A simple question:
If I set switch group port 1-3
port 4 routed
port 5 routed
traffic from any port 1-3 to port 4 or 5 will pass by cpu?
yes, traffic from ports 1-3 will pass through CPU to get to 4 or 5
Hi there! I got a little problem and hope somebody can help me:
I’ve 2x RB2011LS, firmware is 6.4. The both sfp-ports are set to trunk ports. I’ve got some vlans through both 2011LS. On each end i’ve some access ports. To this point, no problems are present.
Now I need at one end a new port (eth6 → switch2) which I also want put in a new vlan (access port). I set the config of the mikrotiks as follow:
on router #1:
[medcon1] interface ethernet print
Flags: X - disabled, R - running, S - slave
# NAME MTU MAC-ADDRESS ARP MASTER-PORT SWITCH
0 RS ether1 1500 XX:XX:XX:XX:XX:XX enabled ether2 switch1
1 R ether2 1500 XX:XX:XX:XX:XX:XX enabled none switch1
2 RS ether3 1500 XX:XX:XX:XX:XX:XX enabled ether2 switch1
3 RS ether4 1500 XX:XX:XX:XX:XX:XX enabled ether2 switch1
10 RS sfp1-medcon2 1500 XX:XX:XX:XX:XX:XX enabled ether2 switch1
[medcon1] interface ethernet switch port print
Flags: I - invalid
# NAME SWITCH VLAN-MODE VLAN-HEADER DEFAULT-VLAN-ID
0 sfp1-medcon2 switch1 secure add-if-missing auto
1 ether1 switch1 secure always-strip 800
2 ether2 switch1 secure add-if-missing auto
3 ether3 switch1 secure always-strip 500
4 ether4 switch1 secure always-strip 900
11 switch1_cpu switch1 secure leave-as-is auto
[medcon1] interface ethernet switch vlan print
Flags: X - disabled, I - invalid
# SWITCH VLAN-ID PORTS
0 switch1 800 ether1
sfp1-medcon2
5 switch1 500 ether3
sfp1-medcon2
6 switch1 900 ether4
sfp1-medcon2
[medcon1]
on router #2:
[medcon2] interface ethernet print
Flags: X - disabled, R - running, S - slave
# NAME MTU MAC-ADDRESS ARP MASTER-PORT SWITCH
0 RS ether1 1500 XX:XX:XX:XX:XX:XX enabled sfp1-medcon1 switch1
4 RS ether5 1500 XX:XX:XX:XX:XX:XX enabled sfp1-medcon1 switch1
5 RS ether6 1500 XX:XX:XX:XX:XX:XX enabled none switch2
6 S ether7 1500 XX:XX:XX:XX:XX:XX enabled ether6 switch2
10 RS sfp1-medcon1 1500 XX:XX:XX:XX:XX:XX enabled none switch1
[medcon2] interface ethernet switch port print
Flags: I - invalid
# NAME SWITCH VLAN-MODE VLAN-HEADER DEFAULT-VLAN-ID
0 sfp1-medcon1 switch1 secure add-if-missing auto
1 ether1 switch1 secure always-strip 800
5 ether5 switch1 secure always-strip 500
6 ether6 switch2 secure always-strip 900
11 switch1_cpu switch1 secure leave-as-is auto
[medcon2] interface ethernet switch vlan print
Flags: X - disabled, I - invalid
# SWITCH VLAN-ID PORTS
0 switch1 800 ether1-AirFiber
sfp1-medcon1
5 switch1 500 ether5-Lobacker-5GHz
sfp1-medcon1
6 switch1 900 sfp1-medcon1
7 switch2 900 ether6-interlink-schaalby
[medcon2] interface bridge port print
Flags: X - disabled, I - inactive, D - dynamic
# INTERFACE BRIDGE PRIORITY PATH-COST HORIZON
0 ether6 bridge-local-masterports 0x80 10 none
1 sfp1-medcon1 bridge-local-masterports 0x80 10 none
My problem is, that i can’t ping through vlan900 
Some ideas?
nobody?
I know this is a bit outdated now but being new to Mikrotik I have a doubt referring to the two chips and performance.
I am preparing a setup on the 2011UiAS with 2 WANS with faiolver and the rest of the ports available for the local network (bridged).
I am not sure how many of the 1G ports I would be requiring but up till I read this entry I had clear that I would move the WANs to eth6-7 as this are all VDSLs of up to 30Mb at the moment. By doing this I was hoping to liberate as many 1G ports as possible (5) for local network traffic.
Now I am in doubt that since the main use is routing internet traffic this could have a penalize in performance as I understand it would all mean “software” CPU traffic.
Considering 3x 1Gb ports might be enough in my case, would I be better off leaving WANs on eth1-2 so most traffic remains on the same “side” and through the best router chip?
Many thanks.
routing is routing period. you will use cpu any time that happens.
the only time the switch chip gets involved is when there is no routing, say where traffic is coming in from port 1 to port 3, with no routing involvement. otherwise the cpu is affected
thanks. That was my guess so in my scenario I understand that having 2 x WANs on either 100Mbps or 1Gb ports would have the same CPU use.
I now have to work out why traffic is not routing that way but that is going to be part of my learning curve with Mikrotik 
Quick question for the guru’s…
I know this is an old post, but it is relevant to my issue.
Would this be possible?
ether1-gateway
bridge-local > ether2-master, ether3-5slave
interfaces > ether6-master, ether7-10slave
Then take a physical cable between ether5 and ether6 bypassing the CPU for switching
Yes, but why would you want to? The 100Mbit bridge between the switches through the CPU doesn’t cost much performance.
I was testing throughput with the btest utility between a Windows host on ether2 and the RB2011 with all gigabit ether ports in a bridge group and I was only hitting 80-90Mbit/s at 95% CPU. I was thinking doing my half ass workaround would bypass the CPU for all switching.
I also tested between 2 computers last night with ether2 set as master and all ether3-5 as slave. It was bypassing the CPU as it was only hitting 4% but I was still only getting about 200-300Mbit/s.
Yeah, euhm. That should work a lot better. Either bridged or switched you should be able to get 1Gbit, so something else might be wrong.
Check flow control on the ports too.
Also, I don’t know this btest utility, but I advise to use iperf. You can find a guide here: http://blog.quindorian.org/2014/05/a-guide-to-iperf-network-metering.html
btest is the bandwidth test utility MikroTik has available for download.
Checked flow control, it is off for tx and rx.
I have another RB2011, maybe I’ll connect it via gigabit and run a bandwidth test between the 2 ruling out the Windows boxes.
I advise to put it on auto
Hi sir,
I have a problem with my network and I can see you have many experiences with mikrotik router. Here is my problem that I want to consult to you sir.
ISP 35Mbps
Main Router- Mikrotik RB951G-2hnd (4 companies connected)
HotSpot Wifi Router - Mikrotik RB1100Ah with 35 units Dlink access points connected.
Company 1,3 & 4 are connected directly to RB951G
Port 2 - Company 1 has 5mb allocated
Port 3 - Mikrotik RB1100Ah (HotSpot and Company 2 shares the 10mb)
Port 4 - Company 3 has 10mb allocated
Port 5 - Company 4 has 10mb allocated
My problem is that I’m experiencing slow connection. Could it be possibly because the Mikrotik RB951G-2hnd is not that capable of handling roughly 230 users actively at the same time.
Right now I bought the 10 ports mikrotik RB2011UiAS and planning to use this to replace my RB951G.
Can you give me advise me sir how should I configure this Mikrotik RB2011UiAs for better performance. What I want to do is directly connect all 4 companies to this router and also my HotSpot router. Kindly advise sir how should I configure this.
Bridging the 2 switches severely affects routing performance.
It does not matter if your WAN is only up to about 200/20.
@vortex your reply is quite confusing. He is not talking about bridging and in his setup he wouldn’t need to bridge either? I do agree that with a bridge or without the RB2011 shouldn’t be too bothered by it since the bridge will max out because of the 100Mbps internal switch uplink.
@toshes22 Euhm, I’m not sure how you picked the RB2011 but it has exactly the same CPU as the RB951G you are using right now? There will be virtually no difference between them CPU or throughput wise…
So if you are only using some queues on the ports to distribute the bandwith on the RB951G/RB2011 there is no reason why you would not get full speed. It should be able to handle it easily even with some queues set for bandwith restrictions per port. Have you checked if the router is indeed hitting 100% CPU usage during usage?
Where are you doing the queues for the wireless clients? Looking at your design these should be running on the RB1100Ah which has your wireless clients connected. The RB1100Ah is a much faster device and much better suited for that role and it would offload the RB951G/RB2011!
Please provide us with a bit more details, since your setup should be having no problems at all.
p.s. It would have been better to open a new topic for this, since your question has nothing to do with the actual topic you posted in?
Yes sir I just need to use more ports since the rb951g only has 5 ports. They bought this rb1100ah to serve mainly for wifi hotspot users only. We upgraded our bandwidth and distribute it centrally because before each of these companies have their own ISP. Right now we only have one ISP and the distribution of bandwidths are done using the rb951g. What I want to do now is to use this RB2011UiAS as the main switch to allocate bandwidths per ports in each company. How should I do it? I created bridge1 and joined port1 (wan), but when trying to join the port6 it does not allow (port6 is already added to Bridge Local) then I can’t access to the interface and have to reset it to factory default.
Thank you for the replies guys.
not sure i understand you correctly each link is for each company or all the wan side of the links are independent but all the lan part are mixed to be redistributed to all companies??
RB2011 only has 200Mbps max of internal bandwidth ( on switch chip + gig ports) otherwise the max is only about 80Mbps on bridged interfaces and anything routed aswell (going tru cpu)
if bandwidth its not mixed then i would just use a switch and put each companies in their own vlan with their providers.
Hi,
Is it possible to use switch based vlan’s between switch groups?
If I understand the theory right, it should work if I add “switch-cpu” in both groups as port to every vlan but I had no luck with that (sorry, can’t give real config exports because I already went back to software-vlans and bridges). Did I understand that right?
What I basically did:
-set one port of both switch to master port for every other ports in same switch
-add ports to vlan [switch1: ether1(trunk) & cpu to every vlan + necessary access ports, switch2: cpu to every vlan + necessary access ports]
-set vlan-mode to secure in every port in both groups
-set vlan-header to “add-if-missing” in ether1 and “always-strip” in every other ports (hmm.. I should actually use add-if-missing with both cpu-ports?)
-set default-vlan-id for access ports
Did I just typo somewhere, or did I understand the whole idea somehow incorrectly?
I will try later again, but if someone can give some guidance/hints it would be greatly appreciated, thank you!