Configuring VLANs correctly

[CGGXANNX]

On your RB5009, the "drop all" rule is currently only on the input chain. The one for the forward chain is still missing (as a result traffic between VLANs are not blocked). Also, you might want this on the RB5009 too:

/tool mac-server mac-winbox
set allowed-interface-list=MGMT

Also, be aware of this default entry on the two switches and the access point:

@DiJuMx

/ipv6 nd
set [ find default=yes ] advertise-dns=yes

For the switches and the access point, you should either disable advertise-dns on that default /ipv6 nd entry, or disable the entry altogether, when you don't want those devices to act as IPv6 routers. See this and the post it links to.

---

@DiJuMx

I am still seeing this in winbox though, which suggests I still haven't completely solved my issues.

Winbox

I'm guessing the vlan100-trusted board port is due to the presence of that interface on the RB5009 bridge.

Is the computer running WinBox 4 plugged into the "Desktop" or "Laptop" port of the RB260GSP - "Office"? If that's the case then what you are seeing in WinBox is normal:

• The computer is actually plugged into VLAN 100, not VLAN 99, because that's what being configured on RB260GSP - "Office" (port has Default VLAN ID 100 and VLAN Receive is "only untagged"). Which means what connects the computer to the RB5009 is VLAN 100. It's normal that WinBox see the RB5009 announced itself with its address on vlan100-trusted and the IPv6 and IPv4 addresses attached to that port.

• It's also normal that you don't see the neighbor discovery from the other switches that only have the CPU connected to VLAN 99 (there is only interfaces declared for vlan-id=99 under /interface vlan). The computer running WinBox is not in the same VLAN as the CPU of those CRS switches.

• It's normal that you see the RB260GSP - "Office" listed in the neighbor list in WinBox, although of course WinBox cannot connect to that 10.99.0.4 address because that device only runs SwOS. You see it listed there because on that switch MikroTik Discovery Protocol is enabled on all ports, so the discovery information is broadcasted to your computer because it's connected directly to one of those ports.

  However, when you use the web browser to manage that switch on 10.99.0.4, it's not a direct connection between the computer and that switch at all. The packets destined for 10.99.0.4 actually travel inside VLAN 100, up to the RB5009, then the RB5009 performs routing on layer 3, and forwards the packets to the RB260GSP through VLAN 99.

  When the RB260GSP - "Office" switch responds, the packets travel back to the RB5009 via VLAN 99, then the RB5009 forwards (routing with layer 3) them via VLAN 100 to your computer.

---

@DiJuMx

how can I get winbox to see the other VLAN(s)?

The easiest way for you to see all the devices in WinBox, is to put the computer running WinBox in VLAN 99 instead of VLAN 100. Which means change Default VLAN ID on the switch port to 99 instead of 100.

An alternative is that you configure that computer to be VLAN aware and be able to handle tagged VLAN (it's supported for all major desktop operation systems), so that the computer is on VLAN 100 untagged and VLAN 99 tagged. The setting of the switch port connected to that computer must be changed into a hybrid port, of course, not only an access port like now. Also on the virtual NIC on the computer that is assigned to the tagged VLAN 99, you should manually configure an IP address in the 10.99.0.0/24 range without specifying any gateway. If you do that, WinBox will also be able to see everything on VLAN 99 and connect to the CRS and cAP ax with MAC address (instead of having to use the 10.99.0.x IP addresses).

Another alternative is to setup RoMON RoMON | RouterOS Manual.