RB4011 > hAP AC Lite VLAN configuration

RouterOS General
4

So the Orange firewall does all the Routing and DHCP service and the RB4011 is just a VLAN bridge type entity (switch)?? Seems like a waste but oh well.

  1. Your Bridge port wlan-5G needs a PVID, as devices attached are not vlan smart. (add pvid=500)
  2. Remove reference to vlan in wireless settings!! “vlan-id=400”, this identification is carried out in bridge port settings and bridge vlan settings.
  3. Remove reference to vlan in wireless settings!! “vlan-id=500”, this identification is carried out in bridge port settings and bridge vlan settings (once you fix the above)

In general
trunk ports should get, ingress-filtering=yes, admit only tagged frames.
access port should get, ingress-filtering=yes, admin only priority and untagged frames.
hybrid port should get, ingress-filtering=yes
DO NOT USE VLAN 1 in the configuration, it is the default pvid vlan ID on the bridge itself and should remain there.

  1. The bridge vlan error,
    # port with pvid added to untagged group which might cause problems, consider adding a seperate VLAN entry
    TO
    /interface bridge vlan
    add bridge=RB-4011_Bridge tagged=RB-4011_Bridge,Eth1_Firewall,Eth3_House untagged=WLAN-5G vlan-ids=500
    add bridge=RB-4011_Bridge tagged=RB-4011_Bridge,Eth1_Firewall,Eth3_House untagged=WLAN-2G vlan-ids=400
    add bridge=RB-4011_Bridge tagged=RB-4011_Bridge,Eth1_Firewall,Eth3 untagged=Eth2_cabin vlan-ids=200
    add bridge=RB-4011_Bridge tagged=RB-4011_Bridge,Eth1_Firewall,Eth3_House vlan-ids=
    50,300,600

Note: Its not clear to me why vlan 50 is being sent to the RB4011 and it does not seem to be sent to the house in your diagram??
Note: Technically its not required to add the untagged entries above like I have done because the router will automatically create them dynamically based on the bridge port rules, but I like to add them because I can visually map everything together.

AS FOR THE HAPACLite
SAME COMMENTS APPLY ref vlan ID in the wireless config - remove!
Fix up the other stuff which you didnt make visibile according to the above.

Your best reference is, understanding Sindy’s diagram and then reading this
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1