connecting two Cloud router switches with vlans

RouterOS Beginner Basics
1

Hi all,
i have another post, where I don’t get an reply therefore here in a different form

I have a CRS125-24G-1S-2HnD and a CRS326-24G-2S+
both are running routeros 6.47.2
I refer to CRS326-24G-2S+ as switchA and to CRS125-24G-1S-2HnD as switchB
SwitchA ether1 connects to a separate firewall and to the internet
SwitchA has a bridge ether2-19+bond0(ether20-24)( ip range 192.168.199.0/24 and 192.168.200.0/24 ) no vlantaggig for that
SwitchA has a tagged vlan 1003 192.168.168.0/24
SwitchA has a tagged vlan 1010 192.168.1.0/24
SwitchA shall be connected via 4 ports ( bond0) ether20-24 to switchB ports ether1-4
pfsense firewall with DHCP server resides on switchA ether9 for vlan1010 and iprange 192.168.200.0/24 and on ether12 for vlan1003 and iprange 192.168.199.0/24

I want on switchB the same iprange/vlans available as on switch A
eg I plug a device into ether10 and it shall receive an IP address ( range 192.168.[199|200].0/24) form my DHCP server which resides on a pfense firewall connected to switchA (9/12)
in addition the ports ether17-24 shall be untagged for Vlan1010 as the devices can’t do vlantagging but shall be in that specific range ( it shall receive a DHCP lease from my pfsense for vlan1010 )
Any help will be greatly apprecitaed

I tried all different variations of MikroTik examples and forum examples , but it does not work ( especially due to the different hardware I have to use different setups on both SwitchA I can use the bridge with filtering switchB I have to use the switch setup for the vlan filtering )

2

The CRS1xx should be configured to use the switch https://wiki.mikrotik.com/wiki/Manual:CRS1xx/2xx_VLANs_with_Trunks (the inter-VLAN routing and DHCP server sections are not applicable to your setup), and the CRS3xx should be configured with a single VLAN-aware bridge https://wiki.mikrotik.com/wiki/Manual:CRS3xx_VLANs_with_Bonds

Note that you should use mode=balance-xor transmit-hash-policy=layer-2-and-3 for the CRS3xx bond interface, not mode=802.3ad. It is somewhat confusing that “trunk” can mean either “a connection carrying multiple tagged VLANs” (typically Cisco-speak), or “a static link-aggregation group” (typically HPE-speak) - the CRS1xx trunk is a static link-aggregation group, and in your case will also be carrying multiple tagged VLANs.

You haven’t indicated how you intend to access the switches for management, it can either be with a separate management VLAN as in the examples, or if one of your networks is already used for management functions you can use that.

3

So on my switchb do I have to setup the trunk and the bond or just the trunk ?

Do I still create the bridge on switchB , If yes ==> I can't add the trunk as it is not shown, if no , what shall I do :slight_smile: ?

on my switch b it would look now like jan/02/1970 03:50:36 by RouterOS 6.47.3

software id = DU55-1G3X

model = CRS125-24G-1S-2HnD

serial number = 744206C4A505

/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik
/interface ethernet switch trunk
add member-ports=ether1,ether2,ether3,ether4 name=trunk1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface ethernet switch egress-vlan-tag
add tagged-ports=trunk1,ether24,switch1-cpu vlan-id=1010
/interface ethernet switch ingress-vlan-translation
add new-customer-vid=1010 ports=ether24
/interface ethernet switch vlan
add ports="trunk1,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ethe
r24,switch1-cpu" vlan-id=1010
/ip address
add address=192.168.199.6/24 interface=ether1 network=192.168.199.0
add address=192.168.1.99/24 interface=ether24 network=192.168.1.0
/ip firewall filter
add action=accept chain=forward log=yes protocol=icmp



