I did VLANs on ethernet via the switch port config, not via the weird bridge vlan-filtering.
Because everything I saw said, that the switch in it can hardware offload but not via the bridge vlan filter.
But
why does the documentation for non bridge vlan say to put all ports into a bridge even when some ports should only have some VLANs?
Why is this so different from other network hardware vendors?
Usually a bridge is a thing that spreads an L2 over multiple physical links. So to me this says that bridge would be redundant to what the switch chip does. Including now bridging multiple VLANs into another which does not make any sense. From reading I saw that with Mikrotik that isn’t what a bridge does or at least the vlans are still disjoint in a bridge. But what for is the bridge then?
Now to the main topic:
I want to put all traffic in a wifi SSID into a specific VLAN.
I have no idea what the proper way of doing that is. Some things say to use the bridge vlan filtering and put uplink ethernet and wifi interfaces in a bridge. But this disables hardware offloading.
For what will it disable hardware offloading? For the entire switch? Just for the uplink port? Just for wifi<->ethernet crossing traffic?
In for example OpenWRT I would do it like that:
Set switch to appropriate VLAN config, like the ports + the CPU port. Bridge the virtual device corresponding to the target VLAN with my ap interface for that SSID.
What I want:
Wifi SSID that puts untagged L2 traffic into a tagged VLAN on uplink ethernet and back.
Everything ethernet should still have VLAN offloading.
The Accesspoint itself does not need any L3 interface on wifi nor in the VLAN that the wifi should map to. Management would only happen over uplink.
I.e.:
According to the official vlan guide page I need to do VLANs the /interface/ethernet way to be hardware accelerated on AR8327.
So now when I want to connect / bridge-in-NOT-mikrotik-terms the Wifi APs to VLANs that are trunked out from the switch to elsewhere, how do I attach them?
Do I add their virtual ports to the primary bridge-in-mikrotik-terms? Do I create a new bridge-in-mikrotik-terms? Does it matter in terms of “connection to the CPU port”? The Mikrotik lingo squashes this so much that it doesn’t seem to make sense.
The CPU Port pendants aren’t well explained in your link.
If I connect the APs via the bridge-in-mikrotik-terms, will I lose hardware acceleration for the ethernet parts?
In this case you create a plain (not VLAN-aware( bridge and attach all ports to it. Make sure that switchX-cpu is set as tagged member of all VLANs which device’s software stack will have to communicate with. And for that you create VLAN interfaces, anchored off bridge interface (just like you’d do with mikrotik-terms bridge and tagged bridge port).
But … you really don’t want to mix the bridge VLAN config with switch-chip VLAN config. It would probably work fine for most of time, but there are some interactions and there the whole setup may misbehave in some random ways … such setup is not valid and thus untested.
The link doesn’t aim to explain that in detail. But the gist is: bridge (the switch-like) entity is bridging a number of ports, which are from L2 persoective all treated the same. And bridge the cpu-facing port is one of them.
The only problem in MT’s implementation is that all the different bridge functions are not clearly separated configuration-wise and it’s hard to get grasp on it from get go.
The same concept in switch-chip setup is more clear with switchX-cpu port clearly marked as switch port and carries similar config as other ports.