Configuring VLAN access port

RouterOS General
1

Hello,
I have a problem. I have VLANs on my RB (RB3011UiAS). There is a working trunk port ether2 but I can’t configure ether3 as an access port. There is a computer connected to that port unaware of VLANs and I need to have that computer in VLAN 30. According to Wiki https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#VLAN_Example_1_.28Trunk_and_Access_Ports.29 configuration should be like this, but it does not work. Am I missing something? Thank you very much for every suggestion…

/interface bridge add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5

/interface vlan
add interface=bridge1 name=vlan20 vlan-id=20
add interface=bridge1 name=vlan30 vlan-id=30

/interface ethernet switch vlan
add independent-learning=yes ports=ether2,switch1-cpu switch=switch1 vlan-id=20
add independent-learning=yes ports=ether2,ether3,switch1-cpu switch=switch1 vlan-id=30

/interface ethernet switch port
set ether3 vlan-mode=secure vlan-header=always-strip default-vlan-id=30

/ip dhcp-server
add address-pool=pool1 disabled=no interface=bridge1 name=server1
add address-pool=pool2 disabled=no interface=vlan20 name=server2
add address-pool=pool3 disabled=no interface=vlan30 name=server3

(This is shortened configuration. I configured IP addresses, pools, DHCP is working, trunk is working…)

2

You don’t say what model Mikrotik, but switch2 is connected to ether6-10 and switch1 to ether1-5 on 2011/3011 (additionally switch 1 to sfp1 on a 2011)

3

Have a slow long read of this excellent source which will help you clean up your config and provide all the answers you desire!
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

After reading that you should be well on your way to success.
The MT wiki resources have been playing catchup such that these ones are now not too bad either!
https://wiki.mikrotik.com/wiki/Manual:Bridge_VLAN_Table

4

tdw: Yes, I know. It’s a typo. This is example of my config. It’s switch2 and ether6, ether7 in my production configuration. But thank you!

anav: Thanks a lot for the link! I’ll check it!

5

In this case the /interface ethernet switch vlan section should look like this:

/interface ethernet switch vlan
add independent-learning=yes ports=ether2,switch1-cpu switch=switch1 vlan-id=20
add independent-learning=yes ports=ether2,ether3,switch1-cpu switch=switch1 vlan-id=30
add independent-learning=yes ports=ether6,switch2-cpu switch=switch2 vlan-id=30

Note that there should be at least 2 config lines for each vlan-id, one per switch= …

But, as always, it’s hard to analyze concrete problems by looking at obfuscated config with typoes … I’m often asking myself why do I bother to think about problem if the person with problem doesn’t want to present all the information in unaltered form …



Tutorial from @anav’s post will work, but slowly as it doesn’t use HW capabilities of your RB …

6

mkx: Yes, you’re right. Sorry for wasting your time. There was another typo. I can’t even rewrite few lines without mistakes. I don’t even know why I’m doing it. Readability is not better, but worse… Sorry for that.


/interface bridge add name=LANbridge
/interface bridge port
add bridge=LANbridge interface=eth6
add bridge=LANbridge interface=eth7
add bridge=LANbridge interface=eth8
add bridge=LANbridge interface=eth9
add bridge=LANbridge interface=eth10

/interface vlan
add interface=LANbridge name=vlan20 vlan-id=20
add interface=LANbridge name=vlan30 vlan-id=30

/interface ethernet switch vlan
add independent-learning=yes ports=eth6,switch2-cpu switch=switch2 vlan-id=20
add independent-learning=yes ports=eth6,eth7,switch2-cpu switch=switch2 vlan-id=30

/interface ethernet switch port
set ether7 vlan-mode=secure vlan-header=always-strip default-vlan-id=30

It’s configured this way now and port eth7 is still not behaving like access port :frowning:


Tutorial from @anav’s post will work, but slowly as it doesn’t use HW capabilities of your RB …

That’s a shame. I need to use HW capabilities, because there would be quite a big load on that device.
I’m quite lost in VLANs.. There is an old way, new way since v6.41, VLANs configured only with bridge, VLANs configured with bridge and switch…hw-offloading and switch chip stuff… Ugh… :frowning: I’m trying to understand VLAN principles on MikroTik for few weeks now, but it’s complicated, because the information is fragmented and qute often misleading. It’s like one huge puzzle.

7

OK, I’ll just pass this problem to anybody else who wants - quoting @anav - to play whack-a-mole with you. You’re not showing us full config (not even the relevant sections), only pieces which you think are relevant.

If you have a problem and don’t know how to solve it (or else you wouldn’t be asking here), how can you assume you know which bits of information do we need?

8

In other words a decent diagram will help and the config
/export hide-sensitive file=yourconfigmay24