CRS vLAN - Scenario Based Solutions (1)

RouterOS General
1

CRS.jpg
As you can see, we have some clients connected to our switch ( CRS ) and we want to use vLAN to separate them.We want to have 3 vLANs.(vLAN11 and 22 and 33). and also we have a server which belongs to all vLANs. The port eth1 connected to the router and act as a master port for all of the other ports in our switch. note that we have just one logical switch.( that is we have just one master port for all other ports which is eth1 or on the other hand we have :

/interface ethernet
set ether2 master-port=ether1
set ether3 master-port=ether1
set ether4 master-port=ether1
.
.
.
set ether24 master-port=ether1

We want all of our clients have access to the server and Internet.


Questions:

1- Our solution must be vLAN-tag based not other vLAN cases like port based or traffic based or mac based or any other one. just vLAN tag based. So what is the solution to have these three vLANs?

2- Is there any specific settings for our client computer’s NIC vLAN tag? If yes , what is it for client “a” of vLAN 11 or client “b” of vLAN 22 or client “c” of vLAN 33.

3- Is there any specific settings for our router port connected to our switch ( in the view of vLANnig ) ?

2

I think you can do it by using port-level isolation on your CRS, you can then have private VLANs.
You need to create port group communities (in your case, you need totally 3 port group community) and uplink ports. (here you have 2 uplink ports, one for your router and one for your server)
Communication is allowed between group members and uplinks, in CRS we have different profiles for each port-level isolation.
port-level isolation profile 0 for uplink ports and profile 1 for isolated ports (here you don’t need isolated ports) and finally you can use profile 2 to 30 for your port group communities.

so it can be something like below:

define uplinks:

/interface ethernet switch port
set ether1 isolation-leakage-profile-override=0
set ether24 isolation-leakage-profile-override=0

define port group community:

/interface ethernet switch port
set ether2 isolation-leakage-profile-override=2
set ether3 isolation-leakage-profile-override=2
set ether4 isolation-leakage-profile-override=2

/interface ethernet switch port-isolation
add port-profile=2 ports=ether1,ether24,ether2,ether3,ether4 type=dst

You need for sure two additional port group communities and I leave it for you :slight_smile: