CCR ROUTER LAYER 2

RouterOS Beginner Basics
1

Hello

I am new to the ccr router side as i come form Cisco Side.

I am using CCR router to route basic internet traffic as an isp.

I have SFP+ 1 port as our router port and then SFP+ 2 port as our wan to all our customers.

I am trying to set up vlan 10 to be a trunk port to pass that vlan from sfp+1 port to sfp+2 port.

SFP plus 1 port is a layer 2 link back to our data center and we are setting up vlan 10 as our mgmt vlan.

We need to pass the vlan 10 up to the data center as this is where our main firewall is located.

Any help would be great.

2

There are different ways of doing it, but the proper (and extensible and future-proof) way is by setting up VLAN-enabled bridge on CCR.

Have a look at this tutorial on how to do it properly. There are a few use cases explained, I don’t think yours is directly one of them (some concepts of switch apply, also sone concepts of all-in-one apply). So here’s a brief description of how I’d tackle the problem:

  • WAN port will be set up as hybrid port, with VID 10 for mgmt and PVID set up (e.g. 666) for internet setvice.
  • LAN ports will be either hybrid with VID 10 tagged and PVID set up (e.g. 100) for LAN service.
    Or they will be untagged (access ports) with PVID set up (either 10 for access to management subnet or 100 for LAN service)
    Or they will be trunk with VLANs allowed set to whatever VLANs have to pass (e.g. for connecting core/edge switches)
  • bridge port has to be tagged member of all VLANs necessary. This means management VLAN andvall VLANS between which CCR needs to route (LAN, WAN).
  • you’ll create (at least) 3 vlan interfaces with vlan-id set to 10 (management interface), 100 (LAN interface) and 666 (WAN interface). Set up WAN interface the way ISP requires it (DHCP client or PPPoE client or static IP), set up LAN interface with appropriate LAN IP address and setvices (DHCP server), set up management interface with appropriate setup.
  • create firewall rules which will allow access to management interface only from management subnet (chain=input) and block routing between management and other networks (WAN in particular) (chain=forward)