and on switch a

\

sep/15/2020 15:47:46 by RouterOS 6.47.2

software id = FV7D-DRZZ

model = CRS326-24G-2S+

serial number = CDA80C0725D5

/interface bridge
add name=bridge1
/interface vlan
add interface=bridge1 name=vlan_1003 vlan-id=1003
add interface=bridge1 name=vlan_1010 vlan-id=1010
add interface=bridge1 name=vlan_1014 vlan-id=1014
/interface bonding
add mode=balance-xor name=bond0 slaves=ether21,ether22,ether23,ether24
transmit-hash-policy=layer-2-and-3
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=ether10
add bridge=bridge1 interface=ether11
add bridge=bridge1 interface=ether12
add bridge=bridge1 interface=ether13
add bridge=bridge1 interface=ether14
add bridge=bridge1 interface=ether15
add bridge=bridge1 interface=ether16
add bridge=bridge1 interface=ether17
add bridge=bridge1 interface=ether18
add bridge=bridge1 interface=ether19
add bridge=bridge1 interface=bond0
add bridge=bridge1 interface=vlan_1010 pvid=1010
add bridge=bridge1 interface=vlan_1003 pvid=1003
add bridge=bridge1 interface=vlan_1014 pvid=1014
/ip address
add address=192.168.198.1/24 interface=ether1 network=192.168.198.0
add address=192.168.198.2/24 interface=ether1 network=192.168.198.0
add address=192.168.198.3/24 interface=ether1 network=192.168.198.0
add address=192.168.199.1/24 interface=bridge1 network=192.168.199.0
add address=192.168.200.2/24 interface=bridge1 network=192.168.200.0
add address=192.168.168.1/24 interface=vlan_1003 network=192.168.168.0
add address=192.168.1.1/24 interface=vlan_1010 network=192.168.1.0
add address=192.168.198.4/24 interface=ether1 network=192.168.198.0
add address=192.168.198.5/24 interface=ether1 network=192.168.198.0
add address=192.168.198.6/24 interface=ether1 network=192.168.198.0
add address=192.168.198.7/24 interface=ether1 network=192.168.198.0
add address=192.168.198.9/24 interface=ether1 network=192.168.198.0
add address=192.168.198.20/24 interface=ether1 network=192.168.198.0
/ip firewall filter
add action=fasttrack-connection chain=forward comment=
"defconf: fasttrack established,related" connection-state=
established,related
add action=accept chain=forward comment="defconf: accept established,related"
connection-state=established,related
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes
protocol=icmp
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=drop chain=input comment=vlan1003 connection-state="" disabled=yes
dst-address-list=Drop_for_guest log=yes src-address=192.168.168.0/24
add action=drop chain=forward comment=vlan1003 connection-state="" disabled=
yes dst-address-list=Drop_for_guest log=yes src-address=192.168.168.0/24
add action=accept chain=forward disabled=yes dst-address=192.168.179.0/24
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=accept chain=forward comment=
"Allow new connections through router" connection-state=new
add action=reject chain=forward disabled=yes reject-with=
icmp-admin-prohibited
/ip firewall nat
add action=same chain=srcnat same-not-by-dst=no src-address=192.168.199.23
to-addresses=192.168.198.3
add action=same chain=srcnat comment=Louis same-not-by-dst=no src-address=
192.168.199.50-192.168.199.59 to-addresses=192.168.198.5
add action=same chain=srcnat comment=Mel same-not-by-dst=no src-address=
192.168.199.60-192.168.199.69 to-addresses=192.168.198.6
add action=same chain=srcnat comment=Yanic same-not-by-dst=no src-address=
192.168.199.70-192.168.199.79 to-addresses=192.168.198.7
add action=same chain=srcnat comment="Fire_tv;radio" same-not-by-dst=no
src-address=192.168.199.90-192.168.199.99 to-addresses=192.168.198.9
add action=same chain=srcnat comment=Infrastructure same-not-by-dst=no
src-address=192.168.199.200-192.168.199.210 to-addresses=192.168.198.20
add action=same chain=srcnat same-not-by-dst=no src-address=192.168.168.0/24
to-addresses=192.168.198.2
add action=same chain=srcnat log=yes same-not-by-dst=no src-address=
192.168.199.0/24 to-addresses=192.168.198.1
add action=accept chain=srcnat disabled=yes
add action=accept chain=srcnat
/ip route
add distance=1 gateway=192.168.198.254
/system clock
set time-zone-name=Europe/Berlin
/system ntp client
set enabled=yes primary-ntp=192.168.200.1 secondary-ntp=192.168.198.254
/system routerboard settings
set boot-os=router-os
/system swos
set allow-from-ports="p1,p2,p3,p4,p5,p6,p7,p8,p9,p10,p11,p12,p13,p14,p15,p16,p
17,p18,p19,p20,p21,p22,p23,p24,p25,p26" identity=MikroTik3
static-ip-address=192.168.199.6

