Configure CCR1009 Multi VLANS to CRS125

RouterOS Beginner Basics
1

Dear All,

I am the new of Mikrotik and just tried to do the network multi VLANs on CCR1009 and deployed its to CRS125 by using DHCP server on CCR1009 and DNS server on Windows Server 2012.
i have setup 3 Vlans (VLAN10; VLAN20; VLAN30) on CCR and seems to be working OK but observed that the domain network show as domain.local 2 (unautheticated) on VLAN20 and VLAN30 and working fine on VLAN10.
Here is the configure that i have done:

  1. on CCR1009
  • Created Bridge Trunk
  • Added ports 4,5,6,7,8 to Bridge Trunk for CRS125 on each areas
  • Created VLANs 10; 20; 30 on Interface=>VLAN
  • Added VLAN10; 20; 30 to interface Bridge Trunk
  • Created Bridge VLAN10, 20, 30
  • Added port VLAN 10 interface and Port 3 to Bridge VLAN10 for Servers

2.On CRS125 (port 24 uplink from CCR1009 at port 4)

  • Created VLAN10; 20; 30 on Interface VLAN
  • Added VLAN10; 20; 30 to interface port 24
  • Created Bridge VLAN10, 20, 30
  • Added port VLAN10 interface and port 1-12 to bridge VLAN10 for clients and printers
  • Added port VLAN20 interface and port 13-17 to bridge VLAN20 for clients
  • Added port VLAN20 interface and port 18-23 to bridge VLAN30 for clients

PS. the VLAN10 is working fine with no issue. could get IP from DHCP server on CCR1009, internet access, remote RDP, communicated with mail and file servers, etc… but the VLAN20 and VLAN30 could get the IP on its own VLANs, can ping to VLAN10, VLAN30 and voice versa; it couldn’t communicated with servers and clients on another VLANs as the domain network showing as Domain.local 2 (Unautheticated).

I am not sure if i have missed anything on configuration or do i need to configure something on DNS server to make it communicated each others.

Please guide me if anyone know on how to fix it.
your help is highly appreciated and sorry for my bad english.

Thanks,

2

Hi,

Just a side note, don’t use bridges on CRS. Traffic in bridges goes via CPU and CRS has got only 1Gbps connection between switch chip and CPU. Better to implement vlans on switch chip level

Check this:
http://wiki.mikrotik.com/wiki/Manual:CRS_examples
http://wiki.mikrotik.com/wiki/Manual:CRS_features

Best,

3

Hi kamillo,

Thank you for your reply,.

i have read the link on your post many-time before posted as i don’t have any idea on how to do it. lack of knowledge

would it be possible to guide me on how to fix this, please?

Thanks,

4

You must add prerouting fillter accept src/dst address is ip range of both bridge
Don’t use port 4 of ccr1009, it share speed with port 1,2,3.

5

You must add prerouting fillter accept src/dst address is ip range of both bridge
Don’t use port 4 of ccr1009, it share speed with port 1,2,3.

6

Hi Miracle,
Thanks for reply but would it be possible to show me on how to config? lack of knowledge and experience with it.

Please help

Cheers,

7

Ex:
Vlan10: 10.0.10.0/24
Vlan20: 10.0.20.0/24

Go to IP > firewall > mangle > add new (ccr1009)

8

still got the same problem by adding Mangle on CCR1009

  • Each VLANs 10, 20, 30 can ping but can’t communicate to each other like: remote RDP (from VLAN10 to VLAN20; 30 and voice versa), file sharing, etc…
  • VLAN 10 working fine and got IP assigned by DHCP server from CCR1009
  • VLAN 20 and VLAN30 got IP assigned by DHCP server on CCR1009, access internet but can’t communicate to other VLANs, also got network domain shows as domain.local 2 (Unauthenticated)

Please advise more