Issues using VLAN SSIDs on Access Point on a MikroTik device acting as a managed switch

RouterOS Beginner Basics
1

Hello,

I managed to get VLANs working on my MikroTik device, which acts as a managed switch for my router. I verified each vlan port works by giving me the ip address I am expecting for each port by physically connecting my device to the MikroTik. Now I want to set up a wireless access point and configure the VLANs on there for my SSIDs.

When I attempt to connect to an SSID I set for my VLAN 10 or 20, I get a “No DHCP server was found” error on my devices connecting to it. My SSID set toward my PVID 1 works fine and I am able to connect and get the ip address I am expecting. So I am guessing it is just a configuration I missed when setting up my MikroTik

Here is my /export:

I only wanted one port to be a separate VLAN, but I don’t think that’s causing any issues

    /interface bridge
    add admin-mac=xxxxxxxxx auto-mac=no comment=defconf name=bridge vlan-filtering=yes
    /interface vlan
    add interface=bridge name=GUEST vlan-id=10
    add interface=bridge name=UNTRUSTED vlan-id=20
    /ip pool
    add name=dhcp_pool0 ranges=192.168.20.2-192.168.20.200
    add name=dhcp_pool1 ranges=192.168.10.2-192.168.10.200
    add name=dhcp_pool2 ranges=192.168.10.100-192.168.10.200
    add name=dhcp_pool3 ranges=192.168.20.100-192.168.20.200
    /port
    set 0 name=serial0
    /interface bridge port
    add bridge=bridge comment=defconf interface=ether1
    add bridge=bridge comment=defconf interface=ether2
    add bridge=bridge comment=defconf interface=ether3
    add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether4 \
        pvid=20
    add bridge=bridge comment=defconf interface=ether5
    /interface bridge vlan
    add bridge=bridge comment=UNTRUSTED tagged=ether1,bridge untagged=ether4 vlan-ids=20
    add bridge=bridge comment=GUEST tagged=ether1,bridge vlan-ids=10
    /ip address
    add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
    /ip dhcp-client
    add interface=bridge
    add interface=UNTRUSTED
    add comment=GUEST interface=GUEST
    /ip dhcp-server
    add address-pool=dhcp_pool2 interface=GUEST name=dhcp1
    add address-pool=dhcp_pool3 interface=UNTRUSTED name=dhcp2
    /ip dhcp-server network
    add address=192.168.10.0/24 gateway=192.168.10.1
    add address=192.168.20.0/24 gateway=192.168.20.1
    /system clock
    set time-zone-name=America/Chicago
    /system note
    set show-at-login=no

I am able to get ip addresses with the DHCP client on my VLAN interface in MikroTik for my LAN and VLANs

I am not too familiar with networks but there has to be a way to pass in the DHCP from OPNsense that’s working on MikroTik down to the Access Point somehow, right? It doesn’t seem to be an access point setting.

I tried to set up a DHCP relay to pass it through but I am unsure of the configuration I need for it:

/ip dhcp-relay
add dhcp-server=192.168.10.1 disabled=no interface=GUEST name=guest
add dhcp-server=192.168.20.1 disabled=no interface=UNTRUSTED name=untrusted

2

If your OPNsense router is providing VLANs and DHCP services the only configuration on the Mikrotik should be bridge ports & VLANs plus management address.

Is the AP you are setting up another device, or on this Mikrotik in which case there appears to be no configuration for it.

3

As noted, if its a switch why are you configuring it like a router ( no pools required )
The only vlan that needs to be defined is the management or trusted vlan where the mT gets its IP address from.
Find the appropriate example here → http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

4

AP is a separate device. An ASUS AX86U Pro that supports VLANs on their stock firmware on AP mode (according to docs). I added several VLAN ID profiles and SSID for each profile to match what I have configured on OPNSense and the switch.

Reason I have those pools is cause I was trying out the different DHCP settings but no good there. I tried to follow the guide but I wasn’t able to get different IP addresses on the different ports corresponding to each VLAN unless I had those DHCP clients set up.

Here’s my configuration with bare minimum of what works as I am expecting it… I tried to get rid of DHCP client but I am not able to get different IP addresses on the different ports corresponding to the VLAN, I just get the same IP address from my LAN:

/interface bridge
add admin-mac=F4:1E:57:4B:52:66 auto-mac=no comment=defconf name=bridge vlan-filtering=yes
/interface vlan
add interface=bridge name=GUEST vlan-id=10
add interface=bridge name=UNTRUSTED vlan-id=20
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether4 \
    pvid=20
add bridge=bridge comment=defconf interface=ether5
/interface bridge vlan
add bridge=bridge comment=UNTRUSTED tagged=ether1,bridge untagged=ether4 vlan-ids=20
add bridge=bridge comment=GUEST tagged=ether1,bridge vlan-ids=10
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
/ip dhcp-client
add interface=bridge
add interface=UNTRUSTED
add comment=GUEST interface=GUEST
/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1
add address=192.168.20.0/24 gateway=192.168.20.1
/system clock
set time-zone-name=America/Chicago
/system note
set show-at-login=no
5

okay, nevermind. I was able to get rid of the DHCP clients and get the IP addresses from the different ports as expected after I set the ip route to my router/opnsense. But on the MikroTik itself, I am not able to ping 8.8.8.8 anymore, is that expected for this configuration?

