Changed the IP assigned from sfp-sfpplus1 to bridge1 (bridge1 is my bridge). Still able to connect to the switch.
/interface/bridge/port print where interface~"sfp"
Flags: I - INACTIVE; H - HW-OFFLOAD
Columns: INTERFACE, BRIDGE, HW, PVID, PRIORITY, HORIZON
INTERFACE BRIDGE HW PVID PRIORITY HORIZON
0 IH sfp-sfpplus1 bridge1 yes 1 0x80 none
1 IH sfp-sfpplus2 bridge1 yes 1 0x80 none
2 IH sfp-sfpplus3 bridge1 yes 1 0x80 none
3 IH sfp-sfpplus4 bridge1 yes 1 0x80 none
4 IH sfp-sfpplus5 bridge1 yes 1 0x80 none
5 IH sfp-sfpplus6 bridge1 yes 1 0x80 none
6 IH sfp-sfpplus7 bridge1 yes 1 0x80 none
7 IH sfp-sfpplus8 bridge1 yes 1 0x80 none
8 IH sfp-sfpplus9 bridge1 yes 1 0x80 none
9 IH sfp-sfpplus10 bridge1 yes 1 0x80 none
10 IH sfp-sfpplus11 bridge1 yes 1 0x80 none
11 IH sfp-sfpplus12 bridge1 yes 1 0x80 none
12 IH sfp-sfpplus13 bridge1 yes 1 0x80 none
13 IH sfp-sfpplus14 bridge1 yes 1 0x80 none
14 IH sfp-sfpplus15 bridge1 yes 1 0x80 none
15 IH sfp-sfpplus16 bridge1 yes 1 0x80 none
16 IH sfp-sfpplus17 bridge1 yes 1 0x80 none
17 IH sfp-sfpplus18 bridge1 yes 1 0x80 none
18 IH sfp-sfpplus19 bridge1 yes 1 0x80 none
19 IH sfp-sfpplus20 bridge1 yes 1 0x80 none
20 IH sfp-sfpplus21 bridge1 yes 1 0x80 none
21 IH sfp-sfpplus22 bridge1 yes 1 0x80 none
22 H sfp-sfpplus23 bridge1 yes 1 0x80 none
23 IH sfp-sfpplus24 bridge1 yes 1 0x80 none
24 IH qsfpplus1-1 bridge1 yes 1 0x80 none
25 IH qsfpplus1-2 bridge1 yes 1 0x80 none
26 IH qsfpplus1-3 bridge1 yes 1 0x80 none
27 IH qsfpplus1-4 bridge1 yes 1 0x80 none
28 IH qsfpplus2-1 bridge1 yes 1 0x80 none
29 IH qsfpplus2-2 bridge1 yes 1 0x80 none
30 IH qsfpplus2-3 bridge1 yes 1 0x80 none
31 IH qsfpplus2-4 bridge1 yes 1 0x80 none
/ip/route/print detail show
Flags: D - dynamic; X - disabled, I - inactive, A - active; c - connect, s - static, r - rip, b - bgp, o - ospf, i - is-is, d - dhcp, v - vpn, m - modem, y - bgp-mpls-vpn; H - hw-offloaded; + - ecmp
*80000001 As
dst-address=0.0.0.0/0 routing-table=main gateway=10.0.200.1 immediate-gw=10.0.200.1%bridge1 distance=1 scope=30 target-scope=10 suppress-hw-offload=no
I have move the IP Address to sfp-sfpplus13 (As I have made sfp-sfpplus1 to untagged vlan 250)
/ip/route/print detail show
Flags: D - dynamic; X - disabled, I - inactive, A - active; c - connect, s - static, r - rip, b - bgp, o - ospf, i - is-is, d - dhcp, v - vpn, m - modem, y - bgp-mpls-vpn; H - hw-offloaded; + - ecmp
*80000001 As
dst-address=0.0.0.0/0 routing-table=main gateway=10.0.200.1 immediate-gw=10.0.200.1%bridge1 distance=1 scope=30 target-scope=10 suppress-hw-offload=no
So indeed the address can be attached to any member port of the bridge and the router still treats it as if it was attached to the bridge interface. But the correct way is nevertheless to attach it to the bridge interface, not to a member port - I remember there was some egde scenario where attaching it to a member port did cause an issue.
I have 6 VLANs and I am about to assign IP addresses to them now. After assigning the IP addresses to the VLAN interfaces, I will be enabling the “Bridge VLAN Filtering”.
My management VLAN is 1. IP address is assigned to the bridge.
Should I explicitly create VLAN1 and assign the IP address to the VLAN1 and not to the Bridge Interface? This is done in my other core switch.
I think Layer 2 features are already HW offloaded. Will require L3HW offload once I enable the Bridge VLAN filtering.
either keep the pvid of the virtual port bridge1 at 1 and do not put the virtual port bridge1 to the tagged list on the /interface/bridge/vlan row for bridge=bridge1 vlan-ids=1, and keep the IP address attached to the virtual router interface bridge1
or set the pvid of the virtual port bridge1 to something else than 1, do put the virtual port bridge1 to the tagged list on the /interface/bridge/vlan row for bridge=bridge1 vlan-ids=1, add an /interface/vlan with vlan-id=1 interface=bridge1 name=bridge1.1, and attach the IP address to this interface.
But the “or” variant will only start working once vlan-filtering will be set to yes on bridge1, so it is exactly a kind of operation you should do while you have some kind of backdoor access available and tested. Otherwise, you should proceed the following way (hh:mm:00 is some time about 10 minutes ahead, 10.0.x.y/z is the IP address and mask currently attached to bridge1):
activate the safe mode in the command line window (it must not be enabled anywhere else!) by pressing Ctrl-X, and issue the following command in that very command line window: /ip/address/set [find where address~“10.0.x.y/z”] interface=bridge1.1 ; /interface/bridge/set bridge1 vlan-filtering=yes
The tricky issue here is that as the bridge has to re-learn after the activaton of vlan-filtering, you may lose connection for long enough that the safe mode rollback would kick in. If that happens, you’ll have to try again without safe mode activated and hope that there is no mistake in the scheduled script if there is a mistake in the new configuration.
That’s one of the reasons why I wanted to divert the conversation away from the forum (apart from the, also off-topic, flame war regarding whether mac-winbox is a legitimate way to configure devices ).
).