but it does not work :slight_smile:

I can't reach anything on vlan1010 on switchb or any other ip

4

You don’t appear to have followed the examples…

Switch B:
Yes, you do need to create a bridge with all of the ports as members. The CRS1xx/2xx link aggregation trunk applies to ports which are already members of the bridge, unlike CRS3xx and non-CRS devices where the ports added to a bond interface must not be members of the bridge.
IP addresses should be applied to VLAN interfaces or the bridge, not ports which are bridge members.

Switch A:
The bridge is not configured to be VLAN-aware. It will pass VLAN tagged traffic in the same way as an unmanged hardware switch does, the pvid= settings under /interface bridge port, and all of /interface bridge vlan settings are ignored.
Do not add VLAN interfaces as members under /interface bridge port.
There are no /interface bridge vlan definitions.
IP addresses should be applied to VLAN interfaces or the bridge, not ports which are bridge members, and why multiple IP addresses on some interfaces?

5

SwitchA
you mean not VLANs aware as I haven't set the bridge stp to mstp ,
that's because as soon as I enable the bridge filtering nothing works so I have disabled the bridge filtering again, and therefore I had to change it to stp again

i have now added the vlan

[admin@MikroTik] > /interface bridge vlan print detail
Flags: X - disabled, D - dynamic
0 bridge=bridge1 vlan-ids=1010 tagged=vlan_1010,bridge1,bond0 untagged="" current-tagged="" current-untagged=""


SWITCHB

model = CRS125-24G-1S-2HnD

serial number = 744206C4A505

/interface bridge
add name=bridge1
/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik
/interface vlan
add interface=ether24 name=vlan1010 vlan-id=1010
/interface ethernet switch trunk
add member-ports=ether1,ether2,ether3,ether4 name=trunk1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=ether10
add bridge=bridge1 interface=ether11
add bridge=bridge1 interface=ether12
add bridge=bridge1 interface=ether13
add bridge=bridge1 interface=ether14
add bridge=bridge1 interface=ether15
add bridge=bridge1 interface=ether16
add bridge=bridge1 interface=ether17
add bridge=bridge1 interface=ether18
add bridge=bridge1 interface=ether19
add bridge=bridge1 interface=ether20
add bridge=bridge1 interface=ether21
add bridge=bridge1 interface=ether22
add bridge=bridge1 interface=ether23
add bridge=bridge1 interface=ether24
/interface ethernet switch egress-vlan-tag
add tagged-ports=trunk1,ether24,switch1-cpu vlan-id=1010
/interface ethernet switch ingress-vlan-translation
add new-customer-vid=1010 ports=ether24
/interface ethernet switch vlan
add ports=trunk1,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24,switch1-cpu vlan-id=
1010
/ip address
add address=192.168.199.6/24 interface=bridge1 network=192.168.199.0
add address=192.168.1.99/24 interface=ether24 network=192.168.1.0
/ip firewall filter
add action=accept chain=forward log=yes protocol=icmp

the ip appears on ether24, even though I had specified it to be on vlan_1010 interface