I have configured my ports for VLAN 102 and recall them being functional at least for a while, but for some reason traffic is now passing on untagged LAN.
WLAN’s are still in said VLAN and function normally.
Below is the entire configuration export, minus some unused default settings.
You have ether1 as bridge member, but still have vlan, IP and dhcp-client assigned to this single interface. That doesn’t make sense, if you want ether1 as part of the bridge you should move any services assigned to it to the bridge itself.
I’ve skimmed through referenced links (“Access Point” and “Other devices without a built-in switch chip”), but somehow I’m either dumb or (possibly both) just having hard time picturing the final image of how a functional config should look in RouterOS.
Please let me know if I’m completely wrong, but to reach a working solution I would have to do something in the lines of:
Move IP from ether1 to bridge
Remove interface vlan
Set PVID in bridge ports (ether2,3,4)
(Re)create VLAN102 in the existing bridge and tag ether1, leaving rest untagged
That sounds like the right direction.
Depending on the way you want to access your mgmt IP, you should include the bridge itself (=its CPU interface) into your vlan setup. If you put the IP directly on the bridge, you probably want to add it as untagged with pvid set. Another option is to create a vlan interface with IP on top of the bridge and then add bridge (not the vlan interface!) as tagged vlan member.
By the way: The hAP ac² has a switch chip capable of vlan filtering, so you could also go the “Other devices with built-in switch chip” route for maximum performance. But it might be even more confusing as it requires settings in bridge and switch chip menu to work together.
Assuming I (finally) have better understanding how CPU bridge VLANs are supposed to be configured, I think I may have an idea how to make the switch chip work based on the “Other devices with built-in switch chip” section.
I tried to make the chip work initially, too, but I remember having problems (possibly to do with WLANs) and then ending up going with CPU bridges instead. This device is mainly serving as WLAN access point after all, the ports are more an afterthought for a couple less used devices.
Ok, so by taking the exact steps I described (plus I had to tag guest wlans on top of ether1 to make them work too) immediately made the config work as I intended.
I’d say yes, you do - you must make the switch1-cpu port also a member of vlan 1 and 102, otherwise setting mode=secure on ether1 prevents frames belonging to VLAN 1 from being forwarded from ether1 to the CPU port.
Alright, thanks for the heads up. I’ll do some testing later with the chip again, but for now I’m just content in the fact that bridge works as it should.
Marked topic solved, thanks all.
One is supposed to configure everything VLAN-related on bridge, so the right thing would be to omit the bolded parts of wireless config and move it to bridge port config (by adding frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes pvid=102 to the shown config lines).
Good point, I was not quite sure if I should do anything with the wireless interface settings.
Somehow changing VLAN-Mode would break the WLAN (device could connect but not to correct LAN), and I had to remake the interface.