Hello, I am trying to make DHCP server assign addresses to members of VLAN 166, but I am unable
to make it work. This is with OS 7.1beta3. My guess is I’m missing something obvious, so I would
appreciate if someone could have a look at my config below and tell me what I’ve done wrong…
This router has a trunk over bond1 to the switch that distributes VLANs around.
Anyway it is working as supposed, but not for dhcp… VLAN 166 is coming to the RB3011
from the trunk.
Maybe I need some advice here, as I never configured VLANs on RouterOS before.
So the scenario is, I have these VLANs reachable through the trunk bond1.
I need inter-vlan routing between them, and need VLAN 166 to get IP addresses assigned through DHCP.
Can you suggest the proper configuration for this?
Bridge MAC address is not exactly correct, you should use proper locally administeted MAC address. Probably not a show stopper, but one never knows.
You may want to add firewall filter rule allowing UDP port 68 traffic from in-interface=VLAN166 … probably not necessary, but the similar rule regarding in-interface=bridge surely doesn’t help in this particular case.
DHCP servers are disabled by default in RouterOS. As your export doesn’t show disabled=no on the /ip dhcp-server row, it is administratively disabled. Some other configuration items are enabled by default, in yet other ones the name of the parameter is enabled instead of disabled, so it is quite easy to get confused.
It was enabled, just not when I captured the config, so it’s not that unfortunately… anything else that may come to mind? I also checked the firewall and there are no packets dropped by any rule.
I’d use logging and sniffing to see what’s going on.
The bonding is implemented completely in software on the 3011, so try sniffing on all three Ethernet ports as well as the VLAN one: tool/sniffer/quick interface=ether5,ether9,ether10,VLAN166 port=67,68
Nothing in your configuration seems wrong to me. A similar configuration between two CHR running 7.1beta3 (bond in LACP mode runs over two EoIP links) works fine.
What kind of switch is connected at the other end of your LAG (= bond in 802.3ad mode)?
It means that the DHCPDISCOVER arrives tagless through the LAG, so concentrate at VLAN handling in the CSS610-xxx . I have no idea how the Amazon thing works, but e. g. most Windows network drivers strip the VLAN header from the received frames, so the networking works even if untagging is configured wrong on the switch in the egress direction. The ACL in the CSS610-xxx doesn’t seem to allow specific handling of DHCPDISCOVER packets, but who knows.
Can you post screenshots of LAG, VLAN, VLANs, and ACL tabs from the CSS610, and indicate to which port the Amazon thing is connected and which ports are connected to the 3011 (and double check that the Amazon box is really plugged to the port to which you intended to plug it)?
Actually, the DHCP server is meant to serve DHCP requests coming from the wifi clients.
Currently, I have a Mikrotik BaseBox2 which is used for IoT clients. It runs DHCP server for VLAN166.
I am trying to replace this DHCP server and use the RB3011 instead, hence this post.
The BaseBox2 is not directly connected to the CSS610, but rather to a CSS326 which in turn has a fiber connection to the CSS610.
The CSS610 then has the LACP trunk to the RB3011.
Trying to get some screenshots now.
So it seems the screenshots from the CSS610 alone are not sufficient, the network diagram all the way from the Amazon box to the 3011 is necessary, and those screenshots from both CSS. I won’t be surprised if you find the issue while gathering these data
Hm, so the last thing to come to my mind is the configuration of the Basebox. Both CSS have VLAN mode set to optional on all ports, which means that if something comes tagged with VID 1 from the Basebox, it will make it through the two CSS all the way to the 3011 will get untagged on the Interconnect link already at the CSS326.
As you say that everything else but the DHCP works fine, what happens if you sniff other traffic of the clients when their addresses are assigned by the Basebox? Does this “normal” (=non-DHCP) traffic arrive tagged to the 3011? Vice versa, if you connect a wired DHCP client to one of the access ports to VLAN 166 at the CSS326 and sniff on the 3011, does the DHCPDISCOVER come tagged or not?
Interesting theory, however, I have no VLANs defined in config on the basebox, and also I have forced VLAN 166 on the CSS326 on that port (see screenshots).
Everything works as expected on the VLAN side anyways. Everything but DHCP…
So it looks like VLAN ID 1 is actually used. How can I ensure there is no VLAN ID added on egress from the basebox? So that id 166 can be added by the CSS326?
