Question about VLAN switching between CRS305 (v6) and hEX (v7)

Recently I get a hEX, I am trying to use it as switch as my current room switch (TP-LINK TL-ST5008Fv1) does not have ethernet port.
0259.png
When I am trying to set the hEX following the wiki, I find a strange problem

I have to set the Frame Type to admit-all, otherwise, the CRS305 will be disconnected and the logging show
hEX-2.png
17:44:31 bridge,stp sfp-sfpplus2 (Room) discarding
17:44:31 route,debug,event Interface change
17:44:31 route,debug,event interface=sfp-sfpplus2 (Room)
17:44:31 route,debug,event status=UP,RUNNING
17:44:31 route,debug,event mtu=9000
17:44:31 route,debug,calc Begin calculation
17:44:31 route,debug,calc End calculation
17:44:32 bridge,stp sfp-sfpplus2 (Room) learning
17:44:33 bridge,stp sfp-sfpplus2 (Room) discarding

The interface bridge,stp sfp-sfpplus2 (Room) is in [learning discarding] loop

In my understanding, I should set the Frame Type to admit-only-vlan-tagged
What is the problem?

/export file=anynameyouwish ( minus router serial number and any public WANIP information)

I deleted the unrelated comments, MAC addresses and IPs.
The TL-ST5008F have the same VLANs of sfp-sfpplus2 (Room) in the TRUNK Port.

CRS305 Script
CRS305.rsc (4.38 KB)
hEX Script
RB750Gr3.rsc (2.65 KB)

Is that a bug or misconfiguration?

99.99% of the time its you.
I can confirm its the config.

On the hex your vlans are a mess.
The /interface bridge ports and bridge vlans dont line up.
You need to decide what the format is based on what is attached to each port.
ex.

ETHER1 - smart device - trunk port ( all vlans coming in tagged )
ETHER2-dumb device - access port one vlan untagged
ETHER3- smart device but needs untagged port into it but can carry vlans as well - hybrid port one vlan untagged, other vlans tagged

Since your diagram also failed to indicate what devices were attached to which port, impossible to make heads or tails of the misconfiguration.
Pass on that and it can be fixed up.

Fixed what I could, the /interface bridge ports and vlans are missing as you need to provide better info, to clean up.

model = RB750Gr3
/interface bridge
add admin-mac= auto-mac=no comment=defconf frame-types=
name=bridge vlan-filtering=yes
{ REMOVED admit-only-vlan-tagged }
/interface list
add name=MANAGE
/interface list member
add interface=MGMT list=MANAGE
/ip neighbor discovery-settings
set discover-interface-list=MANAGE

MISSING /INTERFACE BRIDGE PORTS
MISSING /INTERFACE BRIDGE VLANS

/ip address
add address=192.168.10.23/28 comment=MGMT interface=MGMT network=
192.168.10.0
/ip dns
set allow-remote-requests=yes servers=192.168.10.1
/ip firewall filter { REMOVED NO RULES REQUIRED }
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.10.1
/system ntp client servers
add address=192.168.10.1
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=MANAGE

In retrospect I may need to adjust some of my settings, because I HAVE NO CLUE as to why you insist on bizarro networking setup…
It may be perfectly legit but getting cute with stuff doesnt help ignorant me.

CRS305
/ip address
add address=192.168.10.17/28 interface=LAN_MGMT network=192.168.10.16

/ip dhcp-server network
add address=192.168.10.16/29 dns-none=yes gateway=192.168.10.17 netmask=
29

Curious as to why such an MTU setting??
/interface vlan
add interface=bridge mtu**=9000** name=LAN_MGMT vlan-id=10

HEX
/ip address
add address=192.168.10**.23/28** comment=MGMT interface=MGMT network=
192.168.10**.16**

++++++++++++++++++++++++++++++++++++++++++++++++

Therefore my configs will change all such number so that I know that they work :slight_smile:

Thank you for the reply and explanation of the concept, anav. I am sorry for my late reply as I am busy these days.

First, thank you for your explanation of VLAN port, I understand the concept when I setup my CRS305, maybe I deleted too many useful information for identify the Port usage.

For the Bridge’s VLAN setting, I follow the Basic VLAN Switching Guide so I think I should set frame-types=admit-only-vlan-tagged in the bridge.

However, I am still new to RouterOS. I would like to know if it is important to add interface list for the Manage VLAN.

For the neighbor discovery-settings, since I want to hide the device, so I disable it. Is it normal to expose the device in the network?

Besides, I would like to know more about the DNS function in a Switch. My target is to use the hEX as a VLAN switch, is it necessary to set DNS on a Intranet only Switch?

I also see you add some setting which I never touch. May I know the function of mac-server?

Finally, I follow your solution but no luck. After some digging, I find that I misconfig the TPLINK switch, the Trunk Port on the TP’s switch include VLAN 1 by default.
After I untag the VLAN 1 on the TP’s Switch Truck Port, both the frame-types=admit-only-vlan-tagged or frame-types=admit-all work on the Bridge (hEX) / Trunk Port (Port 1 on hEX).

Super glad you got it resolved.
The management interface list is to allow you to manage the trusted subnet and reach all MT devices via winbox.
So thats why its in neighbors discovery and why all smart devices get IPs on the trusted subnet etc…