I have upgraded my network equipment and changed my old home wireless router and access point with two mikrotik HAP AC2. One acts as a main router, connecting to the internet, and the second HAP AC2 has been configured as a basic AP, in the same subnet. The connection between them is done with a gigabit ethernet link.
The internet connection is tagged with the provider assigned VLAN, which is already done.
Basic configuration is working great, wlan are configured with different ssids for 2.4GHz and 5GHz bands and wifi coverage is great, with even more performance than with the old routers.
Now I want to migrate my IOT and smart-tv&speakers to separate VLANs, something like other users do nowadays as our home networks keep growing.
I guess that I have to (almost) duplicate the bridges wlan and VLAN configuration on both HAP AC2s, then reconfigure the ethernet link between them with a “trunk”" port on each router(switch).
The topology and architecture that I have in mind is this:
Each VLAN would be in a different subnet, then I would go with firewall rules to let some devices connect to the IOT devices.
Is it right?
What would be the right order for configuring both HAPs without loosing total connectivity with the home control system, iot devices and smarttvs?
To reduce the number of devices to reconfigure I’d like keep the IOT devices (15+) in the existing subnetwork 192.168.0.0/24, creating new subnets and VLANs for the other devices.
Could you point me to some tutorial with a similar topology?
After a couple of days trying some configurations and reading tutorials like this http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
I can’t make the dhcp servers associated to the vlans assign any IP address. Any idea of what can I try? I created a bridge and the vlans associated with the wlans are into the bridge.
Each vlan has an IP address associated.
I have a similar setup with capACs, works fine. Will try to post something tomorrow that should help.
Just to be clear your hapacs have four available networks, or two available networks and the second 2.4 and second 5hz wifi networks are actual virtual??
In most of the the cases when DHCP server doesn’t work on vlans after initial configuration, the reason is somebody forgets to add bridge itself as a tagged member of all needed vlans, and as a result - all vlan-interfaces configured on that bridge are actually not connected anywhere.
Thanks for the reply. I double-checked (actually checked it five times -until I found the “Safe Mode” in WinBox) and I guess that the Bridge is a tagged member of all vlans.
I maintained the original config, with the bridge “BR_original”.
When I move some of the interfaces to the new bridge “BR1” I can ping the VLAN IP that I assigned (192.168.10.1, 192.168.20.1, …) from a client connected to the wlan1, but wireless clients get no address from the corresponding dhcp-server. Setting an static ip address and connecting to wlan2 is not routing anything.
Wish someone can help with this issue…
The second should not be a problem:
+1 local port to add to the bridge;
-1 wan port and everything related to connecting to the outside world;
-all dhcp servers;
+1 dhcp client on one of the vlan-interfaces (on this device it is actually ok if the bridge is a tagged member for only one vlan - to have access to the device itself).
Thank you !
It’s working (almost) like a charm.
Once I added the management PVID 99 to both trunk ports everything started to work.
I also found that when I disabled the first bridge that I created, the clients could’nt connect to the internet. Then I noticed that the new bridge didn’t have an assigned MAC address. Strange…
Finally, I have all the wireless devices being tagged on the corresponding VLAN and acquiring leases from the corresponding DHCP server (HOME-IOT-VLAN). That’s good.
And just now I’ve just finished migrating the wired devices to their separate VLAN.
Some of the devices needed a restart to get a new IP from the new pool, but that was all.
Would you kindly share you final working configuration? I have similar requirements for new devices and would appreciate you sharing you config so I can use it as the base to tailor for my requirements. Thanks in advance
I’m afraid I’m far from home right now, let me put it in my todo list.
Basically I followed the tutorials stated in the first posts http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
The only change that I did was renaming the interfaces and vlan names, configuring a trunk port and finally adding all vlans to the bridge.
Feel free to remind me in a few days if I’m unable to connect.
Thanks, I have actually gone through it but its not identical to my requirements. I am looking to use my RB4011 with a CAP AC where I need to isolate my NAS and CCTV/IP CAMs, my Home WIFI from the guest WIFI. NAS (ether port 5) in VLAN along with the IP CAMs (connectedt to CAP AC through one of the AP SSIDs) while guests and Home users are connected to different SSIDs on the same CAP. Your setup looks close to what I am looking for, appreciate if you can share the configs once you’re able to do so. Again, thanks.
