Hi NewStackLearner,
So ether2 and ether3 are trunks and 4 and 5 are access. Those are not entirely
configured correctly as anav pointed out. Have you managed to fix that yet?
If you want your trunks to be just trunks you should change it to this:
/interface bridge port
add bridge=bridge comment=Trunk-AP frame-types=\
admit-only-vlan-tagged ingress-filtering=yes interface=\
ether2
add bridge=bridge comment=Trunk-Switch frame-types=\
admit-only-vlan-tagged ingress-filtering=yes interface=\
ether3
add bridge=bridge comment=Access-VLAN30 frame-types=\
admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=ether4 pvid=30
add bridge=bridge comment=Access-VLAN13 frame-types=\
admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=ether5 pvid=13
#Note that I have removed the SFP port since its not in use in your diagram
# Also you don't have to
/interface bridge vlan
add bridge=bridge comment="NetAdmin VLAN" tagged=bridge,ether2,ether3 untagged=\
ether4 vlan-ids=30
add bridge=bridge comment="DevAdmin VLAN" tagged=bridge,ether2,ether3 untagged=\
ether5 vlan-ids=13
add bridge=bridge comment="IoT-Devices VLAN" tagged=bridge,ether2 vlan-ids=10
add bridge=bridge comment="Guest VLAN" tagged=bridge,ether2 vlan-ids=20
add bridge=bridge comment="Storage VLAN" tagged=bridge,ether3 vlan-ids=11
add bridge=bridge comment="AuthNBoot VLAN" tagged=bridge,ether3 vlan-ids=12
add bridge=bridge comment="PXE VLAN" tagged=bridge,ether3 vlan-ids=14
add bridge=bridge comment="MySpace VLAN" tagged=bridge,ether3 vlan-ids=101
add bridge=bridge comment="DevOps VLAN" tagged=bridge,ether3 vlan-ids=201
If you want your “trunks” to be hybrid ports (which means, if untagged traffic presents itself there use a default tag.) use this configuration.
This assumes that the trunks will use an vlan30 for the untagged traffic
/interface bridge port
add bridge=bridge comment=Trunk-AP frame-types=\
admit-all ingress-filtering=yes interface=\
ether2 pvid=30
add bridge=bridge comment=Trunk-Switch frame-types=\
admit-all ingress-filtering=yes interface=\
ether3 pvid=30
add bridge=bridge comment=Access-VLAN30 frame-types=\
admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=\
ether4 pvid=30
add bridge=bridge comment=Access-VLAN13 frame-types=\
admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=\
ether5 pvid=13
# Note that I have removed the SFP port since its not in use in your diagram
/interface bridge vlan
add bridge=bridge comment="NetAdmin VLAN" tagged=bridge untagged=\
ether4 vlan-ids=30
add bridge=bridge comment="DevAdmin VLAN" tagged=bridge untagged=\
ether5 vlan-ids=13
add bridge=bridge comment="IoT-Devices VLAN" tagged=bridge,ether2 vlan-ids=10
add bridge=bridge comment="Guest VLAN" tagged=bridge,ether2 vlan-ids=20
add bridge=bridge comment="Storage VLAN" tagged=bridge,ether3 vlan-ids=11
add bridge=bridge comment="AuthNBoot VLAN" tagged=bridge,ether3 vlan-ids=12
add bridge=bridge comment="PXE VLAN" tagged=bridge,ether3 vlan-ids=14
add bridge=bridge comment="MySpace VLAN" tagged=bridge,ether3 vlan-ids=101
add bridge=bridge comment="DevOps VLAN" tagged=bridge,ether3 vlan-ids=201
As anav said, if you run into anything consult this:
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Now the hex-s could run the DHCP server for all those vlans just fine, I suggest
to move the DHCP stuff to the hex-s later on.
But first, when the switch gives out an DHCP lease
it will include a gateway address that devices will use to send traffic to the
internet (and possibly other vlans). So for example on VLAN201 a device might
recieve a lease for 10.1.201.123/24 and a gateway of 10.1.201.1 (you have
configured a gateway address somewhere in the switch dhcp server settings).
Now when it has traffic to the internet (for example to 1.1.1.1) it will send
that traffic to 10.1.201.1. This gateway is the hex-s in your example, however
this ip address is not configured on the hex-s. You should fix that by adding
the address on the VLAN interface in the hex-s:
/ip address
add address=10.1.201.1/24 interface=VLAN201-DevOps network=10.1.201.0
And you should do that for the gateway addresses for all your other vlans as well.
Kind regards,
Jelle