But my AP cannot give wifi on those VLANs still

6

Which VLAN are you using for management of the Mikrotik (untagged on the bridge, VLAN 10 or VLAN 20), static or DHCP-assigned address, and which port is the AP plugged into?

7

Managing the MikroTik on the untagged on the bridge and have the access point connected to ether2, which is untagged. I’m unsure of your last question but I am forwarding DHCP from OPNsense but the VLAN have a static range they are assigned to, which is how I am verifying the ports and wifi work by checking if my computer gets the IP corresponding to the right VLAN/SSID

8

Due to the lack of network diagram and overall clarity.

Is the mikrotik device simply between the main router and the AP. ( a switch only, no WIFI)
So the mikrotik gets a trunk port on the router with lets say 3 vlans, managment, homewifi guest wifi etc…

Or is it doing wifi as well.

THere should be no bridge address on the MT device if acting as a switch or ap/switch.
Did you not read the provided reference??

9

MikroTik is just acting as a switch between router and the AP. No wifi on the MikroTik itself.

I tried to follow the configuration in the reference post and it just turns off internet access on all the ports so that’s why my configuration is the way it is now. Just that the access point is only able to broadcast the SSID for the LAN network and not able to provide Internet on the SSIDs associated with the VLANs

I am able to access Internet physically under the VLAN I set to ether4 and on the other ports for the LAN. I verified i get the IP address that’s associated with them.

10

It needs the VLANs for the SSIDs on the AP added as tagged.

I’m unsure of your last question but I am forwarding DHCP from OPNsense but the VLAN have a static range they are assigned to

It was regarding the management address for the Mikrotik, assuming that is provided untagged by DHCP from the router the bridge port & VLAN and management configuration would be:

/interface bridge
add admin-mac=F4:1E:57:4B:52:66 auto-mac=no comment=defconf name=bridge vlan-filtering=yes
/interface vlan
add interface=bridge name=GUEST vlan-id=10
add interface=bridge name=UNTRUSTED vlan-id=20
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=20
add bridge=bridge comment=defconf interface=ether5
/interface bridge vlan
add bridge=bridge comment=UNTRUSTED tagged=ether1,bridge,ether2 untagged=ether4 vlan-ids=20 # the untagged= entry is unnecessary as dynamically added from PVID settings
add bridge=bridge comment=GUEST tagged=ether1,bridge,ether2 vlan-ids=10
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
/ip dhcp-client
add interface=bridge
add interface=UNTRUSTED
add comment=GUEST interface=GUEST
/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1
add address=192.168.20.0/24 gateway=192.168.20.1

11

Regardless you can post all day, but unless you actually read the reference provided and ATTEMPT to put into practice not much more I can say.

12

I appreciate the configuration you sent. I still ran into the same issues as before. I thought it was an issue with my Access Point so I bought a new one and I am still running into the same issues where I am only able to get IP address from the SSID associated with the Default network, not any of the other VLAN IDs

I verified that the ports on the MikroTik work as expected, I am able to get the IP address I am expecting on ether4 and on ether2/3/5.

Here is my /export again:

/interface bridge
add admin-mac=F4:1E:57:4B:52:66 auto-mac=no comment=defconf name=bridge vlan-filtering=yes
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=\
    ether4 pvid=20
add bridge=bridge comment=defconf interface=ether5
/interface bridge vlan
add bridge=bridge comment=UNTRUSTED tagged=ether1,ether2,bridge vlan-ids=20
add bridge=bridge comment=GUEST tagged=ether1,ether2,bridge vlan-ids=10
/ip dhcp-client
add interface=bridge
/ip route
add distance=1 gateway=192.168.2.1
/system clock
set time-zone-name=America/Chicago
/system note
set show-at-login=no

Here is my Access Point configuration here. I have several devices trying to connect to one of the SSIDs but they’re not able to reach my router/OPNSense

13

Someone on another forum suggested the issue could be related to mixing tagged and untagged traffic on the same interfaces. They said if such mixed traffic arrives at OPN then it could be the problem, freeBSD is not a happy camper with that traffic.

Curious on thoughts on this?

I feel like this doesn’t matter much since the switch works fine on the physical interfaces, but I tried to follow the configuration set in this post: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 but run into separate issues:

when I attempt to make ether1 into ‘admit-only-vlan-tagged’, I lose connection to the network completely, even on physical connection on the same VLAN ID

14

So a device plugged into ether3 or ether5 receives an address from the range your base untagged network uses, and plugged into ether4 from the range VLAN 20 uses. Does configuring a port with a PVID of 10 similarly provide an address from the range VLAN 10 uses?

Have you tried temporarily plugging the AP into the feed which normally feeds the Mikrotik switch to check if that works without the switch?

15

So I just plugged the AP into the feed that normally feeds MikroTik and all my SSIDs are working now. Seems the issue is on MikroTik switch specifically. Guessing it may have to do with that vlan untagged stuff then… Been stuck on this for a few days now

My MikroTik is a CRS304-4XG and it’s on RouterOS 7.16.2

16

Read the reference again and watch the video again…
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
https://www.youtube.com/watch?v=YLtGQAQ8iS0

Devices (switches APs) should only get IP addresses from the trusted vlan ( for their own IP )