I currently have the network setup shown in the “current situation” attachment.
However, the CCR2004(-1G-12S+2XS) struggles really hard when transferring data between say, VLAN1001 (eg. my desktop) and VLAN1003 (eg. my NAS), reaching just 5Gbps at max (this is a router bottleneck, the NAS and PC itself are more than capable of it).
As such, I wanted to throw a CRS309 between the CCR2004, CRS317 and CRS326 (see “proposed situation” attachment).
This would also allow me to more easily update the CCR2004 (as it’s the main gatekeeper between my LAN and the wild west of the internet) without affecting the LAN as much.
The CCR2004 will only handle things related to my ISP (connecting to the ISP, handling traffic from and to ISP, firewall etc.)
The CRS309 will handle things related to my LAN (DHCP server, Inter-VLAN connections etc.)
But this leaves some questions:
Would this allow me to reach wirespeed between VLANs even with some firewall rules?
Currently, established and related get fasttracked on the CCR2004, there are no other fancy things just “accept+fasttrack/drop”.
I have read about Fasttrack HW Offloading which is what I intend to use, so that should be fine right?
How would portforwarding work?
CCR2004 will handle the stuff coming from the ISP (eg. someone trying to reach a website hosted here).
I think I could just have the CCR2004 do DST-NAT as usual (action=dst-nat to-addresses=192.168.3.X to-ports=25565), it will then send the packet to the CRS309 and the CRS309 will figure out from here?
Where would I setup queues (only affects uplink to ISP, internally everything can just go as fast as possible)? CCR2004 or CRS309?
I assume on the CRS309 as CCR2004 only sees 1 IP address (the CRS309) or am I wrong?
Would I need to add some extra static routes of sorts?
I assume if I set the default gateway for each of the VLANs to the CRS309 and a static route 0.0.0.0/0 to be reachable via 192.168.0.1/24 (the CCR2004), it’ll work?
Probably need to add static routes in the CCR2004 to forward things to the CRS309?
Would I need some other extra config (eg. a masquerade rule or something)?
I hope this explanation and the questions made enough sense.
Consider posting CCR2004 config after removing sensitive information (serial number, IP addresses, user credentials, etc).
/export terse file=ccr2004-FinlayDaG33k.rsc
CRS309 can do the job at Layer 2 alone, Layer 3 routing not required but that won’t have the LAN independence from CCR2004 downtime you want.
CRS309 supports Layer 3 Hardware Offloading which will provide the LAN independence from CCR2004 downtime you want.
I used to route on CRS309 but moved that job over to an RB5009. Do you run any LAN to LAN firewall rules on CCR2004?
Avoid firewall rules on CRS309 if possible; it can hardware offload some firewall rules but not in large numbers.
If needed a few LAN to LAN rules should be OK and leave WAN rules on CCR2004.
Disclose Spanning Tree Protocol requirements.
I really mean export the entire CCR2004 configuration (redact only security sensitive items).
Failing to fully disclose creates protracted dialogues leading to annoyance and destroying motivation to help.
Your choice do you make it easy for forum users or shall we just ignore you?
Export CRS317 and CRS326 configurations as well please.
Quote configurations as code blocks is typical.
File attachments only add extra steps.
Quote and attach both is optional.
# 2025-02-07 17:40:08 by RouterOS 7.14.2
# software id = REDACTED
#
# model = CRS317-1G-16S+
# serial number = REDACTED
/interface bridge
add admin-mac=2C:C8:1B:2F:B9:CB auto-mac=no ingress-filtering=no name=bridge \
port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] l2mtu=1592
set [ find default-name=sfp-sfpplus1 ] comment=CCR2004-1G-12S+2XS l2mtu=1592
set [ find default-name=sfp-sfpplus2 ] comment=CRS326-24G-2S+ l2mtu=1592
set [ find default-name=sfp-sfpplus3 ] comment=Richthoven l2mtu=1592
set [ find default-name=sfp-sfpplus4 ] comment=Isoroku l2mtu=1592
set [ find default-name=sfp-sfpplus5 ] comment=RB5009UG+S+IN l2mtu=1592
set [ find default-name=sfp-sfpplus6 ] l2mtu=1592
set [ find default-name=sfp-sfpplus7 ] l2mtu=1592
set [ find default-name=sfp-sfpplus8 ] l2mtu=1592
set [ find default-name=sfp-sfpplus9 ] l2mtu=1592
set [ find default-name=sfp-sfpplus10 ] l2mtu=1592
set [ find default-name=sfp-sfpplus11 ] l2mtu=1592
set [ find default-name=sfp-sfpplus12 ] l2mtu=1592
set [ find default-name=sfp-sfpplus13 ] l2mtu=1592
set [ find default-name=sfp-sfpplus14 ] l2mtu=1592
set [ find default-name=sfp-sfpplus15 ] l2mtu=1592
set [ find default-name=sfp-sfpplus16 ] l2mtu=1592
/interface vlan
add interface=bridge name=vlan1000 vlan-id=1000
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip smb users
set [ find default=yes ] disabled=yes
/port
set 0 name=serial0
/user group
add name=mktxp policy="read,api,!local,!telnet,!ssh,!ftp,!reboot,!write,!policy,\
!test,!winbox,!password,!web,!sniff,!sensitive,!romon,!rest-api"
add name=disallow
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus1 \
internal-path-cost=10 path-cost=10 trusted=yes
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus2 \
