock
set time-zone-name=Europe/Vienna
/system identity
set name=switch5
/system routerboard settings
set boot-os=router-os

Edit: some more details:

Tried to use a dhcp client instead of static IP - still no route to host from workstation, but via serial I see that the switch got an IP
Tried setting different values for /interface/bridge/set arp=
Tried connecting workstation directly to this switch (port with mgmt vlan untagged) and to a mgmt vlan port on a different switch

zauberfisch · December 15, 2023, 11:50am

I still don’t really understand what’s broken, but if I manually add the switch to my arp table, now I can connect:

$ ssh admin@10.111.50.15 
ssh: connect to host 10.111.50.15 port 22: No route to host

$ arp -a
switch5.local (10.111.50.15) at <incomplete> on enp3s0
_gateway (10.111.50.1) at 00:00:00:00:00:00 [ether] on enp3s0
? (172.18.0.5) at 01:01:01:01:01:01 [ether] on br-a1e64b7af742

$ sudo arp -i enp3s0 -s 10.111.50.15 A0:A0:A0:A0:A0:A0

$ arp -a
switch5.local (10.111.50.15) at A0:A0:A0:A0:A0:A0 [ether] PERM on enp3s0
_gateway (10.111.50.1) at 00:00:00:00:00:00 [ether] on enp3s0
? (172.18.0.5) at 01:01:01:01:01:01 [ether] on br-a1e64b7af742

$ ssh admin@10.111.50.15 
admin@10.111.50.15's password:

mkx · December 15, 2023, 3:00pm

These two properties of bridge are incompatible:

frame-types=admit-only-vlan-tagged pvid=50

… and the rest of bridge VLAN 50 config assumes untagged.

Bridge has multiple personalities, pretty well explained in this article/tutorial. Setting quite a few properties on bridge under /interface/bridge is actually about bridge the “the router-facing port of the switch” and this includes above quote properties. No, frame-types, set on bridge, doesn’t mean anything to other bridge ports (it’s not default setting or something like that).

I suggest you to keep using tagged frames over bridge port … in this case pvid seting doesn’t matter at all, but you have to set bridge port as tagged member of VLAN 50 (under /interface/bridge/vlan)