Experts,
I have currently switched from Peplink to Mikrotik and trying to figure out the config for Mikrotik already configured for dual static WAN load balancer with single LAN network. This works just great.
However, I need to start creating vlan for voice and data. The switches I used are Cisco 3560 and Cisco SG200 & SG300. I would like to configure ETH ports as trunks and connect each Mikrotik ETH port as a trunk to a single switch.
On the switch I will configure eaith switchport for single VLAN device or trunkport for phone and computer or phone and other network device. Picture attached.
My understanding would be:
192.168.100.1/24 current LAN network and that would be untagged
VLANS: 180 192.168.180.1/24 voice
I am new to mikrotik and wonder how that configuration would look like, and if this is possible at all. Thank You
mixig
October 29, 2018, 5:18pm
2
Try with this:
/interface bridge
/interface vlan
/interface bridge vlan
/interface bridge port
/ip address
/interface bridge set bridge vlan-filtering=yes
P.S. by default PVID for bridge port is pvid=1, if I changed that to pvid=180 I cannot connect to the router any more.
Jotne
October 29, 2018, 6:03pm
3
Just to give some information about this setup.
Se some example here:http://forum.mikrotik.com/t/sofware-vlan-bridge-on-ruteros-explained/122534/1
xvo
October 29, 2018, 10:11pm
4
…and the config above is exactly a vlan-aware bridge. Aka “the new way”.
“The old way” would be а set of vlan-interfaces on top of each port, then bridged together by separate bridges - one for each vlan.
thank you all for info provided here, I will try over the weekend and let you know how it works thank you again
Jotne
October 30, 2018, 6:14am
6
I did not see the vlan-filtering=yes at the bottom.
My fault
is this should work?
/interface bridge
I cannot even type it in terminal, V6.35.4 any thoughts?
anav
November 10, 2018, 11:56pm
8
Okay for the setup provided, I see one possible error
Should be170 , 171,172,173
To answer your question BEFORE YOU START configuring the router put into SAFE MODE!!!
How to make that port to be workinglike trunk, in cisco it clear 4 - 5 lines of code and done here is tragedy
This my config:
/interface bridge
set [ find default-name=ether7 ] name=ether7-LAN
add address-pool=dhcp-pool disabled=no interface=LAN lease-time=24m name=
what only works is
interface GigabitEthernet3/0/4
from:
vlan 169,180
there is something wrong with tagged vlan 1 …
Jotne
November 11, 2018, 6:38am
11
nov/09/2018 18:07:53 by RouterOS 6.35.4
You are running a router that does have a big security risk.
Read this post:http://forum.mikrotik.com/t/urgent-security-reminder/124064/1
anav
November 11, 2018, 5:35pm
12
Concur, upgrade to the latest config and then we can talk apples to apples.
Also why did you take ether10 and name it ether7 that is very confusing???
Your bridge ports are screwed up.
Your sourcenat rule needs work and your are missing one of the WANS anyway.
Your IP firewall filter rules are missing many necessary rules.
I would have to look at your mangle and routing rules after all the above is sorted out.
I am sorry for the confusion in my earlier config. I update the OS and did config from scratch.