internal-path-cost=10 path-cost=10 trusted=yes
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus3 \
internal-path-cost=10 path-cost=10 pvid=10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus4 \
internal-path-cost=10 path-cost=10 pvid=30
add bridge=bridge comment=defconf interface=sfp-sfpplus5 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus6 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus7 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus8 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus9 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus10 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus11 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus12 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus13 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus14 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus15 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus16 internal-path-cost=10 \
path-cost=10
/ip firewall connection tracking
set enabled=no udp-timeout=10s
/interface bridge vlan
add bridge=bridge tagged=\
bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus4,sfp-sfpplus5 untagged=\
sfp-sfpplus3 vlan-ids=10
add bridge=bridge tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3 \
untagged=sfp-sfpplus4 vlan-ids=30
add bridge=bridge tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus5 \
vlan-ids=1002
add bridge=bridge tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus5 \
vlan-ids=1005
add bridge=bridge tagged=bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus5 \
vlan-ids=1255
add bridge=bridge tagged=\
bridge,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus4,sfp-sfpplus5 untagged=\
sfp-sfpplus3 vlan-ids=1001
add bridge=bridge tagged=sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus5,bridge \
vlan-ids=1000
/ip dhcp-client
add interface=vlan1000
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/flash/pub
/radius
add address=192.168.0.7 service=login
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Amsterdam
/system health settings
set fan-control-interval=5s fan-min-speed-percent=0% fan-target-temp=60C
/system identity
set name=CRS317-1G-16S+
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system routerboard settings
set boot-os=router-os
/system swos
set allow-from-ports=p1,p2 allow-from-vlan=99 identity=CRS317-1G-16S+ \
static-ip-address=192.168.0.2
/tool bandwidth-server
set authenticate=no enabled=no
/tool romon
set enabled=yes id=2C:C8:1B:2F:B9:CB
/tool sniffer
set filter-vlan=10
/user aaa
set default-group=disallow use-radius=yes
Hopefully this is good?
one minor side-note: It says VLAN10 and VLAN30 here while in my original question I used VLAN1001 and VLAN1003, this is because when I make the entire migration, I want to move VLAN10 to 1001 and VLAN30 to VLAN1003, hence the discrepancy.
Definite progress, thank you. By now you’ve seen this forum is doesn’t handle code blocks consistently.
Please edit last post to add a blank line or two above code block begin and below code block close.
All exports start with comment lines, first is device model (not sensitive) and third is serial number (redact).
Leaving first two comment lines improves recognition significantly as do the extra blank lines surrounding code blocks.
Edited the blocks.
They looked fine for me (for some reason, I had the old phpBB layout) but I’ve swapped to the “normal” layout to see if it worked (and will just stick to that, I don’t know why it swapped).
Also added the comment blocks you asked for, sans software ID and serial number.
OK, I see enough to draft a CRS309 configuration; that could be a further discussion starting point.
But it occurred to me CRS309 has L3HW Offload idiosyncrasies that must be kept front and center for best results.
We can work on improving current configurations prior to diving into the future.
Do you have a preference on where you prefer to go next?
Any particular reason you need to use bridge filtering vice normal filter rules ( forward and input chain ) ??? /interface bridge settings
set use-ip-firewall-for-vlan=yes ???
Recommend you set this to none, as its known to cause weird issues. /interface detect-internet
set internet-interface-list=WAN lan-interface-list=LAN wan-interface-list=WAN
The complexity of your config grows with each line, you have much queueing but then have a plethora of fast track rules.
Suggesting fastrack may not be compatible to use??? Somebody use to complex would be better qualified to comment.
Many firewall rules are bloatware and should be removed, would stick to defaults and then add traffic needed. It would seem your focus
is blocking traffic vice simply allowing only needed traffic.
Cannot help much more on the router side.
+++++++++++++++++++++++++++++++++++++++++++++++
As for the switches, the main error I see is that all vlan-ids are tagged with the bridge in /interface bridge vlan settings. ONLY the vlan-id=1000 should be tagged for the bridge.
I do not know what oddities I’d have to deal with with the CRS309?
I could opt for a CRS310 instead if that would be less of a headache?
