I want to replace my Cisco and HP switch with this CRS328-24P-4S+RM switch. I’ve already bought it. It’s connected to my Fortigate 60e appliance, where I’ve already configured the VLAN IPs, networks etc.. (Essentially, most of the networking is done at a firewall level, and it’s just static routes)
I have WiFi APs, where I need them to be in “trunk” or “tagged” mode, and allow other VLANs too , given it allows multiple SSIDs on different VLANs. They’d need to have DHCP being allowed out too, as well as to be able to route out to the firewall
Almost. The syntax of your /interface bridge vlan section is not correct - you can only specify a vlan-ids= value once and the tagged= / untagged= entries expect a list rather than being repeated, also if you wish to comment entries the syntax is comment=“some text”, so:
Note I prefer to leave out the untagged= entries under /interface bridge vlan as they will be dynamically added to match the pvid= settings under /interface bridge port so as not to accidentally end up with a mismatch. If you look in Winbox or use /interface bridge vlan print you can see the current membership, inactive (i.e. down / not running) interfaces do not appear.
You may wish to drop unexpected VLAN ingress as by default all are accepted, add ingress-filtering=yes to the /interface bridge port entries, also on a pure trunk add frame-types=admit-only-vlan-tagged otherwise there will always be an untagged VLAN membeship dynamically added matching the PVID.
Currently ether1-3 only have VLAN 10 tagged for the APs, add these interfaces as tagged members of other VLAN IDs as required.
You only need /interface vlan entries for the VLANs which are accessing services on the CRS, not those passing through the bridge, so it reduces to:
/interface vlan
add interface=bridge1 vlan-id=40 name=Management
If you wish to access the CRS from subnets other than 10.10.40.0/24 you need a default route for the return traffic:
/ip route
add distance=1 gateway=10.10.40.1
How would the switch know what the PVID is, if I don’t actually define said VLANs on the switch?
The VLANs and untagged membership are dynamically generated from the pvid= entries under /interface bridge port if they have not been made explicitly.
Your Mikrotik configuration doesn’t match that on the Cisco for the WiFi AP interfaces.
interface PORT
switchport trunk encapsulation dot1q
switchport trunk native vlan R
switchport trunk allowed vlan R,S,T
switchport mode trunk
translates to
/interface bridge port
add bridge=bridge1 interface=PORT hw=yes pvid=R
/interface bridge vlan
add bridge=bridge1 tagged=…,PORT,… vlan-ids=S
add bridge=bridge1 tagged=…,PORT,… vlan-ids=T
So, the switchport trunk native vlan 10 becomes:
/interface bridge port
add bridge=bridge1 interface=ether1 hw=yes pvid=10 comment=WiFi
add bridge=bridge1 interface=ether2 hw=yes pvid=10 comment=WiFi
add bridge=bridge1 interface=ether3 hw=yes pvid=10 comment=WiFi
…
As I mentioned previously you can’t have the same vlan-ids= appear more than once under /interface bridge vlan, so:
/interface bridge vlan
add bridge=bridge1 tagged=sfp-sfpplus1 vlan-ids=10
add bridge=bridge1 tagged=sfp-sfpplus1,ether1,ether2,ether3 vlan-ids=20
add bridge=bridge1 tagged=sfp-sfpplus1 vlan-ids=30
add bridge=bridge1 tagged=sfp-sfpplus1,bridge1 vlan-ids=40
add bridge=bridge1 tagged=sfp-sfpplus1 vlan-ids=50
add bridge=bridge1 tagged=sfp-sfpplus1,ether1,ether2,ether3 vlan-ids=60
add bridge=bridge1 tagged=sfp-sfpplus1 vlan-ids=70
You have created a second /interface vlan port section rather than updating the original one with the correct settings. This will fail when the statements in the second section attempt to add ports which have already been added by statements in the first section - merge the two together.
"[admin@MikroTik] /interface bridge port>> add bridge=bridge1 interface=ether1 hw
es pvid=10 comment=WiFi
failure: device already added as bridge port
[admin@MikroTik] /interface bridge port>
"
By default, it appears Mikrotik has added every single port to the “bridge” that’s defined as “bridge” instead of “bridge1” I’ve tried to “remove” this, but it has a syntax issue. I’m not sure what else is needed?
When I’ve physically removed ether1, and added it back “hw.offload” is not ticked in the GUI?
So the following config absolutely works for this switch
edge=yes is essentially “rootguard” as far as I know. Initially, another switch was becoming the root, and that’s a dumb £10 switch. Not a good idea!