Here is my config:
# nov/11/2018 14:19:12 by RouterOS 6.43.4
# software id = Z0NI-ZVVR
#
# model = RouterBOARD 3011UiAS
# serial number = 71A00530D6DD
/interface bridge
add dhcp-snooping=yes fast-forward=no name=localnetwork
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN-Fiber
set [ find default-name=ether2 ] name=ether2-WAN-Cable
set [ find default-name=ether6 ] name=ether6-LAN
/interface vlan
add interface=localnetwork name=vlan_169_cams vlan-id=169
add interface=localnetwork name=vlan_170_dispatch vlan-id=170
add interface=localnetwork name=vlan_180_voice vlan-id=180
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=lan-dhcp ranges=192.168.168.50-192.168.168.220
add name=vlan-voice ranges=192.168.180.50-192.168.180.100
add name=vlan-cams ranges=192.168.169.2-192.168.169.10
add name=vlan-dispatch ranges=192.168.170.50-192.168.170.100
/ip dhcp-server
add address-pool=lan-dhcp disabled=no interface=localnetwork name=lan-dhcp
add address-pool=vlan-voice disabled=no interface=vlan_180_voice lease-time=\
24m name=vlan-voice
add address-pool=vlan-cams disabled=no interface=vlan_169_cams lease-time=24m \
name=vlan-cams
add address-pool=vlan-dispatch disabled=no interface=vlan_170_dispatch \
lease-time=24m name=vlan-dispatch-dhcp
/interface bridge port
add bridge=localnetwork interface=ether6-LAN
/interface bridge vlan
add bridge=localnetwork tagged=localnetwork untagged=\
vlan_169_cams,vlan_170_dispatch,vlan_180_voice vlan-ids=180,169,170
/ip address
add address=192.168.168.1/24 interface=localnetwork network=192.168.168.0
add address=50.238.23.x/29 interface=ether1-WAN-Fiber network=\
50.238.x.x
add address=96.70.x.x/29 interface=ether2-WAN-Cable network=96.70.x.x
add address=192.168.180.1/24 interface=vlan_180_voice network=192.168.180.0
add address=192.168.169.1/24 interface=vlan_169_cams network=192.168.169.0
add address=192.168.169.1/24 interface=vlan_170_dispatch network=\
192.168.169.0
/ip dhcp-server network
add address=192.168.168.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.168.1 \
netmask=24
add address=192.168.169.0/24 dns-server=8.8.8.8 gateway=192.168.169.1 \
netmask=24
add address=192.168.170.0/24 dns-server=8.8.8.8 gateway=192.168.170.1 \
netmask=24
add address=192.168.180.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.180.1
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall mangle
add action=mark-connection chain=prerouting connection-state=new \
in-interface=ether1-WAN-Fiber new-connection-mark=wan1 passthrough=yes
add action=mark-connection chain=prerouting connection-state=new \
in-interface=ether2-WAN-Cable new-connection-mark=wan2 passthrough=yes
add action=mark-routing chain=output connection-mark=wan1 new-routing-mark=\
wan1-out passthrough=yes
add action=mark-routing chain=output connection-mark=wan2 new-routing-mark=\
wan2-out passthrough=yes
add action=mark-connection chain=prerouting connection-state=new \
dst-address-type=!local in-interface=localnetwork new-connection-mark=\
wan1 passthrough=yes per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting connection-state=new \
dst-address-type=!local in-interface=localnetwork new-connection-mark=\
wan2 passthrough=yes per-connection-classifier=both-addresses:2/1
add action=mark-routing chain=prerouting connection-mark=wan1 in-interface=\
localnetwork new-routing-mark=wan1output passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan2 in-interface=\
localnetwork new-routing-mark=wan2output passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-WAN-Fiber
add action=masquerade chain=srcnat out-interface=ether2-WAN-Cable
/ip route
add check-gateway=ping distance=1 gateway=50.238.x.x routing-mark=\
wan1output
add check-gateway=ping distance=2 gateway=96.70.x.x routing-mark=\
wan2output
add check-gateway=ping distance=1 gateway=50.238.x.x
add check-gateway=ping distance=2 gateway=96.70.x.x
/system clock
set time-zone-name=America/Chicago
/system routerboard settings
set silent-boot=no
WAN1 = Fiber = 50.238.x.x
now it should be more visible what is what so I did not have a chance to test loadbalance yet,but at least my vlans with cisco catalyst work partially, of course vlan filtering OFF !!!
vlan 169,180
!
!
!
interface GigabitEthernet3/0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
!
interface GigabitEthernet3/0/2 THIS WORKSWHEN PLUGGED LAPTOP HAS 180 IP
switchport access vlan 180
switchport mode access
!
interface GigabitEthernet3/0/3 THIS DOES NOW WORK!!!!!!!!!!!!!!!!
switchport mode access
!
interface GigabitEthernet3/0/4 THIS WORKS WHEN PLUGGED LAPTOP HAVE 169 IP
switchport access vlan 169
switchport mode access
switchport voice vlan 180
srr-queue bandwidth share 10 10 60 20
queue-set 2
spanning-tree portfast
!
interface GigabitEthernet3/0/5 THIS WORKS WHEN PLUGGED LAPTOP HAVE 168 IP
switchport mode access
switchport voice vlan 180
srr-queue bandwidth share 10 10 60 20
queue-set 2
spanning-tree portfast
interface GigabitEthernet3/0/6 works ok when plugged laptop have 168 ip
OF COURSE next step would be to plug phone to
switchport access vlan 169
and I should get on the phone 180 ip and on the laptop 169 ip but i will check that later. Also next step would be to check that on SG200 cisco.