Or maybe another one of those CRS317’s Altho that would be stretching the budget quite hard (I’d like to stay below 300 bucks).
Yes, I was in the progress of moving VLAN10 to VLAN1000 but got distracted by something and haven’t found the time to finish that bit of migration yet.
No particular reason, I very likely followed some guide or something while doing that.
It was my first time using VLANs (so I might have made a bunch of mistakes here and there) but since it was almost 2 years ago, I can’t exactly remember what I did.
Can I just disable that setting (“use-ip-firewall-for-vlan=no”)?
Fixed.
The queueing is just how fast clients (eg. my desktop or my parent’s their devices) can go when trying to do stuff on the WAN.
The FT rules are for the IPTV and landline/VoIP (which run on a separate VLANs to the ISP and don’t count towards my transfer speed), as well as some DNS-related stuff (which should just get through ASAP); Hence they are fasttracked to lower resource usage (at least, that’s the idea).
I think you mean the things like the lan-access chain and the detect-remote-intrusion chains?
A lot of the rules could be considered “bloatware”, although I have them in there mostly to make it easier for me to follow what is going on (I mostly use WinBox).
So unless they hurt performance really badly (or otherwise cause major issues), I’d prefer to keep them there.
So you mean that only outgoing ports (not those that face the client itself) need to be tagged?
So is say “sfp-sfpplus1” goes to my router and “sfp-sfpplus2” goes to my client, only “sfp-sfpplus1” needs to have the tag?
Vlan1000 is your management or trusted vlan as all smart devices get their IP address on that vlan, and all the other vlans have nothing to do with the bridge.
Coming in tagged on etherX and then going out either tagged or untagged on the rest of the switch ports.
Ahh, I see.
I’ll try to poke around with it this weekend to see if stuff breaks or not.
Already was kind of wondering about it in the past given how “unscalable” it felt, just never really played around with it.
Thank you for working with @anav which has saved us time by pointing out current configurations have room for improvement and will affect new intermediate switch at firewall level so I suggest let’s get current firewall(s) relatively clean before writing a new switch draft configuration.
I see a misunderstanding here; let’s get up to speed on MikroTik Product+Naming, in particular read sections:
CloudCoreRouter naming details
CloudRouterSwitch and CloudSmartSwitch naming details
CCR products are classic routers deriving their routing performance from robust CPU designs. - Outstanding routers, meh switches.
CSS products are classic switches deriving their switching performance from robust switch chip designs. - Outstanding switches, weak routers.
CRS products are hybrid designs with CSS level CPU and CSS level switch chip capabilities with Layer 3 Hardware Offloading features. - Outstanding switches but good routers only within model specific constraints.
IMO reviewing Switch Chip Features is worthwhile and in particular drill deep into:
Review carefully TCAM references in L3 Hardware Offloading then scroll down this page and match up switch chip model numbers in the following sections:
L3HW Feature Support - IMO the critical table on that page.
L3HW Device Support
CRS3xx: Switch DX3000 and DX2000 Series
CRS3xx, CRS5xx: Switch DX8000 and DX4000 Series
Switch chip TCAM memory varies substantially and is a limiting factor in maintaining L3HW Offload wire speed performance. TL;DR change from CRS309 to any CRSxxx product changes nothing qualitatively, only quantities at which pain points arise vary.
I have not drilled into currently posted configurations but will do so and follow up with additional posts as discoveries merit.
I have looked at the table but I couldn’t really make out from it was was important and what wasn’t (in-fact, if it wasn’t for you mentioning the TCAM memory, I wouldn’t have known it existed).
I don’t use IPv6, so that should “save” me a lot of resources.
Seems like the CRS310 I proposed doesn’t support FT offloading, so it seems that that won’t do then? Am I correct?
Consider instead if current LAN to LAN firewall rules can be substituted with Switch Rules (ACL) per section Stateless Hardware Firewall and if so then you have CCR2004 downtime affecting only WAN links and not LAN links assuming all required Switch Rules fit within device TCAM limits.
IMO the device constraining issues surrounding your request are now exposed in this topic. Skills demonstrated so far suggest capability to self service the request are within reach once device specific issues are understood. Let’s continue the design discussion and decide later if configuration drafting is still an attractive play.
Oh yes, they very likely can.
The firewall rules are just there because the CCR2004 doesn’t have that feature.
They would very likely fit within the limits (my network isn’t anything insane, just think small homelab)?
Ok so, viewing from the WAN side (incoming from ISP):
ISP
CCR2004
CRS317
CRS309* + CRS326
CRS310 only has 4 SFP+ ports, which isn’t enough, CRS309 would have enough ports for the foreseeable future while still giving me options to expand.
Would moving the CRS309 down 1 step be a big improvement?
From what I can tell, the biggest differences are just the amount of ports and the amount of RAM (and an RS232 port wh_iiiiii_ch I never really use)?
