Dokumentation for Options and Settings in the "Switch" menu (top level) in WinBox of a 915G 2HnD

RouterOS General
1

Hi,

I am trying to setup a VLAN switch using the switch chip of a 915G (router OS v6.27), but I do not find any documentation on what the options do. What I did find referred to CRS but those settings do not work/exist in my 915G. I know how to do it with bridges but i want to see how it is done using the switch (which is said to be faster). I do not need to route between my VLANs.

What I would like to do: I want ether1 to be VLAN trunk (VLAN 77,78,79) and ether2,3,4 should be mapped to VLAN 77,78,79. Later I want to set up two WLANs, which I want to assign to VLAN 77 and VLAN 78, therefore VLAN 77 and VLAN 78 must also be accessible beyound the switch layer. In Switch/VLAN I define VLANs for my ports:

  • 77=switch1 cpu, ether1,ether2
  • 78=switch1 cpu, ether1,ether3
  • 79=ether1,ether4

Is this correct so far?

Of course I have to activate VLAN Mode for ether1-ether4 in Switch/Port, and I think I have to set “VLAN Mode” to secure to obey my settings in Switch/VLAN.

But what option for “VLAN Header”? Is “add if missing” and “always strip” applied to incomming packets or outgoing? On ether2,3,4 I want “add if missing” for incomming and “always strip” for outgoing packets. On ether1 “leave as is”.

Furthermore I have no Idea what is set up in Switch/Host (and why I can define VLANs there as well) and in Switch/Rules.

I thank you very much for your help.

2

I finally found the information I need:

http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features

The setting for “VLAN Header” is applied on outgoing traffic and untagged incomming traffic is tagged with default VLAN ID.

I needed a while to understand, that the switch layer VLAN settings are independent of the interface VLAN settings. If you put all your ports in a switch group and let the switch layer tag all incomming traffic with a VLAN ID (for example ID99), use secure mode on all ports and on “switch1 cpu” but forget to add a VLAN interface for ID99 to the master port, you locked yourself out of your device. All traffic reaching the router is now tagged as ID99 but the router is ignoring that VLAN.

So long
John