FIRST POST
I recently purchased an RB750Gr3 for home use. I am just trying to get a simple VLAN setup working, including a Management port on the Hex itself and a Management VLAN.
Using typical VLAN membership tables I have seen on other routers, this is my intent:
VLAN Ports
2 3 4 5
1 X U U U
SegregatedWiFi 5 X X X T
SiteLAN 6 X T T T
Management 7 T X X T
PVID 7 1 1 1
X = uninvolved/empty
U = untagged
T = tagged
After some reading around the documentation and online examples I could find, including the Wiki, I ran Winbox and first upgraded RouterOS to 6.41.3 from factory software of 6.38.7, in order to get the new VLAN-aware bridges and up-to-date features.
Then I accepted the initial Default Configuration choice, so I could keep the WAN and its associated configuration (NAT and firewalls etc.) and deleted the default bridge named “bridge” because it involved all the ports as group. So, now I had five ports: ether1 through ether5, with ether1 being the WAN - which I left untouched.
These are the configuration rules I used:
/interface bridge
add name=br1 vlan-filtering=yes
add name=brv0 vlan-filtering=yes
add name=brv1 vlan-filtering=yes
/interface bridge port
add bridge=br1 interface=ether3
add bridge=br1 interface=ether4
add bridge=br1 interface=ether5
/interface bridge vlan
add bridge=brv0 tagged=brv0,ether2,ether5 vlan-ids=7
add bridge=brv1 tagged=ether5 vlan-ids=5
add bridge=brv1 tagged=ether5,ether4,ether3 vlan-ids=6
/interface vlan
add interface=brv0 name=Management vlan-id=7
add interface=brv1 name=SegregatedWiFi vlan-id=5
add interface=brv1 name=SiteLAN vlan-id=6
/ip address
add address=192.168.88.1/24 interface=br1 network=192.168.88.0
add address=192.168.7.1/24 interface=Management network=192.168.7.0
add address=192.168.5.1/24 interface=SegregatedWiFi network=192.168.5.0
add address=192.168.6.1/24 interface=SiteLAN network=192.168.6.0
I have a dual NIC Windows server on which I am testing the Management port and Management VLAN. The first NIC is just connected to the Internet (and higher priority) via another router - so should not be relevant. The second NIC is connected to ether2 for Management port testing. I also changed and experimented with setting the VLAN ID for it to match the Management VLAN ID (i.e. changed it from its default of 1 to 7).
Problem: no matter how I experiment with either the client NIC’s VLAN nor minor tweaks to the configuration above, I cannot connect to the router via its IP of 192.168.7.1 UNLESS I change the IP interface from “Management” to “ether2”. Then suddenly it works. But this seems to defeat the purpose of having a Management VLAN and confounds my understanding of VLANs and Bridges in this Mikrotik router. Oddly enough, I can always connect via the MAC address of the ether2 port.
I started worrying I need to dream of “switch chips” or hidden bridges or that my initial basic intent is somehow invalid. Yet why would only this final step appear to be failing (IP)?
Can anyone point out where I am going wrong and any other glaring errors in my setup, please? More details: Management VLAN is to eventually put all the routers + switches in one subnet. SegregatedWiFI VLAN is to keep the WiFi away from the other networks yet provide Internet via this edge router. SiteLAN VLAN is to confine anything connected to its own network and without Internet (I believe the second part will require changes to the firewall).
Note. I am not networking professional, just a person with some experience in tech and not afraid to experiment. 