With load balance voip is not going work since it should be prioritize to use only with WAN - fiber - is there a way to achieve that?
once again thank you allforhelp here,
Jotne
November 12, 2018, 6:32am
14
As far as I do understand VLAN on the Mikrotik.
I do not see what interface VLAN 180,169, and 170 is connected to.
You may try some like this. Interface bridge vlan does connects to ports and bridge, not to the VLAN itself
/interface bridge vlan
add bridge=localnetwork tagged=localnetwork,ether6-LAN vlan-ids=169
add bridge=localnetwork tagged=localnetwork,ether6-LAN vlan-ids=170
add bridge=localnetwork tagged=localnetwork,ether6-LAN vlan-ids=180
Since all are equal, this may be shorten to some like this: (not testet so can not confirm this)
/interface bridge vlan
add bridge=localnetwork tagged=localnetwork,ether6-LAN vlan-ids=169,170,180
Now VLAN 1 should came untagged on port 6 and vlan 169.170 and 180 tagged on port 6
See my post at 9:15am here: http://forum.mikrotik.com/t/sofware-vlan-bridge-on-ruteros-explained/122534/1
Jotne
November 12, 2018, 7:33am
15
You have the same IP for voice and dispatch in your config.
Thank you for replying, my point was having tagged vlan 1, and untagged 169,170 & 180,
vlan 1 = 192.168.168.1/24 for management
I have in that way on Peplink and all worked fine. I connected Polycom phone to the cisco port and have phone on voice - 180 vlan and my laptop having vlan 170 so I think its ok
Jotne
November 13, 2018, 5:59am
17
You can only have one untagged VLAN pr port, so to help you, list what port you like to have what VLAN (both tagged and untagged)
should be fixed:
nov/13/2018 18:29:21 by RouterOS 6.43.4
software id = Z0NI-ZVVR
model = RouterBOARD 3011UiAS
serial number = 71A00530D6DD
/interface bridge
I will check this with cisco catalyst. theoretically all should be ok now, I dont know but I have feeling like that load balance does not work properly, most data goes thought Cable ISP which is a way slower, also ideally would be send all traffic http https + voip only thought Fiber isp
i just tested with cisco catalyst and looks like after disabling vlan filtering on bridge = localnetwork ports with above configuration works fine, when I enable vlan filtering nothing works
Jotne
November 14, 2018, 6:03am
20
This is the wrong part
/interface bridge vlan
add bridge=localnetwork tagged=vlan_169_cams,vlan_170_dispatch,vlan_180_voice \
untagged=localnetwork vlan-ids=169,170,180
You are connecting the Bridge/Vlan to the VLAN interface . It should be connected to the physical Interfaces .
You need to list what Vlan you like to get out of interface 6 and 7
Untagged vlan 1
Tagged 168,170, 180
If that is the case it should be
/interface bridge vlan
add bridge=localnetwork tagged=localnetwork, ether6-LAN, ether7-LAN vlan-ids=169,170,180
Bridge localnetwork need to be tagged as well.VLAN 169 and 170 . That does not work.
add address=192.168.169.1/24 interface=vlan_169_cams network=192.168.169.0
add address=192.168.169.1/24 interface=vlan_170_dispatch network=192.168.169.0
Change to
add address=192.168.169.1/24 interface=vlan_169_cams network=192.168.169.0
add address=192.168.170.1/24 interface=vlan_170_dispatch network=192.168.170.0
II also suggest that your Router is DNS for all network. And netmask is missing for your 180.0/24 network.
/ip dhcp-server network
add address=192.168.168.0/24 dns-server=192.168.168.1 gateway=192.168.168.1 netmask=24
add address=192.168.169.0/24 dns-server=192.168.168.1 gateway=192.168.169.1 netmask=24
add address=192.168.170.0/24 dns-server=192.168.168.1 gateway=192.168.170.1 netmask=24
add address=192.168.180.0/24 dns-server=192.168.168.1 gateway=192.168.180.1 netmask=24
Updated Viso:
