Retagging 2 vlan from CCR2116 to CRS317

maxspeed · July 27, 2025, 2:28am

Hi

My ISP router give me 2 vlans inside a trunk, vlan 3 for voip and vlan 5 for internet, the trunk between my router CCR2116 and cisco working fine, we want to replace old HP copper ports for a new CRS317 as top of switch for other switches.

Old setup: Vlan 3 and 5 was access ports between CCR2116 and HP access port 103 and 500 all copper ports and HP have trunk for all others vlans to lower switch, so between access to access no problem to retag, easy way.

My Question is : I would like to know if its possible to retag vlan 3 and 5 from CCR2116 to 103 and 500 and put a fiber trunk between CCR21116 and CRS317 with new retag vlans ??? and how to do it ???

Thank you for your answer

BartoszP · July 27, 2025, 7:51am

Theory to be checked:

Seems to be doable in Switch menu

maxspeed · July 27, 2025, 3:27pm

Hi BartoszP

I will try it today !!! I never had to do that before with Mikotik, I will confirm later.

for cisco i think is Switch(config-if)# switchport vlan mapping original_vlan_ID translated_vlan_ID

Thank you for your fast answer

Maxspeed

maxspeed · July 31, 2025, 1:20am

Hi,

no luck for me .... I test with a CRS328 with the official doc and cant transform original vlan to new vlan .....

I test with 2 mikrotik L009uigs (to emulate vlans inside trunk) connected to CRS328 with official config from doc, trunk is ok on both side to CRS328, I try with 2 HP switch with trunk and vlan same bug (just to test trunk and vlan).

I can do a mac telnet between the first L009 < - > CRS328 < - > L009 and the second L009

I test with CRS125 with example in the forum (the config is different because of chip, not working too)

someone can confirm if the doc is ok ?

any idea ?

Thank you maxspeed

Ingress VLAN translation

It is possible to translate a certain VLAN ID to a different VLAN ID using ACL rules on an ingress port. In this example we create two ACL rules, allowing bidirectional communication. This can be done by doing the following.

Create a new bridge and add ports to it with hardware offloading:

/interface bridge add name=bridge1 vlan-filtering=no /interface bridge port add interface=ether1 bridge=bridge1 hw=yes add interface=ether2 bridge=bridge1 hw=yes

Add ACL rules to translate a VLAN ID in each direction:

/interface ethernet switch rule add new-dst-ports=ether2 new-vlan-id=20 ports=ether1 switch=switch1 vlan-id=10 add new-dst-ports=ether1 new-vlan-id=10 ports=ether2 switch=switch1 vlan-id=20

Add both VLAN IDs to the bridge VLAN table:

/interface bridge vlan add bridge=bridge1 tagged=ether1 vlan-ids=10 add bridge=bridge1 tagged=ether2 vlan-ids=20

Enable bridge VLAN filtering:

/interface bridge set bridge1 vlan-filtering=yes

lurker888 · July 31, 2025, 2:15am

As an experiment, why don’t you include both ether1 and ether2 in both vlan 10 and 20 as tagged?

maxspeed · August 6, 2025, 2:09am

Hi

I’ve done a lot of research on the subject online for Mikrotik, but unfortunately I haven’t found anything more than what’s in the official documentation.

Has anyone successfully changed a VLAN to another VLAN? (my switch is CRS-328)

I ran Wireshark on the line, and the result is that it can’t find the route via ARP. With the Torch function, I can see both VLANs on each port, but no communication is transferred to the other VLAN.

Does anyone have any ideas?

Thank you for your help

lurker888 · August 6, 2025, 4:12am

I have done it successfully, but there were many changes/fixes in the switch rule system since then.

Torch disables the switch rules automatically, so no surprise there…

maxspeed · August 6, 2025, 2:05pm

Hi lurker888

Do you have an example of configuration with a CRS328 or CRS125 switch or other model with firmware 7.19.4 (or lower) with which I could carry out tests on my own equipment?

I’ve been trying to make this work for several hours now and I would like to understand why communication is not being established.

According to your answer it is important not to use the torch function so as not to interfere with the rules of the switch, this is well noted for me.

Thank you in advance for your response.

lurker888 · August 8, 2025, 4:56am

Sorry, but not really. I did it on an rb5009, that has a similar but not same family switch chip. And I don't have the config any more.

What I do recall (maybe it's helpful, maybe not, I'll jot it down anyway)

I used vlan-header present
I added both ports as tagged to both vlans
The new-vlan-id didn't work for packets to the cpu, so two vlan interfaces were needed bridged in software to have reachability to/from the cpu (forwarding was hw offloaded fully)
I didn't use new-dst-ports

maxspeed · August 10, 2025, 3:25pm