Hi, I finally got the vlans to work from a cisco switch to a mikrotik router at wire speed following this fine write up by marcus:
Hi Marcus, thank you for your research on creating vlans from a cisco switch to the mikrotik router. It works flawlessly. This is the first complete instruction outline with all the details for setting up the network where the bridge is completely sidelined thus improving the speed to a wire speed on the switch ports. It worked right out of the box after config was done. Simply marvelous. Now I can start putting some rules, filtering and doing other stuff. Thank you for a wonderful write-up…
What is nice about this setup is, that it does not use the bridge interface at all for the vlans and since I have placed the vlans on a physical ether 5 (made into a trunk), it achieves wire speed. After doing this, I made vlan1 as the default vlan and native vlan as well on the 3560 that feeds into this mikrotik router. The physical ports that are on vlan 100, 200, and 300 (all tagged packets) work fine when I connect clients on them. Port 1 on the 3560 is left for management and is on default vlan 1. I have also made vlan 1 as the native vlan on the trunk interface connecting to the router. When I physically connect a client on port 1 of the cisco 3560 switch, it does not get an ip address from the mikrotik. Can you pls help. thanks
cisco 3560 config:
Current configuration : 3533 bytes
Praveens Cisco 3560 Switch - Unauthorized access is prohibited!
===========================================
[admin@mikrotik-2011-RM] > /export compact
/interface bridge
There is no DHCP server configured for vlan1 on ether5…
ether5 is not member of the bridge. So the untagged portion of ether5 goes nowhere.
Thank you *pe1chl and Chris. I somehow assumed that it would automagically forward it to the bridge
OK, I tried to fix the condition by creating a dhcp-server on the "ether5-trunk" interface to catch all the untagged traffic on ether5-trunk, which is a trunk from a cisco 3560 switch. It did not like that and would list the dhcp server in red. Also when I did "/ip address print", it did not print the newly created dhcp-server. So I thought that I had assigned the dhcp-server to physical interface that was carrying trunks to/from the cisco switch. So I created a vlan on the Mikrotik (vlan 1) to match the default/native vlan on the cisco switch. I then move the dhcp-server (dhcp-server-untag) to the newly created vlan 1 interface. The rb2011 still thinks there is an error in assignment and leaves the text in red. Also, when I move the PC to switchport 1 on the cisco switch, it does not get an IP. Other ports with vlans 100, 200, and 300 are just fine. I have attached the config from both the MT and the cisco switch. Kinda frustrating that I cannot see what the problem is. Please help.
Thanks
------------------------------------------------MT config
[admin@mikrotik-2011-RM] > /export compact
/interface bridge
======================================== cisco config follows
Building configuration...
Current configuration : 3523 bytes
prswitch#
Remove the vlan ID1 from ether5 - no need to add this (FYI, you’re now tagging that VLAN with id=1 instead of being untagged).
/ip address
add interface=ether5-trunk address=10.0.4.1/24 network=10.0.4.0
And it should work.
Thank you so much, Chris. That did it!!!
Thanks
Glad to hear it works and that I was able to help.
Just did not think the whole thing through. Appreciate your help. So, in this case would it work if I use the same dhcp server that I am using for the bridge and tie it to ether2-trunk so that any untagged dhcp discover requests are answered or should I create another dhcp server? reason I ask is, I would like to have the same IP handed out to all other clients that are outside of the tagged ones. Again, thank you for pointing to a glaring error. appreciated.