CRS326-24G-2S+

RouterOS General
1

I made this configuration on a CRS326-24G-2S+ with RouterOS 6.42 in order to obtain:
ether2 and sfp-sfpplus1 as trunk ports with untagged ip address by dhcp client, to reach and ping this switch from other trunk devices (switches, management pc);
ether1 access port with vlan 2012 for voip phones;
ether3 and ether4 access ports with vlan 2014 for video;
ether5 access port with vlan 2008 for control room;
ether6 to ether24 access ports with vlan 2000 for office computers;
ip addresses from dhcp over vlan 2012, 2008 and 2000 to reach and ping this switch from those access networks;

# jan/02/1970 07:48:47 by RouterOS 6.42
# software id = 7AF9-SIJP
#
# model = CRS326-24G-2S+
# serial number = 763E081A8E9E
/interface bridge
add fast-forward=no name=bridge protocol-mode=none vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment="telefoni vlan2012"
set [ find default-name=ether2 ] comment="trunk port"
set [ find default-name=ether3 ] comment="video1 vlan2014"
set [ find default-name=ether4 ] comment="video2 vlan2014"
set [ find default-name=ether5 ] comment="domotica1 vlan2008"
set [ find default-name=sfp-sfpplus1 ] comment="trunk port"
/interface vlan
add interface=bridge name=vlan-domotica vlan-id=2008
add interface=bridge name=vlan-telefoni vlan-id=2012
add interface=bridge name=vlan-uffici vlan-id=2000
add interface=bridge name=vlan-videosorv vlan-id=2014

/interface bridge port
add bridge=bridge interface=ether24 pvid=2000
add bridge=bridge interface=sfp-sfpplus1
add bridge=bridge interface=ether2
add bridge=bridge interface=ether23 pvid=2000
add bridge=bridge interface=ether22 pvid=2000
add bridge=bridge interface=ether21 pvid=2000
add bridge=bridge interface=ether20 pvid=2000
add bridge=bridge interface=ether19 pvid=2000
add bridge=bridge interface=ether18 pvid=2000
add bridge=bridge interface=ether17 pvid=2000
add bridge=bridge interface=ether16 pvid=2000
add bridge=bridge interface=ether15 pvid=2000
add bridge=bridge interface=ether14 pvid=2000
add bridge=bridge interface=ether13 pvid=2000
add bridge=bridge interface=ether12 pvid=2000
add bridge=bridge interface=ether11 pvid=2000
add bridge=bridge interface=ether10 pvid=2000
add bridge=bridge interface=ether9 pvid=2000
add bridge=bridge interface=ether8 pvid=2000
add bridge=bridge interface=ether7 pvid=2000
add bridge=bridge interface=ether6 pvid=2000
add bridge=bridge interface=ether5 pvid=2008
add bridge=bridge interface=ether4 pvid=2014
add bridge=bridge interface=ether3 pvid=2014
add bridge=bridge interface=ether1 pvid=2012
/interface bridge vlan
add bridge=bridge comment=uffici tagged=bridge,ether2,sfp-sfpplus1 untagged=\
    ether24,ether23,ether22,ether21,ether20 vlan-ids=2000
add bridge=bridge untagged=ether2,sfp-sfpplus1 vlan-ids=1
add bridge=bridge comment=videosorveglianza tagged=bridge,ether2,sfp-sfpplus1 \
    vlan-ids=2014
add bridge=bridge comment=telefoni tagged=bridge,ether2,sfp-sfpplus1 \
    vlan-ids=2012
add bridge=bridge comment=domotica tagged=bridge,ether2,sfp-sfpplus1 \
    vlan-ids=2008
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=bridge
add add-default-route=no dhcp-options=hostname,clientid disabled=no \
    interface=vlan-uffici use-peer-dns=no use-peer-ntp=no
add add-default-route=no dhcp-options=hostname,clientid disabled=no \
    interface=vlan-telefoni use-peer-dns=no use-peer-ntp=no
add add-default-route=no dhcp-options=hostname,clientid disabled=no \
    interface=vlan-domotica use-peer-dns=no use-peer-ntp=no

/system routerboard settings
set boot-os=router-os silent-boot=no

It works.
As you can see, in this entry:

/interface bridge vlan
add bridge=bridge comment=uffici tagged=bridge,ether2,sfp-sfpplus1 untagged=\
    ether24,ether23,ether22,ether21,ether20 vlan-ids=2000

I put only ether20-ether24 as untagged ports, as described here: https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Bridge_VLAN_Filtering
But also ether6-ether19 work as expected as access port on the vlan 2000.
And also ether1, 3, 4, 5 work as expected as access port on their respective vlan!
So, why the wiki examples ask to insert untagged ports in the /interface bridge vlan?
Are there any issue if I don’t insert them?

2

Please don’t post the same question in multiple topics.

It is not always needed to specify ports as untagged ports.
Ports are added dynamically as untagged ports for the VLAN that matches the PVID. For a simple trunk/access/hybrid port setup this behaviour can be untouched and let the bridge dynamically add ports as untagged. You can see that when you set the PVID on a port, a dynamic entry in the bridge VLAN table is added and all ports with this PVID value are added as “current-untagged” ports (note that the bridge itself also can have a PVID and the same behaviour applies to it as well).

You must specify untagged ports when you are using MAC/Protocol based VLANs, the untagged port will not be added dynamically.

We recommend adding the untagged ports for all cases in order to make the configuration more readable, otherwise it might be quite confusing and you might loose access to the CPU when reconfiguring the device.

3

Ok, thanks.
i’m sorry.
i posted here (new topic) the same question because here http://forum.mikrotik.com/t/bridge-vlan-vs-switch-vlan/118449/1 is marked as SOLVED in Fri Apr 13 2018 and I I thought that nobody would replay under a topic already solved.