CRS112 Switch Chip VLAN config - inconsistent behavior

Tommy544 · August 3, 2026, 10:43am

Hi,

I am trying to configure some basic VLAN separation on several CRS112 switches and I am running into a problem where the same (or a very similar) configuration behaves differently on different physical switches. I've been trying to understand and solve this issue for a few days now and I am out of ideas. The situation:

CRS112 Switch A: a switch fresh out of the box configured with 3 VLANs:

# RouterOS 7.21.5
# model = CRS112-8P-4S
/interface bridge
add admin-mac="some MAC" auto-mac=no comment=defconf name=bridgeLocal
/interface vlan
add interface=bridgeLocal name=MGMT vlan-id=130
add interface=bridgeLocal name=VLAN10temp vlan-id=10
/interface ethernet switch
set drop-if-invalid-or-src-port-not-member-of-vlan-on-ports=ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8,sfp9,sfp10,sfp11,sfp12
/port
set 0 name=serial0
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
add bridge=bridgeLocal comment=defconf interface=ether3
add bridge=bridgeLocal comment=defconf interface=ether4
add bridge=bridgeLocal comment=defconf interface=ether5
add bridge=bridgeLocal comment=defconf interface=ether6
add bridge=bridgeLocal comment=defconf interface=ether7
add bridge=bridgeLocal comment=defconf interface=ether8
add bridge=bridgeLocal comment=defconf interface=sfp9
add bridge=bridgeLocal comment=defconf interface=sfp10
add bridge=bridgeLocal comment=defconf interface=sfp11
add bridge=bridgeLocal comment=defconf interface=sfp12
/interface ethernet switch egress-vlan-tag
add tagged-ports=ether7,ether8 vlan-id=99
add tagged-ports=switch1-cpu,ether7,ether8 vlan-id=130
add tagged-ports=switch1-cpu,ether7,ether8 vlan-id=10
/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=99 ports=ether1,ether2
add customer-vid=0 new-customer-vid=130 ports=ether3,ether4,ether5,sfp9,sfp10,sfp11,sfp12
add customer-vid=0 new-customer-vid=10 ports=ether6
/interface ethernet switch vlan
add ports=ether1,ether2,ether7,ether8 vlan-id=99
add ports=switch1-cpu,ether3,ether4,ether5,ether7,ether8,sfp10,sfp9,sfp12,sfp11 vlan-id=130
add ports=switch1-cpu,ether6,ether7,ether8 vlan-id=10
/ip address
add address=192.168.130.254/24 interface=MGMT network=192.168.130.0
add address=10.11.10.222/24 disabled=yes interface=VLAN10temp network=10.11.10.0
/ip dhcp-client
add comment=defconf interface=bridgeLocal
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/snmp
set enabled=yes
/system note
set show-at-login=no
/system routerboard settings
set enter-setup-on=delete-key

CRS112 Switch B: configuration very similar to Switch A. Some differences like having only one trunk port instead of two, etc.:

# RouterOS 7.21.5
# model = CRS112-8P-4S
/interface bridge
add admin-mac="some other MAC" auto-mac=no comment=defconf name=bridge
/interface vlan
add interface=bridge name=MGMT vlan-id=130
add interface=bridge name=VLAN10tmp vlan-id=10
/interface ethernet switch
set drop-if-invalid-or-src-port-not-member-of-vlan-on-ports=ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8,sfp9,sfp10,sfp11,sfp12
/interface list
add comment="This is used to avoid the \"martian\" packet spam on the NUCs." name=WINBOX_DISCOVERY
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp9
add bridge=bridge comment=defconf interface=sfp10
add bridge=bridge comment=defconf interface=sfp11
add bridge=bridge comment=defconf interface=sfp12
/interface ethernet switch egress-vlan-tag
add tagged-ports=ether8 vlan-id=99
add tagged-ports=switch1-cpu,ether8 vlan-id=130
add tagged-ports=switch1-cpu,ether8 vlan-id=10
/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=99 ports=ether1,ether2
add customer-vid=0 new-customer-vid=130 ports=ether3,ether4,ether5,ether6,sfp9,sfp10,sfp11,sfp12
add customer-vid=0 new-customer-vid=10 ports=ether7
/interface ethernet switch port
set 6 custom-drop-counter-includes=ingress-vlan-filtered
/interface ethernet switch vlan
add ports=ether1,ether2,ether8 vlan-id=99
add ports=switch1-cpu,ether3,ether4,ether5,ether6,ether8,sfp10,sfp9,sfp12,sfp11 vlan-id=130
add ports=switch1-cpu,ether7,ether8 vlan-id=10
/interface list member
add interface=MGMT list=WINBOX_DISCOVERY
/ip address
add address=192.168.130.254/24 interface=MGMT network=192.168.130.0
add address=10.11.10.222/24 interface=VLAN10tmp network=10.11.10.0
/system identity
set name=MikroTik-CRS112-D7C0
/system routerboard settings
set enter-setup-on=delete-key

