I’ve been trying to set up a standard VLAN configuration for my RB5009UPr router with VLAN filtering, but I can’t seem to get it to work.
To help me better visualize how I want to configure things, I’ve drawn a little diagram of my local network.
My switch is configured as in the picture.
sg350x#sh vlan
Vlan Name Tagged Ports UnTagged Ports Created by
---- ----------------- ------------------ ------------------ ----------------
1 1 tw1/0/1,tw1/0/5-6, D
(...)
7 VLAN7 tw1/0/8 tw1/0/2 S
8 VLAN8 tw1/0/8 tw1/0/3-4,tw1/0/7 S
9 VLAN9 tw1/0/8 S
sg350x#sh ip int
IP Address I/F I/F Status Type Directed Prec Redirect Status
admin/oper Broadcast
------------------ --------- ---------- ------- --------- ---- -------- ------
192.168.7.254/24 vlan 7 UP/UP Static disable No enable Valid
192.168.8.254/24 vlan 8 UP/UP Static disable No enable Valid
192.168.9.254/24 vlan 9 UP/UP Static disable No enable Valid
sg350x#sh int switchport tw1/0/8 | inc Mode|Trunk
Administrative Mode: trunk
Access Mode VLAN: 1
Trunking Native Mode VLAN: 1
Trunking VLANs: 1,7-9
This way, by changing my PC’s IP, I can reach the switch’s VLANs from their respective ports.
As for the router, I tried to follow some of Mikrotik guides, including the videos:
This is the bridge configuration:
[RB5009] > interface/bridge/print
0 R ;;; defconf
name="bridge" mtu=auto actual-mtu=1500 l2mtu=1514 arp=enabled arp-timeout=auto
mac-address=78:9A:18:39:5D:BC protocol-mode=rstp fast-forward=yes igmp-snooping=no auto-mac=no
admin-mac=78:9A:18:39:5D:BC ageing-time=5m priority=0x8000 max-message-age=20s
forward-delay=15s transmit-hold-count=6 vlan-filtering=yes ether-type=0x8100 pvid=1
frame-types=admit-all ingress-filtering=yes dhcp-snooping=no port-cost-mode=long mvrp=no
[RB5009] > interface/bridge/port/print
# INTERFACE BRIDGE HW PVID PRIORITY HORIZON
;;; defconf
0 IH ether2 bridge yes 1 0x80 none
;;; defconf
1 IH ether3 bridge yes 1 0x80 none
;;; defconf
2 IH ether4 bridge yes 1 0x80 none
;;; defconf
3 IH ether5 bridge yes 1 0x80 none
;;; defconf
4 IH ether6 bridge yes 1 0x80 none
;;; defconf
5 H ether7 bridge yes 1 0x80 none
;;; defconf
6 IH ether8 bridge yes 9 0x80 none
;;; defconf
7 X sfp-sfpplus1 bridge 1 0x80 none
8 H ether1 bridge yes 1 0x80 none
These are the bridge VLANs.
[RB5009] > interface/bridge/vlan/print detail
0 ;;; Bridge_VLAN7
bridge=bridge vlan-ids=7 tagged=ether1,bridge
untagged=ether2,ether3,ether4,ether5,ether6,ether7 mvrp-forbidden=""
current-tagged=bridge,ether1 current-untagged=ether7
1 ;;; Bridge_VLAN8
bridge=bridge vlan-ids=8 tagged=ether1,bridge untagged="" mvrp-forbidden=""
current-tagged=bridge,ether1 current-untagged=""
2 ;;; Bridge_VLAN9
bridge=bridge vlan-ids=9 tagged=ether1,bridge untagged=ether8 mvrp-forbidden=""
current-tagged=bridge,ether1 current-untagged=""
3 D bridge=bridge vlan-ids=1 tagged="" untagged=bridge,ether7 mvrp-forbidden="" current-tagged=""
current-untagged=bridge,ether7
And these are the IP VLANs.
[RB5009] > interface/vlan/print
# NAME MTU ARP VLAN-ID INTERFACE
;;; VLAN7 PC
0 R VLAN7_PC 1500 enabled 7 bridge
;;; VLAN8
1 R VLAN8 1500 enabled 8 bridge
;;; VLAN9
2 R VLAN9 1500 enabled 9 bridge
[RB5009] > ip/address/print
# ADDRESS NETWORK INTERFACE
;;; IP Address for VLAN7 PC
0 192.168.7.1/24 192.168.7.0 VLAN7_PC
;;; IP Address for VLAN8
1 192.168.8.1/24 192.168.8.0 VLAN8
;;; IP Address for VLAN9
2 192.168.9.1/24 192.168.9.0 VLAN9
;;; IP Address for default Bridge
3 192.168.88.1/24 192.168.88.0 bridge
After all this, I can only reach the router by connecting my PC directly to it, and only through MAC.
VLAN trunking does not work.
I guess I must be doing something wrong, but I just can’t see it.
Any suggestions?