I then try to connect a "dumb" VLAN unaware Mikrotik CRS112 switch C to the port 6 on Switch A or port 7 on Switch B. When I connect it to Switch A, everything works fine. I can ping the management interface of Switch C and I can also communicate with all devices connected to Switch C. These devices will land in the VLAN 10, as expected. However, when I connect the Switch C to Switch B instead, I get no communication. I cannot ping the Switch C management interface, nor can I ping any devices connected to that switch. I can at least ping the VLAN10tmp interface configured on the Switch B from my VLAN10 device that is located behind the trunk, so at least a part of it works. The config of Switch C:


# RouterOS 7.21.5
#
# model = CRS112-8P-4S
/interface bridge
add admin-mac="some other other MAC" auto-mac=no comment=defconf name=bridge
/interface list
add name=WAN
add name=LAN
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp9
add bridge=bridge comment=defconf interface=sfp10
add bridge=bridge comment=defconf interface=sfp11
add bridge=bridge comment=defconf interface=sfp12
/interface list member
add interface=ether1 list=WAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=sfp9 list=LAN
add interface=sfp10 list=LAN
add interface=sfp11 list=LAN
add interface=sfp12 list=LAN
/ip address
add address=10.11.10.10/24 comment=defconf interface=ether2 network=10.11.10.0
/system identity
set name=MikroTik-CRS112-E731
/system routerboard settings
set enter-setup-on=delete-key

So the issue is that I simply cannot connect Switch C to Switch B's untagged port ether7 and I am failing to notice any difference in configuration relative to Switch A, where everything works as I would expect.

What am I missing here?

biki73 · August 3, 2026, 6:21pm

did you remember to disable stp?

Tommy544 · August 4, 2026, 12:52pm

Thanks, running: /interface bridge set bridge protocol-mode=nonefixes the issue. It of course also disables spanning tree protocol. Why is that necessary?

I also found out that I can get the misbehaving switch to work when I lower its bridge's priority by running: /interface bridge set bridge priority=0x4000.

LLMs suggest that the RSTP protocol doesn't work correctly with my VLAN configuration on the switch chip and the nondeterministic behavior results from the priority of the bridges being determined based on the admin MAC, if the bridge priority is left at default value on all participating switches.

For example, after adjusting the bridge priority on the Switch B, I can still see this value on the ethernet port connected to the dumb switch:

interface=ether7 bridge=bridge priority=0x80 edge=auto point-to-point=auto learn=auto horizon=none hw=yes auto-isolate=no restricted-role=no 
       restricted-tcn=no pvid=1 frame-types=admit-all ingress-filtering=yes unknown-unicast-flood=yes unknown-multicast-flood=yes broadcast-flood=yes 
       tag-stacking=no bpdu-guard=no trusted=no mvrp-registrar-state=normal mvrp-applicant-state=normal-participant multicast-router=temporary-query 
       fast-leave=no status=in-bridge port-id=0x80.7 role=designated-port edge-port=yes edge-port-discovery=yes point-to-point-port=yes 
       external-fdb-status=no sending-rstp=yes learning=yes forwarding=yes actual-path-cost=20000 designated-bridge-id=0x4000."admin MAC" 
       designated-cost=0 designated-port-id=0x80.7 tx-bpdu=1810 rx-bpdu=0 discard-transitions=0 forward-transitions=1 tx-tc=0 rx-tc=0 topology-changes=0 
       hw-offload-group=switch1 hw-offload=yes

The tx-bpdu=1810 rx-bpdu=0 seem to indicate a problem with reception of the BPDU packets.
Ether7 also shows up as "Edge" port in the bridge GUI. I would expect it to learn that it is not an Edge port.

What are the general recommendations in a situation that I find myself in? Should I just run without RSTP? Or is there any configuration that I am missing, which should allow HW offloaded VLAN filtering with a working RSTP protocol as well?